EVV and the Federal Mandate

Electronic Visit Verification (EVV) refers to the system or technology by which the services of home health and personal care providers are electronically verified. This can be accomplished through a mobile application, a secure website, a cell phone or a landline telephone.

The 21st Century Cures Act

Section 1903(l)(5)(A) of the 21st Century Cures Act (the Cures Act), which was signed into law in December of 2016, mandates that all personal care services (PCS) and home health care services (HHCS) must be electronically verified with respect to:

  1. Type of service being performed
  2. Individual receiving the service
  3. Date of the service
  4. Location of service delivery
  5. Individual providing the service
  6. Time the service begins and ends

When a visit claim is submitted, CMS will verify that there is (or is not) an EVV record for the visit and that it is (or is not) within state parameters, and will then accept or reject the claim accordingly.

The mandate applies to all Medicaid-reimbursed home care providers in the United States and its territories, both managed care and fee-for-service systems.

The EVV mandate:

  • ties reimbursements for Medicaid services to EVV data
  • includes all PCS and HHCS services that require an in-home visit by a provider:
    • EVV applies for medical supplies or DME that require an in-home visit for set-up
    • EVV does not apply for medical supplies or DME that picked up at a pharmacy or delivered through the mail
  • does not apply to any inpatient or residential settings where 24-hour service is available (hospital, SNF, ICF, rehab)
  • does not apply to PACE (Program of All-Inclusive Care for the Elderly)
  • can utilize various technologies, as long as requirements are met
  • will be implemented and managed at the state level, and states may set their own additional requirements and standards

EVV Compliance: PCS compliance is required as of 1/1/20 and HHCS compliance is required as of 1/1/23. Many agencies are already electronically documenting visits through their electronic medical record (EMR) system and/or a dedicated EVV system, but this does not mean they are or will be automatically compliant with the Cures Act mandate. Compliance necessitates meeting federal and state mandated standards and requirements and transmitting EVV data to the state.

Penalties for Non-Compliance: States that don’t meet the deadline will be subject to Federal Medical Assistance Percentage (FMAP) reductions of up to 1%. The reduction will start at 0.25% and increase incrementally the longer a state is non-compliant. To avoid this penalty, according to CMS, a state must demonstrate that it has made a “good faith effort” to comply and that it has encountered “unavoidable delays.”

For more information on FMAP reductions, see page 6 of the CMS document: “Section 12006 of the 21st Century CURES Act.”

Why the Mandate? Health care fraud is a persistent problem. In fiscal 2014, the U.S. government recovered $3.3 billion in attempted fraud schemes. In 2016, more than 300 individuals were charged with participating in schemes involving about $900 million in fraudulent billing to Medicare or Medicaid.

According to the CMS (Centers for Medicare & Medicaid Services), mandatory EVV will cut down on fraud and abuse by ensuring that the home care visits reported and billed to CMS are actually taking place. More importantly, according to CMS, verified visit tracking will result in more consistent, higher quality care by ensuring that patients are actually getting the care they need. EVV compliance will be managed by each state or territory, and states may choose to require more than the six CMS-mandated data items in their individual efforts to address home care visit fraud or waste.

The Benefits of EVV

EVV will soon be required of all PCS and HHCS providers, but companies such as Sandata, CellTrak, Dial-N-Document, and DataLogic/Vesta have been offering EVV solutions for quite a while. As many provider agencies are already aware, EVV has benefits beyond ensuring compliance with the Cures Act mandate. Some providers are using EVV because one or more of their payer sources require it. Other providers are already using EVV for their own operational or quality assurance purposes. In addition, agencies can customize and augment their EVV platform in order to enhance benefits and differentiate themselves in the home healthcare marketplace.

In addition to federal and state compliance, an EVV system can:

  • increase financial accountability by reducing the number of unauthorized services
  • discourage and reduce missed or late visits by recording the exact location and time of visit
  • allow real-time visibility of clinician/caregiver locations and real-time alerts to late or missed visits
  • provide real-time availability of caregiver schedules and notification of changes
  • allow secure, real-time communication between clinicians/caregivers and agency
  • support different types of visits, including unscheduled and shared care visits
  • ensure more accurate mileage reimbursement using global positioning software (GPS), and support individual agency mileage policies
  • offer accurate GPS-based mileage recording and timekeeping for out-of-home visits and other patient- and agency-related travel
  • increase efficiency by
    • reducing paper documentation traditionally associated with visit verification
    • allowing for immediate electronic billing
    • allowing for automatic payroll entry

EVV Implementation: Five Models

States will be dictating the timing (within mandated deadlines) and the manner of federal compliance, and the way they are choosing to implement EVV will impact home care providers. Most states have already decided on one of the five EVV models:

  1. Provider Choice
  2. Managed Care Plan (MCP) Choice
  3. State Mandated In-house System
  4. State Mandated External Vendor
  5. Open Vendor (sometimes called “Open Choice”)

States may choose to implement more than one model to accommodate diverse provider circumstances such as differences in geography and strength of cellular networks.

