NCQA comes up frequently in conversations about health plan quality, payer partnerships, and healthcare contracting, but it is easy to mistake it for another government regulator. It is not. NCQA is an independent nonprofit organization that develops healthcare quality standards, accredits and certifies organizations, recognizes practices and clinicians, and maintains widely used measurement programs such as HEDIS.
For telehealth operators, NCQA sits alongside, but separate from, legal and security requirements such as HIPAA. That distinction matters because a strong telehealth privacy and security program may support the documentation and operational discipline that sophisticated healthcare partners expect. Still, HIPAA compliance does not create NCQA accreditation, and NCQA accreditation does not replace HIPAA compliance.
There is also an important nuance behind the word voluntary. No blanket federal rule requires every health plan or telehealth company to become NCQA accredited. At the same time, NCQA standards align with many state requirements, employers may look for accreditation when evaluating health plans, and federal programs use NCQA in specific ways. In other words, something does not need to be universally required by law to become commercially or operationally important.
What Is NCQA?
NCQA stands for the National Committee for Quality Assurance. It was founded in 1990 as an independent nonprofit focused on improving healthcare quality through measurement, transparency, and accountability. Today, NCQA's work spans accreditation, certification, recognition programs, quality measurement, and research.
That makes NCQA different from a regulator. A government agency can create or enforce legal requirements; NCQA creates evaluation frameworks and independently reviews organizations against the standards of its programs.
Depending on the program, NCQA works with organizations including:
- Health plans
- Primary care practices
- Specialty practices
- Virtual-care organizations
- Provider networks
- Healthcare vendors and service organizations
- Organizations that oversee care delivery
The exact credential matters because “NCQA accredited” is not one universal status. A health plan pursuing Health Plan Accreditation is being evaluated under a different program from a primary care practice pursuing Patient-Centered Medical Home recognition or a virtual-care provider seeking Virtual Care Accreditation.
Accreditation, Certification, and Recognition Are Not the Same Thing
NCQA uses several evaluation models, so operators should focus on the specific program being discussed rather than treating every NCQA designation as interchangeable.
| NCQA Term | Generally Applies To | Example |
|---|
| Accreditation | Organizations and healthcare delivery programs | Health Plan Accreditation |
| Recognition | Practices or clinicians operating under a defined care model | Patient-Centered Medical Home |
| Certification | Specific functions, products, or capabilities | Program-specific certification |
| Measurement | Quality performance and benchmarking | HEDIS |
This distinction becomes useful during payer conversations. If a partner says it is “NCQA accredited,” the next question should be which NCQA program and what scope that accreditation covers.
A credential for one part of an organization does not automatically apply to every vendor, product, provider group, or technology platform connected to it.
What Does NCQA Health Plan Accreditation Cover?
NCQA's Health Plan Accreditation program evaluates managed healthcare organizations against requirements that span several operational and quality areas.
NCQA currently identifies major areas including:
- Quality management and improvement
- Population health management
- Network management
- Utilization management
- Credentialing and recredentialing
- Members' rights and responsibilities
- Member connections
- Medicaid benefits and services, when applicable
NCQA describes Health Plan Accreditation as a framework for quality improvement and measurement, not a simple compliance badge. The program also incorporates clinical performance and member-experience measurement through HEDIS and CAHPS.
For telehealth companies partnering with a health plan, those categories help explain why payer diligence can extend far beyond whether the platform supports video visits. Credentialing, access, care coordination, member experience, data quality, documentation, and operational controls can all become relevant somewhere in the relationship.
What About Physician Practices and PCMH Recognition?
NCQA also evaluates care delivery at the practice level through programs such as Patient-Centered Medical Home, or PCMH, Recognition.
The PCMH model organizes primary care around patients, including coordination, continuity, population management, access, and quality improvement. NCQA says its PCMH program is the country's most widely adopted PCMH evaluation model.
The federal Health Resources and Services Administration also works with NCQA for PCMH recognition within its health-center accreditation initiative. HRSA distinguishes between accreditation organizations and PCMH-recognition organizations and identifies NCQA as one of its contracted PCMH partners.
This is another reason precise terminology matters. A medical practice can have NCQA recognition without being a health plan, and that recognition should not be described as though the practice holds NCQA Health Plan Accreditation.
NCQA Now Has a Program Specifically for Virtual Care
For telehealth operators, one development changes the conversation considerably: NCQA now offers Virtual Care Accreditation.
