1.A Question Your Firm Should Be Able to Answer Instantly

Pick one plan client. What has your firm earned from that relationship so far this year?

Not just the commission. The overrides. The bonus tied to book growth. The amount a carrier paid you in connection with that client. The conference the carrier covered. Add it all together, as of today.

At most firms this takes somewhere between a few hours and a few days — because commissions live in one system, carrier compensation arrives on a different schedule in a different format, and anything non-cash sits in expense records or in nobody’s records at all. None of these systems was built to keep a running total per client relationship.

That is a manageable annoyance right up until the moment the number has to be reported.

2.Why the Number Is Now Required

Since the Consolidated Appropriations Act, 2021, a firm providing brokerage or consulting services to an employer’s group health plan has to tell that client, in writing, what it expects to be paid — including money that comes from third parties such as carriers rather than from the client directly. The requirement kicks in at $1,000 per plan relationship, which in practice means nearly every client. The disclosure has to be made before the arrangement is entered into, renewed, or extended.

The consequence is worth stating plainly, because it is easy to miss in the legal language. Getting the disclosure right is what makes your fee arrangement permissible in the first place. If the disclosure is late, incomplete, or has gone stale since it was issued, the arrangement no longer qualifies — and the exposure runs to both your firm and the client who engaged you. Explaining that to a plan sponsor is not a conversation any firm wants to have at renewal.

This is also getting broader rather than narrower. The Consolidated Appropriations Act, 2026, signed on February 3, 2026, confirmed that pharmacy benefit managers fall under the same disclosure standard — closing an argument some had relied on. That confirmation applies to contracts entered into, extended, or renewed after that date, while the Act’s wider rebate and reporting provisions phase in for plan years beginning on or after August 3, 2028.

ERISA §408(b)(2)(B); Consolidated Appropriations Act, 2021; Consolidated Appropriations Act, 2026, Division J, Title VII. The Department of Labor also published a proposed rule on pharmacy benefit manager fee disclosure on January 30, 2026, with the comment period later extended into April 2026. This paper is informational and is not legal advice.

3.What the Reconstruction Actually Costs

We would rather you run this with your own numbers than accept ours, so here is the arithmetic in the open.

Take the number of plan clients your firm serves. Multiply by the hours it takes to assemble a defensible compensation total for one client — pulling commissions, matching carrier statements, chasing down anything non-cash, and having someone senior confirm it is complete. Multiply by your loaded hourly cost for the people who actually do that work.

A firm with 300 plan clients, spending two hours per client per year on reconstruction, at a $75 loaded hourly cost, is spending roughly $45,000 a year to produce a number its own systems already contain.

Substitute your own figures. The point is not the total — it is that the work is recurring, it scales with the size of your book, it produces nothing a client will pay more for, and it happens at renewal season when the same people are needed elsewhere.

And it is not the whole cost. There is the risk that the reconstruction is wrong, or that a threshold was crossed months before anyone noticed. There is the disclosure issued in good faith in January that quietly went stale by June. Neither shows up as a line item until it becomes a problem.

4.Two Ways to Run It

5.What the Firm Gets Back

6.Why You Can Test This Without Anyone’s Permission

This is the part that usually surprises people. Nothing here requires a carrier to participate, a client to agree, or an industry standard to exist. The obligation is your firm’s own. The data is your firm’s own. The systems are already in your building.

A first deployment of the Trust Layer Protocol can run entirely inside your environment, where your firm is its own source of truth. Start with one line of business, or one segment of the book. Nothing has to be replaced — the protocol reads the systems you already run and keeps the running total current against the threshold.

What testing it involves is mostly scoping rather than building. You pick a segment of the book. You identify which systems hold commission records, carrier compensation, and non-cash items — usually three or four, all of which you already run. The protocol reads from them and keeps the running total current against the threshold. Nothing is replaced, nothing is migrated, and no data leaves your environment. The work is in agreeing what counts toward the total and where each piece lives, which is the same work a reconstruction exercise does once a year — done once, deliberately, instead of repeatedly under deadline.

To be straight about where this stands: the architecture is proven and the first institutional deployment is the next milestone. If your firm is weighing this, you would be early — and we would rather say that plainly than imply otherwise.

It is also worth saying that this pattern is not unique to benefits. An investment adviser tracking client gifts against FINRA and SEC limits, a contractor tracking hospitality against federal gift rules, a bank tracking client entertainment against internal caps — all the same shape. A total that builds continuously, checked only occasionally. Only the threshold changes.

7.Questions Worth Sitting With

This is not a pitch for a rollout. If any of it sounds familiar, these are the questions we would genuinely like to explore with you.

1. If a client called this afternoon and asked what your firm has earned from their relationship this year, how long would it take to give them a number you would stand behind?
2. How many staff hours does your firm spend each year assembling compensation totals that its own systems already contain?
3. When a carrier pays your firm in connection with a client, what connects that payment to the running total for that specific relationship?
4. How would you know today if a disclosure issued six months ago is no longer accurate?
5. What else in the firm works this way — a total that builds continuously, but gets checked only when someone asks?

