When you delegate: what URAC expects you to oversee
Delegating a function to a contractor does not move your accountability under URAC. In my practice, how you oversee it depends on whether the contractor holds URAC accreditation or certification for the work.
You can delegate under URAC, and you stay accountable for what you delegate. In my practice, how much oversight that takes depends on one fact: whether the contractor holds URAC accreditation or certification for the work it does for you. If it does, your job is an agreement and proof of its status, plus the yearly check that the accreditation is still in place. If it does not, you do the reviewer's work on that contractor yourself, every year, and you keep the evidence.
This article covers URAC only; NCQA's delegation rules are outside it. It addresses Health Network Accreditation v8.1 (June 2022) and Pharmacy Benefit Management Accreditation v4.0 (October 2025); other programs may differ. Where I cite URAC's public credentialing webinar, it addresses Health Plan v8.1, Marketplace Health Plan v8.1 and Medicaid Health Plan v1.1, so check your own program's standards. URAC's standards are URAC's copyrighted work; this article describes them in my words and does not reproduce them.
What counts as delegation, and what stays with you
Under both Health Network v8.1 and PBM v4.0 the standard is OPIN 1-2, Delegation Management, in the Operations and Infrastructure focus area. Handing work to a contractor leaves the responsibility for it with you, and the standard sets out what you must be able to show. In my practice the center of it is a contract with each delegate and a regular review of how the delegate is doing against the standards its work touches.
URAC's product pages list these versions as the ones it sells: https://www.urac.org/product/health-network-accreditation-standards/ and https://www.urac.org/product/pharmacy-benefit-management-accreditation-standards/ (pages opened October 10, 2026).
PBM v4.0 treats delegation differently in places; read your program's standards before you design the arrangement.
URAC's own credentialing webinar sorts delegation by whether the contractor is URAC-accredited, which in my reading makes accreditation an incentive and not a mandate.
What do you owe when the contractor is accredited for the function?
Less. If the contractor already holds URAC accreditation or certification covering the work, you show that instead of testing the contractor against the standards yourself; that is how URAC's public credentialing webinar draws the line. For desktop review you send your written delegation plan and an inventory of what you have handed off. For an accredited contractor the plan describes how you verify that its accreditation continues. At validation review, the reviewer looks at the agreement itself and at the contractor's accreditation proof.
In my practice the agreement requires the contractor to comply with the URAC standards for the delegated function, and you map those standards to what the contractor does for you, so you can say which standard covers which activity. Then you verify its status in URAC's online directory at https://www.urac.org/directory/accreditations/ (page opened October 10, 2026). The results show each organization's name, accreditation status, expiration date and program, so the check is whether the program shown covers the work you delegated. You make that comparison against the standards.
In my practice the yearly review of an accredited contractor includes confirming that the accreditation is still in place. I recommend checking a couple of times a year, which is my recommendation and not a URAC requirement. Record each check with its date and what the directory showed.
What do you owe when the contractor is not accredited for the function?
In my practice you carry the oversight yourself, under a written plan. You submit the plan and a separate list of delegated functions. Your annual results are the proof that you are watching the contractor. Who does each review and when it falls due are my additions and not URAC requirements: put an owner's name and a calendar date on each one.
At validation review, as URAC's public credentialing webinar shows it, the proof is the agreement plus the paper trail from your yearly review. In my reading, if that record is missing the reviewer has nothing to credit for the annual oversight, and that is a finding against you. For a contractor with no URAC recognition for the work, I put it this way:
[...] you essentially step into the shoes of URAC. You need to look at the standards that are implicated by what you're delegating to that [...] contractor, and then look at how URAC validates that applicant is complying with those. And then you need to do that. [...]
Take a hypothetical health network that sends its provider directory updates to an outside vendor with no URAC recognition. The details are invented and nothing here describes a client. In my practice your annual review of the vendor asks for the evidence a reviewer would ask for and reads it against the directory standard. Are updates timely against the timeframe your own policy defines, and are member reports answered? You write up what you found and the date.
That is more work than checking a directory, and it is the cost of choosing a contractor without URAC recognition for the function. For that function you are doing the reviewer's job once a year. It starts with the list of what you have delegated: a delegate you do not know about is a delegate you are not overseeing, and URAC's public credentialing webinar lists that inventory as a desktop review item.
What does delegating credentialing add?
Credentialing carries its own requirements on top of OPIN 1-2. In Health Network v8.1 they sit in CR 3-8, Credentialing Delegation Oversight. URAC's public credentialing webinar for Health Plan v8.1, Marketplace Health Plan v8.1 and Medicaid Health Plan v1.1, dated September 30, 2022, shows the same structure for those programs: https://www.urac.org/wp-content/uploads/2022/10/Credentialing-Slides.pdf (page opened October 10, 2026).
Delegating the work does not delegate the decision. Under CR 2-1 (final authority), as URAC's public credentialing webinar describes it, the committee has the last word on applicants, including those whose files a delegate built. In my practice the delegate takes on the legwork, such as application intake and primary source verification, and the decision stays with the committee. URAC's public credentialing webinar lists the following under CR 3-8. The first two apply to any delegate; the third applies when the delegate is not URAC-accredited for credentialing:
- You need a checkpoint ahead of your directory: before a delegate-credentialed practitioner goes live in it, you check that your organization has approved that person at all and has not dropped them from the network before.
- Once a year the committee gets a report on how you oversaw the delegate's credentialing work.
- A delegate without URAC accreditation for credentialing gets a file audit from you each year. Per URAC's public credentialing webinar, plan on 15 files at least, 7 first-time credentialing and 8 recredentialing.
Two cautions from the oversight side are mine and not URAC's. Keep a majority and the chair on the health plan's side of the committee, and have any delegate-affiliated member step out of votes on files the delegate's own operation credentialed. My reason is that you are standing in URAC's shoes for that contractor, so the committee has to be able to look at its work at arm's length.
What should you do, and by when?
This week, list every outside party that performs part of a function covered by your accreditation. Ask each department head, not only the people who hold the contracts. For each one, find the date you last checked its URAC status; if there is no record, make one now. For each party without URAC recognition, name an owner and set the date of the first annual review.
What do people ask about delegation under URAC?
How many files does a delegated credentialing audit cover?
At least 15 a year, seven initial and eight recredentialing, when the delegate is not URAC-accredited for credentialing. URAC's public credentialing webinar gives these figures for Health Plan v8.1, Marketplace Health Plan v8.1 and Medicaid Health Plan v1.1; check your own program's standards.
What if a health plan asks me to take on delegated credentialing?
In my practice the health plan's own audit tool is the working specification, because it is the plan's document and not URAC's. I would ask to see it before building anything.