Healthcare Provider Data Accuracy Statistics: How Stale Is the US Provider Registry?

This article reports measurements of a public dataset and the published regulatory record. It is not legal, compliance or clinical advice.

Measured by Forage AI from the CMS NPPES monthly file, October 2026 vintage. Data as of 12 October 2026. Published 22 October 2026.

Somebody in the audit meeting asks how accurate your provider file is. Every number within reach is a vendor percentage with no method, a federal survey thirteen years old, or a telephone audit last published in 2018. Provider data accuracy has been discussed far more than it has been measured.

We measured the registry's own clock, the one thing free to measure at full population. This page covers 9,494,255 active NPI records as of 12 October 2026: the share untouched for one, five and ten years, the cuts by specialty and state, what the date field can and cannot tell you, and a method to rerun on your own file. It measures whether anyone touched a record, not whether it is true.

If you are here to look up a single NPI, the registry's own search is what you want.

How accurate is US provider data?

Registry-wide, 85.16% of the 9,494,255 active NPI records in the October 2026 file carry no filed change in over a year. That measures attention, not truth.

NPPES is the enumeration registry that issues National Provider Identifiers. CMS states that an NPI does not validate a licence or credentials. The other public sources are mapped in where this data comes from; this page measures one.

When was provider data accuracy last measured?

The registry itself has been measured once. In a report of 28 May 2013, the HHS Office of Inspector General found NPPES data inaccurate in 48 percent of records (95 percent interval 39.7 to 57.2), from a survey fielded in 2011 against a January 2010 extract. The sample was 170 Medicare-enrolled individual providers, and 126 responded. Organisations were not assessed, and nothing on this page is comparable to that figure.

The directories built on it were measured by telephone. CMS ran three rounds of its Online Provider Directory Review for Medicare Advantage between 2016 and 2018 and calls them not directly comparable. The last published report is dated 28 November 2018. CMS then ran three more rounds between June 2022 and June 2024 and published no report, as its own proposed rule of 20 October 2026 states. The gap is a publication gap.

The REAL Health Providers Act, section 6220 of the Consolidated Appropriations Act, 2026, was signed on 3 February 2026. CMS proposed the implementing rule on 20 October 2026, with comments open until 15 December. As proposed, Medicare Advantage organisations would verify each listed provider every 90 days from plan year 2028, and CMS would post machine-readable accuracy scores from contract year 2029. The scoring method is still being decided. If a final rule has appeared since 22 October 2026, read that sentence as out of date.

How stale the registry is, by elapsed time

Read the curve, not a single average. Half the file is older than the median of 5.28 years, but the tail is where the risk sits: about three in ten records have gone over a decade without a filed change.

The denominator is part of the finding. The file holds 9,852,180 NPIs, and 357,925 are deactivated records that CMS has stripped of every field, the date included. Leave them in and you either shrink every share unannounced or treat blank dates as the oldest records. We set them aside.

Organisations are staler than individuals at every threshold, which matters because an organisation record is usually what a directory address resolves to. Read the gap as stability as well as neglect: their contact details also change less often.

Scope, on this screen: these figures count the absence of a filed change, not error. A provider whose details have not changed has nothing to file, and the registry never asked for more. Last Update Date is a touch date, not a verified date, and it is a complete record of filed change for contact and name fields but not for specialty.

Nearly half the registry has never been edited since creation

A record counts as never edited when its Last Update Date equals its Provider Enumeration Date exactly.

That figure is a floor. The 2005 and 2006 enumeration cohorts read 0% never edited and 2007 reads 9.3%, against a plateau near 50% for 2008 to 2016, and no record in those early cohorts sits within 189 days of its creation date. That is a bulk date write, and a reset can only push the number down. Nor are these just new records: the never-edited block has a median age of 5.55 years, and 29.5% of it is over ten. The mechanism is CMS's own, and ten years old.

Never edited is not the same as wrong. A provider who never moved, changed a number or changed specialty is never edited and correct, and this measure cannot tell the two apart.

What changed in the registry over twelve months?

This is measured, not modelled. We matched the October 2025 and October 2026 files on NPI, exactly twelve months apart, and compared seven fields on the 8,834,297 records with field data in both, after normalising whitespace, case, phone digits and ZIP+4.

Specialty changes more often than street address, which looks odd until the next section: 71.1% of taxonomy changes never moved the update date, so part of that movement has an origin we cannot see. Treat the contact rate as the clean cadence number.

The entity split reverses the staleness one. Organisations are staler yet change more fields overall (11.96% against 10.79%), while individuals change contact fields more than twice as often (4.58% against 2.12%).

