Who Owns CAQH? Twelve Insurance Companies, and Not One Provider

Quick answer: Twelve insurance-affiliated companies now own CAQH, the organization that runs the credentialing database nearly every therapist in the country updates for free. The ownership change became official on January 6, 2026, and the board chair is Tim Kaja, an executive at UnitedHealth Group. CAQH has since rebranded as DataSpring, powered by CAQH, but the login, the form, and the 120-day attestation clock are exactly the same as they were the day before. Its board has nine seats and not one belongs to a provider.

If you typed “who owns CAQH” into a search bar late at night because a rebrand notice landed in your inbox, you were right to be curious. Something real happened in January. It is just not the thing most of the coverage implies.

I directed behavioral health programs before I opened a private practice, so I have watched this database from both sides of the credentialing wall. Clinicians tend to treat CAQH like weather: you do not love it, you do not ignore it, and you assume somebody neutral built the instruments. That last assumption was never true, and understanding why is more useful than the outrage.

This matters even if you have never filled out a CAQH profile yourself. The database connects insurance eligibility information for more than 75 percent of insured people in the United States, according to DataSpring’s own site. It exists, in theory, to keep your health plan’s list of in-network therapists accurate. Whether it actually does that is a different question, and the honest answer sits in the middle of this post.

CAQH Is a Shared Filing Cabinet, Not a Regulator

CAQH stands for the Council for Affordable Quality Healthcare. It was incorporated in 1998 as the Coalition for Affordable, Quality Healthcare, founded not by a government agency and not by a licensing board, but by a group of health plans looking for a shared way to handle administrative paperwork, according to Wikipedia’s history of the organization. It took its current name in 2002, the same year it launched its provider database, then called the Universal Provider Datasource. That database is now the CAQH Provider Data Portal, marketed today as DataSpring for Clinicians.

Underneath the branding, CAQH is one standardized form. A clinician enters license numbers, malpractice history, education, and practice details once, then confirms the same information is still accurate on a recurring schedule, and the insurers that clinician has authorized pull from that single file instead of each running its own paperwork. CAQH is not a licensing body; your state board decides who is allowed to practice. It is not a regulator; it does not write your insurance contract. It is not an accreditor. It is a shared filing cabinet the insurance industry built so it would not have to ask every clinician the same twenty questions twice.

The scale is real. By DataSpring’s own count, fetched in July 2026, the portal holds about 4.8 million provider records, and 2.5 million clinicians had confirmed their information within the prior 120 days. Those are two different measurements, and it is worth not blurring them: records are not clinicians.

The clinicians who feed the cabinet do not pay for it. The health plans that use it do, an administrative fee plus a per-provider charge, according to one payer’s own CAQH FAQ page. Whoever pays the bill tends to get the say in how the tool is run. That is worth holding onto for the rest of this post.

The 120-Day Clock Protects the Health Plan’s Accreditation

Every clinician who has used the portal knows the rhythm: confirm your information at least every 120 days, or your profile lapses and payer verification stops. It feels like busywork generated for its own sake. It exists because of a standard your health plan has to meet, not one you do.

The National Committee for Quality Assurance, which accredits health plans, requires that a credentialing decision rest on a provider attestation current within 180 days, a standard unchanged in NCQA’s own 2025 credentialing guidance. That is the entire chain of logic. NCQA sets a 180-day ceiling for the plan. The 120-day cycle is the buffer that keeps every plan comfortably inside that ceiling. The rule was never built around a clinician’s calendar. It was built around a health plan’s accreditation renewal.

Sit with that asymmetry. A clinician does the data entry, every 120 days, for the length of a career. The health plan keeps its NCQA accreditation.

It also explains why the deadline can feel arbitrary from the clinician’s side. Your license may still be active. Your address may not have changed. You may have attested to identical information four times running. None of that changes the plan’s need for a sufficiently recent attestation on the day its committee meets. The timer tracks the plan’s review process, not the moment your information actually changes. The 90-to-120-day wait new clinicians hit when they first try to join a panel, which I have written about separately, runs on this same underlying machinery.

Twelve Insurance Companies Now Hold the Deed

CAQH was never independent to begin with. It exists because a set of health plans built it as their own shared tool in 1998 and 1999. What changed on January 6, 2026 did not strip away a neutral umpire that had been watching the game. It removed the last layer of paper sitting between the payers and a database the payers had built for themselves.

