Understanding the NPPES Public Data: What Is Disclosed and What Is Protected

Many providers are surprised to find their practice address and phone number on NPI Profile and other public directories. Many data users, from medical billers to researchers to credentialing teams, want to understand precisely which fields they can rely on and which are absent by design. This page answers both questions directly, drawing on the official FOIA data elements notice and the NPPES data dissemination documentation.

Why NPI Data Is Public

When HHS created NPPES and began assigning NPIs, it faced an immediate question: should the data be public? The NPI's entire purpose was to let health plans, pharmacies, clearinghouses, and other covered entities identify providers in standard transactions. For that to work, those entities needed access to the data. Requiring every health plan to individually petition for records would have been unworkable at scale.

HHS reviewed the data elements collected by NPPES against the standards of the Freedom of Information Act. The conclusion was that most provider data is required to be disclosed under FOIA, and that the most efficient way to satisfy that obligation was to make the data freely available for bulk download and online query. The NPPES Data Dissemination Notice, published in the Federal Register on May 30, 2007, formalized this policy.^[1] There is no charge to download the files or use the query database.

Three data elements did not pass the FOIA review. HHS determined that Social Security Numbers, IRS Individual Taxpayer Identification Numbers, and dates of birth are not disclosable under FOIA and will never be released publicly. This decision was driven by fraud prevention concerns in the Medicare and Medicaid programs.^[1]

What Is Disclosed vs. Protected

The table below summarizes the categories at a glance. Detailed field-by-field lists for individuals and organizations follow in the next two sections.

Fields Specific to Individual Providers (Type 1)

For providers with an entity type code of 1, the following fields are disclosed in addition to the shared fields above:^[3]

• Provider last name (legal name), first name, middle name, prefix, suffix, and credential text
• Other last name, other first name, other middle name, and other name type code (1=Former Name, 2=Professional Name, 5=Other)
• Provider gender code (M or F)
• Healthcare Provider Taxonomy Codes 1 through 15, each paired with the primary taxonomy switch (Y/N/X) and associated license number and license state
• Other provider identifiers (up to 50), each with type code, state, and issuer name

What is not present for individuals: date of birth, state of birth, country of birth, and SSN or ITIN. These were collected on the NPI application for identity verification purposes but are never released publicly.

Fields Specific to Organizations (Type 2)

For providers with an entity type code of 2, the disclosed fields include:^[3]

• Provider organization name (legal business name)
• Other organization name and other organization name type code (3=Doing Business As, 4=Former Legal Business Name, 5=Other)
• Employer Identification Number (EIN) - technically disclosable under FOIA, but currently suppressed in the downloadable file^[2]
• Is Organization Subpart flag and Parent Organization LBN/TIN - also suppressed in the download^[2]
• Authorized Official last name, first name, middle name, title or position, and telephone number
• Healthcare Provider Taxonomy Codes and group taxonomy codes
• Other provider identifiers, with type, state, and issuer

Masked and Suppressed Identifiers

Early in NPPES's operation, some providers mistakenly entered SSNs, ITINs, or EINs in fields that are FOIA-disclosable, such as the Other Provider Identifier number or the License Number field. CMS took active steps to prevent these sensitive numbers from appearing in the public data.

When CMS detects these values in disclosable fields, they are replaced with placeholder strings in the downloadable file:^[2]

Separately, EINs for all organizations and Parent Organization TINs for all subparts are suppressed entirely from the downloadable file, even though they are technically disclosable under FOIA. CMS took this protective measure because some providers had reported SSNs in the EIN field.^[2]

The Monthly Download File

CMS releases a full monthly download of the NPPES data. Each monthly file replaces the previous month's file and contains three categories of records:^[4]

• All FOIA-disclosable data for currently active providers
• Updates and changes made to active provider records during the prior period
• NPI number and deactivation date for deactivated providers (no other fields are included for deactivated records)

The file is delivered as a ZIP archive. Inside the archive are four items: the main data file in CSV format, a header file containing the column names, the Code Values reference document describing what each code means, and the Readme document covering the file structure. The data file itself can be very large and is recommended to be handled by personnel with technical expertise.^[4]

File Format and Structure

Each NPI record occupies a single row in the CSV file. Every value is enclosed in double quotes, and commas separate the fields. If a data value itself contains a double quote, that quote is replaced with a single quote in the file to avoid parsing errors.^[4]

The file has 329 columns, accounting for all possible repeated fields such as up to 15 taxonomy codes, up to 50 other provider identifiers, and multiple address fields. Most rows will have many empty columns because providers do not fill all optional fields. The full column list matches the NPIDataDisseminationFileHeader.csv, which is the definitive reference for column positions.

Three sub-fields are included beyond the basic field definitions:^[4]

• For Other Provider Identifiers: the Issuer name (the health plan that assigned the identifier) and the State (for Medicaid identifiers)
• For Taxonomy Codes: the Primary Taxonomy Switch flag (Y=primary, N=not primary, X=not answered) designating which of up to 15 taxonomy codes is the provider's primary specialty
• For Other Names: prefix, suffix, and credential text, when furnished

Understanding the Code Values

Many fields in the data file store coded values rather than human-readable text. The Code Values document included in the download bundle defines all of these. The most commonly referenced codes are:

Healthcare Provider Taxonomy codes themselves are not defined in the Code Values document because the taxonomy code set is maintained by the National Uniform Claim Committee (NUCC) and updated twice a year independently of NPPES. The current taxonomy codes are published at taxonomy.nucc.org. You can also look up taxonomy codes using NPI Profile's taxonomy lookup tool.^[6]

How NPI Profile Uses This Data

Concerns for Providers

The most common concern providers raise is that a former address appears in the registry. This happens when a provider changes practices but does not update their NPPES record. Because the address is FOIA-disclosable, it cannot be deleted from the registry. It can only be updated to reflect the current location. The moment the provider logs into NPPES and submits an address change, the corrected address will propagate to the public registry and, on the next weekly cycle, to directories like NPI Profile.

A secondary concern is the residential address issue. If a provider entered a home address on their NPI application, that address became part of their public FOIA-disclosable record. The solution is the same: log into NPPES and update the address to a business location. There is no mechanism to retroactively remove a disclosed address, but an update is effective immediately for the registry and at the next refresh cycle for downstream sites.^[7]

For providers who want to verify exactly what is currently visible in their public record before making any changes, the NPPES NPI Registry at npiregistry.cms.hhs.gov shows the FOIA-disclosable data as it currently stands in the official database, and NPI Profile's own lookup reflects the most recent weekly snapshot.