The program is designed for organizations that deliver or oversee virtual primary and urgent care. NCQA currently provides paths for organizations that directly deliver eligible virtual care and for organizations that oversee virtual-care networks. Eligible organizations can include virtual-only providers, hybrid organizations, health systems, and organizations that oversee virtual services.
Its standards are organized around areas including:
- Quality and patient safety
- Care coordination
- Equitable access
- Patient and clinician experience
- Data sharing and exchange
That means the statement “telehealth companies generally are not NCQA-accredited entities” is now too broad. A software vendor that simply provides technology may not fit the same category as a care-delivery organization, but a virtual-first healthcare organization delivering eligible primary or urgent care may be able to pursue NCQA's Virtual Care Accreditation.
A Quick NCQA Applicability Map
| Organization | NCQA May Be Relevant Through | Key Question |
|---|
| Commercial/Medicare/Medicaid health plan | Health Plan Accreditation | Is the plan eligible and seeking accreditation? |
| Primary care practice | PCMH Recognition | Does the practice operate under the PCMH model? |
| Virtual-first primary care organization | Virtual Care Accreditation | Does it directly deliver eligible virtual care? |
| Health plan overseeing virtual providers | Virtual Care Oversight Accreditation | Does it oversee a virtual-care network? |
| Telehealth software vendor only | Depends on functions/program | Does the company deliver care or only provide technology? |
| Telehealth brand working with payers | Partner requirements may matter | What does the payer require from vendors and delegated entities? |
This is one of the most useful distinctions for a telehealth founder: NCQA relevance depends on what the organization actually does, not simply whether it delivers care online.
Does Law require NCQA?
Not as a universal rule.
No federal law requires every health plan, medical practice, or telehealth company to hold NCQA accreditation. NCQA explains that Health Plan Accreditation can help organizations meet state requirements and employer needs, reflecting that its importance can vary across markets and contracts.
But stopping at “NCQA is voluntary” can also be misleading.
A health plan may encounter NCQA because:
- A purchaser expects accredited plans.
- A state requirement aligns with or incorporates accreditation standards.
- A contract makes a particular credential important.
- A government program uses an NCQA process.
- A payer uses NCQA standards internally when evaluating quality.
- A virtual-care organization wants to demonstrate its quality framework to potential partners.
So the better question isn't simply, “Is NCQA legally mandatory?”
It is:
“Does our market, payer, contract, care model, or government program make NCQA status important to this relationship?”
Why NCQA Matters to Medicare Advantage Plans
Medicare Advantage provides a good example of why the voluntary-versus-required distinction needs nuance.
CMS's Medicare Managed Care Manual describes an MA deeming program in which approved national accreditation organizations can determine, on CMS's behalf, whether a Medicare Advantage organization complies with certain Medicare requirements. NCQA is among the accrediting organizations that have participated in this federal oversight framework.
Deeming does not mean NCQA replaces CMS or that every CMS requirement disappears. It means accreditation can overlap with defined areas of federal oversight, allowing CMS to recognize an approved accrediting organization's review for specific requirements.
An even more direct example involves Medicare Advantage Special Needs Plans. According to CMS's Model of Care requirements, every SNP must have a Model of Care approved by NCQA under the applicable statutory framework.
That is an NCQA process with a specific federal role, although it is distinct from ordinary Health Plan Accreditation.
This distinction is important for telehealth operators serving Medicare populations: NCQA can be voluntary in one context and explicitly embedded in a government program in another.
Where HEDIS Fits
NCQA also oversees HEDIS, the Healthcare Effectiveness Data and Information Set.
HEDIS is not the same thing as NCQA accreditation. It is a standardized healthcare performance-measurement framework used by health plans and other organizations to measure areas such as care effectiveness, access, experience, utilization, and other aspects of healthcare performance.
NCQA reports that more than 236 million people are enrolled in health plans that report quality results using HEDIS, making it one of healthcare's most widely used performance-improvement systems.
The relationship looks roughly like this:
NCQA
→ develops accreditation and recognition programs
→ maintains HEDIS measures
→ evaluates organizations under applicable programs
→ uses quality and experience data in some evaluation frameworks
For a telehealth operator, HEDIS may become relevant when working with payers that need reliable data from their provider or vendor ecosystem. That does not mean every telehealth vendor needs to calculate HEDIS itself; it means data quality and the ability to support payer measurement can become part of enterprise integration discussions.
