FOUNDING50 — 50% off for lifeSee pricing →
UPP
UPP
Universal Provider Passport
 Back to methodology
Discrepancy workflow

Triage. Dispute. Resolve. Re-verify.

When attested data and primary-source data disagree, UPP never silently picks a winner. Every mismatch moves through a transparent lifecycle — and every state transition becomes an immutable audit record.

Severity classification

Every discrepancy is classified at open time and re-checked at triage. Severity controls what the packet receiver sees and whether the credential can be sent.

Informational

Examples: Casing, punctuation, formatting drift (e.g. 'MD' vs 'M.D.').

Logged for completeness. Does not affect packet send. Auto-resolves on next attestation sync.

Material

Examples: Date drift > 30 days, address mismatch, PECOS revalidation due < 60 days, MOC lapse.

Surfaced on the packet. Committee sees both values + source citation. Requires reviewer acknowledgement before send.

Blocking

Examples: License status mismatch (active vs suspended), OIG/SAM exclusion hit, identity mismatch, DEA revoked.

Packet cannot be sent until resolved or formally overridden by an org admin with written justification.

Lifecycle & audit mapping

Six phases, each tied to specific audit_logs records and emitted events. Reviewers, providers, and committees can replay the entire chain from the packet view.

  1. 01

    Detect & open

    Monitoring worker or PSV match

    A monitoring sweep or a fresh PSV result detects a mismatch. The system classifies severity and opens a discrepancy with both values, source citation, and timestamp.

    Audit records
    • audit.discrepancy.opened
      Field, attested value, source value, severity, source id, detected_at.
    Events emitted
    • discrepancy.opened
      { discrepancy_id, provider_id, field, severity, source }
  2. 02

    Triage & assign

    Credentialing specialist

    A specialist reviews the discrepancy, confirms severity (or re-classifies), and assigns an owner. Triage notes are captured as part of the event record.

    Audit records
    • audit.discrepancy.triaged
      from_status=open, to_status=triaged, reviewer, reclassification reason.
    • audit.discrepancy.assigned
      assignee_user_id, assigned_at.
    Events emitted
    • discrepancy.triaged
      { discrepancy_id, severity_changed, note }
  3. 03

    Provider dispute (optional)

    Provider

    The provider sees the discrepancy in their wallet and can either update their attestation or dispute the source value. Disputes attach evidence (e.g. updated COI, board letter) without overwriting the source field.

    Audit records
    • audit.discrepancy.disputed
      Dispute reason, evidence attachments[], provider statement.
    • audit.discrepancy.evidence_added
      Evidence hash, content type, uploader, retrieved_at.
    Events emitted
    • discrepancy.disputed
      { discrepancy_id, evidence_count, reason }
  4. 04

    Re-verify against source

    PSV worker (HSM-backed)

    A targeted PSV job re-queries the primary source. If the source agrees with the attestation, the discrepancy auto-resolves. If the source confirms its original value, the discrepancy stays open with the new evidence attached.

    Audit records
    • audit.discrepancy.reverification_requested
      PSV job id, source, requested_by.
    • audit.discrepancy.reverified
      Source response hash, agreement bool, signed credential id.
    Events emitted
    • discrepancy.reverification_requested
      { discrepancy_id, job_id }
    • discrepancy.reverified
      { discrepancy_id, agreement, credential_id }
  5. 05

    Resolve or dismiss

    Reviewer or auto-resolve

    Resolution records who resolved it, the resolution notes, and the new authoritative value. Dismissal (for false-positive monitoring hits) records the rationale and the reviewer who dismissed it.

    Audit records
    • audit.discrepancy.resolved
      resolved_by, resolved_at, resolution_notes, final_value.
    • audit.discrepancy.dismissed
      dismissed_by, dismissal_reason.
    Events emitted
    • discrepancy.resolved
      { discrepancy_id, final_value, resolution_notes }
    • discrepancy.dismissed
      { discrepancy_id, reason }
  6. 06

    Audit & export

    audit_logs (append-only)

    Every state transition above is mirrored into audit_logs with actor, IP, request id, and a SHA-256 link to the previous entry. The full discrepancy lifecycle is exportable as signed JSON for NCQA file review or legal hold.

    Audit records
    • audit.discrepancy.exported
      Export id, requestor, scope, signature key id.
    Events emitted
    • audit.exported
      { scope:'discrepancy', id, sig }

What UPP guarantees

Never silently reconciled

UPP does not rewrite the attestation to match the source, or the source to match the attestation. Both values stay visible until a human resolves.

Receiver sees the full history

Packets shared with a hospital or payer include the complete discrepancy timeline — not a sanitized snapshot.

Every transition is logged

Open, triage, dispute, re-verify, resolve, dismiss — each becomes an audit_logs entry with actor, IP, and hash-chained integrity.

Override requires justification

Blocking discrepancies can only be overridden by an org admin, and the override itself is a first-class audit record with written rationale.

See discrepancies in your own packet.

Open a passport and watch every mismatch surface with full provenance — and a clear path to resolution.

Get started free Back to methodology