PSV-PulseNY
Book a 20-min demo
Built for 2026 NCQA Credentialing Standards

Forensic PSV for NY physicians.
Under a minute per provider.

A self-hosted or managed container that performs Primary Source Verification against NYSED, NPPES, and the NY Physician Profile — and hands your NCQA auditor a timestamped PDF with a tamper-evident audit log. Your provider data never leaves your network.

Book a 20-min demoSee how it works
per verification
<60s
primary sources
2
audit chain
SHA-256
Verification Packet
PSV_NY
License #234567
StatusRegistered✓
NPPESActive (1386852341)✓
Legal ActionsClean✓
Evidence3 screenshots, SHA-256 chained
verify.complete outcome=Pass
sha256: fe961a05…7330a33c4
prev_hash: a34a4651…f10b8bff

Built for credentialing, compliance, and RCM teams at

NY-licensed telehealth startups
Credentialing outsourcing firms
Virtual-first specialty practices
Revenue-cycle management shops
The problem

Manual PSV doesn't scale.
And screenshots in a shared drive aren't an audit trail.

Your clerks are copy-pasting license numbers from three websites

NYSED for the license. NPPES for the NPI. NY Physician Profile for discipline. For every provider, every renewal, every new hire. It's 20 minutes of humans doing the same thing a script could do in 45 seconds.

Your NCQA reviewer asks for forensic evidence

Dated screenshots, time-stamped, from primary sources, stored immutably. Most teams stash PNGs in a Google Drive folder and hope the reviewer doesn't notice that the folder's modified-date is last Tuesday.

SaaS credentialing tools want your data

The big incumbents charge per-provider per-month and require your provider roster to live in their cloud. For many compliance teams that's a non-starter — or an annual BAA review they'd rather not do.

How it works

One API call. Three primary sources. One forensic packet.

Integrate with your existing credentialing workflow in an afternoon. POST a license number and last name; receive a JSON decision plus a PDF with timestamped screenshots.

  1. 01

    Submit

    Call POST /verify with license_number and last_name. Authenticated via X-API-KEY. Schema rejects any unknown field so PHI can't enter the pipeline by accident.
  2. 02

    Verify

    Headless Chromium visits NYSED and NY Physician Profile; NPPES is queried via its public API. Full-page screenshots, deterministic parsing, CAPTCHA and maintenance detection, license-to-NPI cross-reference.
  3. 03

    Decide + preserve

    Get back a structured outcome (Pass / Human Review Required / Fail), a forensic PDF with every screenshot, and a SHA-256 chained audit log entry proving exactly what was retrieved, when.
The audit trail

Tamper-evident by design.

Every verification step appends a SHA-256-chained JSON line to an append-only log. Every screenshot carries its own hash. Every generated PDF is hashed into the chain at the moment of creation.

If a screenshot is modified, a PDF is edited, or a past audit record is altered on disk, GET /audit/verify returns chain_ok: false. That's the forensic claim your auditor asks for, backed by math and not policy.

  • Append-only file; application has no seek/truncate path
  • Hash chain anchored at a fixed genesis hash
  • PDFs and screenshots hashed at creation, written into the chain
  • Designed to mount on WORM storage (S3 Object Lock, immutable FS)
// /logs/audit.log (excerpt)
nppes.query.ok npi=1386852341 active=true
nysed_vue.scrape.ok status=Registered
nydoc.scrape.ok flag=Clean npi_match=true
verify.complete pdf_sha256=fe961a05…7330a33c4
$ curl -s /audit/verify
{
"chain_ok": true,
"records": 12
}
Primary sources covered

Honest scope. No hand-waving.

We tell you exactly which NCQA-designated sources we cover and which we don't. The checks we run are primary-source. The checks we don't are on the roadmap.

SourceRoleStatus
NYSED Office of the Professions
NCQA-designated primary source
NY medical license verificationLive
NPPES Registry (CMS)
NCQA-designated primary source
Federal provider identityLive
NY Physician Profile
Not NCQA-designated; used for due-diligence cross-check
Supplementary disciplinary signalLive
OIG LEIE (federal exclusions)
NCQA-designated; free CSV feed
Sanctions + debarmentNext
SAM.gov (federal debarment)
NCQA-designated; free API
Federal contractor debarmentNext
NPDB, DEA, ABMS
On the roadmap; paid data access
Additional primary sourcesRoadmap
TX, CA, FL state boards
Same driver pattern as NY
Multi-state license verificationNext
Delivery model

Self-hosted or managed. Same code, same audit log, same PDF.

