When the New York Attorney General's office surveyed roughly 400 behavioral health providers listed across 13 commercial health plans in 2023, only 56 of those providers — 14 percent — could actually book an appointment. The other 86 percent were unreachable, no longer in-network, or not accepting new patients. New York's commercial insurers had been quietly maintaining directories full of providers who were not there. The state finally put a rule behind that problem.
What the regulation says
The New York Department of Financial Services (DFS) and the Department of Health jointly adopted these regulations in February 2025. The DFS version, formally 11 NYCRR 38, covers commercial health insurance plans licensed in New York: insurers under Insurance Law Article 42, Article 43 corporations (HMOs), municipal cooperative health benefit plans, and student health plans.
Two appointment standards sit at the center of the rule:
- 10 business days from the date of a member's request for an initial outpatient behavioral health appointment, whether with a facility, clinic, or individual clinician.
- 7 calendar days following discharge from a hospital or emergency room visit.
These are not aspirational targets. They are legally required timelines. Insurers are now required to certify annually that they are meeting them, with the first certification due December 31, 2026.
The rule also requires insurers to post accurate, current provider directories — including telehealth availability, languages spoken, and geographic location. That piece directly targets the ghost-network problem the AG documented: a directory that looks full but lists providers who have left the panel, closed their practices, or never accepted new patients.
Who it covers — and the rolling effective date
The regulation applies to commercial health insurance policies issued, renewed, modified, or amended on or after July 1, 2025. That rolling clause matters. This is not a cliff date where every plan in New York flipped simultaneously. Plans phase in as they renew, so coverage varies until every policy in the state cycles through. A plan that has not yet renewed since July 1, 2025 may not yet be bound by the new standards.
One important scope boundary: this regulation governs plans overseen by DFS — commercial insurance issued in New York. Medicaid managed care and self-insured employer plans regulated under federal ERISA law fall under different frameworks. The 10-business-day standard and the OON-at-INN provision in 11 NYCRR 38 are commercial insurance obligations, not universal coverage requirements.
For the NY/NJ/CT private-practice population, where most working-age clients carry commercial employer-sponsored coverage, the majority of plans that have renewed since July 2025 are in scope. When there is doubt about a specific plan, the DFS FAQ for 11 NYCRR 38 is the primary reference.
What the OON provision means for therapists not on panel
This is where the regulation hands private-practice clinicians real leverage, including those who are out-of-network with the insurer in question.
When an insurer receives a formal access complaint — meaning a member has tried and failed to secure an in-network appointment within 10 business days — and the insurer cannot locate an in-network provider who can treat the condition, meet the wait time, and is within a reasonable distance, the insurer must approve a referral to an out-of-network provider. The cost-sharing requirement in the regulation is specific: the insurer cannot charge the member a copayment, coinsurance, or deductible greater than what they would owe for in-network care.
In practice: if your client's commercial plan has an under-built behavioral health network, and your client cannot get an in-network appointment within 10 business days, your client has grounds to request an OON referral at INN rates. For a therapist not paneled with that insurer, this can mean a client who could not otherwise afford your rate may be able to see you with standard in-network cost-sharing applied.
The referral is not automatic. The member has to file an access complaint with the insurer. The OON provider must be able to treat the condition, meet wait times, be within a reasonable geographic range, and charge rates DFS would not consider excessive. But the mechanism is written into the regulation. The insurer cannot refuse simply because you are not in their directory.
Why the enforcement picture matters
The AG's 2023 survey put numbers on what most NY therapists already knew from their own phones: the listed networks and the real networks are not the same thing. Across 13 commercial plans, 86 of every 100 listed providers were effectively unavailable. The named plans in that investigation included Aetna, Cigna, EmblemHealth, Empire BlueCross BlueShield, and UnitedHealthcare.
In February 2026, AG Letitia James secured a $2.5 million settlement from EmblemHealth — the largest ghost-network penalty the office had reached — after an investigation found that 82 percent of the behavioral health providers EmblemHealth listed as accepting new patients were effectively unavailable when patients called. EmblemHealth had settled a nearly identical directory-accuracy case with the state in 2011. The 2026 settlement stands out because EmblemHealth had already promised to fix this. The AG's office also settled a separate ghost-network case against MVP Health Plan in 2025.
