New delegation agreements implemented on or after January 1, 2022, must include a description of the delegate’s UM/CR system security controls.
For delegation agreements in place prior to January 1, 2022, NCQA has extended the time frame for including a description of UM/CR system controls in the delegation agreement. All delegation agreements under the 2024 HPA standards (effective July 1, 2024) must include a description of UM/CR system controls. Prior to July 1, 2024, organizations may alternatively provide a delegation agreement and other mutually agreed upon documentation OR the delegate's system controls policies and procedures in lieu of a delegation agreement with a description of UM/CR System controls.
HP 2022