Why NCQA Matters for Telehealth Payer Relationships
Most telehealth founders will not wake up one morning and decide to pursue Health Plan Accreditation. More often, NCQA enters the conversation because a prospective payer, health plan, employer, or enterprise healthcare organization already operates in an NCQA-influenced environment.
That changes the diligence conversation.
A payer may want to understand:
- How providers are credentialed and monitored
- How patient information is documented
- Whether access and permissions are controlled
- How quality issues are identified and escalated
- How care is coordinated across settings
- Whether operational activities are auditable
- What patient-experience information is available
- How data can support quality measurement
- What happens when a workflow fails
- Which party owns each delegated responsibility
Not every item on this list is an NCQA requirement in every relationship. The point is that organizations operating under formal quality frameworks tend to need evidence, not verbal assurances.
That is why good operational infrastructure matters before accreditation ever becomes the explicit topic.
NCQA and HIPAA: Two Completely Different Questions
NCQA and HIPAA can both appear in a healthcare diligence questionnaire, but they answer different questions.
| HIPAA | NCQA |
|---|
| Federal legal framework | Independent quality organization |
| Focuses heavily on privacy and security of protected health information | Focuses on quality, processes, performance, and program-specific standards |
| Compliance depends on an organization's legal role and activities | Accreditation/recognition depends on the NCQA program pursued |
| Enforced through government authority | Evaluated by NCQA under its programs |
| Not replaced by accreditation | Does not replace HIPAA obligations |
A telehealth company can be subject to HIPAA without holding an NCQA credential. Likewise, an NCQA-accredited organization still has to satisfy the legal requirements that apply to it.
Bask's existing guide to telehealth privacy and HIPAA compliance covers the privacy and security side separately, which is the right way to think about these frameworks. Combining them into one generic concept of “healthcare compliance” makes it harder to understand what each requirement is actually trying to accomplish.
What NCQA Does Not Tell You
An NCQA credential can communicate something meaningful about an organization's performance against a particular program, but it should not be stretched beyond that scope.
NCQA status does not automatically tell you:
- That every vendor connected to the accredited organization is separately NCQA accredited.
- That the organization satisfies every healthcare law or regulation.
- That HIPAA requirements no longer need independent attention.
- That every clinical service offered is within the scope of the credential.
- That a technology vendor inherits its customer's accreditation.
- That strong cybersecurity controls alone satisfy NCQA standards.
- That an organization without NCQA accreditation necessarily delivers poor-quality care.
This is especially relevant in vendor marketing. A telehealth platform working with an NCQA-accredited payer should not imply that the payer's accreditation transfers to the platform.
The same principle applies in reverse: having excellent technical security is valuable, but it should not be marketed as though security controls constitute NCQA accreditation.
What a Telehealth Operator Should Prepare Before a Payer Conversation
Even if your company is not pursuing accreditation, a well-organized operational foundation makes payer diligence easier.
Useful preparation includes:
1. Know Your Organizational Role
Are you a software vendor, a virtual care delivery organization, a provider group, a management-services organization, or some combination?
That answer affects which standards and credentials may apply.
2. Document Provider and Clinical Operations
Be able to explain how providers are onboarded, credentialed where applicable, granted system access, monitored, and connected to patient workflows.
3. Make Security Controls Demonstrable
A payer may want evidence of access control, authentication, logging, encryption, incident response, and other safeguards rather than a statement that a system is simply “secure.”
Bask's security infrastructure includes encryption at rest and in transit, administrative access controls, system monitoring, logging and alerting, and two-factor authentication. These controls do not constitute NCQA accreditation, but they provide a more auditable security foundation for organizations undergoing partner diligence.
4. Understand Your Data
Know what clinical, operational, and patient-experience information your platform captures and what you can exchange with partners.
Supporting quality measurement often depends on reliable data long before anyone starts discussing a specific HEDIS measure.
5. Define Responsibility Clearly
If a payer delegates a function to another organization, both parties need to understand who owns what.
A polished platform cannot compensate for an arrangement where nobody knows who owns credentialing, follow-up, quality monitoring, or escalation.
How Bask Health Supports Compliance-Ready Operations
Bask Health does not claim NCQA accreditation in this article, and using Bask does not automatically give a telehealth brand an NCQA credential.
Bask provides infrastructure that supports a more documented and auditable digital-health operation. Bask's security architecture includes controls such as encryption, administrative access controls, system monitoring, logging, alerting, information governance, and two-factor authentication.