Open vs Closed: Each of these models can be defined as either “Open” or “Closed”, and there are arguments in favor of each.

With “Closed” models, providers are mandated to use a specific state-selected EVV system and/or vendor. This can simplify state-mandated compliance and billing, and can be an affordable solution for agencies without EVV solutions already in place.

With “Open” models, providers may choose their own EVV system and/or vendor, as long as it has been certified as meeting certain requirements. Many agencies already have EVV systems in place, and/or EMR systems that do or will integrate EVV compliance into existing visit documentation. Those agencies without an EVV solution are free to select the system and/or vendor that works best for them, and they may choose that system or vendor based on benefits beyond EVV compliance. In addition, it is more efficient for a provider that operates in multiple states to use a single EVV solution, rather than multiple solutions across multiple states (which could be the case if a state opts for a “Closed” model).  

  1.  Provider Choice Model (“Open”)

According to CMS, under this model providers will select an EVV vendor of their choice and self-fund EVV implementation. States using this model will set standards for EVV vendors, including specific data collection requirements, and may provide an approved list of EVV vendors. This is a beneficial model for states with high existing EVV utilization among providers.


  • Providers that already use an EVV system (or that use an EMR system that does or will incorporate EVV into visit charting) may continue to use their existing system, as long as it meets the requirements and standards set by the state.
  • The provider choice model may be more technologically or financially burdensome for single or small provider agencies, although states may mitigate the financial burden by incorporating associated costs into the reimbursement rate methodology.
  • States implementing this model will need to create a higher level umbrella system that collects, collates, and consolidates the aggregate data from all qualified vendors.
  • State umbrella systems can offer compliance and payment monitoring benefits of their own, and may be eligible for enhanced federal funding.

At the time this article was published, 13 states had selected this model: Alaska, California, Louisiana, Maine, Minnesota, Missouri, New Jersey (not definite), New York, Pennsylvania (MCOs have selected the aggregator system), Utah, Vermont, Virginia, and Washington.

  1.  MCP Choice Model (“Open”)

This model is similar to the Provider Choice option, according to CMS, except that MCPs rather than providers will select an EVV vendor of their choice and self-fund implementation. States using this model may set minimum standards for EVV vendors, including specific data collection requirements.


  • Providers may find this model burdensome if a state has multiple MCPs that select multiple systems, because providers will have to use and train on more than one EVV technology or system.
  • Providers may find that billing, payroll, time-tracking, and scheduling systems are impacted if they must use multiple EVV systems.
  • Providers may require additional administrative support if they have to integrate multiple EVV systems.
  • States implementing this model will need to create a higher level umbrella system that collects, collates, and consolidates the aggregate data from all qualified vendors.

As of publication, only Florida and Tennessee had adopted this model (TN is not definite; the state may end up with the Open Vendor model).

  1.  State Mandated In-House Model (“Closed”)

Under this model, according to CMS, states will create, operate, manage, and oversee their own EVV system. The state takes on a greater administrative and financial burden with this model compared to others, but the In-House model guarantees standardization of data and data access across all providers and enhanced federal matching funds may be available.


  • Providers with no existing EVV system may benefit from this simplified and cost-effective solution.
  • Providers and MCPs that already use an EVV system (or that use an EMR system that does or will incorporate EVV into visit charting) may have to adopt a new system.
  • There is no need for the state to aggregate data from multiple external EVV systems.
  • The state is responsible for the education and training of all affected parties (providers,  caregivers, individuals, and families).

Only Alabama and Maryland had opted for this model as of publication.

  1.  State Mandated External Vendor Model (“Closed”)

According to CMS, under this model states will contract with a single EVV vendor to implement a single state-wide EVV solution. All providers, MCPs, individuals and families will be required to use the same EVV system, and the state will have direct involvement in its management and oversight. The state takes on an administrative and financial burden with this model, but guarantees standardization of data and data access across all providers. Enhanced federal matching funds may be available.


