Bulk NPI Enumeration with EFI: A Guide to Electronic File Interchange
Electronic File Interchange (EFI), also called bulk enumeration, lets an approved organization called an EFIO submit NPI applications and updates for hundreds or thousands of providers at once, using a structured CSV or XML file. EFI is designed for large health systems, staffing organizations, professional associations, and health plans that manage NPIs on behalf of many providers. Individual providers and small practices should use the standard online NPPES application instead.[1]
Most health care providers apply for an NPI individually through the NPPES website in about 20 minutes. For organizations managing NPIs for large numbers of providers, that one-at-a-time process becomes impractical fast. EFI solves that problem by allowing a single file to carry hundreds or thousands of applications, processed by NPPES in batch. This guide covers the full EFI lifecycle, from deciding whether EFI is right for your situation through ongoing compliance obligations.
What EFI Is and Why It Exists
Electronic File Interchange is a bulk process by which an approved organization, called an EFI Organization or EFIO, submits NPI applications and data change requests for large numbers of providers with minimal manual intervention. Rather than a provider submitting an individual paper or web application, the EFIO collects provider data and delivers it to NPPES in a single structured electronic file.[1]
EFI was developed alongside the NPI rollout to address a practical reality: when HIPAA compliance deadlines approached in 2007 and virtually every health care provider in the country needed an NPI simultaneously, individual applications at scale would have been unmanageable. EFI let professional associations, hospital systems, and health plans obtain NPIs for large provider networks efficiently, and that capability continues today for routine operations.[2]
EFI is not limited to initial applications. It can also submit change requests to update existing NPI records, such as address changes, taxonomy updates, or name changes, across many providers in a single file upload.[1]
When EFI Makes Sense vs. Individual Applications
EFI involves a registration process, a formal certification statement, and technical file preparation. That overhead is justified only when the volume of NPI work warrants it. The EFI Summary documentation itself notes that if a group of only a few providers is seeking NPIs, it may wish to consider simply submitting paper or web applications as opposed to utilizing EFI.[1]
| Situation | Recommended approach |
|---|---|
| Individual provider or small group of a few providers | Online NPPES application (fastest, no overhead) |
| Hospital system onboarding a new cohort of residents or employees | EFI, if the organization is already an approved EFIO |
| Staffing or locum tenens organization managing many provider records | EFI, once EFIO approval is obtained |
| Professional association with member providers needing NPIs | EFI, with explicit written permission from each provider |
| Health plan needing to link provider NPIs to their internal records | EFI for bulk processing; individual web applications for small volumes |
| Mass address or taxonomy update across a large employed provider network | EFI change request file |
An EFIO may not submit NPI applications on a provider's behalf without the provider's explicit permission. The provider must authorize the organization to act on their behalf. The EFIO is responsible for obtaining and retaining documentation of that authorization.[1]
Key Roles: EFIO and EOR
- Responsible for accuracy of all submitted data
- Signs and retains the certification statement
- Must retain all files for seven years[3]
- Authorized official must be a W-2 employee or owner
- Submits and downloads files from NPPES
- Collects provider data and resolves discrepancies
- Cannot sign the certification statement
- EOR access is deactivated if the person leaves the EFIO[4]
Becoming an EFIO: Registration Steps
Log into NPPES at nppes.cms.hhs.gov using an approved I&A account. Select the Manage EFI button on the bottom of the page to reach the Electronic File Management Main Page.
Locate the employer organization in the list. If the EFIO Status is not Active or Pending, select Request EFI Access in the Actions column to begin EFIO registration. Once submitted, the status will be set to Pending.[4]
Download the EFI Certification Statement (available in the Actions column once the status is Pending). Have an authorized official of the organization sign and complete it. The authorized official must have legal authority to bind the EFIO to all terms and conditions and must be a W-2 employee or owner.
Mail the signed certification statement to the NPI Enumerator. Faxed, emailed, stamped, or photocopied signatures are not accepted.[4]
Once the Enumerator receives and approves the certification statement, they will activate the EOR's user ID and password and the EFIO's system-generated ID. Only then can the organization begin submitting files to NPPES.
