The 21st Century Cures Act EVV requirement

The 21st Century Cures Act was signed on 13 December 2016. It is a large piece of legislation covering medical research and drug approval, and buried in it is section 12006, which is the part that reaches your agency.

Section 12006(a) requires states to implement electronic visit verification for Medicaid-funded personal care services and home health services that require an in-home visit by a provider. The obligation is placed on states, not directly on you, which is a point worth holding on to.

The law specifies six data elements every verified visit must capture: the type of service, the individual receiving it, the date, the location of delivery, the individual providing it, and the time the service begins and ends.

It also requires that systems be minimally burdensome, that provider and family input be taken into account when a state designs its approach, and that everything be handled consistently with HIPAA.

The Cures Act set two dates:

• Personal care services: originally 1 January 2019
• Home health care services: 1 January 2023

The personal care deadline did not survive contact with reality. States were nowhere near ready, and on 30 July 2018 a separate bill, H.R. 6042, was signed into law delaying it by one year to 1 January 2020. It passed both chambers without opposition, which tells you how widely the original timeline was regarded as unworkable.

So the federal deadlines that ended up mattering are:

• 1 January 2020 for Medicaid personal care services
• 1 January 2023 for Medicaid home health services

Both are in the past. If you are reading this because you have just learned about EVV, you are not early. The question is not whether the requirement applies but what your state already has in place.

This trips up a lot of agency owners. You read that the deadline was January 2020, then your state tells you the requirement started in 2021, and you wonder which is wrong. Neither is.

States that could show a good faith effort to comply, and that had run into unavoidable delays, could obtain a one-year extension. Several took it. That is why some states began enforcing personal care EVV in 2021 rather than 2020, and home health in 2024 rather than 2023.

The federal deadline is a floor for states. The date that governs your agency is whatever your state set, and in managed care it may effectively be whatever date each plan you contract with started requiring it.

The practical takeaway: the federal dates tell you the requirement is real and settled. They do not tell you what applies to you. For that, read your state guide and confirm with your state Medicaid agency.

The enforcement mechanism points at states, not providers. A state that fails to implement EVV faces an incremental reduction in its federal medical assistance percentage, the share of Medicaid spending the federal government reimburses. The reduction escalates over time, up to one percent.

One percent of a state Medicaid budget is a large amount of money, which is why every state moved. A state can avoid the reduction if it demonstrates both a good faith effort to comply and unavoidable delays.

What this means for you is indirect but real. Your state is under genuine financial pressure to make sure providers actually use EVV, and that pressure reaches you through claim edits, payment holds and provider agreements rather than through a federal penalty landing on your agency.

The federal law obliges states. Your obligation comes from your state and your payers, and it usually shows up in three ways.

Claims stop paying. The most common enforcement is simply that a claim without a matching verified visit does not get paid, or is recouped later. This is the one that reaches most agencies first.

Your provider agreement requires it. Enrollment conditions and managed care contracts typically require EVV use, which makes non-compliance a contract problem as well as a payment one.

Audit exposure. Visits you cannot substantiate are the ones that come back in a review, sometimes years later.

Notice that none of these require you to buy a particular product. The requirement is that visits are verified and the data reaches your state. How you get there depends on your state's model.

Vendors sometimes present their own product decisions as federal requirements. The Cures Act says nothing about any of the following:

• GPS. The law requires the location of service delivery. GPS is the common way to capture it, not a legal mandate.
• Biometrics. No fingerprint or face scan is required by federal law.
• Client signatures on a device. Not a federal requirement.
• Which vendor you use. The law does not name one, and it does not require you to pay for one.
• Continuous location tracking. Nothing in the law asks for a caregiver's movements between visits.

Your state may require some of these. When it does, that is a state requirement and it should be described as one.

Once you know the federal requirement is short, a useful habit follows. When someone tells you EVV requires something, ask which level of government requires it. There are only three possible answers and they carry very different weight.

Federal. The six data elements, and the fact that Medicaid personal care and home health visits in the home must be electronically verified. That is close to the whole list. It applies in every state and it is not negotiable.

State. Which system you use, whether third-party systems are permitted, how quickly visits must be transmitted, what counts as an acceptable reason for a manual correction, how long you keep records, and what happens when a visit fails to verify. This is where most of the rules you actually live with come from, and it is why two agencies in neighboring states can have genuinely different obligations.

The payer or plan. In managed care, individual plans set expectations within their contracts with you. These can be stricter than the state baseline and they can differ between plans you contract with.

Applying this test costs nothing and it changes conversations. A vendor saying "federal EVV rules require biometric verification" is saying something that is not true. A vendor saying "your state requires visits to transmit within 24 hours" may well be right, and it is a claim you can check with your state agency in one phone call.

The same test helps with deadlines. If you are told a federal deadline is approaching, be sceptical. Both federal EVV deadlines passed years ago. Anything still coming is your state or your plan changing something, which is worth knowing precisely.