  • Providers with no existing EVV system may benefit from the simplified selection process.
  • Providers and MCPs that already use an EVV system (or that use an EMR system that does or will incorporate EVV into visit charting) may have concerns about adopting a new system.
  • While there are costs associated with the management and oversight of the selected vendor system, the model may be less costly for states than building their own EVV system.
  • The state is responsible for the education and training of all affected parties.

At the time this article was written, this model had been adopted by the following: Arizona, Connecticut, Hawaii, and Rhode Island (Sandata has been selected as EVV vendor); Wisconsin (currently Sandata, but considering the Open Vendor Model with Sandata as the aggregator system); Massachusetts (under development with Optum); South Dakota (Therap is the EVV vendor); Texas (DataLogic/Vesta is the current EVV vendor, but TX may be expanding the approved provider list); Kansas, Nevada, New Mexico, Oklahoma, West Virginia, and Washington DC (no EVV vendor yet selected).    

  1.  Open Vendor Model (“Open”)

This is a hybrid model. According to CMS, states utilizing this model will either contract with one or more EVV vendors, or operate their own EVV system. This state-contracted vendor/in-house system will serve as the default system, but providers will have the option of using the state system or selecting an EVV vendor of their choice. States may set minimum requirements and standards for all vendors, and will likely require some level of integration among them in order to aggregate the EVV data.


  • Providers and MCPs that already use an EVV system (or that use an EMR system that does or will incorporate EVV into visit charting) may continue to use their existing system.
  • Providers with no existing EVV system may benefit from the simplified selection offered by the state system.
  • The state may require that providers select from a list of preferred EVV vendors.
  • The state is responsible for maintaining EVV oversight; enhanced federal matching funds may be available.
  • The state is responsible for the development and implementation of EVV policies and procedures.

The Open Vendor Model had been selected by nine states as of publication: Arkansas, Colorado, Georgia, Illinois, Indiana, Michigan, Nebraska, North Carolina, and Ohio.

11 states were still undecided at the time this article was published: Delaware, Idaho, Iowa, Kentucky, Mississippi, Montana, New Hampshire, North Dakota, Oregon (no final decision, but likely to be a closed model), South Carolina (no final decision, but likely to be a closed model), and Wyoming.

How States Are Preparing for EVV

Regardless of which model a state selects, there are several federal requirements which must be addressed. According to CMS, states must consider the EVV systems already in use in the state and ensure that the selected model is “minimally burdensome.” They must consult with PCS and HHCS providers and seek “stakeholder input” regarding EVV implementation from providers, beneficiaries, caregivers, and others. They also must ensure opportunities for provider training and ensure privacy and security in compliance with the Health Insurance Portability and Accountability Act (HIPAA).

Promising Practices: CMS has identified “promising practices” for states to consider during EVV implementation:

  • Selection and Implementation: Among other things, states should assess and evaluate EVV models and existing vendor relationships; define EVV requirements and evaluate integration with other state Medicaid systems and data; and assess state capacity re technological and training requirements.
  • Training and Education: States should consider all aspects of planning, developing, and delivering comprehensive training and education of state staff, provider clinicians and caregivers, patients, and family members.
  • Ongoing Operations: States should outline expectations regarding EVV service monitoring and should allow for continuous provider involvement in decision-making.

For more information on EVV Promising Practices, see the May 2018 CMCS EVV Informational Bulletin or the August 2018 CMS conference session: EVV Requirements in the 21st Century Cures Act.


Federal Reimbursement for EVV: Federal reimbursement may be available for the development, implementation and/or operation of an EVV system. More information is available through CMS’s document FAQ: Section 12006 of the 21st Century Cures Act, questions 18-22.

EVV Technology

EVV has been around for a while, and there are several technologies available. These include telephony and interactive voice response (IVR); biometric finger print or voice recognition; caregiver-owned smart phones; electronic random number generators in the home; onsite dedicated tablets; and mobile devices. Each of these solutions offers visit verification features, but most of them cannot guarantee compliance with all requirements of the Cures Act. Currently, only onsite dedicated tablets and mobile devices can accomplish all six of the federally mandated EVV requirements with the level of security required to meet HIPAA guidelines.