Under the EmblemHealth settlement, the insurer must expand its behavioral health network, meet appointment-access standards, and allow members to use out-of-network providers at in-network cost-sharing levels when timely in-network care is not available — the same mechanism now required by 11 NYCRR 38 for all covered commercial plans.
Governor Hochul secured $1 million in the FY 2026 state budget for DFS enforcement of these regulations. The state launched its "Real Care, Real Access to Behavioral Health Services" public awareness campaign in February 2026, directed at both consumers and providers. The first annual compliance certification is due December 31, 2026, which means the coming months are when insurers will either demonstrate they have fixed the problem or put their documented failure on the record.
What to do now
You do not need to be paneled with a plan for this regulation to matter to your practice.
Know the complaint pathway. When a client tells you they cannot get an in-network appointment, ask whether they have filed a formal access complaint with their insurer. That complaint is the trigger for the OON referral mechanism. Without a filed complaint, the insurer has no legal obligation to move toward OON authorization. The DFS "Real Care, Real Access" campaign includes a consumer-facing complaint resource. CHAMP — the Community Health Access to Addiction and Mental Healthcare Project — can also assist members in filing complaints and navigating denials.
Document the access failure. Ask clients who are looking for in-network care to keep a record of who they called, when they called, and what they were told. If an OON referral request is denied, that record is the basis for an appeal. A verbal "we don't have anyone available" is much harder to act on than a written log.
Understand which plans are in scope. Because the regulation applies on a rolling renewal basis, some plans may not yet be bound by the new standards. The DFS FAQ for 11 NYCRR 38 clarifies which entity types are covered. A plan that has not renewed since July 1, 2025 is not yet subject to the 10-business-day standard — but underlying parity and access rights still apply under existing law.
Know your rate position. The OON referral mechanism requires that your rates not be considered excessive. The regulation does not define a hard ceiling, and DFS has not published a specific benchmark. Being able to articulate your rates relative to your market is useful context if a referral request is contested.
This is not a fix for the underlying reimbursement problem. Commercial insurers have been paying behavioral health clinicians a fraction of what they pay medical and surgical providers within the same plan — a within-plan disparity that Connecticut, Pennsylvania, and Georgia have all documented through parity enforcement actions in 2025 and 2026. Network adequacy rules address whether you can get a client through the door. Parity enforcement addresses whether you get paid fairly once they are. Those are different fights, and both are active.
What 11 NYCRR 38 does give you is a rule, now backed by enforcement dollars and a compliance deadline, that says a commercial insurer cannot run a ghost network and call it an adequate behavioral health panel. In New York, where the AG found 86 of every 100 listed providers couldn't actually get a client an appointment, that rule is long overdue.
VibeCheck is built by a clinician who navigates exactly this — keeping your practice running while the system catches up. If you're in private practice in NY and want to talk through what this means for your caseload, book a call.
FAQ
Does New York's 11 NYCRR 38 apply to my client's employer-sponsored plan?
It depends on the plan structure. DFS 11 NYCRR 38 covers commercial health insurance plans licensed in New York, including fully insured employer group plans. Self-insured employer plans regulated under federal ERISA are governed by different federal rules and are not covered by 11 NYCRR 38. If a client is unsure about their plan type, DFS or CHAMP can help them confirm.
What exactly triggers the right to out-of-network care at in-network cost?
A formal access complaint filed with the insurer, after the insurer is unable to provide an in-network appointment within 10 business days. The insurer must then attempt to locate an available in-network provider. If none meets the distance, wait time, and specialization requirements, the insurer must approve an OON referral at INN cost-sharing. The client initiates the complaint — it does not happen automatically.
Does this regulation apply to telehealth behavioral health appointments?
Yes. Insurers must clearly list telehealth availability in their provider directories, and the 10-business-day standard applies to outpatient behavioral health appointments regardless of modality. A telehealth appointment counts toward meeting the access standard.
What happens if an insurer fails its annual compliance certification?
The first certification is due December 31, 2026. Governor Hochul's FY 2026 budget included $1 million for DFS enforcement of these standards. Failures can trigger DFS investigation, fines, and corrective action requirements — the same enforcement pathway that led to the $2.5 million EmblemHealth and MVP Health Plan settlements. The difference now is that the obligation is explicitly documented and annual.
---