UPP cuts physician credentialing processing time by as much as 80% — with continuous monitoring, primary source verification, and reusable signed credential packets.
Packet → primary-source verify → signature → share → VERIFIED. Click any chapter to jump.
Build it once. Reuse it everywhere.
Privilege physicians in days.
Network ops without the rework.
Worklists that close themselves.
Place verified physicians faster.
Hospitals, payers, and state boards have spent decades duplicating verification because they couldn't trust each other's work. UPP exists to be the record they can all trust — cryptographically signed, primary-source verified, continuously monitored, and audit-ready by default.
Every license, board certification, DEA registration, malpractice policy, training history, work history, and sanctions check on UPP is a structured, versioned record — not a scanned PDF in someone's inbox.
UPP doesn't decide a physician is credentialed — the issuing authorities do. We pull directly from the same primary sources NCQA, CMS, and The Joint Commission require, and we show our work on every field.
Trust comes from infrastructure, not marketing. UPP runs on isolated tenant data, encrypted end-to-end, with SOC 2 Type II controls, HIPAA BAAs, and an immutable audit log of every read, write, and verification.
Every credential on UPP is verified against the actual issuing authority. If a source is down or returns a discrepancy, the record is marked — never silently approved.
Each credential packet is hashed and signed at issuance. Recipients can independently verify the packet wasn't altered in transit or after delivery — no need to trust UPP as the intermediary.
Every view, share, verification, and policy decision is appended to a write-once log. Exports are signed and timestamped for board reviews, NCQA surveys, and CMS audits.
OIG, NPDB, sanctions, license status, and DEA registration are swept every 24 hours. Material changes trigger alerts to the provider and every organization with an active packet.
The passport belongs to the provider. Organizations get scoped, revocable access to packets the provider explicitly shares — not bulk database access.
Tenant data is logically isolated and encrypted at rest (AES-256) and in transit (TLS 1.3). Enterprise customers can bring their own KMS keys for envelope encryption.
When a primary source disagrees with a self-attested field, UPP marks the record as 'in dispute' and routes it to a credentialing specialist. We never auto-reconcile silently.
Our verification rules, source priority, and confidence scoring are publicly documented. Compliance teams can map every UPP field to NCQA CR standards in one page.
Credentials are append-only. A license renewal creates a new version with full history — you can always answer 'what did this record look like on the day we privileged this physician?'
Security at UPP is engineered, not declared. Every control below is in production today and independently verifiable in our SOC 2 Type II report.
AES-256-GCM on all stored data, with field-level encryption for PII (SSN, DOB, DEA #) using HSM-backed keys rotated every 90 days.
TLS 1.3 only, HSTS preload, certificate pinning on mobile, perfect forward secrecy. TLS 1.0/1.1 and weak ciphers are rejected at the load balancer.
Enterprise tenants can bring AWS KMS, Azure Key Vault, or GCP Cloud KMS via envelope encryption. Revoking your key cryptoshreds your tenant — instantly and provably.
RBAC down to the field level, MFA enforced on every account (TOTP, WebAuthn, FIDO2), SSO via SAML/OIDC, and SCIM provisioning for enterprise IdPs.
Logical isolation at the row, schema, and storage-bucket level with policy-enforced microsegmentation. No shared caches. No cross-tenant query paths.
Providers see every read of their record — who, when, why, from what org, against which policy. Logs are append-only and exportable.
US-only data residency (us-east + us-west). Provider-initiated deletion cryptoshreds keys within 24h and purges backups within 30 days, with a signed deletion receipt.
SIEM-integrated anomaly detection, on-call SecOps, contractual 72-hour breach notification, and annual third-party penetration tests with public summary reports.
Most credentialing tools digitize an outdated process. UPP rebuilds it around the only thing that actually matters: a primary-source-verified, continuously monitored record the provider owns and every stakeholder can trust.
Why it's different: Most platforms start with what the provider types in. We start with what the issuing authority says — then reconcile.
Why it matters: Attestations expire and drift. Primary sources are the only record auditors, payers, and hospitals actually accept.
vs. status quo: CAQH is an attestation database. We are a verification record.
Why it's different: Sanctions, licensure, DEA, and NPDB are swept every 24 hours — not at re-credentialing.
Why it matters: An excluded provider seeing patients for 18 months is a Medicare clawback event. We close that window to hours.
vs. status quo: Legacy CVOs verify at hire, then nothing for 2–3 years.
Why it's different: One verified packet is shared, scoped, and revoked across every hospital and payer the provider works with.
Why it matters: Providers stop filling out the same 50 fields 14 times a year. Organizations stop re-verifying what's already verified.
vs. status quo: Point tools re-do the work for every counterparty.
Why it's different: When a primary source disagrees with a self-attested field, we mark it 'in dispute' and route it — never silently overwrite.
Why it matters: Silent reconciliation is how bad data enters the credentialing record. We make every conflict visible and resolvable.
vs. status quo: Most platforms default to the most recent value and discard the conflict.
Why it's different: Every read, write, verification, and policy decision is appended to a write-once log, signed and timestamped.
Why it matters: NCQA surveys, CMS audits, and board reviews demand provenance. We hand them a signed PDF in one click.
vs. status quo: Spreadsheet trackers and email threads are not an audit trail.
Why it's different: The passport belongs to the provider. They grant scoped, revocable access — not bulk database dumps.
Why it matters: Providers actually keep their record current when they own it. Organizations get a record that follows the clinician, not the org.
vs. status quo: Vendor-owned records become vendor lock-in.
Why it's different: Open APIs, FHIR-compatible exports, and pre-built connectors to Epic, Cerner, MD-Staff, symplr, and Verity.
Why it matters: Credentialing data has to land inside the EHR, MSO, and payer enrollment systems. We meet them where they live.
vs. status quo: Most platforms force you into their UI.
Why it's different: Every field maps directly to NCQA CR, URAC, CMS, and Joint Commission requirements out of the box.
Why it matters: Your compliance team stops writing crosswalks. The mapping is the product.
vs. status quo: Generic CVOs leave the compliance mapping to you.
| Capability | UPP | CAQH ProView | Legacy CVO |
|---|---|---|---|
| Primary-source verification | Live API to all 11 sources | Attestation only | Manual, batch |
| Continuous monitoring | Every 24h, every source | No | Re-verify at 2–3 yr cycle |
| Reusable signed packets | Yes — scoped & revocable | Static profile share | Per-engagement file |
| Provider-owned consent | Yes — granular per org | Org-level only | No |
| Discrepancy surfacing | Flagged with provenance | Silent overwrite | Manual reconcile |
| Tamper-evident audit trail | Cryptographically signed | Activity log | PDF exports |
| Avg. time to ready-to-bill | < 30 days | 60–90 days | 90–180 days |
| EHR / MSO integration | Epic, Cerner, MD-Staff, symplr | Limited exports | Custom only |
| NCQA / URAC / CMS mapping | Built in | Partial | DIY crosswalk |
The net effect: providers carry one verified record everywhere they practice, organizations stop duplicating verification work, and auditors get the provenance they've always needed but never had.
Continuously updated. Always available. Owned by the provider, trusted by every hospital, payer, and board they work with. Credentialing stops being a project and becomes a living record.
Providers never pay to own their passport. Organizations pay for the workflows that move credentialing in days.
Small clinics getting credentialing out of spreadsheets.
Multi-site groups and hospitals running real committees.
Health systems, payers, and multi-state networks.
Create your free passport, or spin up an organization workspace in minutes.
