Research · 10 min read
How to Look Up a Prescriber in the Federal Provider Registry
There is one free federal database that will tell you whether a clinician or a company holds a national provider number, and what they reported about themselves when they got it. It is genuinely useful, and it is weaker evidence than most people assume.
Key takeaways
- CMS publishes the disclosable federal enumeration data free, in a query-only registry it says is updated daily and in a downloadable file.
- The content is what the provider reported about themselves, by CMS's own description, so it is a self-reported identity record rather than a credential check.
- The disclosure rests on the Freedom of Information Act, and CMS states there is no way to opt out or suppress the record of a provider with an active number.
- For an individual the public fields include a license number and its state, but no license status, no discipline and no malpractice history.
- The entity type code separates individuals from organizations, cannot be changed after assignment, and is the field to read first.
- A covered provider must communicate changes in its required data elements to the system within thirty days, which is a floor on staleness rather than a guarantee of accuracy.
- An organization covered provider must require a prescriber it employs or contracts with to obtain a number and to disclose it on request where they prescribe within that relationship.
- For a deactivated number, CMS says it discloses only the number and the deactivation date.
Answer first: one free lookup, and a narrow answer
Federal health administration runs an enumeration system for providers, and part of what it holds is public.
CMS describes the public side in two forms. A query-only database called the NPI Registry, updated daily, which lets you search by number or provider name and retrieve the disclosable data. And a downloadable file. CMS states there is no charge for either.
What a hit tells you is narrower than it looks. It tells you a record exists, and it shows what the provider reported about themselves to the enumeration system.
CMS says so in its own words: the registry and the files contain data as reported by the provider, by someone acting on their behalf, or by an organization provider's authorized official.
So treat a result as a self-reported identity record maintained under a legal duty, not as a credential check.
Why the data is public at all
The disclosure has a stated legal basis, and it explains why there is no privacy switch on it.
CMS says that in September 2007 it began disclosing the enumeration data that are disclosable under the Freedom of Information Act. It adds that, in accordance with the electronic FOIA amendments, it has disclosed those data over the internet in the two forms above.
The consequence is stated bluntly on the same page. The information disclosed is FOIA-disclosable and required to be disclosed, and there is no way to opt out or suppress the record data for a provider with an active number.
The regulation puts the maintenance duties on the system rather than on the public. The National Provider System assigns a single unique number to a provider, collects and maintains information about each provider assigned one, and performs the tasks necessary to update that information.
It also handles the end of a record. Where appropriate it deactivates a number on receipt of information about the dissolution of an organization, the death of an individual, or other circumstances justifying deactivation, and it may reactivate one. A deactivated number is never assigned to any other provider.
What is actually in the public record
CMS publishes the field list, and reading it is the fastest way to calibrate what a lookup can do.
For both individuals and organizations the disclosable set includes the number itself, an entity type code, a replacement number where one was assigned, and the legal name. It also includes other names, each with a type code. The codes mark a name as a former name, a professional name, a doing-business-as name, a former legal business name, or other.
Addresses are in it twice. A business mailing address with telephone and fax, and a business practice location address with telephone and fax, each with city, state, postal code and a country code if outside the United States.
Then classification and history. A healthcare provider taxonomy code, with a primary taxonomy required and up to fourteen more reportable as an option. Up to twenty other provider identifiers with their type codes, reported optionally. The enumeration date and the last update date. And deactivation reason code, deactivation date and reactivation date.
Some fields appear for one kind of provider only. For individuals: a gender code, a license number, and a license number state code. For organizations: an employer identification number, and the authorized official's name, title or position and telephone number.
That individual license field is the one people over-read, and the next section is about why.
A license number is not a license status
The public record can carry a clinician's license number and the state that issued it. It carries no status alongside them.
Nothing in the disclosable field set records whether that license is currently active, restricted, suspended or expired. Nothing records discipline. Nothing records a malpractice history.
The field is also provider-reported, like most of the record. CMS says providers may update or change the data they furnished at any time, and the regulation gives them thirty days to communicate any change in their required data elements to the system.
Thirty days is not nothing, but it is a floor on how stale a field can be, not a guarantee of accuracy. A number that was correct on entry and never revisited looks identical to one confirmed yesterday.
For license status, the issuing state board is the record that carries it. This lookup answers a different question, and treating it as a license check is the single most common way it gets misused.
Type 1 and type 2, and why the distinction is load-bearing
Every record carries an entity type code. A code of one means an individual; a code of two means an organization.
That single field separates the two things a telehealth reader is usually trying to tell apart. A brand or a practice entity is a type two record. The clinician who evaluated you would be a type one record.