7125 Ambassador Rd, Suite 100
Windsor Mill, MD 21244-2751
CSV and XML File Formats
NPPES accepts EFI files in two formats: CSV (comma-separated values) and XML. Both formats carry identical provider data elements, which mirror the fields on the paper CMS-10114 NPI application form. The choice between them is mainly one of technical preference and tooling available within the submitting organization. The EFI Technical Companion Guide (version 3.0) provides the definitive field-by-field specification for both.[5]
Key data elements included in both formats cover:
- Provider name (full legal name for individuals; legal business name for organizations)
- Entity type (1 for individual, 2 for organization)
- Tax identifier (SSN or ITIN for individuals; EIN for organizations)
- Business mailing address and practice location address
- Healthcare Provider Taxonomy Codes and associated license numbers
- Other provider identifiers such as DEA numbers
- Subpart indicator and parent organization LBN/TIN (for Type 2 subparts)
Both formats also support a provider tracking reference identifier, which is an optional field the EFIO can populate with its own internal ID to make matching response records back to source systems easier.
NPPES applies a privacy rule that automatically removes any 9-digit numeric values it detects in certain fields during file processing. This protects against SSNs or EINs accidentally appearing in the wrong field. If your system generates 9-digit values in fields where they are not appropriate, review and correct them before uploading, as the automatic removal may strip data you intended to include.[6]
New Requests vs. Change Requests
An EFI file can contain new NPI applications, change requests for existing records, or both, depending on the file's transaction type code.[5]
| Type | XML transaction code | Purpose |
|---|---|---|
| New application | RK (Enumeration) |
Apply for an NPI for a provider who does not yet have one. The NPI field must be blank; populating it will cause the record to reject with error code 01. |
| Change request | U5 (Update/Modify) |
Update an existing NPI record. The NPI field is required; if the NPI is not found in NPPES the record rejects with error code 10. |
There is also a CSV-specific Change Request Upload feature for adding information to NPIs. Note that this feature can add information but cannot modify or remove existing information; a full file upload is needed for those operations.[5]
The Processing Lifecycle
Understanding the processing sequence helps EFIOs set expectations for turnaround time and know what to watch for.
The EFIO uploads the file through the NPPES Electronic File Management page. NPPES sends an email confirming the file was successfully uploaded and places it in a processing queue.
When the Enumerator releases the file from the queue, NPPES runs it against its validation edits. Records with missing required fields are rejected immediately. Records with minor discrepancies are pended for Enumerator review. Records that pass all edits are enumerated and assigned NPIs.
No later than approximately six business days after the file is released from the queue, NPPES emails the EFIO that the file has been processed and is available for download. If the entire file is rejected due to a technical error, the email states that no response file was generated.[7]
The EFIO downloads the response file and reviews the status of each record. Approximately every six business days thereafter, NPPES provides updated response files reflecting any status changes for previously pended records.
The EFIO promptly notifies each provider of the outcome: the assigned NPI if approved, or the reason for rejection if the application failed.[7]
Reading the Response File
Each record in the response file carries a status code. There are three possible outcomes for any individual record:[7]
- Approved (NPI assigned)
- Pended (under Enumerator review)
- Rejected (with error code)
Important: when a record hits an edit error during processing, NPPES stops validating that record at the first error and pends it with the corresponding error code. It does not continue checking the remaining fields in that record. This means that once a pended record is corrected and resubmitted, a second error may surface that was masked by the first. An error in one record has no effect on any other record in the same file.[8]
The entire file can also be rejected before any records are processed, for reasons such as a schema validation failure, an invalid transaction type code, an empty file, or special characters in the XML data. In this case no response file is generated at all, and the EFIO must correct and resubmit the entire file.[8]
Discrepancy Resolution
When records are pended, the Enumerator attempts to resolve the discrepancy independently. If the Enumerator cannot resolve it, it contacts the EFIO for assistance. The EFIO is not prohibited from independently taking steps to resolve issues with the provider, but if it does, it must promptly notify the Enumerator of how the matter was resolved. The EFIO cannot unilaterally resubmit a corrected record; the Enumerator is always responsible for making the final correction in NPPES.[8]
The certification statement requires the EFIO to respond to the Enumerator promptly when asked to assist. Responses can be provided on a record-by-record basis as each is resolved, without waiting for the full set of pended records to be addressed simultaneously. The Enumerator reserves the right to reject a record if it does not receive appropriate clarification in a timely manner.[8]
Ongoing EFIO Responsibilities
Becoming an EFIO carries obligations that extend beyond filing. The certification statement creates formal legal duties:[3]
- Record retention. The EFIO must maintain all files, certification statements, and related documentation for a minimum of seven years, unless CMS prescribes a shorter period.