On that day, CAQH announced by press release that it “is now owned by twelve shareholder companies affiliated with the nation’s leading health plans.” The named owners include UnitedHealth Group, Centene, Aetna (through CVS Health), Elevance Health, The Cigna Group, Humana, Horizon Blue Cross Blue Shield of New Jersey (through an entity called Multistate Investment Services), CareFirst BlueCross BlueShield, Blue Cross Blue Shield of Michigan, Blue Cross Blue Shield of North Carolina, and BlueCross BlueShield of Tennessee.

The board chair is Tim Kaja, an executive at UnitedHealth Group. The vice chair is Susan Smith, an executive at Centene, both according to DataSpring’s own board page. That is not an adjective. That is the org chart. CEO Sarah Ahmad framed the change as an upgrade in the same release: “Reliable data underpins every successful care moment. This new chapter allows us to reimagine the data infrastructure behind care, so the system works better for everyone.” The release cites plans to “deepen partnerships” and “accelerate product development.”

This fits a wider pattern. Insurers have spent the past several years building out their own behavioral-health supply chain end to end, and owning the credentialing pipe outright is one more piece of that same shelf.

Then, on June 8, 2026, the organization dropped the CAQH name from its public face and became DataSpring, powered by CAQH. The American Dental Association’s coverage lists the rebrand as June 10. It is the ADA, not CAQH, that has used the word most clinicians reach for: the ADA reports that the January restructuring converted CAQH from a nonprofit to a for-profit company. CAQH’s own press release never says “for-profit.” Read the primary source and not the summary. The release announces a change in ownership and investment, and the for-profit framing belongs to the dentists who were watching closest, not to the company describing itself.

Nine Board Seats, and Not One Belongs to a Provider

Count the board. DataSpring’s own roster lists nine people. Seven are executives at the health plans that now own the company: Tim Kaja of UnitedHealth Group, Susan Smith of Centene, Shantanu Agrawal of Elevance Health, Eric Berger of Humana, Jessica Conley of Aetna, Sachin Joshi of The Cigna Group, and Heather Staples of Horizon Blue Cross Blue Shield of New Jersey, seated as the Blue plans’ representative. The eighth is CEO Sarah Ahmad. The ninth is David C. Rhew of Microsoft.

Not one seat belongs to a provider, a provider organization, or a clinical association. Microsoft has a chair at the table where the future of the national provider-data file gets decided. Social workers, counselors, psychologists, and marriage and family therapists do not.

The sloppy version of this complaint is wrong, so be precise. Two of those board members are physicians: Shantanu Agrawal and David C. Rhew both hold MDs. They sit in those seats as executives of a health plan and a technology company, not as representatives of the people who fill out the form. The gap is representation, not credentials.

The Directory Was Still Broken When the Data Was Current

The entire justification for the 120-day cycle is that health plan directories need to stay accurate. Test that claim against what happens when someone tries to use one.

In 2023, investigators working for the Senate Finance Committee ran a secret shopper study against directories from 12 health plans across six states. They called 120 listed providers. A third of the numbers were wrong, disconnected, or never returned the call. Investigators could book an actual appointment only 18 percent of the time. More than 80 percent of the in-network mental health providers they tried to reach turned out to be, in the committee’s own hearing title, “ghost networks.”

New York’s Attorney General ran a similar test on 13 health plans, calling 396 mental health providers listed as in-network, a finding I cover in more depth elsewhere. Eighty-six percent were unreachable, out of network, or not taking new patients. Only 14 percent of calls produced an appointment.

Every clinician re-attesting on schedule was, by definition, current. The directory built from those attestations was still a ghost network.

Both things can be true, because a directory is not a photocopy of one clinician’s profile. The plan still has to decide which clinicians appear in which network, attach the right phone number and address to the right listing, strip out clinicians who left two years ago, and publish something a person can actually use. Regular attestation improves one input. It does not produce the output. Treating the clinician’s deadline as the whole accuracy strategy leaves the plan’s half of the job conveniently outside the frame.

