The Cures Act EVV requirement, explained

What the law says

Section 12006 of the 21st Century Cures Act (2016) requires every state Medicaid program to use an electronic visit verification system for personal care services and for home health care services. A state that did not comply lost a share of its federal Medicaid funding, which is why every state now has an EVV program. The statute is short. It says the system must verify six things about each visit:

1. The type of service performed — the HCPCS or service code on the authorization.
2. The individual receiving the service — the Medicaid member.
3. The date of the service.
4. The location of service delivery — where the visit happened; in practice, GPS at clock-in and clock-out, or the client's phone line.
5. The individual providing the service — the caregiver, by an identifier the state recognises.
6. The time the service begins and ends.

What the law does not say

It does not name a vendor, an app, or a data format. It does not require GPS specifically — the location can be verified another way, and several states accept a landline call from the client's home. It does not require the state to run a central system at all. That silence is why four different models grew up.

The four state models

Direct to the state (Virginia, Utah, Washington, Oregon, New York …)

The agency's own system sends the six elements straight to the state: as extra fields on the claim (Virginia's 837P, Washington's ProviderOne claim), as a file uploaded or e-mailed per period (Utah, Oregon), or through a state API (New York's eMedNY). No vendor sits in between and nothing has to be certified — the state's own claim edits or file checks are the enforcement. Virginia, Utah, Washington, Oregon and New York each have a page.

One aggregator

The state contracts one company — Sandata, HHAeXchange, CareBridge, Netsmart, Therap or AuthentiCare — to run an "aggregator" that collects every agency's visits. An agency may use the state's free app or its own software, but its own software must be certified with the aggregator once: test credentials, a set of test cases, then production. About thirty states work this way.

Several aggregators

A few states route by payer: fee-for-service to one company, each managed-care plan to its own. North Carolina, Pennsylvania, Florida and Texas (with its own TMHP process) are the well-known ones. The agency's software has to talk to each.

Closed system

Maryland and New Mexico run a single state system that no third-party software can submit to. Agencies there use the state's tool for EVV regardless of what else they run.

The 51-state map lists which model each jurisdiction uses and where Homecare App stands in it.

What this means for an agency

• Caregivers must clock electronically for every Medicaid visit — an app with location on, or the client's phone line. A typed time is allowed only as an exception, with a reason code from the state's list.
• Manual entries are counted. States and plans watch the share of visits that were typed rather than clocked; an agency far above its peers gets audited.
• The data has to arrive in the state's shape. A perfect record in your software is worth nothing if the file, claim or API call is malformed. This is where most of the work is, and it is the part a vendor should own.
• Records are kept for years. Most states require the EVV record to be retained with the claim — six years in Washington, for example — and produced on audit.

How Homecare App meets it

Every Medicaid visit is captured the same way regardless of state: server-stamped clock-in and clock-out with GPS at both ends, a phone-line clock by PIN when the phone is not an option, an offline queue for houses without signal, a coded reason and a note for any typed or corrected time, and an audit trail that keeps the original device times. The state-specific part — the claim loops, the file, the API call, the aggregator connector — is a formatter over that one record. See the rest of the software, or the glossary for the vocabulary the state documents use.