What EVV Actually Requires — and Why Most Software Gets It Wrong

When the 21st Century Cures Act passed in 2016, it did something that quietly reshaped how home care and home health agencies do business: it required Electronic Visit Verification — EVV — for Medicaid-reimbursed personal care services and home health services. The mandate kicked in for personal care on January 1, 2020, and for home health on January 1, 2023.

Six years in, almost every agency I talk to thinks they have EVV "handled." Most of them are wrong.

The rule is more specific than people remember, and the software that claims to support it often misses one or more of the legally required pieces. Here is what EVV actually requires, what most software gets wrong, and what to look for if you are buying.

What the law says

Section 12006 of the Cures Act (Public Law 114-255) requires any state Medicaid program that reimburses personal care services or home health services to electronically verify, at minimum, six data points for every visit:

| # | Required data point | What it means | |---|---|---| | 1 | Type of service performed | Which authorized service was delivered (e.g., personal care, home health aide, skilled nursing) | | 2 | Individual receiving the service | The client/patient identity | | 3 | Date of the service | Calendar date | | 4 | Location of service delivery | Where the visit happened — home, community, etc. | | 5 | Individual providing the service | The caregiver/clinician identity | | 6 | Time the service begins and ends | Clock-in and clock-out timestamps |

That's the federal floor. States are free to require more, and many of them do. They are not free to require less.

Two important things to know:

The mandate applies to Medicaid-funded services. Private pay, LTC insurance, and most VA contracts are outside the federal EVV scope — though many of them have adopted it anyway.
The mandate is implementation-flexible. The Cures Act doesn't tell agencies what to use; it tells them what to capture.

The four EVV models

CMS gave states a choice in how to implement EVV. There are four recognized models:

| Model | How it works | |---|---| | Provider Choice | Agencies pick their own EVV vendor; data flows to a state aggregator | | Open Vendor | State has a designated aggregator; agencies use any compliant vendor that connects to it | | MCO Choice | Each Medicaid managed care organization picks the EVV solution for its providers | | State Mandated In-House | The state directly provides the EVV system; agencies must use it |

Most states landed on Provider Choice or Open Vendor. A handful (Texas, Ohio, Illinois historically) have used state-mandated systems. Either way, agencies have to reconcile their internal scheduling system against the state aggregator, and that reconciliation is usually where things break.

Where software gets EVV wrong

Here are the failure modes I see most often.

1. Treating GPS as the only location proof

The Cures Act requires location verification, not specifically GPS. Most software defaults to GPS-only — which means a caregiver in a basement apartment, a rural area with no signal, or an underground parking garage will fail to check in and the agency has no fallback.

Good EVV software supports multiple location proofs: GPS as the primary, with telephony (caller ID matched against the client's home phone) and FOB (small device at the client's home that emits a code) as documented backups. Each backup needs to be auditable.

2. Allowing edits after clock-out without an audit trail

Once the shift is closed, the EVV record is supposed to be locked. Most software lets administrators edit times after the fact — which is sometimes legitimately needed (the caregiver forgot to clock out), but those edits must be logged with who, when, why, and the previous values. No audit trail = no defense in an audit.

We enforce this at the database level. Edits to a closed shift write a row to an append-only audit log automatically.

3. Not handling the GPS-denied case cleanly

This is the one that keeps agencies up at night. A caregiver arrives at the client's home, opens the app, and GPS won't lock. Now what?

Bad software either silently lets the caregiver clock in without location verification (a compliance violation) or refuses the clock-in entirely (a service disruption that means the caregiver leaves and the client doesn't get care).

Good software requires an explicit override reason — "GPS unavailable," "device denied location permission," etc. — logs it, and surfaces it to the supervisor for review. The shift goes forward, the audit trail is intact.

4. No reconciliation against the state aggregator

This is the one most agencies don't realize until they get a denial. The visit happened, the caregiver clocked in and out, the ADL log is filled — but the state aggregator never received the EVV record, or received it with a mismatched field, and the claim is denied.

Good EVV software either submits directly to the state aggregator (in Provider Choice states) or generates a state-conformant export file that the agency's billing team can submit. Either way, someone has to reconcile what was scheduled, what was performed, and what the aggregator received. Agencies that don't reconcile lose money to denied claims they could have prevented.

5. Treating EVV as a clock, not as a workflow

This is the deepest failure mode. EVV isn't supposed to be a separate timeclock app the caregiver uses on top of the scheduling system. It's supposed to be the same check-in and check-out events that drive the schedule, the ADL log, payroll, and billing.

When EVV is bolted on, caregivers end up with two apps, supervisors end up reconciling between them, and audit trails fragment across systems. When EVV is integrated into the scheduling product from day one, all of those flows come from a single event.

What to ask a vendor

If you are evaluating home care or home health software, ask these five questions before signing:

Which Cures Act data points do you capture, and how? A vendor that can't immediately list all six is selling you a checkbox.
What happens when GPS fails? If the answer is "we just block the check-in," walk away.
Do you support the four EVV models, or only Provider Choice? Multi-state agencies need flexibility.
Show me the audit log for an admin-edited shift. If the vendor has to "look into that," it doesn't exist.
How does your EVV reconcile against the state aggregator? "We send a CSV" is not reconciliation.

A vendor that can answer those five questions confidently is rare. A vendor that can't is going to cost you in claim denials, audit risk, and caregiver frustration.

The takeaway

EVV is not a feature. It is an integrated workflow that touches scheduling, documentation, payroll, and billing simultaneously. The agencies that get it right have software where the clock-in event drives all four downstream systems from a single source of truth. The ones that don't are gluing together five products and praying nothing falls through the cracks.

This is one of the reasons we built Home Care Scheduling the way we did. EVV isn't a module on the side — it's part of how shifts work. Clock-in starts the ADL log, captures the location proof (with documented overrides), and locks the record at clock-out. One event, one source of truth, one audit trail.

If your current software treats EVV as a checkbox, you are leaving money and compliance on the table.

See how integrated EVV looks in practice — explore Home Care Scheduling.