Which is why the Senate committee pointed where it did. Its recommendation, reported by the AAMC, was that CMS increase auditing of these directories and that Congress require regular audits, public transparency, and financial penalties for plans that fail them. That is pressure on the plans, not a longer form for clinicians.

And notice who is not the villain in this. The client calling down a list of disconnected numbers and the therapist re-attesting for the fourth time are not on opposite sides of anything. They are standing at opposite ends of the same bad map.

The Payers Now Own the Company That Writes Their Own Rules

Ask who regulates the company now holding your credentialing file, and the honest answer takes three parts. None of them is “nobody,” exactly, but none of them is reassuring either.

First, no single federal agency directly supervises DataSpring as a company. It operates as a HIPAA business associate rather than a covered entity, which means its obligations run through contracts with the health plans, not through direct federal oversight. Under HHS’s own guidance, a covered entity is not even required to actively monitor how its business associate carries out its safeguards.

Second, the federal government handed this organization real public authority. Under Section 1104 of the Affordable Care Act, the HHS Secretary is directed to adopt and update standards and operating rules for how electronic health transactions move between insurers, clearinghouses, and providers. HHS designated CAQH CORE, the standards-writing arm of the same organization, as the Operating Rule Authoring Entity that drafts those national rules.

Third, the standards that actually govern credentialing belong to somebody else. Who gets on a panel, and how a plan proves its network is adequate, is set by NCQA, CMS, and the HHS Office of Inspector General. CAQH is the pipe the data runs through. It does not set the standard the data has to meet.

Put the three pieces together. The same insurance companies now own the company federally authorized to write the rules for how insurers exchange data, and no agency sits on top of that company the way NCQA sits on top of a health plan.

No conspiracy is required to get here. Congress and HHS designated an industry consortium to author its own operating rules, and then that consortium’s ownership consolidated into the hands of twelve of the plans it was built to serve. It is the same administrative logic that already shows up every time a payer runs prior authorization on a claim: the party with the most to gain writes the process the rest of us live inside.

For a Clinician, Almost Nothing Changes Tomorrow

Log into your CAQH profile tomorrow and expect anticlimax. Same portal, same login, same profile, same 120-day schedule. The American Dental Association put it plainly to its own members: expect to see communications branded DataSpring, powered by CAQH, and “aside from this, dentists should not perceive other changes.”

The ownership change is not a data breach. Payer-owners gain no additional access to a clinician’s information beyond what that clinician already authorizes when choosing which plans can view a profile. If you see a claim online that insurers can now read files they could not read before, that claim is false. The privacy and security commitments already in place did not move.

What moved is leverage, not access. And this is where the professions separate.

The American Dental Association had enough organizational standing to convert the moment into something in writing. It says it will “monitor this issue and hold the company to its agreement with the ADA to offer its services for free.” An agreement, and a stated intent to enforce it.

Social work’s associations were not silent. They were unarmed.

The Clinical Social Work Association told members on June 12 that the company now controls “every provider enrollment decision,” “every network participation determination,” and “every directory listing that patients use to find you.” It named the conflict directly, warning that under insurer ownership “decisions are likely to serve the profit motives of insurers, not the confidentiality of patients.” It called changing “this destructive culture” a high priority. It announced no agreement, no timeline, and nothing obtained from the company.

NASW’s own member guidance, published June 29, was plainer still: “DataSpring is a for-profit organization owned by commercial insurers.” It reported that members worry insurers “will prioritize their own interests over the needs of providers.” Then it said what it could actually do: “At this time, NASW is unable to validate these concerns but will monitor the situation for potential problems.” It asked members to write in if their credentialing changes.

Read those three postures next to each other. The dentists got a contract. The social workers got a newsletter telling them to keep an eye out. Nobody in that second group is doing anything wrong; monitoring is a reasonable thing to do when monitoring is what your bargaining power buys. The profession that supplies a large share of the country’s mental health care found out about this the same way its members did, and its strongest available move was to ask those members to report back.

It lines up exactly with the empty seats on the board. You do not get a commitment from a room you are not in.

None of this required a hidden vote. It happened in a press release and on a public board page, sitting in the open the entire time. The hours clinicians spend keeping this one file current were never optional either, the same way the hours an EHR quietly extracts from a clinician’s evening were never optional. Covered was never the same as cared for.