Over the year 660,465 new NPIs appeared and 35,796 active records became deactivated, 0.40% of those active a year earlier. That is a floor on exit, since nothing requires deactivation when a provider retires, dies or closes a practice.

Two bounds frame the question. The 4.07% contact rate is what the registry admits changed. The 85.16% is how much of the file has filed nothing in a year. Every recorded contact change moved the date, so the untouched majority really did file no contact change, and how many should have is the unknown. A floor from changes, a pool from silence: neither is a decay rate.

What does Last Update Date actually mean?

CMS publishes the field and, in everything we could find, never defines it. We looked in four CMS documents: the Data Dissemination readme, the FOIA data elements table, the Dissemination Notice and the code values file. The readme gives each field four columns, none a description, and defines Last Update Date as itself. We checked on 16 and 22 October 2026; a CMS definition would invert this section.

In the same 2016 deck, Gilbert states that NPPES "isn't engineered to track or display the freshness of its data". CMS also holds a certification date the bulk file lacks. On 16 October 2026 we probed 400 active Internal Medicine records through the API (200 results per request, no bulk mode), 50 each from eight states, in API order. 180 had no certification date, 204 had one equal to the update date and 16 had an update date ahead of it. That is not a registry share, and it shows only that the two dates differ.

Our two vintages let us test the field both ways. Across address, city, state, postal code and phone, zero of 1,292,677 changes bypassed the date, and no date moved backwards. For contact data the date is a complete record of filed change, which licenses the headline.

Specialty is the exception. 71.1% of primary-taxonomy changes bypassed the date, which fits administrative remapping outside the provider's edit path. That is our inference. It makes date-based staleness for specialty an upper bound on inattention, while trivial edits that advance the date push the other way. Do not reason about specialty from this date.

Which specialties have the stalest records?

Start with the confound. The raw ordering is dominated by how old each profession is: a young profession looks fresh because its records are new. Raw, General Practice Dentistry, Chiropractor and Pharmacist are stalest.

Hold the enumeration cohort constant, using the 2,565,559 records created from 2008 to 2016, and the ordering reverses. Case Manager/Care Coordinator and Registered Nurse become stalest, both above 94%. Family Medicine and Internal Medicine sit among the five freshest of the 25, beside Nurse Practitioner, Family Nurse Practitioner and Physician Assistant. Only two physician taxonomies are in the list, so this says nothing about physicians as a class.

Behavior Technician looks freshest raw and carries no adjusted figure, because the profession barely existed in the window. Read it, and the student category, as cohort effects and not hygiene findings.

A 2024 study by Butala and colleagues in BMC Health Services Research counted agreement across five insurers' directories for 449,282 physicians, with data from September 2022. Only family medicine and internal medicine overlap with our rows, so we cannot test its ordering, and agreement between directories is a different quantity from edits to one federal record. Two of the three authors disclose fees from a provider-data analytics company, and one is affiliated with it.

Which states have the stalest records?

New York is stalest, raw and cohort-held. Nebraska looks freshest, and most of that is composition: 50.1% of its active records were created in 2024 to 2026, against 18.1% nationally. A young registry reads fresh without being better kept.

Hold the 2008 to 2016 cohort constant and the spread between the ends falls from 29.6 points to 13.1, while Nebraska drops to fifteenth stalest. The point is composition, not a league table. State means the practice location on the record, not the licence state. The remaining spread we cannot explain, and we counted no state law. State directory update rules have no current primary count, and the most-cited tally is undated.

Why do the circulating provider data percentages not hold up?

We collected the decay percentages on pages ranking for this keyword family. As of 16 October 2026 there were eleven distinct figures, and ten trace to nothing. Four failures recur.

• Unsourced: no source anywhere in the chain, only "studies" or "industry experience".
• Laundered: credited to a named analyst house through a second vendor's page, with the study itself unreachable.
• Duplicated: one 2014 claim restated as 30%, 25% and "more than 25%", then counted as several.
• Contradicted: the one measured physician series (Annals of Internal Medicine, 2010 to 2020) puts turnover at 5.3% to 7.6% and moving at 4.2% a year, against circulating claims of 5% and 20% a year.

The top-ranking explainer for this query says 15 to 20 percent of NPPES practice addresses are stale "at any given time", lists CMS pages as sources, and attaches none to the figure. We found no source for it anywhere. Ours has a denominator, an as-of date and a method.

One figure deserves a fairer hearing: a commercial file's change rate, with over two million prescribers and two vintages that agree. But it measures whether at least one element changed, on a file you cannot see, in a press release with no methodology section. We do not print it, and it is no benchmark. The same audit on company records is in our B2B data decay statistics.

Staleness is not error

A secret-shopper study asks whether a listing is true. This page asks whether anyone has touched it. Only a phone call establishes truth, and what we offer is a way to decide which number to dial first.