Mobile Devices and EMRs: Mobile technology (i.e., agency-provided tablets or laptops) is the most convenient and efficient EVV solution. Mobile devices mostly rely on GPS technology to record the actual time clinicians or caregivers arrive and depart a specific location: the GPS coordinates of the clinician or caregiver are matched with the GPS coordinates of the visit address. EVV systems may also utilize electronic signatures, near-field communications (short-range wireless connectivity), and photos for visit verification.

Most quality EMR systems utilize mobile devices to offer comprehensive point-of-care documentation. Which EVV model your state selects is out of your hands and, in most cases, already decided, but most states have selected a model that allows integration of EVV technology into an existing EMR system. This will provide clinicians and caregivers a relatively seamless visit documentation experience, even when no landline or connectivity is available.

A full mobile EMR system adds many benefits beyond EVV compliance:

  • Comprehensive point-of-care visit documentation, including assessments, care planning, visit notes, reports and forms, and photos
  • Real-time availability of current client demographic information, notes to care team members, care and service plans, care and service history as well as care team information
  • Increased productivity and efficiency
  • Decreased administrative costs
  • Increased time with patients, which can improve quality of care and patient outcomes
  • Increased communication: real time messaging and patient data
  • Extensive data collection and access to data, including reporting on key performance indicators (KPIs)

Privacy and Cybersecurity Considerations: The increased use of mobile devices brings increased concern for data security. Mobile devices are encountering more private health information than ever before and, according to the latest Verizon Mobile Security Report, 25% of healthcare providers faced a mobile device breach in 2018.

Home health care providers must carefully examine the cyber risks associated with EVV and how to mitigate those risks. According to healthcare liability insurance provider Highland Risk, provider agencies should:

  • Implement and/or review policies and procedures regarding the use of mobile devices
  • Implement and/or review training policies and procedures to ensure that staff receive basic cybersecurity training
  • Review and log all mobile devices used for agency services
  • Review and log the type of information being accessed, stored and/or sent by mobile devices
  • Review EVV and/or EMR passwords and permissions to ensure that all patient data is password protected
  • Implement two-factor or multi-factor authentication whenever possible
  • Regularly review and update software security programs and software on all devices
  • Consider reducing the financial risks of security breaches with a cybersecurity insurance policy

In addition to patient data security and HIPAA considerations, EVV technology has raised concerns about clinician and caregiver privacy, as well. According to CMS, states are not required to capture each location as a clinician or caregiver moves throughout the community. EVV data must be captured for services starting and/or stopping in the individual’s home, but the location in which the service is started and stopped is sufficient to meet the minimum requirements specified in the Cures Act. EVV vendors assure that the GPS location of a clinician or caregiver is only recorded at visit check-in and check-out; no vendors have reported using active, continuous GPS tracking.

Agency Readiness: Preparing for EVV

When vetting or selecting an EVV/EMR vendor, make sure the system can reliably collect and verify all six data elements required by the Cures Act. Talk to other providers who use the system, and make sure it’s interoperable with your state’s Medicaid enterprise systems.

Talk to the EMR vendor about how EVV is accommodated in the system now, and how it will work once the mandate goes into effect–next year or in 2023.

  • Does or will the system incorporate EVV data and alerts at the point of care as seamlessly as possible?
  • Can EVV data be utilized by the EMR system for agency operations and reporting?
  • Does or will the vendor offer integration with the state-mandated EVV vendor?
  • Does or will the EVV system transmit required data directly to the state or, if not, will it incorporate a seamless interface requiring no agency intervention?
  • Can the EVV system be customized to individual state requirements (i.e., GPS coordinate requirements for visit compliance)?

Regardless of the selected (or designated) EVV solution, agencies should follow the lead of the CMS Promising Practices for Training and Education. Staff should be involved as early as possible–ideally before implementation–and clinician/caregiver training should be ongoing. Agencies should always make sure they are up-to-date and familiar with the latest state requirements.

Agency training should cover:

  • EVV requirements and regulations
  • Consequences (e.g., penalties and sanctions) for non-compliance
  • Benefits of EVV re:
    • detection and prevention of fraud and abuse
    • facilitated visit scheduling/re-scheduling and tracking
    • less paperwork
    • faster mileage reimbursement
    • faster claims processing
  • EVV software and hardware use:
    • integration with existing EMR system
    • data capture/input
    • system reports
    • technical assistance
  • Patient and family member responsibilities
  • Privacy and security concerns (i.e., no active tracking throughout the service or community)

Additional Resources


  • EVV Vendors: