FaceTec has published a new white paper positioning its UR Code protocol as a way to strengthen identity binding in healthcare, where demographic matching and possession-based identifiers often fail to confirm the right person at the point of care. The company describes a UR Code as an owner-controlled, cryptographically signed QR barcode that embeds verified identity attributes and biometric face vector data inside the code, along with a digital signature intended to protect integrity and confirm issuer authenticity without requiring each verification event to query a centralized database.
The paper frames patient matching as both a safety issue and an administrative drag. It cites research referenced by the Pew Charitable Trusts indicating that approximately 18 percent of patient records within healthcare organizations are duplicates, and links identity breakdowns to improper payments and fraud. CMS estimated improper payments of 28.83 billion dollars in Medicare Fee-for-Service and 37.39 billion dollars in Medicaid in 2025, while the National Healthcare Anti-Fraud Association estimates healthcare-related fraud at 3 percent to 15 percent of annual expenditures.
FaceTec’s argument is that UR Codes can act as digitally signed identity containers that are broadly scannable and lightweight enough to support use across devices and settings. In an example workflow described in the white paper, scanning a UR Code with a device camera surfaces identity data and initiates a face match that compares a live capture to face vector data stored within the barcode. For online interactions, the paper emphasizes that liveness should be performed before biometric matching to reduce fraud risk, and it highlights tokenized, time-stamped actuation as a mechanism to produce auditable records of identity-confirmed interactions.
The document organizes the concept into three healthcare use cases. For patient-to-record binding, UR Codes could be issued after enrollment identity verification and bound to the electronic health record, then required during subsequent in-person or remote interactions to reduce duplicate and overlay record creation. For health insurance credentials, the paper proposes binding UR Codes to private insurance, Medicare, or Medicaid credentials so that use of the credential requires a face match by the rightful owner, producing an auditable verification event that can be associated with the care encounter. For fraud-prone service delivery, including home health care and Medicaid-funded transportation, the white paper describes a dual-party confirmation model in which both the provider and the patient verify identity in the same transaction context.
The publication fits within FaceTec’s broader push toward cryptographically anchored identity events and higher-assurance face verification. The company’s UR Code concept has already moved into pilot-phase deployments involving state DMVs, and healthcare has been positioned as a primary target environment for identity abuse, as detailed by Jay Meier, FaceTec’s Chief Identity Technology Strategist, in a recent discussion of why healthcare has become a core identity challenge.
In parallel, FaceTec has continued to emphasize third-party validation as the threat model expands beyond simple spoof media toward software-layer compromise, reflected in Level 1 to Level 5 liveness and injection attack testing and analysis of how injection attacks are reshaping expectations for liveness security.
The full white paper is available for download from FaceTec’s website. And examples of FaceTec’s spoof detection technology in action can be seen on the company’s YouTube channel.
–
By Cass Kennedy and Alex Perala
