The 2028 Medicaid Secret Shopper Rule: What FQHCs Need to Prepare for Now

An unfamiliar caller contacts one of your health center sites and asks a few basic questions:

• Are you in-network with this Medicaid plan?
• Are you accepting new Medicaid patients?
• Is this the correct address and phone number?
• What is the first available routine primary care appointment?

The answers may soon become part of a formal annual access review.

Beginning with Medicaid managed-care rating periods on or after July 10, 2028, states must use an independent entity to conduct annual secret shopper surveys of Medicaid and CHIP managed-care plan networks.^[1][2]

This is not a new CMS inspection program aimed directly at FQHCs as a provider category.

The legal obligation falls on states and Medicaid managed-care plans. But FQHC sites can be included in the survey sample when they appear in plan directories as primary care, OB/GYN, outpatient mental health or substance use disorder providers, or as the additional provider type selected by the state.^[2]

CMS also has the right to inspect the survey documentation collected by the state.^[3] Results must be reported to CMS and publicly posted by the state, and identified access problems can trigger formal remedy plans.^[2][3]

That makes 2027 and 2028 important preparation years for FQHC access operations.

What the 2028 Secret Shopper Requirement Actually Measures

The secret shopper program has two related purposes.

1) Provider-directory accuracy

The independent survey entity must test whether information in each plan's current electronic provider directory is accurate for at least:

• active network status
• street address
• telephone number
• whether the provider is accepting new enrollees^[2]

If an error is identified, the survey entity must send information sufficient to facilitate correction to the state within three business days. The state then has three business days to send that information to the applicable managed-care plan.^[2]

For an FQHC, that means a disconnect between the health center, the plan directory, and the actual scheduling operation may become visible quickly.

A site may genuinely accept Medicaid patients, but still create a directory failure if:

• the listed number reaches the wrong department
• the address is outdated
• a provider is listed at a site where they no longer practice
• the directory says “accepting new patients” when no qualifying appointment can be offered
• the health center and managed-care plan maintain different versions of the same provider data

Related: why accurate provider directories are foundational to patient access.

2) Timely appointment access

The survey must also measure whether plans' provider networks can offer routine appointments within the required timeframe:

The survey must use a random sample, include all areas covered by the plan contract, and use a statistically valid sample of providers for appointment wait-time testing.^[2]

A plan is considered compliant when at least 90% of sampled appointment requests meet the applicable standards.^[2]

Telehealth can count toward compliance only if the surveyed provider also offers in-person appointments to the plan's enrollees, and telehealth results must be identified separately.^[2]

What “CMS Has the Right to Inspect” Means

The regulation does not say that CMS will directly conduct a routine FQHC site inspection under this secret shopper provision. Instead, the state must make available to CMS, upon request:

• documentation collected from its managed-care plans
• documentation from all required secret shopper surveys^[3]

States must submit assurances of network compliance to CMS and post the associated reports publicly. Secret shopper results must also be posted on the state's website within 30 days of submission to CMS.^[2][3]

If the state, plan, or CMS identifies an access problem, the state must submit a remedy plan to CMS within 90 days. The plan must identify specific steps, responsible parties, and timelines designed to address the problem within 12 months, with quarterly progress updates to CMS.^[3]

So while an individual FQHC may not receive a public “pass/fail score,” access failures at sampled health center sites can contribute to a managed-care plan's documented network problem, resulting in pressure for operational correction.

Why FQHCs Are Especially Exposed to the Access Test

FQHCs sit at the center of Medicaid primary care.

In 2025, HRSA-funded health center awardees served more than 32.7 million patients. Approximately 47.9% of their patients were covered by Medicaid or CHIP, while 17.2% were uninsured.^[7]

That means small access problems can affect a very large number of people.

FQHCs also face a difficult operational mix:

• high call volumes
• complex eligibility and enrollment questions
• multilingual access needs
• transportation barriers
• high demand for routine and time-sensitive care
• staffing constraints
• multiple sites with different capacity

A secret shopper does not see the operational reasons behind a long wait or failed call transfer. The shopper experiences what a patient experiences.

That is why preparation should focus on the full access journey. (For more on the operational realities, see Scheduling in FQHCs.)

Where Online Self-Service Scheduling Can Help

Online self-service scheduling does not by itself make a managed-care network compliant. It can, however, solve several of the access problems the survey is designed to expose.