The code is also sticky by design. CMS states that once a provider has been assigned a number, the provider cannot change the entity type code on that record. A provider who applied with the wrong code has to deactivate that number and reapply.
So finding a company in the registry establishes that the company is enumerated. It does not identify any person, and the record was never built to.
The provision that reaches telehealth prescribers directly
One paragraph of the regulation is aimed squarely at the arrangement most GLP-1 telehealth companies use, and it is rarely quoted.
Take an organization covered health care provider that has as a member, employs, or contracts with an individual health care provider. Where that individual is not a covered entity and is a prescriber, the organization must require them to do two things.
First, obtain a number from the National Plan and Provider Enumeration System.
Second, disclose that number on request to any entity that needs it to identify the prescriber in a standard transaction. That second duty applies to the extent the prescriber writes a prescription while acting within the scope of the relationship with the organization.
Read what that establishes and what it does not. It means an individual prescriber working inside an organization is expected to be enumerated in the same public system. It does not create a public directory of which prescribers work for which company, and no such mapping exists in the disclosable field set.
Deactivated records, and what disappears
A record that ends behaves differently from one that is live, and the difference is worth knowing before you conclude someone is missing.
CMS states that for a deactivated number, it will disclose only the deactivated number and the associated date of deactivation. The rest is not published.
CMS also notes that a deactivated record cannot be viewed or edited by the provider it had been assigned to. That is the reason it gives for saying there is no need to disclose whom the number was previously assigned to.
Two operational rules travel with that. Covered entities should not use deactivated numbers in standard transactions, and providers who deactivated a number should not use it or allow others to use it.
Where a number is reactivated, CMS says the disclosable data will again be displayed in the registry and included in the downloadable file.
How to run the check, and what to do with the answer
Search on the name and the state together, because common names collide and the record carries a practice location to separate them.
Read the entity type first. It tells you whether you are looking at a person or at a company before you read anything else in the record.
Compare the taxonomy and the practice location against what the company told you. A mismatch is not proof of anything, but it is a question worth asking in writing.
Look at the last update date next to the enumeration date. A record whose fields were never revisited is a weaker signal than one that was.
Then go somewhere else for the things this record cannot carry. License status lives with the issuing state board. Payments from manufacturers live in the federal open payments system. Malpractice and adverse action reports live in a data bank that is not open to the public. All three are different questions from the one this lookup answers.
And if a company will not give you a prescriber's name at all, that is its own answer. A lookup cannot start without one.
What is not verified here
One limit, stated where a reader can see it rather than in small print.
The description above comes from CMS's published account of what the registry and the downloadable files contain, and from the regulation that creates the system. The search interface itself was not exercised, and no individual record was read or reproduced.
The field list also carries a date worth knowing. CMS's information document for providers is dated June 20, 2007, and it was written in advance of disclosure. It says at the time that CMS had not yet announced when the data would be publicly disclosed. CMS's current dissemination page states that disclosure began in September 2007 and describes files added since.
So read the field list as CMS's published account of the disclosable set rather than as a screen you should expect to match field for field. If a specific field matters to you, confirm it against the record in front of you.
Sources
- 45 CFR Part 162 Subpart D — Standard Unique Health Identifier for Health Care ProvidersSection 162.408 for the duties of the National Provider System: assigning a single, unique identifier to a health care provider; collecting and maintaining information about each provider assigned one and performing the tasks necessary to update that information; deactivating an identifier where appropriate on receipt of information concerning the dissolution of an organization, the death of an individual, or other circumstances justifying deactivation; reactivating one where appropriate; never assigning a deactivated identifier to another provider; disseminating system information upon approved requests; and assigning an identifier to a subpart on request where the identifying data are unique. Section 162.410(a)(4) for the requirement that a covered health care provider communicate any changes in its required data elements to the system within 30 days of the change. Section 162.410(b) for the requirement that an organization covered health care provider that has as a member, employs, or contracts with an individual health care provider who is not a covered entity and is a prescriber must require that provider to obtain an identifier from the National Plan and Provider Enumeration System, and, to the extent the prescriber writes a prescription while acting within the scope of the relationship with the organization, to disclose it upon request to any entity that needs it to identify the prescriber in a standard transaction. Section 162.410(c) for a provider that is not a covered entity being able to obtain one by application if necessary. The subpart's source note is 69 FR 3468, January 23, 2004.
