EVV Compliance Requirements for Self-Directed Care Programs

Electronic Visit Verification has been mandatory for Medicaid personal care services since 2020 and for home health services since 2023, under the 21st Century Cures Act. Most organizations are past the question of whether they need EVV. The harder question is what compliance actually requires — because the federal requirement is narrower than most people assume, and the findings that surface in state audits usually are not about the requirement itself.

What federal law actually requires

The Cures Act specifies six data elements that must be electronically captured for each visit:

1. The type of service performed
2. The individual receiving the service
3. The date of the service
4. The location of service delivery
5. The individual providing the service
6. The time the service begins and ends

That is the entire federal data requirement. It says nothing about which technology you use, whether GPS is required, or how the data must be transmitted.

This matters because a great deal of EVV anxiety is about things federal law does not mandate. GPS, for example, is one way to satisfy the location element — not a requirement. Telephony from the consumer’s home phone establishes location just as validly.

What states add on top

States implement EVV through their own systems, and this is where real variation lives. A state may operate an aggregator model, where providers submit visit data to a state system in a prescribed format; a state-mandated system, where you use the state’s chosen vendor directly; or an open vendor model, where you choose your system and meet the state’s data and submission requirements.

State rules also commonly govern how visit data may be edited, how long records must be retained, what constitutes an acceptable manual entry reason, and how quickly visits must be submitted.

If you operate across state lines, you are operating under several of these regimes at once. That is an argument for visit capture that can produce different submission formats from one underlying record, rather than for running a different EVV product per state.

Why self-directed programs are harder

EVV requirements were largely written with agency-employed workforces in mind. Self-directed care differs in ways that matter operationally.

The workforce is not uniform. Caregivers are frequently family members, often older, and not necessarily carrying a current smartphone. A mobile-only EVV solution will produce manual entries at exactly the rate your workforce lacks devices — and manual entries are what auditors examine.

The setting is the consumer’s home. Rural homes may have no reliable cellular signal. If your capture method requires live connectivity, visits will fail to record for reasons that have nothing to do with whether the visit happened. Offline capture that syncs later, preserving the original check-in and check-out times, is not a nicety here.

The employer is the consumer. In a self-directed program the common-law employer is the consumer or their representative, not your organization. Compliance depends on people who do not work for you following a process. The process has to be simple enough that they actually do.

This is why supporting mobile, telephony, and web capture together matters more in self-directed care than in agency-based care. Not every caregiver’s situation is served by the same method, and the ones you fail to serve become your exception volume.

Where audits actually find problems

In practice, findings tend to cluster in a few places — and mostly not in whether visits were captured at all.

Manual entry without documented justification. Manual entries are permitted. Manual entries without a recorded reason, or with a generic reason applied uniformly, are a finding. If half your manual entries say “forgot to clock out,” that is a pattern that invites scrutiny.

Edits without an audit trail. Visit data gets corrected — that is normal. What auditors look for is whether the system records who changed what, when, and why, and whether the original captured value is preserved alongside the correction. A system that overwrites the original value has destroyed the evidence.

Visits that do not reconcile to payment. If EVV data says 6 hours and payroll paid 8, that gap needs an explanation. This is the finding that most often turns into a recovery, and it is a structural consequence of running EVV and payroll in separate systems that are reconciled periodically rather than continuously.

Visits outside the authorization. A visit delivering a service the authorization did not cover, or falling outside its date range, or exceeding the authorized amount. Validating at check-in rather than at billing is what prevents this category entirely.

Late submission. States impose submission windows. Missing them is a compliance issue independent of whether the underlying data was correct.

What good EVV operations look like

The organizations that handle EVV well tend to share a few practices.

They treat exceptions as a queue, not an inbox — every exception is assigned, resolved, and documented, and the queue is worked to zero on a schedule rather than reviewed when someone has time.

They monitor the manual entry rate as a leading indicator. A rising rate usually means something specific: a device problem, a coverage dead zone, a caregiver who needs retraining. Watching the rate finds the cause while it is still small.

They validate upstream. Catching an unauthorized service at check-in costs a phone call. Catching it at billing costs a denial, a correction, and possibly a recovery of wages already paid.

They keep the evidence attached to the payment. When a payer asks why a specific check was issued, the answer should be a lookup that produces the visit record, the authorization it validated against, and the payroll run it fed — not an investigation across three systems.

Getting there

The structural point is that EVV is not really a compliance product bolted onto an operation. It is the moment service delivery becomes verifiable data, and everything downstream either inherits that verification or re-derives it.

ArborSoft captures visits by mobile, telephony, and web, validates each against the governing authorization at check-in, and feeds verified visits directly into payroll and billing — so the reconciliation between what was verified and what was paid is not a monthly task.

If you are evaluating how EVV fits into a broader fiscal agent operation, our self-directed care and FMS software page covers how the pieces connect, or you can request a demo.