Who Controls Your Credentials?

Physicians should be able to prove their qualifications without surrendering control of their professional information.

We support accurate credentialing, reliable provider directories, and technology that reduces administrative work. But physicians deserve to know whether a requirement comes from the law, a health plan’s policy, or a software vendor’s preferred workflow.

That distinction matters when a practice is told that joining a network requires using one particular platform.

State credentialing laws and federal antitrust cases offer reasons to examine these requirements closely. They do not establish that every portal requirement is illegal, or that every shared database violates antitrust law. They do support a more informed conversation about physician choice, competition, and accountability.

A standardized application does not have to mean a single mandatory platform

Some states require health plans to accept a uniform credentialing application. The protections differ, and the application itself must be distinguished from the system used to transmit it.

Here is what the primary sources establish:

State	Verified requirement	What it means for physician choice
New Jersey	The Department of Banking and Insurance says carriers and their vendors must accept the state’s universal physician application when a physician chooses it. Carriers cannot require an alternative credentialing mechanism in its place as a condition of network participation.	This is explicit support for choosing the state application even when a carrier encourages a national database.
Texas	The Department of Insurance says hospitals, HMOs, and PPOs must use the standardized physician credentialing application and directs applicants to send it to the relevant plan or network.	There is a recognized standardized application process. This does not establish an unrestricted right to submit through any API or electronic channel.
Maryland	Insurance Article § 15-112.1 requires covered carriers and credentialing intermediaries to accept the designated uniform form as the sole application, subject to specified exceptions. It also places conditions on designating an application associated with an online system.	Under § 15-112.1(e)(2), that designation requires the application to be free to providers and its use not to be conditioned on submission through the online system.

Sources: New Jersey regulator guidance; Texas regulator guidance; Maryland Insurance Article § 15-112.1.

Maryland’s electronic-filing regulation goes further: it permits electronic filing in a format containing the information required by the uniform form. That supports flexibility, but it should not be presented as a requirement that every payer build or connect to a physician’s preferred API. Source: COMAR 31.10.26.04.

Virginia is sometimes included in discussions of universal applications, but the frequently cited § 38.2-3407.10:1 addresses application processing, timing, and reimbursement during a pending application. It does not establish the broad vendor-choice protection described above. Source: Virginia statute.

These rules also do not guarantee a network contract. Acceptance of an application, verification of qualifications, and agreement to participate in a network are separate steps.

For practices, the practical question is specific: What rule applies to this carrier, this application, and this submission requirement?

Calling every conflicting workflow a deliberate “loophole” goes beyond the evidence. A better approach is to document the requirement, request its legal or contractual basis, and distinguish credentialing from separate directory-maintenance obligations.

Shared software does not put competitors beyond antitrust scrutiny

Healthcare needs data exchange. The antitrust question concerns how competitors use shared information and whether their conduct unlawfully restricts competition.

The MultiPlan litigation illustrates why that distinction matters.

Reported allegations: Healthcare providers allege that MultiPlan and participating payers used a common pricing system and competitively sensitive information to coordinate depressed reimbursement for out-of-network services.

Verified court action: On June 3, 2025, the federal district court allowed the federal and state antitrust claims to proceed. The court granted the dismissal motions in part on other claims. Its ruling assessed whether the allegations were legally sufficient at that stage; it did not determine that the defendants had committed price fixing. Source: court opinion, reproduced by Justia.

The Department of Justice also filed a statement of interest explaining that coordination and information exchange through a common pricing algorithm can violate Section 1 of the Sherman Act. DOJ’s participation did not turn the providers’ civil litigation into a government prosecution. Source: DOJ filing, March 27, 2025.

The lesson is consequential: routing conduct through software does not automatically make it lawful.

RealPage shows why the use of data matters

The DOJ’s RealPage case concerns rental housing, but its enforcement theory is relevant to the broader debate about intermediaries.

DOJ alleged that competing landlords shared nonpublic, competitively sensitive information through software that helped align rental pricing. On November 24, 2025, DOJ announced a proposed settlement addressing information sharing and pricing coordination. That announcement is a settlement development, not a trial finding that every shared algorithm is unlawful. Source: DOJ announcement.

Our interpretation: Healthcare organizations should examine whether a shared platform supports legitimate administrative work or facilitates coordination over competitive decisions. A directory containing professional qualifications is not equivalent to a system coordinating reimbursement. The data, agreements, safeguards, and actual conduct matter.

What changed when the agencies withdrew healthcare guidance?

In 2023, DOJ and the FTC withdrew longstanding healthcare antitrust enforcement policy statements. The FTC explained that the statements no longer reflected market realities and that healthcare conduct would be evaluated case by case. Source: FTC announcement.

The withdrawn guidance included enforcement safety zones. Those were not blanket legal immunity for any company using a third-party vendor.

Withdrawal did not make ordinary credential verification unlawful. It did remove a basis for relying on those older agency assurances. Organizations must evaluate what their data-sharing arrangements actually do.

Why CAQH/DataSpring’s ownership deserves attention

Company-reported fact: In January 2026, CAQH announced that it was owned by twelve shareholder companies affiliated with leading health plans. The announcement, now hosted on DataSpring’s website, describes a board representing those shareholders and plans for greater investment in connected healthcare data. CAQH has been in the business for over 25 years, with more than 4.8 million provider data records sourced directly from providers and member data. Source: company announcement.

What DataSpring collects, and what we learned what they do with the data:

DataSpring’s privacy policy, updated September 29, 2026, says it collects the information you’d expect from a credentialing service. That includes your contact details, government ID numbers, demographic details, licenses and credentialing records, and payment information.

The policy also covers what happens when you use DataSpring’s websites. In a section written for California residents, it says DataSpring may “sell” or “share” information such as your browsing activity and approximate location with advertising and analytics companies. You can opt out with the site’s cookie settings or a browser privacy signal.

Our position is that physicians should have clear answers to four questions:

What information is collected, and what purposes can it serve?
Who can access it, including owners, affiliates, and customers?
What safeguards separate administrative data exchange from competitive decision-making?
Can practitioners correct, export, and share their information through lawful alternatives?

These are reasonable expectations for any credentialing platform, including Evercred.

Sources:

Build credentialing around the practitioner

At Evercred, we believe a practitioner’s professional record should be portable, accessible, and under their control. Our credential-wallet approach reflects that commitment. Learn about Evercred’s practitioner wallet.

The standard we advocate is straightforward: collect necessary information, verify it at the source, explain how it will be used, and preserve a clear record of access and changes. Give physicians meaningful choices wherever the law allows them.

Using a credential wallet does not automatically replace a payer’s lawful application process. It can, however, support a different relationship with professional information: one in which the practitioner maintains a reusable record instead of rebuilding it for every organization.

Physicians should not have to choose between participating in healthcare and having a voice in how their professional data is used.

Explore a more practitioner-centered approach to credentialing with Evercred.

This article distinguishes verified legal requirements, reported allegations, and Evercred’s policy views. It is educational commentary, not a determination that a particular payer or platform has violated the law.