Three things are worth watching from here. Whether the service stays free for behavioral health without a written commitment like dentistry’s. Whether directory accuracy enforcement ever lands on the plans at the scale the Senate report described. And whether the state regulators who write network-adequacy rules have anything to say about a system of record owned by the carriers they oversee.

FAQ

Who owns CAQH now? As of January 6, 2026, CAQH is owned by twelve shareholder companies affiliated with the nation’s leading health plans, including UnitedHealth Group, Centene, Aetna, Elevance Health, The Cigna Group, and Humana. The board chair is Tim Kaja, an executive at UnitedHealth Group, and the vice chair is Susan Smith, an executive at Centene.

Is CAQH still free for clinicians? Yes. CAQH, now marketed as DataSpring, remains free to clinicians, provider groups, and practices. The American Dental Association says it will hold the company to its written agreement to offer the service free of charge. Social work’s associations engaged but obtained no equivalent agreement: the Clinical Social Work Association raised the conflict of interest in a June 12, 2026 alert, and NASW told members on June 29 that it “is unable to validate these concerns but will monitor the situation.”

Did CAQH really convert from a nonprofit to a for-profit company? That is how the American Dental Association describes the January 2026 restructuring. CAQH’s own press release announces the change in ownership but never uses the words “for-profit.” The facts it does state directly are the twelve insurance-affiliated owners and a board chaired by a UnitedHealth Group executive.

Can the insurers that own CAQH now see clinician data they could not see before? No. According to the American Dental Association’s reporting on the change, payer-owners gain no additional access to clinician data beyond what each clinician already authorizes, and existing privacy and security commitments remain in place. What changed is governance and ownership, not data access.

Sources

1. CAQH, press release: “Leading Health Plans Become CAQH Owners to Shape the Future of Healthcare Data”, PR Newswire, January 6, 2026. Ownership by twelve shareholder companies, named owners, board chair and vice chair, CEO quote.
2. DataSpring board members, fetched July 2026. Full nine-member board roster, chair and vice chair, employer affiliations.
3. DataSpring for Clinicians, fetched July 2026. Free-to-clinicians commitment, 4.8 million records, 2.5 million clinicians attested within 120 days.
4. ADA News, “What to know about CAQH change to DataSpring, powered by CAQH”, June 2026. For-profit framing, free-service commitment, no additional data access, rebrand date.
5. DataSpring, “CAQH rebrands as DataSpring to power the next era of healthcare data”, June 2026. Rebrand date of June 8, 2026.
6. NCQA Credentialing eBook 2025 (PDF), 2025. 180-day attestation requirement for credentialing decisions.
7. DataSpring, Operating Rules Mandate, fetched July 2026. HHS designation of CAQH CORE under ACA Section 1104.
8. HHS.gov, Business Associates FAQ. Covered entities not required to monitor business associate safeguards.
9. DataSpring privacy policy, fetched July 2026. Business associate, not covered entity, status.
10. Senate Finance Committee, secret shopper study report (PDF), hearing May 3, 2023. Ghost network figures across 12 plans and six states.
11. Congress.gov, S.Hrg. 118-574, May 3, 2023. Hearing record and title.
12. AAMC Washington Highlights, 2023. Senate recommendations for CMS auditing and penalties.
13. Wikipedia: CAQH, page last edited 2026-07-16. Founding history, 1998 to 2002, used only for pre-2026 facts.
14. AmeriHealth Caritas Pennsylvania, CAQH FAQ. Health plans, not clinicians, pay for CAQH access.
15. DataSpring homepage, 2026. Eligibility data connected for more than 75 percent of insured people in the US.
16. NASW, “Tips and Tools for Social Workers: CAQH is now DataSpring”, June 29, 2026. For-profit and insurer-owned description, member concerns, NASW’s monitoring posture.
17. Clinical Social Work Association, “Changes to CAQH/DataSpring”, June 12, 2026. Conflict-of-interest position and the scope of what the entity controls.

Figures current as of July 2026.

Disclaimer

This article is for educational and informational purposes only. It does not constitute medical, clinical, legal, or therapeutic advice, and reading it does not create a therapist-client relationship with Matthew Sexton, LCSW or Mental Wealth Solutions, Inc. Although the author is a licensed clinical social worker, the content in this article is not clinical assessment, diagnosis, or treatment.