National Plan and Provider Enumeration System (NPPES)

Key facts

Operated by

Centers for Medicare & Medicaid Services (CMS)

Legal basis

HIPAA NPI final rule, 45 CFR Part 162, Subpart D

Public access

NPI Registry search and API, plus downloadable data files

File schedule

Monthly full file, weekly incremental file, monthly deactivation file

Update duty

Providers must report changes within 30 days (45 CFR 162.410)

What is NPPES?

NPPES is where providers apply for a National Provider Identifier (NPI) and maintain the record behind it. Individuals and organizations apply online or on paper form CMS-10114, and the information they enter becomes the official NPI record.

Much of that record is public. CMS discloses the non-sensitive fields and withholds items such as Social Security Numbers, taxpayer identification numbers and dates of birth.

What an NPPES record contains

A typical record includes:

• Entity type (Type 1 individual or Type 2 organization), legal name and other names used.
• Mailing address and primary practice location, with additional practice locations in a separate reference file.
• One or more Healthcare Provider Taxonomy Codes, one flagged as primary, with a state license number where applicable.
• Other identifiers, such as legacy Medicaid provider numbers.
• For organizations, an authorized official, and for some records, electronic endpoints such as Direct messaging addresses.
• Enumeration date, last update date and any deactivation or reactivation dates.

Why NPPES matters

NPPES is the broadest public roster of U.S. health care providers. It covers clinicians and organizations whether or not they bill Medicare, which makes it the usual starting point for building provider universes, mapping practice locations, segmenting by specialty through taxonomy codes and joining other datasets on the NPI.

Limitations of NPPES data

The data is self-reported. CMS notes that issuing an NPI does not validate licensing or credentialing, and taxonomy selections are not checked against training or board certification.

Records also age. Providers are required to report changes within 30 days, but many practice addresses lag behind moves, and a listed address may be a billing office rather than a place where patients are seen. Retired or deceased providers stay in the file until their NPIs are deactivated.