How a Regional Health Plan Achieved URAC Health Website Accreditation in 11 Months

Last updated: April 2026

A regional health plan operating a member-facing wellness portal and disease management content library had published health content for over a decade without a formal editorial governance framework. When a large employer purchaser began requiring independently verified health content quality standards as a condition of group health plan contracting, the plan had 12 months to close the gap. IHS guided the engagement from initial gap assessment through URAC Accreditation Committee approval in 11 months.

Client details are anonymized per IHS confidentiality policy. The situation, gaps, process, and outcomes are representative of engagements IHS conducts in this program area.

The Situation

The plan served approximately 180,000 commercial members across a three-state region. Its member portal included a health library of over 400 articles, a chronic disease management section covering diabetes, cardiovascular disease, and respiratory conditions, and a wellness incentive platform with embedded health content. The portal had been built incrementally over nine years through a combination of licensed third-party content and internally authored material.

The plan held URAC Health Plan Accreditation — covering clinical operations, utilization management, and member services. It had never evaluated the member-facing content infrastructure against an external standard. The internal assumption had been that URAC Health Plan Accreditation addressed all material quality requirements. It did not: Health Plan Accreditation evaluates clinical operations; it does not evaluate health content editorial governance, advertising separation, linking policy, or contributor conflict of interest disclosure.

The Triggering Event

A Fortune 500 employer with 22,000 covered lives issued an RFP requiring health plan finalists to demonstrate independently verified health content quality standards by contract year. The employer's procurement team cited the absence of HONcode (discontinued in 2023) as a market gap and specified URAC Health Website Accreditation as the acceptable credential. The plan's account management team had 12 months before the contract decision.

What the Plan Did Not Have

The initial gap assessment — conducted by IHS in the first three weeks of the engagement — identified six categories of deficiency against URAC Health Website Accreditation standards:

  1. No formal editorial policy — content had been published for nine years without a documented policy governing author or reviewer attribution, evidence requirements, or false-claims prohibition language. The plan's licensed content vendor had its own editorial processes, but the plan had never documented how it evaluated or adopted that content.
  2. No user-accessible conflict of interest policy — the plan had a standard employee conflict of interest policy in its HR handbook, but no mechanism for collecting or disclosing financial relationships at the content contributor level, and no version of the policy accessible to portal users.
  3. No quality oversight committee for linking decisions — the wellness portal contained approximately 85 external links embedded in health articles. No written policy governed how links were selected, and no committee had reviewed them. Links had been added by content staff based on individual judgment over nine years.
  4. Advertising and editorial content insufficiently separated — the portal carried banner advertising from a pharmacy benefits vendor and a medical device company. The visual design did not clearly distinguish these placements from editorial content. A user reading a diabetes management article could not readily identify which adjacent content was editorial and which was commercial.
  5. Privacy consent mechanisms inconsistently applied — the plan had a privacy notice governing member data in its health plan operations. The member portal collected additional health-specific data through wellness assessments and disease management check-ins. The portal-specific data collection had not been mapped to the health plan privacy notice, and no distinct consent mechanism applied to portal health data collection.
  6. Security documentation not mapped to URAC requirements — the plan's IT department maintained technical security documentation meeting HIPAA Security Rule requirements. No documentation had been prepared mapping those technical controls to URAC's specific procedural security standard language.

None of the six gaps required a technology rebuild. Each represented a policy and governance deficiency — the operational infrastructure existed; it had never been formally governed or documented against an external standard.

The IHS Approach

IHS structured the engagement in four phases aligned to the 11-month timeline.

Phase 1: Gap Assessment and Remediation Roadmap (Weeks 1–3)

IHS reviewed the member portal against all six URAC Health Website Accreditation standard domains — content quality, editorial and advertising policy, conflict of interest, consumer personal information, website privacy and security, and linking governance. The review covered the full content library, all external links, the advertising placement architecture, the privacy notice structure, and the existing IT security documentation.

