EVV in 2026: what the federal mandate actually requires

The 21st Century Cures Act has been on the books for nearly a decade, but every year we still get the same question from agencies new to EVV: what does compliance actually require?

The marketing copy from EVV vendors makes it sound complicated. The reality is more tractable than the acronym soup suggests. Here's the version that fits in a single blog post.

What the federal mandate requires

Under §12006 of the 21st Century Cures Act, every state must have an EVV system in place for personal care services (PCS) and home health care services (HHCS) funded by Medicaid. The system must electronically verify — that is, capture without manual entry — six pieces of information for every visit:

1. The type of service performed
2. The individual receiving the service (the "consumer," in agency-speak)
3. The date of service
4. The location of service delivery
5. The individual providing the service (the caregiver)
6. The start and end times of the visit

That's it. Six data points. Every visit. Electronically captured.

If you're using paper timesheets, manual reconstruction, or call-in logs that the office types up later, you're not compliant. Compliance requires the data to be captured at the point of service, by the system itself.

Where states actually diverge

The federal mandate sets the floor. State implementations vary — sometimes dramatically — on the ceiling. Here are the dimensions that vary:

Model (open vs. closed). Some states run a "closed" EVV system: every agency must use the state-designated EVV vendor. Other states run an "open" model: agencies pick their own EVV system, as long as it transmits data to the state aggregator in the required format. Most states are open or hybrid; check your state's specific rules.

Aggregator integration. In open-model states, your EVV system has to talk to the state's aggregator. The integration spec — file format, transmission cadence, error handling — is published per state, and the details matter.

Live-in caregiver exemptions. Many states exempt live-in caregivers (typically a family caregiver providing services in their own home) from EVV. The exemption rules vary.

HHCS phase-in. Federal EVV for personal care services has been required since 2021. EVV for home health care services has a separate, later compliance date. Where you are in that timeline depends on your state and your service mix.

Telehealth & virtual visits. Post-2020, more states added explicit rules for what counts as a verifiable visit when the visit was virtual. The location data point gets weird here.

What auditors actually look at

In our experience working with EVV-using agencies, audits tend to focus on four things:

1. Completeness of the six data points. Every visit, every field, captured electronically. Missing fields trigger follow-up questions.

2. Geographic plausibility. If a caregiver's check-in location doesn't match the individual's service address, you should have a documented explanation. (Some services are legitimately delivered in the community, not at home — your EVV system should handle this without breaking.)

3. Time integrity. Start and end times that can't be retroactively edited without leaving an audit trail. If your system lets supervisors silently "fix" a check-in time, the audit log is what saves you. Make sure you have one.

4. Reconciliation against billing. EVV visits and billed visits should match. Discrepancies — billed visits with no corresponding EVV record, or EVV records with no corresponding bill — are an audit flag.

What "good" EVV software does

A well-designed EVV system, from the agency's perspective, looks like this:

• Caregivers don't fight it. Check-in takes three taps, biometric login, and works the first time. If the software burns time the caregiver could have spent with the individual, the agency will hear about it.
• It works offline. Spotty signal is normal in the field. The system should capture visits offline and sync when connectivity returns — without losing visits or breaking timestamps.
• It captures location precisely. Not "the right city" — the actual GPS coordinates, with a path if needed.
• It has a tamper-evident audit trail. Any edit, by anyone, leaves a record.
• It integrates cleanly with the aggregator. In open-model states, the aggregator integration is non-negotiable — and you don't want to be debugging it in production.

ctEVV™ does these by default. Native iOS & Android, biometric login, GPS-verified visits, offline-tolerant sync, tamper-evident audit trail. It's compliance built into the product, not bolted on as a setting.

What about the agency back-office?

EVV isn't just a caregiver app — it's also a back-office workflow. Agencies need to be able to:

• Schedule visits and have those expectations show up in the caregiver's app
• Monitor in real time which visits are happening, which are late, and which are missed
• Reconcile EVV records against the billed claims
• Generate the audit reports your state aggregator (or state surveyor) asks for

For larger agencies, the EVV system needs to integrate with the rest of the operations — billing, scheduling, payroll. This is where the standalone-EVV-app approach starts to break down. Our take: pair ctEVV™ with ctAgency Suite™ for agencies that need the full operations layer, including HHAeXchange aggregator integration.

The bottom line

Federal EVV compliance is six data points, every visit, electronically. Your state will have additional requirements on top — model, aggregator, exemptions, phase-in. Most state-level surprises come from the aggregator integration spec; budget time for that.

The compliance bar isn't high. The caregiver-experience bar should be. If your EVV system is causing caregiver turnover, the compliance value is being eaten by the operational cost. Pick a system that respects the people using it.

Want the longer version? Our full EVV Compliance Guide walks through the mandate, state-level variations, and audit-prep checklists.