EVV Requirements by State: What Homecare Agencies Must Know

Electronic Visit Verification (EVV) requirements now shape daily operations for virtually every Medicaid-funded homecare agency in the United States. What began as a federal anti-fraud measure has evolved into a complex, state-by-state compliance landscape — with different EVV models, aggregators, deadlines, and penalties depending on where your agency operates. This guide breaks down the federal EVV mandate, the six data elements every state requires, the EVV models and aggregators used across the country, and what non-compliance actually costs an agency.

What Is EVV and Why Is It Required?

EVV is a technology-based system that electronically verifies that a home care visit actually took place — confirming who provided the service, who received it, where, when, and what was done. The mandate comes from Section 12006 of the 21st Century Cures Act, signed into federal law in 2016. Its goal is straightforward: improve care quality, reduce fraud, waste, and abuse in Medicaid-funded home care, and increase accountability for visits billed to public programs.

The federal EVV mandate covers two service categories with two different deadlines. States were required to implement EVV for Medicaid personal care services (PCS) by 2020 (following good-faith extensions from the original 2019 date), and for home health care services (HHCS) by January 1, 2023. The federal requirement applies to Medicaid-funded visits only — private-pay home care is not federally required to use EVV, though individual states or payers may impose their own requirements.

States that fall short face real financial consequences. Under the Cures Act, a non-compliant state’s Federal Medical Assistance Percentage (FMAP) — the share of Medicaid costs the federal government covers — is reduced on a rising schedule. For personal care services, the reduction began at 0.25% and steps up to a full 1% by the fourth year of non-compliance. For home health services, reductions run from 0.25% in 2023 to 0.75% in 2026, reaching 1% from 2027 onward. Because those lost federal dollars run into the hundreds of millions, state Medicaid agencies have strong incentive to push compliance down onto providers — which is why agency-level enforcement has intensified every year.

The Six EVV Data Elements Every State Requires

Regardless of state or EVV model, federal law requires every EVV record to capture six data points for each visit. These are non-negotiable nationwide:

• Type of service performed — the specific service delivered, matched to the CPT or service code on the claim.
• Individual receiving the service — the Medicaid beneficiary, matched to the eligibility record.
• Individual providing the service — the caregiver, matched to their NPI and provider enrollment record.
• Date of service — the calendar date the visit occurred.
• Location of service delivery — the address where the visit happened, confirming it was at the patient’s place of residence.
• Time the service begins and ends — start and end times captured electronically at the point of care.

One of the most common compliance failures is a mismatch between the EVV record and the claim. If your EVV system records a visit from 10:00 AM to 11:00 AM but the claim shows the service starting at 9:45 AM, the visit gets flagged. This typically happens when EVV data is captured in one system and claims are entered in another — the practical fix is a single system that captures visit data and billing data together, as in an integrated home care software platform.

How visits are verified: mobile apps, IVR, and FOBs

States generally accept several capture methods. The most common is a mobile app with GPS, where caregivers clock in and out from the client’s home. Interactive Voice Response (IVR) or telephony systems let caregivers call a toll-free number from the client’s home phone to record start and end times. Some states also use FOB devices — small tokens in the client’s home that generate verification codes. Location is typically captured only at clock-in and clock-out; federal guidance has made clear that continuous GPS tracking of caregivers between visits is not required.

Note that not every entry method counts as compliant. For example, Iowa’s CareBridge system treats manual web-portal entries as a last resort — they are not considered EVV-compliant — and agencies relying on non-GPS devices must use the app or IVR to meet the standard.

State EVV Models: Open, Hybrid, and State-Mandated

CMS allows states to choose how they implement EVV, and the model determines how much freedom your agency has in choosing its software. Most states fall into one of these models:

Open model

In an open model, the state designates a required aggregator — the central system all EVV data must flow into — but agencies can use any compliant EVV tool for point-of-care capture, as long as the data reaches the aggregator in the right format. Georgia is a classic example: the state (via its contractor, Conduent, in partnership with Netsmart/Tellus) provides a state EVV solution at no charge to providers, but agencies may also use an alternative vendor that meets federal requirements, signs the state’s third-party attestation, and sends data to the state system. Other open-model states include Alabama (HHAeXchange), Indiana (Sandata), and Louisiana (LaSRS).