That technical foundation sits alongside clinical and operational infrastructure. Bask Health's plans include capabilities such as a doctor portal, e-prescribing and EMR functionality, patient experiences, pharmacy fulfillment, scheduling on applicable tiers, and API/webhook integration options.
For a telehealth operator preparing for payer or enterprise relationships, those capabilities can make it easier to demonstrate how workflows operate and where information lives. They should still be described accurately: infrastructure can support an accreditation-ready operating environment, but infrastructure is not itself an NCQA credential.
When Should a Telehealth Company Care About NCQA?
A useful decision framework is to ask four questions:
-
Are we delivering care or only providing software?
A virtual-care delivery organization may have different NCQA options from a pure technology vendor.
-
Are we pursuing payer or employer contracts?
Enterprise buyers may introduce quality requirements that never arise in a direct-to-consumer model.
-
Does our partner already operate under NCQA standards?
Their accreditation can shape what they ask from contracted organizations.
-
Are we eligible for an NCQA program ourselves?
With Virtual Care Accreditation now available, some telehealth organizations may have a direct path that did not exist several years ago.
If the answer to several of these questions is yes, NCQA deserves attention earlier rather than later.
Frequently Asked Questions
What does NCQA stand for?
NCQA stands for the National Committee for Quality Assurance. It is an independent nonprofit healthcare quality organization, not a government agency.
Is NCQA accreditation required by law?
No universal federal requirement requires every health plan or telehealth organization to obtain NCQA accreditation. However, state requirements, purchaser expectations, contracts, and particular government programs can make NCQA status or NCQA processes important in specific circumstances.
Does NCQA accredit telehealth companies?
NCQA now offers Virtual Care Accreditation for eligible organizations that deliver or oversee virtual primary and urgent care. Eligibility depends on the organization's actual care-delivery role and the program requirements.
What is the difference between NCQA accreditation and HIPAA compliance?
HIPAA is a federal legal framework governing protected health information and applicable regulated organizations. NCQA is an independent nonprofit organization whose accreditation and recognition programs evaluate healthcare organizations against defined quality standards. One does not replace the other.
What is HEDIS?
HEDIS is the Healthcare Effectiveness Data and Information Set, a widely used set of healthcare performance measures maintained by NCQA. More than 236 million people are enrolled in plans reporting quality results using HEDIS.
Why do health plans care about NCQA?
NCQA accreditation provides an external quality framework covering areas such as quality improvement, population health, network management, utilization management, credentialing, and member experience. Employers, states, and government programs may also use or interact with NCQA standards in different ways.
Is NCQA involved with Medicare Advantage?
Yes. NCQA has a defined role in parts of the Medicare Advantage quality framework. Most notably, CMS states that every Medicare Advantage Special Needs Plan must have an NCQA-approved Model of Care.
Conclusion
NCQA is not another healthcare regulator, and its accreditation should not be treated as a universal legal requirement. But describing it as “just voluntary” misses why health plans, employers, government programs, and healthcare partners take it seriously.
Its influence reaches across health plan accreditation, PCMH recognition, HEDIS quality measurement, and increasingly virtual care itself. For telehealth operators, the practical question, then, is not whether every business needs an NCQA seal. It is whether the markets and partners the business wants to serve operate within an NCQA-influenced quality framework.
Strong documentation, security controls, clearly defined workflows, and measurable operations do not substitute for accreditation. Still, they put a telehealth organization in a better position when payer diligence becomes more demanding. Bask Health's plans provide the clinical, operational, and security infrastructure brands can build on as those relationships become more sophisticated.
References
- National Committee for Quality Assurance. (n.d.). About NCQA. https://www.ncqa.org/about-ncqa/
- National Committee for Quality Assurance. (n.d.). Health Plan Accreditation. https://www.ncqa.org/programs/health-plans/health-plan-accreditation-hpa/
- National Committee for Quality Assurance. (n.d.). Virtual Care Accreditation. https://www.ncqa.org/programs/health-care-providers-practices/virtual-primary-care-and-urgent-care-accreditation/
- National Committee for Quality Assurance. (n.d.). HEDIS and Performance Measurement. https://www.ncqa.org/hedis/
- Centers for Medicare & Medicaid Services. (n.d.). Model of Care (MOC). https://www.cms.gov/medicare/enrollment-renewal/special-needs-plans/model-care