- Provider notification. After each processed file, the EFIO must promptly notify each provider of the result of their application or change request, including the assigned NPI or the reason for any rejection.
- EOR management. If an EOR leaves the organization or is no longer authorized to act on the EFIO's behalf, the EFIO must promptly notify the Enumerator so the EOR's credentials can be deactivated.
- Provider responsibility remains with the provider. Even when an EFIO submits changes on a provider's behalf, ultimate responsibility for keeping the NPI record accurate rests with the provider. If the relationship between the EFIO and a provider ends, that does not automatically update NPPES; the provider must take steps to ensure their record reflects current information.
EFI is sometimes confused with the separate process by which an organization health care provider applies for NPIs on behalf of its employed health care providers on a record-by-record basis. That individual process is covered in the CMS guidance document "NPI: Guidance for Organization Health Care Providers Who Apply for NPIs for Their Health Care Provider Employees." EFI is the bulk file submission process; the individual record-by-record approach does not require EFIO registration and is appropriate for smaller volumes.[9]
Verify NPIs obtained through EFI.After a bulk submission, confirm each NPI is active and the record reflects the correct taxonomy and address.
Search the NPI RegistrySources
This guide is based on the following official government publications. NPI Profile summarizes official documentation for convenience; the source documents remain the authoritative reference.
- Centers for Medicare & Medicaid Services. Electronic File Interchange Summary (EFI Summary 3.0). Updated June 27, 2023. Sections I (What is EFI), II (Why EFI exists), and III (How EFI works).
- Department of Health and Human Services. NPPES Data Dissemination Notice (CMS-6060-N). 72 Fed. Reg. 30012, May 30, 2007. (EFI process description at p. 30012.)
- Centers for Medicare & Medicaid Services. EFI Summary 3.0, Section V.E: Other EFIO Responsibilities. Covering seven-year retention, provider notification, and agency relationship terms.
- Centers for Medicare & Medicaid Services. EFI Summary 3.0, Section III, Step 1: EFIO and EOR Registration. Covering registration steps, certification statement mailing address, and EOR management.
- Centers for Medicare & Medicaid Services. CMS XLC EFI Technical Companion Guide 3.0 (NPPES EFI Technical Companion Guide). Covering XML and CSV file formats, transaction type codes RK and U5, and field-level specifications.
- Centers for Medicare & Medicaid Services. EFI Summary 3.0, Section V.B: Preparing and Submitting Files to NPPES. Covering the nine-digit value privacy rule.
- Centers for Medicare & Medicaid Services. EFI Summary 3.0, Section IV: Example of EFI in Action. Covering the six-business-day processing timeline, status codes, and provider notification requirements.
- Centers for Medicare & Medicaid Services. EFI Summary 3.0, Section V.C: Processing the File and Resolving Discrepancies; and EFI Technical Companion Guide Appendix FAQ on file and record rejection.
- Centers for Medicare & Medicaid Services. NPI: Guidance for Organization Health Care Providers Who Apply for NPIs for Their Health Care Provider Employees (ICN 902604, August 2014). Distinguishing individual record-by-record application from bulk EFI.