Self-Hosted

Run the container yourself.

  • Pull from our private registry
  • Run via docker compose on your infra
  • Audit log + PDFs stay on your disk — we never see data
  • BAA not legally required, but available on request
  • Most compliance-paranoid story

Ideal for teams with existing DevOps and strict data-residency policies.

Managed Hosting

We run it on a VPS dedicated to you.

  • HTTPS endpoint + API key in 2 hours
  • Customer-dedicated single-tenant VPS, US region
  • We operate updates, security patches, backups
  • BAA signed as standard
  • Zero DevOps burden on your team

Ideal for teams who want SaaS ergonomics without multi-tenant data mixing.

Pricing

Transparent. Retainer-based. No per-provider gotchas.

One-time setup, monthly maintenance retainer. Managed hosting adds a modest uplift. No per-verification billing, no surprise overages.

Starter

Setup
$5,000
Retainer (self-hosted)
$1,000 / mo
Managed hosting: +$500 / mo
  • Up to 50 verifications / month
  • NY only
  • Business-hours ET support
  • 5-business-day selector-drift SLA
  • Quarterly audit-chain attestation

Single-location practices, bootstrapped telehealth, first pilot.

Talk to us

Pro

Most popular
Setup
$10,000
Retainer (self-hosted)
$2,500 / mo
Managed hosting: +$500 / mo
  • Up to 500 verifications / month
  • NY included; additional states as add-ons
  • Extended-hours support
  • 2-business-day selector-drift SLA
  • Quarterly NCQA evidence-binder call
  • Priority email / Slack channel

Mid-size telehealth (~50-200 providers), RCM firms, specialty groups.

Talk to us

Enterprise

Setup
$15,000+
Retainer (self-hosted)
$3,500+ / mo
Managed hosting: +$1,000 / mo
  • Unlimited verifications
  • NY + 1 additional state included
  • 1-business-day SLA; 24/7 urgent line
  • BAA signed as standard
  • Custom PDF branding, EHR integration hours
  • Dedicated account contact

Larger RCM firms, multi-state networks, anyone with a compliance officer on staff.

Talk to us

Add-ons: additional states at $7,500 setup + $500/mo each. White-label PDFs $2,000. EHR integrations $5–10K scoped. Ask about founding-customer pricing.

FAQ

Straight answers.

Why not just use Medallion / symplr / Modio?
Those are great if you have an enterprise credentialing budget and a 6-month procurement cycle. For small-to-mid NY telehealth and RCM teams we solve a narrower problem faster and for a fraction of the cost — and you get the forensic audit trail built in. Many of our customers use Medallion for something else.
How is this different from a Python contractor building a scraper?
The scraper is the easy part. What takes months to get right is the WORM-style audit log, HIPAA-aligned container hardening, CAPTCHA and maintenance-mode detection, per-source driver isolation so selector drift is contained, and the ongoing maintenance contract for when state sites restyle. That's what your NCQA auditor actually cares about.
What happens when NYSED changes their site?
Under your maintenance retainer we push a selector fix within your SLA (1-5 business days depending on tier). Our nightly CI runs a live verification against a pinned license, so we see drift before your clerks do.
Is this HIPAA-compliant?
Credentialing data is provider information, not patient PHI — so HIPAA doesn't strictly apply to the inputs. We still sign a BAA on request for the self-hosted tier and as standard for the managed tier. The API schema explicitly rejects unknown fields so accidental PHI is refused at the boundary.
Do you see our provider data?
Self-hosted: no — the container runs entirely on your infrastructure; we have no access. Managed: only on the customer-dedicated VPS you've contracted for, never aggregated across customers, and only with written support-ticket authorization for debugging.
Why NY only?
Because we built it right the first time instead of building shallow coverage for 50 states. Our driver-per-source architecture means adding a state is a short engineering project; we add states when customers request them, typically within 1-2 weeks.
How long does onboarding take?
Self-hosted: typically under 15 minutes from credential delivery to first verification. Managed hosting: we provision the dedicated VPS and hand over the endpoint URL + API key, usually within 2 hours of a signed Order Form.

Your next NCQA review has a forensic trail.

Book a 20-minute demo. We'll run a live verification against a real NY license in front of you, show you the audit log, and walk through the PDF your reviewer will see.

Book a 20-min demoEmail hello@psvpulse.com