Hybrid model

Hybrid states offer a free state system and also permit third-party integrations under regulated conditions. This is the most common arrangement nationwide. Examples include Illinois (HHAeXchange), Texas (TMHP for state programs with HHAeXchange for managed care), North Carolina (Sandata direct with HHAeXchange for MCOs), and California (CalEVV, built on Sandata).

State-mandated (closed) model

A small number of states require agencies to use one specific system with no approved alternatives. Examples include Maryland (ISAS), New Mexico, and South Carolina (both AuthentiCare). In these states there is no integration pathway from a third-party tool — the state’s system is the only compliant option.

MCO-driven models

Some states route EVV through their managed care organizations. Iowa, for instance, uses an MCO-led implementation built on CareBridge, provided at no cost to providers, with alternative vendors required to aggregate into CareBridge for claim submission.

EVV Aggregators: The Systems Your Data Flows Through

An aggregator is the central hub that collects EVV visit data from agencies (or their vendors), validates it, and matches it to claims before payment. In 2026, the dominant state aggregators are:

• Sandata — the most widely used state aggregator, serving states including Arizona, Connecticut, Delaware, Maryland, Mississippi, North Dakota, Ohio, and Pennsylvania.
• HHAeXchange — used by California (CalEVV), Illinois, Michigan, Minnesota, New York, and others.
• Tellus/Netsmart — used by Florida, Nebraska, and several smaller states.
• AuthentiCare — used by Arkansas, Oklahoma, and others.
• CareBridge — the aggregator for Iowa’s MCO-led program.

Aggregator contracts do get re-competed, so the vendor behind your state system can change. What does not change is the principle: your EVV data must reach the aggregator in its required format. If your agency uses a third-party “Alt-EVV” vendor rather than the state system, that vendor must complete testing and certification with the aggregator — there is no CMS certification for EVV products; vendor certification happens state by state. Building an aggregator-certified EVV integration is a core part of custom homecare software development services, and certification workflows differ in every state.

Key State-by-State Differences Agencies Must Watch

Beyond models and aggregators, the details vary enough that a compliance checklist from one state will not work in another. Watch for:

• Which services are covered. Most states cover personal care and home health services, but some extend EVV to private duty nursing, therapy services, or behavioral health.
• Exemptions — and their removal. Live-in caregiver exemptions are disappearing. Effective October 1, 2026, Virginia eliminated its live-in caregiver exemption, requiring all agency-directed aides and consumer-directed attendants to log shifts with an EVV-compliant method.
• Training and certification requirements. Some states require caregiver training or administrator certification before EVV-compliant claims can be submitted.
• Offline and rural capture. Agencies in low-connectivity areas should confirm whether their state accepts offline visit verification or requires real-time mobile check-in.
• Phased enforcement and capture thresholds. States increasingly measure how data was captured, not just whether it arrived. Pennsylvania requires 85% of visits to be verified without manual edits (effective January 2025), Minnesota phased its requirement from 50% (January 2026) to 80% (July 2026) — real-time verification on at least 8 of every 10 visits — with visit data due by the 14th of each month (September visits and corrections are due October 14, 2026), and Massachusetts stepped its auto-verified-visit target from 30% up to 50% across 2025–2026.
• Program expansion. States continue to refine and broaden their EVV programs, adding new service types and ramping up audits as the data becomes available.

Because policies shift with contract renewals and new CMS guidance, always verify current requirements against your state Medicaid agency’s official EVV page before making billing-critical decisions.

Penalties for EVV Non-Compliance

Enforcement hits agencies at two levels: denied or delayed payment, and administrative sanctions. Oversight is also getting sharper nationwide: an October 2026 KFF survey of Medicaid home-care officials in all 50 states found 42 states now use all eight fraud-oversight strategies, and every responding state keeps EVV data in machine-readable files and cross-checks billed claims against EVV data — so EVV gaps increasingly surface automatically as claim-payment flags. The practical consequences include:

• Denied claims. A claim submitted without a matching compliant EVV record can be denied outright. Georgia’s program is explicit: EVV-related claims must include the required EVV information or they are denied.
• Corrective action plans. Agencies below capture thresholds are commonly required to submit and follow approved remediation plans — Pennsylvania applies this when providers fall below 85% of visits verified without manual edits for three consecutive months, for example.
• Payment holds and recoupment. States can hold payments and claw back reimbursements for services that lacked proper EVV verification.
• Monetary and enrollment sanctions. States may levy fines that scale with severity and frequency, and restrict or sanction an agency’s Medicaid enrollment.
• Suspension or termination. Persistent non-compliance can lead to suspension, termination of Medicaid enrollment, or exclusion from government-funded programs — Missouri’s regulations, for instance, tie visit-data submission directly to claims alignment, with denials and contract termination as the enforcement tools.
• Audit escalation. Falling below manual-edit or electronic-capture thresholds triggers increased audit frequency, and unresolved discrepancies can invite Medicaid fraud scrutiny.

The trend is unambiguous: manual data entry is becoming unacceptable as states demand real-time, electronically captured verification. Agencies still running paper timesheets or back-entering visits are on borrowed time.

How EVV-Ready Software Keeps Your Agency Compliant

Compliance is ultimately a technology problem, and the right platform turns EVV from a burden into background process. Purpose-built homecare software can:

• Capture the six data elements automatically — GPS clock-in/out, caregiver and client identity, service codes, and timestamps at the point of care.
• Integrate with your state’s aggregator — certified data feeds to Sandata, HHAeXchange, Tellus, AuthentiCare, or CareBridge, so EVV records and claims always match.
• Flag exceptions before billing — missed check-ins, mismatched times, and manual edits surface for resolution before claims go out, protecting reimbursement.
• Surface noncompliant visits before state deadlines — compliance dashboards that flag noncompliant visits by caregiver before the submission deadline (not in next month’s report), document reasons for manual edits, and surface aggregator import rejections fast. Telephony check-in gives caregivers without smartphones an approved verification method.
• Work offline — critical for rural caregivers, with data syncing when connectivity returns.
• Produce audit-ready reports — compliance dashboards and visit verification reports that stand up to state and OIG scrutiny.

Off-the-shelf tools work well in open-model states with straightforward requirements. But multi-state agencies, MCO-contracted providers, and agencies with custom scheduling or billing workflows often outgrow them — which is where custom enterprise software development pays for itself. A custom EVV module can be built to your state’s exact aggregator specifications, certified through the state’s testing process, and extended with automation such as AI-powered voice verification and scheduling automation.

EVV Requirements: Frequently Asked Questions

Is EVV required in every state?

Yes — all states must implement EVV for Medicaid-funded personal care and home health services under the 21st Century Cures Act. How they implement it varies: open, hybrid, state-mandated, or MCO-driven models, each with its own designated aggregator. And exemptions are not permanent: Virginia eliminated its live-in caregiver EVV exemption effective October 1, 2026, so agencies should track state bulletins even when currently exempt.

Does EVV apply to private-pay clients?

No. The federal mandate covers Medicaid-funded visits only. However, individual states, managed care organizations, or payer contracts may impose EVV-style requirements beyond the federal floor, so check your contracts.

Can I use my own EVV vendor instead of the state’s system?

In open and hybrid states, generally yes — your vendor must meet federal requirements and complete certification testing with your state’s aggregator. In closed, state-mandated states (such as Maryland, New Mexico, and South Carolina), you must use the designated state system.

What happens if a caregiver forgets to clock in?

Manual entries and backdated records are treated as exceptions everywhere, and in some states they are not considered EVV-compliant at all. Agencies need an exception-resolution workflow — ideally inside their scheduling software — that corrects and documents missed verifications before claims are submitted, since high manual-edit rates trigger audits.

How does an EVV software vendor get certified?

There is no federal CMS certification for EVV vendors. Vendors certify state by state: they transmit test visits to the state’s aggregator, pass validation, and receive production credentials and training — a process that must be repeated for every state the vendor serves.

EVV compliance is too expensive to get wrong — and too routine to do manually. If your agency operates across multiple states, struggles with aggregator integrations, or needs EVV built into scheduling, billing, and payroll, talk to WebSphere Innovations. We build EVV-ready homecare platforms with certified aggregator integrations, real-time capture, and audit-proof reporting — so your caregivers focus on care and your claims focus on getting paid.