1) It reduces unnecessary dependence on the telephone

A patient seeking a routine primary care appointment should not always need to wait on hold during business hours. When a portion of routine demand shifts to online self-scheduling:

• patients can book outside office hours
• call queues become more manageable
• staff have more capacity for complex scheduling and eligibility questions
• patients who need telephone assistance are more likely to reach someone

Research on automated self-scheduling has found that patients frequently use it outside normal office hours and that successful implementation depends on strong workflow design, rule configuration, and organizational governance.^[10]

For secret shopper readiness, effective online access should strengthen existing telephone pathways, helping FQHCs keep up with telephone responsiveness.

2) It makes available capacity easier to find

An access center representative may say, “Nothing is available,” when there is capacity at other sites, with another qualified provider, or in a newly opened slot.

A well-designed self-service platform should search across sites, providers, visit types, in-person and telehealth options, and released same-day or short-notice capacity.

That makes it easier to offer the first clinically valid appointment rather than the first appointment a single scheduler happens to see.

A large physician-group case study found that self-scheduling adoption increased over time and demonstrated that automated scheduling can be implemented across a large volume of ambulatory appointments.^[11]

3) It can keep “accepting new patients” tied to real scheduling rules

A directory field that says “accepting new patients” is meaningful only if the practice can actually offer an appropriate appointment.

The strongest architecture uses a governed source of truth for:

• provider network participation
• locations
• phone numbers
• new-patient status
• visit types
• age and payer constraints
• available appointment inventory

When the provider directory and scheduling engine use different data, the organization can look accessible on paper, but the reality is different.

4) It can recover cancellations faster

A late cancellation can create a temporary opening inside the 10- or 15-business-day standard.

Manual call-down lists often cannot fill those openings quickly enough. Automated waitlists can identify eligible patients, offer the opening, and confirm the appointment without requiring staff to call one patient at a time.

That helps the health center use existing capacity more effectively.

5) It creates measurable access data

Self-service scheduling can help FQHC leaders see:

• next available appointments by site and visit type
• attempted bookings that produced no valid option
• patients routed to “call us”
• digital abandonment points
• how often cancellations are backfilled
• whether Medicaid patients see different availability from other patients

That data is useful before any external survey occurs. It allows the health center to find the same access failures internally.

Why the 2027 Medicaid Eligibility Changes Raise the Stakes

The secret shopper requirement arrives after major Medicaid eligibility changes begin.

Starting with renewals scheduled on or after January 1, 2027, states must generally conduct eligibility redeterminations every six months for most adults in the Medicaid expansion group.^[6]

Also beginning January 1, 2027, certain adults must demonstrate 80 hours per month of qualifying community engagement activities, such as work, education, community service, or participation in qualifying programs, unless they are exempt.^[5]

These changes inherently increase the number of eligibility events, verification steps, notices, and opportunities for coverage interruption.

The Congressional Budget Office estimates that the Medicaid provisions in Public Law 119-21 will increase the number of uninsured people by 7.5 million in 2034 relative to its prior baseline.^[8] That signals the scale of the coverage disruption health centers may need to absorb. For FQHCs, this creates a difficult overlap:

• more patients will arrive with inactive, pending, or uncertain Medicaid coverage
• staff will face more eligibility-related calls and documentation work
• plan directories and network status still need to remain accurate
• appointment access standards still apply to managed-care enrollees
• uninsured demand will rise

How Self-Service Scheduling Can Handle Eligibility Uncertainty

Online scheduling can prevent an eligibility question from becoming an unnecessary access dead end. A well-designed FQHC scheduling workflow distinguishes among:

• active coverage
• coverage pending verification
• coverage recently terminated
• uninsured or self-pay status
• patient unsure of status

Instead of blocking the patient with “insurance not found, please call,” the workflow can:

1. preserve or complete the appointment request when clinically and operationally appropriate
2. ask the patient to update contact and coverage information
3. connect the patient with enrollment or eligibility assistance
4. explain the health center's sliding fee process
5. route unresolved coverage questions to trained staff
6. avoid forcing the patient to repeat the full scheduling process later

Coverage loss should therefore change the administrative pathway instead of closing the clinical front door.

A Practical 2027–2028 Preparation Plan

FQHCs should not wait for the first survey call.

The Bottom Line

The 2028 secret shopper requirement is a new accountability mechanism for Medicaid managed-care networks. FQHCs are likely to be part of what gets tested because they are central to primary care, behavioral health, and safety-net access.

The most important question for your organization to answer today is whether a real Medicaid patient can:

• find accurate information
• reach the health center
• learn whether new patients are accepted
• obtain a timely appointment
• keep moving towards care when coverage status changes

Online self-service scheduling can help answer those questions by reducing phone dependence, exposing available capacity, keeping scheduling rules consistent, and preventing coverage uncertainty from becoming an automatic dead end.

But the goal is bigger than passing a survey; it's to build an access system that works before anyone calls to test it.