EVV compliance isn't optional. It's a hard condition of getting paid by Medicaid, and the 21st Century Cures Act put it there. Congress passed the law in 2016. Every state now runs a live electronic visit verification mandate for personal care and home health services. Soft rollouts are over. In 2026 states enforce this aggressively. Clean data keeps the checks coming. Gaps stop them cold.
If you run a homecare agency you hear the term everywhere. Auditors, software reps, MCOs. The noise is loud but the mandate itself is narrow. This is what the law actually demands, stripped clean.
What Should Your EVV Compliance Planning Look Like?
Start with your state's technical specs, not a vendor demo. Your whole EVV compliance timeline depends on one fact: open vendor model or state-mandated platform. That answer shapes your budget, your training dates, and how much risk you carry.
Look at how you capture time right now. Paper timesheets, call-in lines, manual spreadsheets all fail the 21st Century Cures Act standard. You close that gap by picking a system that sends the six required data elements straight to your state's aggregator. No manual massaging.
Budget for training hours, not just licenses. A caregiver who messes up a clock-out or hits a dead zone with a weak GPS signal creates bad data. Bad data means no reimbursement. In 2026 states hand out hard claim denials for incomplete records. A single missing punch can zero out a shift.
Schedule real practice time. Mock visits. A written correction process everyone knows. Every visit record needs one unbroken chain from clock-in to aggregator confirmation. No mystery edits.
What Are the Core Components of EVV Compliance?
Six data points. That's the federal list. Capture them at the start and end of every visit and you've hit the baseline for EVV compliance. The six:
Type of service
Individual receiving care
Date of service
Location of service delivery
Individual providing the service
Time the service begins and ends
States pile on extra fields like task lists. Fine. Those don't override the core six. Location trips up most agencies. GPS coordinates work. A landline call from the home works. A fob registered to the address works. What matters is real-time tie between the caregiver and the service location. A clock-in from five miles away won't survive a review. The system doesn't need to be fancy. It needs to be accurate and tamper-proof.
What Framework Supports EVV Compliance?
CMS built two models. An open model lets you choose any Medicaid EVV system that fits state data exchange specs. A state-mandated model hands you one vendor and that's it. Both push data through a state aggregator. That aggregator is the final word on EVV compliance.
The framework cares about data integrity, not how many features your software has. Audits check that the six elements arrived complete, on time, and free of unexplained edits. A 2024 OIG report found improper payments for personal care and home health hit $6 billion in one year before EVV. That's why states give zero slack now.
Treat every visit file like a check. If the aggregator rejects a batch, billing halts immediately. No exceptions. This is home care compliance under the 21st Century Cures Act.
What Are the Best Practices for EVV Compliance?
Daily habits keep you audit-ready. Lock your clock-in rules hard. Caregivers punch in after stepping onto the property. Not from the car. Not from the lobby. Set a GPS radius that mirrors the real service address. Even small drift needs a note.
Run exception reports weekly. Look for visits with no out punch or hours that don't line up with the care plan. In 2026 states track your rates. Hard thresholds, often between 50% and 80%, trigger corrective action if you dip below. Short visits plus manual edits kill your rate fast.
Guard your edit logs like financial records. Let caregivers request a correction through a timestamped form with a clear reason. Never accept an override that just says "fixed time." A note like "Caregiver forgot to clock out, verified with client at 2:15 p.m." proves discipline. The first version screams carelessness. Audit investigators know the difference immediately. EVV data is now a standard part of every state audit. Those logs get pulled first.
Call your state's EVV help desk the moment a file fails. Don't guess. Their team knows the usual transmission snags. A fast relationship with that desk saves whole pay periods. Small moves keep EVV compliance locked in.
Summary
Six data points. A clean transmission pipeline. Know your state's model. Drill your people. Audit visits weekly. Protect your edit trail with detail. The 21st Century Cures Act wants proof, not perfection. Proof of who did what, where, and when. In 2026 that proof isn't optional. Agencies that build their day around it don't flinch when the state calls. They produce the record and keep working.
Frequently Asked Questions
What triggers an EVV compliance audit?
Data patterns trip the wire. Too many manual edits or visits with no location flag draw eyes fast. Random sampling also grabs claims that look fine on the surface but have holes in the clock records underneath.
Does the 21st Century Cures Act apply to private pay clients?
No. The mandate covers only Medicaid-funded personal care and home health services. Medicare-only and private pay clients sit outside it. Some states extended EVV to other waivers through their own laws, so check your codes.
Can a mobile EVV system work without cell service?
Yes, offline mode handles it. The caregiver clocks in and out like normal and the device syncs when a signal returns. Verify your vendor's sync window so delayed uploads don't show visits as late at the aggregator.
What happens if a caregiver forgets to clock out?
Follow a documented correction process. The caregiver contacts the office. A supervisor enters the correct time with a note that states the verified reason. Repeated missed clock-outs from the same person look like incomplete records and open a deeper review.
Are GPS coordinates shared with the state?
It depends. Some aggregators pull full latitude and longitude, others just a verified-location flag. Even when coordinates aren't transmitted your system must store them. Assume any location data is fair game during an audit.
How do I handle a client who refuses EVV verification?
Educate them. EVV is a federal condition of Medicaid service and refusing risks their authorization. Offer the least intrusive method, usually the caregiver's smartphone app. Document each refusal and every step you take to resolve it.
What is the biggest mistake agencies make during implementation?
Buying software before reading the state's technical requirements. They sign a contract then discover the system can't export the right format or misses a required field. Get the data spec document first, confirm live integration with your state's aggregator, and purchase last.
Ready to cut your credentialing overhead?
We build custom healthcare staffing platforms with compliance built in from day one. Fixed price. 6–10 weeks to live.