1.The Burden, As It Stands

A card is shown, not verified. A photo ID and an insurance card get a visual check. Neither one proves, in any technical sense, that the card belongs to the person holding it.

Coverage is checked once, then assumed. A clinic checks a patient’s insurance at check-in and treats that answer as good for the whole visit — even though coverage can change mid-cycle (a lost job, a lapsed payment, a plan swap) without the clinic ever finding out.

Doing it right costs more, so it’s often skipped. A fully manual coverage check costs a provider about $7.97. A fully electronic one costs about $2.18. That gap pushes busy practices toward whatever is cheapest — not necessarily whatever is most current.

2.Where the System Breaks

Member ID fraud isn’t one problem. It’s a handful of different ways the same weak link gets exploited.

3.Regulatory Fault Lines

No single rule governs this. At least six different regulatory efforts each touch a piece of it, and each one solves its own narrow slice — which is exactly why the gaps between them add up.

The pattern: every rule answers its own question well. None of them, together or apart, continuously answers the one question that actually matters at check-in — is this specific person, right now, actually covered for what they’re about to receive?

4.The Structural Problem

Every rule above solves a version of the same underlying gap we found in physician credentialing: systems built to answer “was this true the last time we checked?” instead of “is this true right now?” A patient’s identity and coverage decide whether they get care, what it costs, and who pays for it — yet both are usually confirmed with nothing stronger than a glance and a database lookup that’s already a little stale.

Most eligibility systems in healthcare answer a point-in-time question — was this person covered when we last checked? — instead of a continuous one: is this specific person, right now, actually covered for what they’re about to receive?

Trust Layer Advisors advises organizations on how emerging verification infrastructure — including patent-pending architecture filed in provisional form beginning February 2026 — is being designed to close this gap: continuously confirming identity and coverage at the moment of care, instead of checking once and assuming. This paper describes a category of infrastructure that member verification will need regardless of which vendor or standard ultimately carries it — not a specific product.

5.What’s Emerging

Real ID verification infrastructure already exists — and it’s being built now. California’s DMV has issued more than four million digital driver’s licenses that use the W3C Verifiable Credential standard — the same open, cryptographic credential format referenced elsewhere in this paper series — alongside the ISO mobile ID standard. This isn’t a future concept. It’s live, government-issued infrastructure that proves a person is who they say they are, checked with a phone instead of a glance.

But identity and coverage are two different problems, solved by two different parties. A digital driver’s license proves who someone is. It says nothing about whether they’re covered by a specific health plan today. That second question can only be answered by the insurer — which means the real fix pairs a trustworthy identity credential (like California’s) with the insurer’s own coverage records as the source of truth, checked live, not batch-updated overnight.

This is additive to the identity verification companies already in the market, not a replacement for them. A number of established providers already do the work of confirming who someone is — through document checks, biometric matching, government-record lookups, and similar methods. That work is valuable and it isn’t going away. What’s largely missing is the second half: a live, continuous confirmation of coverage that connects to that identity check at the actual moment care is delivered, not just at sign-up. The opportunity is to connect those two pieces, not to rebuild the first one.

Real-time coverage checks are becoming the expectation, not the exception. Regulatory pressure and competition are both pushing payers toward faster, live eligibility responses.

Proof travels; the underlying data doesn’t. A clinic can confirm someone is covered without ever taking custody of that person’s full policy or claims history — better for both the clinic’s data risk and the patient’s privacy.

6.The Cost of Finding Out Too Late

That’s just what victims pay directly. The same study found 31% of victims lost their health insurance entirely because of the fraud, and 35% had their own benefits used up by someone else’s fraudulent claims — meaning the honest patient’s real coverage becomes collateral damage.

The industry has already measured what closing gaps like this is worth at scale.

National Health Care Anti-Fraud Association (fraud share of spending); CMS National Health Expenditure Accounts, 2024 (total spending figure — the dollar range is our own calculation applying NHCAA’s percentage to CMS’s total, and covers all healthcare fraud, not member ID fraud specifically). CAQH, 2023 CAQH Index (per-transaction verification costs).

Continuous Counterparty Verification™ applies that same shift to a patient’s identity and coverage directly — confirming both before care is given, not after a claim is denied or a record is already contaminated.

7.Questions Worth Sitting With

This isn’t a pitch for a rollout. If any of this sounds familiar, these are the questions we’d genuinely like to explore with revenue cycle, compliance, and payer-relations leaders.

