Credentialing Conflict and an Eleven-Week Go-Live at MedAxis

Treat the conflicts as policy decisions first and system decisions second. Averaging produces a design nobody owns and a control that satisfies no one.

Plan:

• Classify each conflict by decision owner: credentialing scope is owned by HR and compliance; unit-level approval is owned by nursing operations; retention is owned by compliance. A facilitator does not have authority to decide policy.
• Run a joint 90-minute workshop with all three groups plus the vendor's product architect. Walk through two or three end-to-end swap scenarios, including the hard case of a nurse swapping into a shift outside their credentialed scope. Concrete cases expose real disagreement faster than requirement lists.
• Separate the requirement from the implementation. "No clinician works outside credentialed scope" is the requirement; a 24-hour batch check is one implementation. Ask compliance what control is acceptable when verification is pending: block the shift, allow with named clinical override, or allow and flag.
• Define "real-time" empirically. Ask nursing what decision must be immediate and what can lag. Convert answers into thresholds: swap confirmation, credential verification, audit write, and notification each get a number.
• Prototype the swap screen and the pending-verification state; reactions to a clickable screen resolve more conflict than another meeting.
• Record each decision with owner, date, and the rejected alternative. Escalate to the COO only the genuine policy trade-offs, not the ones the owners can settle.
• For the 22 requirements lacking criteria, rewrite them in the same session or return them to the requester with a deadline before the freeze.

Criteria must be testable and must make the compliance control observable, not assert that the system is "real-time."

Example set:

1. A nurse can request a swap for a shift starting more than 24 hours ahead; the request is visible to the receiving nurse and unit manager within 60 seconds.
2. If the receiving nurse's credentials cover the shift, the manager approval makes the swap effective immediately and the roster updates within 2 minutes.
3. If credentials do not cover the shift, or the check is pending, the swap is held in a blocked state and the shift remains unfilled until a named credentialing user resolves it.
4. Credential verification results are returned within 15 minutes for 95% of requests and within 4 hours for 99%; any request unresolved at 4 hours is blocked and escalated.
5. Every swap attempt, approval, block, override, and credential result writes an immutable audit event containing actor, timestamp, prior and new credential status, shift identifier, and reason code.
6. Audit events are retained for 10 years and are exportable to the compliance reporting format without manual transformation.
7. No swap can reach "effective" status while a block or unresolved credential exception exists; a negative test proves this.

These criteria give nursing speed in the common case, give HR and compliance a hard stop in the exception case, and give the test team something binary to verify. The 24-hour batch design fails criterion 3 and 4 as stated, so the vendor must propose either an on-demand check or a pre-verification cache refreshed more frequently.

Do not commit to the full scope on the fixed date. Present a scoped go-live that preserves the business outcome the COO actually needs, which is likely a working self-service roster for the union milestone rather than every capability.

Recommendation:

• Go live with request-and-manager-approval for swaps within a pre-verified credential pool, where the pool is refreshed nightly and staff whose credentials are expired or restricted are excluded.
• Hold out of phase 1 any swap that would place a clinician outside verified scope; those are handled manually by credentialing staff with a tracked workaround.
• Defer the on-demand credential API integration to phase 2, with a dated plan and an interim control.
• Obtain written compliance sign-off on the interim control, not just COO approval. The risk is regulatory and patient-safety related, and the COO cannot unilaterally accept it on compliance's behalf.
• Make the trade explicit: what is in, what is out, what manual effort the interim control creates, and who owns it.
• Confirm what the union agreement actually requires; if it requires only the ability to request swaps, the proposed phase 1 may satisfy it fully.

If the COO still insists on full scope at 11 weeks, document the decision as a risk acceptance signed by the COO and the compliance officer, with the specific control gap and the date it will be closed. Then re-plan testing and cutover to protect the controls that do ship. Recommending an unsafe go-live to preserve a date is not a neutral option; it transfers clinical and regulatory risk to the client and reputational risk to your firm.