- Data DisseminationThat in September 2007 CMS began disclosing NPPES health care provider data that are disclosable under the Freedom of Information Act to the public, and that in accordance with the e-FOIA amendments it has disclosed these data via the internet in two forms. That the NPI Registry is a query-only database updated daily that enables users to query NPPES, for example by number or provider name, and retrieve the FOIA-disclosable data from the search results, with no charge to view the data. That the NPI Downloadable File comprises a full replacement monthly file, a weekly incremental file and a full replacement deactivation file, with no charge to download. That the registry and the downloadable files contain data from NPPES as reported by the provider, by someone acting on their behalf, or by an organization provider's authorized official, and that providers should correct information that is incorrect. That the disclosed information is FOIA-disclosable and required to be disclosed under FOIA and the e-FOIA amendments, and that there is no way to opt out or suppress the record data for health care providers with active identifiers. That for a deactivated identifier CMS will disclose only the deactivated identifier and the associated date of deactivation; that deactivated records cannot be viewed or edited by the providers they had been assigned to; that covered entities should not use deactivated identifiers in standard transactions and providers should not use or allow others to use them; and that data for providers who reactivate will continue to be displayed in the registry and included in the downloadable file.
- National Plan and Provider Enumeration System (NPPES) Data Elements — Data Dissemination — Information for ProvidersThe two-column list of NPPES data elements CMS states may be disclosed to the public under the Freedom of Information Act, one column for individuals and one for organizations, together with the document's statement that these elements are listed in the NPPES Data Dissemination Notice (CMS-6060-N). Fields common to both columns: the identifier itself; entity type code, with 1 for individual and 2 for organization; replacement identifier; legal name; other name with a type code covering former name, professional name, doing business as name, former legal business name and other; first and second line business mailing address with city, state, postal code, country code if outside the United States, telephone and fax; first and second line business location address with the same elements; healthcare provider taxonomy code, with a primary taxonomy required and up to 14 additional taxonomies reportable as an option; other provider identifier and other provider identifier type code, with up to 20 reportable as an option; provider enumeration date; last update date; deactivation reason code; deactivation date; and reactivation date. Fields marked for individuals only: gender code, license number, and license number state code. Fields marked for organizations only: employer identification number, and the authorized official's last, first and middle name, title or position and telephone number. Also note 3, that the entity type code is selected at application, cannot be changed once an identifier has been assigned, and that a provider who applied using the incorrect code must deactivate that identifier and re-apply. ⛔ The document is dated June 20, 2007 and states on its face that CMS had not yet announced the date when these data would be publicly disclosed in a downloadable file and in the query-only registry; the dissemination page above states that disclosure began in September 2007 and describes files added later.
Frequently asked questions
Is there a free way to check whether a prescriber has a national provider number?
Yes. CMS publishes the disclosable enumeration data in two free forms. One is a query-only database called the NPI Registry, which CMS says is updated daily and can be searched by number or by provider name. The other is a downloadable file. CMS states there is no charge to view the registry data or to download the files.
What does a hit in that registry actually prove?
That a record exists, and what the provider reported about themselves. CMS states that the registry and the downloadable files contain data as reported to the enumeration system by the provider, by someone acting on their behalf, or by an organization provider's authorized official. It is an identity record maintained under a legal duty to keep it current, not a verification of credentials, competence or current practice.
Does it show whether a clinician's license is active?
No. For an individual the disclosable field set includes a license number and a license number state code, but no status. Nothing in it records whether a license is active, restricted, suspended or expired, and nothing records discipline. License status is held by the issuing state board, which is a separate record and a separate check.
How current is the information?
The regulation requires a covered provider to communicate any change in its required data elements to the system within thirty days of the change, and CMS says the query-only registry is updated daily. Both facts describe the plumbing rather than the content. A field that was entered correctly and never revisited will look exactly like one confirmed recently, so read the last update date next to the enumeration date.
Can a provider have their record removed?
Not while the number is active. CMS states that the disclosed information is FOIA-disclosable and required to be disclosed, and that there is no way to opt out or suppress the record data for a provider with an active number. Where a number has been deactivated, CMS says it discloses only the deactivated number and the associated deactivation date.
How do I tell a company's record from a person's?
By the entity type code. A code of one marks an individual and a code of two marks an organization. CMS states the code cannot be changed once a number has been assigned, and that a provider who applied under the wrong code must deactivate that number and reapply. So a company appearing in the registry establishes that the company is enumerated and identifies no person.
Are prescribers who work for a telehealth company required to be in the system?
The regulation reaches that arrangement directly. Take an organization covered health care provider that has as a member, employs, or contracts with an individual provider. Where that individual is not a covered entity and is a prescriber, the organization must require them to obtain a number from the enumeration system. It must also require them to disclose that number on request to any entity that needs it to identify them in a standard transaction. That second duty applies to the extent they prescribe within the scope of the relationship. None of this is the same as a public list of who works where.