1. Beyond a glance at a card, how does your front desk actually confirm the person in front of them is who they say they are?
2. How current is the coverage data your system checks — real time, once a day, or somewhere in between?
3. If a patient’s coverage ended yesterday, would you find out at check-in, or at claim denial?
4. How do you tell the difference between a family member legitimately using someone else’s coverage and outright fraud?
5. When a medical record gets mixed up with someone else’s care, what’s your process for the real patient to get it corrected?

1.The Burden, As It Stands

Credentialing departments are not inefficient; they are managing a fundamentally manual process at institutional scale. Three costs recur across nearly every institution, regardless of size or specialty mix.

Time to privilege. Primary source verification, committee review, and board approval commonly runs sixty to one hundred twenty days. Locum and visiting faculty appointments frequently wait longer, delaying both care and revenue.

Repeated re-verification. The same medical degree, board certification, and state license are re-confirmed independently every time a physician joins a new facility, network, or payer panel.

Compliance exposure. A documentation gap or a missed re-verification window creates regulatory and liability exposure that is typically discovered in an audit — after the fact, rather than before.

2.Regulatory Fault Lines

Credentialing is not governed by a single rulebook. At minimum, seven distinct regulatory frameworks each impose their own verification obligation, and in practice, institutions satisfy each one through a separate manual workflow — which is exactly where the redundancy, the lag, and the audit risk accumulate.

3.The Structural Problem

Every framework above is, in its own language, asking a version of the same question: is this person currently authorized to act? Most credentialing infrastructure was built to answer a related but different question — was this person verified as of the last time someone checked? That gap between verified once and authorized right now is where compliance exposure actually lives, and it is structural rather than administrative. No amount of additional staffing closes it, because the underlying architecture re-answers the same question independently, from scratch, every time.

Most compliance tooling in healthcare evaluates whether a specific transaction looks compliant. Far less infrastructure exists to continuously answer a prior question: is the actor behind that transaction currently authorized to be doing it at all?

Trust Layer Advisors advises organizations on how emerging verification infrastructure — including patent-pending architecture filed in provisional form beginning February 2026 — is being designed to close this gap: continuous, cryptographic verification of an actor’s authorization status at the point of execution, rather than periodic re-confirmation after the fact. This paper describes a category of infrastructure that credentialing, and healthcare compliance more broadly, will need regardless of which vendor or standard ultimately carries it — not a specific product.

4.What’s Emerging

The direction of travel is already visible in adjacent industries and standards efforts.

Verifiable credentials as a standard, not a vendor feature. W3C Verifiable Credentials and decentralized identifiers are moving from academic standard to production infrastructure across government identity programs, giving credentialing bodies a genuine path to issue machine-verifiable, tamper-evident proofs rather than PDFs.

Continuous monitoring as the compliance baseline. Financial services regulation is already moving toward continuous, point-of-execution verification rather than periodic review — a pattern healthcare credentialing is a natural, high-stakes candidate to follow.

Sourcing from the issuer. The more durable model treats medical boards, the NPDB, and the OIG as the authoritative source of truth to verify against directly, rather than asking every institution to re-collect and re-store the same underlying documentation.

Proof travels; the data doesn’t. Architectures built around cryptographic proof, rather than data replication, let an institution confirm a credential is currently valid without ever taking custody of the sanction history or license file itself — a privacy property and a liability property at the same time.

5.The Cost of Finding Out Too Late

That is the revenue a credentialing gap puts at risk every day a physician is unbillable. And the gap is not shrinking: in a 2021 MGMA Stat poll, 54% of medical practices reported credentialing-related claim denials on the rise that year — against 41% flat and only 5% improving. The problem is not that these gaps go undetected. They are found constantly. They are simply found after the claim has already gone out, when the only options left are appeal, write-off, or repayment.

The industry has already measured what that shift is worth at scale — not for credentialing specifically, but for the broader category of manual, after-the-fact administrative verification.

CAQH, 2025 CAQH Index. These figures span prior authorization, eligibility, and claims transactions broadly — not credentialing specifically. They are included because they are the industry’s own measurement of what moving verification from after-the-fact to point-of-execution is worth, at scale.

Continuous Counterparty Verification™ applies that same shift to the credentialing question directly — confirming a provider’s authorization status at the moment a claim is submitted, not months later when an audit finds what already happened.

6.Questions Worth Sitting With

This is not a proposal for a rollout. If any of the fault lines above are familiar, these are the questions we would genuinely like to explore with credentialing, compliance, and CIO or CISO leaders.

1. Where in your credentialing process does the same fact — license status, board certification, exclusion status — get re-verified by more than one team or system?
2. How much of your OIG and NPDB screening today is continuous versus periodic, and what is the average lag between a status change and your system reflecting it?
3. When CMS, the Joint Commission, or a payer asks for credentialing audit evidence, how much of that evidence is generated automatically versus assembled by hand?
4. If a physician’s status changed today — a lapsed license, a new exclusion — how would your organization find out, and how fast?
5. Today, would a lapsed credential surface at claim submission — or at audit?