The output was a prioritized remediation roadmap identifying each gap, the specific URAC standard element it implicated, the policy or operational change required to close it, and the sequencing logic — which changes had to precede others, and which could run in parallel. The roadmap gave the plan's internal team a clear picture of what the engagement required before any policy development began.

Phase 2: Policy Development (Months 1–5)

IHS drafted six policy documents, each mapped to the specific URAC standard elements it was designed to satisfy:

  • Member Portal Editorial Policy — governing author and reviewer identification, evidence requirements, false-claims prohibition, and content review cadence for both internally authored and licensed content
  • Advertising and Sponsored Content Policy — defining visual and contextual separation requirements between paid placements and editorial content, with specific design requirements the portal team implemented in the CMS
  • Contributor Conflict of Interest Disclosure Policy — governing collection and publication of financial relationship disclosures for all content contributors, with a user-accessible disclosure page and a process for updating disclosures when relationships changed
  • Member Portal Privacy Notice — a portal-specific addendum to the existing health plan privacy notice, covering the distinct data collection points of the wellness portal and disease management tools, with consent mechanisms mapped to each collection point
  • Security Incident Response Procedure for Member Portal — mapping the plan's existing IT security controls to URAC's procedural requirements and documenting the specific response sequence for portal-specific security events
  • External Linking Policy and Quality Oversight Committee Charter — establishing the committee composition, meeting cadence, review criteria for new and existing links, and documentation requirements for linking decisions

Each policy was drafted to satisfy URAC's specific standard language — not to be generic compliance documentation. The plan's internal legal, compliance, and content teams reviewed each draft and adapted them to organizational terminology and governance structures.

Phase 3: Operational Implementation and Evidence Generation (Months 4–9)

Policies do not satisfy URAC standards on paper alone. The plan had to demonstrate operational implementation — evidence that the policies were actively governing the content operation.

Key implementation work during this phase:

  • Content library audit — IHS and the plan's content team reviewed the full 400-article library against the new editorial policy. Articles without author/reviewer attribution were flagged; 67 articles required attribution updates, and 12 legacy articles contained implied therapeutic claims that required revision or removal before submission.
  • Advertising separation redesign — the portal design team implemented visual separation changes based on the new policy: labeled advertising zones, visual boundaries distinguishing commercial placements from editorial content, and a "Sponsored" label applied to all vendor-paid placements. IHS reviewed the implemented design against URAC standard language before the plan submitted.
  • Quality oversight committee establishment — the plan convened a five-member quality oversight committee (medical director, compliance officer, content lead, privacy officer, and an independent clinical reviewer) with a quarterly meeting cadence. IHS provided the committee charter, meeting documentation templates, and the first-cycle link review framework. The committee conducted its first formal link review in month 6, reviewing all 85 existing external links against the new policy criteria. Fourteen links were removed; six were updated to current URLs.
  • Privacy consent implementation — the portal development team implemented distinct consent mechanisms at each health data collection point identified in the gap assessment — wellness assessments, disease management check-ins, and personal health record uploads. IHS reviewed the implemented consent flows against the portal privacy notice.
  • Conflict of interest disclosure collection — the plan's content team contacted all identified content contributors — including the licensed content vendor, three independent clinical reviewers, and two internal physician authors — to collect financial relationship disclosures. A disclosure page was added to the portal listing all contributors and their disclosed relationships.

Phase 4: Application Submission and URAC Review Support (Months 9–11)

IHS compiled the submission package — all six policy documents, the content library attestation, the quality oversight committee documentation, the advertising separation implementation evidence, and the privacy and security procedure documentation — in the format URAC's review process requires.

The plan obtained URAC standards through the URAC store, completed the required consultation with the URAC team, and executed the application agreement. IHS coordinated the submission and managed communication with URAC's program staff throughout the review period.

URAC's clinical reviewer (a nurse with health content expertise) reviewed the editorial policy, content library attestation, and conflict of interest documentation. One request for additional information was issued — the reviewer asked for clarification on how the editorial policy applied to licensed third-party content versus internally authored content. IHS drafted the response, clarifying the policy's vendor content adoption process and the editorial review the plan conducted before publishing licensed material. No further requests were issued.

