GLEIF and DirectTrust are developing a practical framework for verifiable organizational identity in US healthcare
How can a hospital be sure which organization is behind a digital system requesting information? And how can it verify that a doctor, employee, or automated application is genuinely acting on behalf of the organization it claims to represent?
These questions are becoming increasingly important as hospitals, laboratories, insurers, and healthcare organizations exchange more information through digital systems.
On October 19, 2026, the Global Legal Entity Identifier Foundation (GLEIF) and DirectTrust, a US organization focused on digital trust in healthcare, announced a partnership to advance verifiable organizational identity in US healthcare.
At the center of the initiative are the Legal Entity Identifier (LEI) and its digital counterpart, the verifiable LEI (vLEI).
The partnership goes beyond discussing whether LEIs might be useful in healthcare. The partners have identified specific applications, from verifying healthcare organizations and delegated authority to using digital credentials in API connections and automated transactions.
As a result, the initiative marks a significant step toward extending the LEI's role beyond financial services.
Healthcare Already Has Identifiers. Why Does It Need Another Approach?
US healthcare relies on several identification systems. One of the best known is the National Provider Identifier (NPI), a standard that identifies healthcare providers in administrative and financial transactions.
However, having an identifier does not answer every question about an organization's identity or who can act on its behalf.
Healthcare organizations often have complex structures. For example, a hospital may belong to a larger group, operate across multiple locations, outsource laboratory services, and connect its systems to external technology providers.
The healthcare provider, the location where care takes place, and the legal entity responsible for the service are not necessarily the same.
When two systems communicate, several questions arise. Which legal entity is behind the transaction? Has anyone verified its identity? Who is acting on its behalf, and what authority do they have?
Existing healthcare identifiers do not provide a single answer to all these questions. For example, an NPI identifies a healthcare provider, but it does not necessarily establish the precise legal entity behind a particular healthcare operation. This creates a practical need for a complementary way to verify organizational identity.
DirectTrust addressed this challenge at the ViVE 2026 healthcare conference, held in February, during a session titled “No Identity, No Interop”. The discussion explored how verifiable organizational identity could complement existing identifiers, including the potential role of LEI and vLEI.
In October 2026, GLEIF and DirectTrust announced their partnership to develop this approach further.
Four Practical Areas Where LEI and vLEI Could Make a Difference
The GLEIF and DirectTrust partnership identifies four areas for applying verifiable organizational identity in healthcare.
1. Verifying healthcare organizations
An LEI provides a globally recognized identifier linked to reference information about a legal entity.
In electronic healthcare transactions, this can help participants establish which organization is behind an interaction. They would no longer need to rely entirely on separate directories or bilateral arrangements.
2. Connecting people and digital systems to accountable organizations
People are not the only ones initiating healthcare transactions. Software applications, automated systems, and increasingly AI-enabled tools also exchange information and initiate requests.
The initiative aims to help participants establish which verified organization is responsible for these interactions.
3. Proving organizational roles and delegated authority
A vLEI extends an organization's verified identity into digital credentials that participants can check cryptographically.
For example, an authorized hospital representative could present a credential showing their connection to the hospital and their defined organizational role. The proposed approach also covers permissions and healthcare-specific purposes, helping other participants verify not only the organization involved but also the authority associated with a particular interaction.
4. Using credentials in everyday digital transactions
The planned applications include secure messaging, API connections, and automated workflows.
This matters because a growing share of healthcare information exchange takes place directly between systems, often without a person reviewing each transaction.
Consequently, a common approach to verifiable identity could reduce the need for every organization to build separate identity checks for each new partner.
Together, these use cases show the practical direction of the initiative. The goal is not simply to assign another identifier to healthcare organizations. Instead, the partners want to make verified organizational identity useful in the digital transactions those organizations carry out every day.
How GLEIF and DirectTrust Plan to Put the Model into Practice
An important part of the partnership is the development of a new Qualification Agent model.
Under the existing vLEI framework, Qualified vLEI Issuers (QVIs) issue digital credentials. These organizations must complete GLEIF's qualification process before they can issue credentials.
GLEIF already maintains a public list of qualified vLEI issuers. This shows that the underlying credential ecosystem is already established.
The new model aims to help that ecosystem expand into sectors with existing certification and accreditation networks.
Under the proposed structure, GLEIF would qualify Qualification Agents. These agents could then qualify vLEI issuers within their own networks. GLEIF would oversee the Qualification Agents, while each agent would monitor the issuers it qualifies.
DirectTrust brings experience in healthcare accreditation, certification, and digital identity assurance. Meanwhile, GLEIF contributes the international organizational identity framework and the governance structure behind vLEI.
The partners are developing the qualification, governance, and oversight requirements for this proposed model. DirectTrust is expected to seek qualification as a Qualification Agent, subject to completing the required process. The new framework is intended to complement existing qualification arrangements rather than replace them.
This is a significant part of the story. The partners are not just proposing a technical solution. They are also working on a way to introduce it through organizations and trust networks that already operate in healthcare.
In practice, that could make adoption easier than requiring every healthcare organization to establish an entirely new trust arrangement from scratch.
Verified Identity Is Not the Same as Access to Patient Data
There is an important distinction between proving someone's organizational role and granting access to medical information.
A digital credential might confirm that a person is an authorized representative of a particular hospital. However, it does not automatically give that person permission to view a patient's medical record.
Access to health information still depends on healthcare laws, the relationship between the patient and provider, and the access rules of the relevant information system.
The distinction is straightforward.
An LEI identifies the legal entity. A vLEI can help verify the identity and organizational role of someone acting on its behalf. Separate authorization controls must still determine whether that person can access patient data.
That is also where vLEI's potential value lies. It does not need to replace existing healthcare security systems. Instead, it can provide those systems with a verifiable basis for establishing who is acting and which organization they represent.
Europe Is Addressing a Similar Challenge
The need for reliable digital identity is not unique to US healthcare.
The European Union is developing the European Health Data Space (EHDS), a framework intended to improve access to and exchange of electronic health data.
Through MyHealth@EU, participating countries already exchange certain types of health information across borders, including electronic prescriptions and patient summaries.
The EU has also introduced more specific rules for identity verification.
In September 2026, the European Commission adopted Implementing Regulation (EU) 2026/2099, establishing requirements for interoperable cross-border identification and authentication of patients, healthcare professionals, and healthcare providers.
The regulation entered into force in October 2026 and generally applies from 26 March 2027. Certain provisions, including those relating to the use of European Digital Identity Wallets, apply from 26 March 2029.
The US and Europe are therefore addressing related questions. How can organizations and individuals reliably establish their identities when healthcare information moves between different systems and institutions?
However, their approaches are different.
Europe is building interoperability around national identity systems and cross-border health data infrastructure. In contrast, the US initiative involving GLEIF and DirectTrust explores a model based on internationally verifiable organizational identity and role credentials.
The EHDS does not require healthcare organizations to use LEIs or vLEIs.
Nevertheless, the parallel is revealing. Both developments reflect a growing recognition that exchanging healthcare information safely requires more than secure technical connections. The identity and authority of those participating in the exchange must also be trustworthy.
Could Healthcare Become the LEI's Next Major Sector?
The GLEIF and DirectTrust partnership is noteworthy well beyond the healthcare industry.
The LEI is best known for its role in financial markets, where it supports legal entity identification and regulatory reporting. In healthcare, however, the proposed application is different.
The central question is how to verify organizations, people, and digital systems involved in everyday information exchange.
This becomes particularly relevant as automated workflows and AI agents take on more tasks.
For example, if a software agent requests information or initiates a transaction on behalf of a healthcare organization, the receiving system needs a reliable way to establish which organization stands behind it and what authority the organization has delegated.
The GLEIF and DirectTrust initiative connects that challenge to an existing international identity framework.
The next test will be turning the proposed qualification model into practical implementations with healthcare organizations and technology providers. The October announcement does not establish that vLEI-based hospital pilots are already operating. However, it identifies concrete applications and a pathway for bringing them into use.
There is also a broader lesson here.
Healthcare does not necessarily need another isolated identification system. It needs better ways to establish trust between organizations, people, and technology platforms that already use different systems.
That is precisely where an internationally verifiable organizational identity could become valuable.
US healthcare could become one of the most important real-world tests of vLEI beyond financial services. The question is no longer whether verified organizational identity could be useful in healthcare, but whether GLEIF and DirectTrust can turn their proposed model into something healthcare organizations use every day.