The Accreditation Committee approved the plan's Health Website Accreditation in month 11 — one month ahead of the employer contract decision date.

Outcomes

Immediate: Employer Contract Secured

The plan submitted its URAC Health Website Accreditation credential as part of the employer RFP response with four weeks to spare. The employer's procurement team confirmed the credential satisfied their health content quality requirement. The plan retained the group health contract covering 22,000 covered lives.

Operational: Content Governance Infrastructure Established

Beyond the accreditation credential, the engagement established a content governance infrastructure the plan had not previously had:

  • An editorial policy that applies consistently to both internally authored and licensed content — reducing the plan's liability exposure for content accuracy claims
  • A functioning quality oversight committee with documented meeting records and link review decisions — an operational governance body that did not exist before the engagement
  • A contributor conflict of interest disclosure process — for the first time, the plan had documented visibility into the financial relationships of everyone contributing to its member-facing health content
  • A portal-specific privacy framework — closing a documented gap between the plan's HIPAA compliance posture and its member portal data collection practices

Strategic: Multi-Program URAC Posture Strengthened

The plan already held URAC Health Plan Accreditation. Adding Health Website Accreditation completed a comprehensive URAC quality posture covering both clinical operations and the member-facing content infrastructure. The plan's compliance team noted that several privacy and governance documentation elements developed for Health Website Accreditation directly supported their upcoming URAC Health Plan Accreditation renewal.

Timeline Summary

  • Month 1: Gap assessment complete; remediation roadmap delivered
  • Months 1–5: Six policy documents drafted, reviewed, and adopted
  • Months 4–9: Content library audit, advertising separation redesign, committee establishment, privacy consent implementation, conflict of interest disclosure collection
  • Month 9: Application submitted
  • Month 10: URAC clinical review; one request for additional information issued and responded to
  • Month 11: Accreditation Committee approval

What This Engagement Illustrates

The Gap Between HIPAA Compliance and URAC Health Website Standards

The plan had a mature HIPAA compliance program. It had never failed a HIPAA audit. None of that was relevant to the six gaps URAC Health Website Accreditation identified. HIPAA governs the use and disclosure of protected health information by covered entities. URAC Health Website Accreditation governs how consumer-facing health content is produced, reviewed, published, and protected. The programs address different organizational layers. Compliance with one does not imply compliance with the other.

Why URAC Health Plan Accreditation Does Not Cover This

The plan's assumption that URAC Health Plan Accreditation addressed all material quality requirements was the central misunderstanding that created the risk. Health Plan Accreditation evaluates clinical operations — utilization management, care coordination, member services, network adequacy. It does not evaluate health content editorial governance, advertising separation, linking policy oversight, or contributor conflict of interest disclosure. These are evaluated only under Health Website Accreditation. Health plans operating member-facing content platforms without Health Website Accreditation have an unaddressed standards gap regardless of their Health Plan Accreditation status.

Policy Gaps Are Faster to Close Than Technology Gaps

None of the six deficiencies identified in the gap assessment required a technology rebuild. The portal's infrastructure was adequate. The gaps were in governance documentation, policy formalization, and operational processes. This is the typical pattern in URAC Health Website Accreditation preparation: the content infrastructure exists; the governance framework around it does not. Policy-based gaps close faster and at lower cost than technology gaps — if the engagement is structured correctly from the start.

Submission Without Preparation Fails

The URAC review process involves a clinically trained reviewer evaluating whether submitted policies reflect genuine operational practice — not just documentation that was written to satisfy a checklist. Organizations that submit without operational implementation generate reviewer requests for additional information, documentation gaps that delay committee approval, or findings that require resubmission. The preparation phase — implementing policies operationally and generating the evidence reviewers examine — is where the accreditation is actually earned.

Facing a Similar Situation?

If your organization publishes consumer or member health content and needs to establish — or verify — that your content governance meets URAC Health Website Accreditation standards, IHS can conduct an initial gap assessment and give you a clear picture of what the engagement requires.

Schedule a Free Discovery Session

Related Resources