The concession that matters most: NPPES is an enumeration system, CMS has said it was not designed as a directory, and an unedited record is partly the registry doing its job. It still matters because the industry starts from it, and CMS's own engineers describe it as branched and corrected over 5,000 times in silos. Four limits follow.

1. Untouched is not wrong, and touched is not verified. In the OIG study, of 96 inaccurate elements 53% were outdated, 19% partly wrong and 28% never correct.
2. A mismatch between two files does not say which is wrong. OIG found 961,634 of 987,266 paired records differed on a variable between two federal systems, a consistency figure and not an error rate.
3. The decay floor cannot be computed from what CMS publishes. The 30-day duty in 45 CFR 162.410(a)(4) binds covered providers, while paragraph (c) says only that a provider that is not covered "may obtain an NPI", with no update duty attached. The file has no flag for which is which, so we did not estimate the share of the registry carrying no duty. The gap is printed, not estimated.
4. What sits outside the measure. Fifteen of roughly 330 columns, one practice location and the primary taxonomy: no secondary locations, mailing address or licence data.

If you need a verdict on a listing, call. If you need to decide whom to call first, use the distribution.

How to measure your own file

Three inputs and three traps

Three inputs: the current CMS NPPES monthly full-replacement file (download.cms.gov/nppes), an earlier vintage for churn, and the enumeration, update, deactivation and reactivation date columns. Join your roster on NPI stored as text, set deactivated records aside, take the file's newest update date as your as-of, and divide untouched by active matched records.

Take an invented roster of 1,000 NPIs: 12 not in the file, 108 deactivated, and 484 of the 880 active matches untouched over five years. The right share is 484 divided by 880, or 55.0%. Divide by 1,000 and you report 48.4%, by the 988 found, 49.0%, or counting deactivated rows as stale, 59.9%.

Three traps catch most files.

• A line count is not a record count. Address fields hold line breaks, so use a CSV parser.
• Blank entity-type rows are field-stripped deactivated NPIs. Take them out of the denominator (357,925 here) and report their share separately.
• Unnormalised values inflate churn. Fold case and whitespace, and cut phones to digits and ZIP to five.

Test your code on the October 2026 file first: it should find 9,852,180 rows, 357,925 stripped and 9,494,255 active.

The archive is the hard part. The monthly files we tried, July 2025 to January 2026, were retrievable by predictable name, but nothing promises they stay. Keep a copy. Deactivations ship in a separate file, so a weekly-only pipeline can carry dead NPIs. For tooling see NPI data tools; for pipelines, healthcare data management.

Matching your records to the registry is where the work goes. Forage AI builds custom extraction and provider directory matching to the fields you name, monitored on your cadence.

How often to re-verify

Cadence belongs to the maintenance process, not the transport: a real-time API is no fresher than a file if nobody changes what sits behind it. Use your own staleness by field to pick what to re-check first: records with no filed change in over five years go to the front of the call list, and contact fields are the ones whose filed history can be trusted. For a defensible cadence, anchor on two measured numbers. In a year, 4.07% of matched records filed a contact change, a floor because it counts only what was filed. Spread evenly, which we did not test, that is about one record in a hundred per quarter, so a 90-day cycle should expect to find at least that many moved, and an annual cycle at least four in a hundred. Individuals changed contact fields at 4.58% against 2.12% for organisations, so re-check individual records more often. Specialty is the exception: 71.1% of its changes left the date untouched, so staleness cannot set its cadence. The legal clocks are your floor, not our advice: the No Surprises Act has set a 90-day directory verification clock since plan years beginning in 2022, and the proposed Medicare Advantage rule would add one from plan year 2028. Read both with your own counsel.

Method and limits

• Source and as-of: CMS NPPES October 2026 file, 9,852,180 unique NPIs parsed, zero duplicates, zero malformed. The as-of is the maximum update date in the file.
• Active: no deactivation date, or a reactivation on or after it (19,257 reactivated records).
• Age: as-of minus Last Update Date, years of 365.2425 days. Never edited means exact date equality, with a seven-day sensitivity shown in its table.
• Specialty: primary taxonomy only, NUCC code set 25.1, 9,494,253 of 9,494,255 mapped. Cohort window 2008 to 2016, cells under 1,000 thin, direct standardisation as the cross-check.
• Churn: seven fields on 8,834,297 records, from 15 kept of roughly 330 columns, which forbids any claim about the rest.
• Not measured: correctness, the covered-entity share and secondary locations. Deactivations are a floor on exit, and 2026 is a partial year.
• Shelf life: these values describe the October 2026 file, which CMS replaces monthly. Cite with the file date or not at all.

Frequently asked questions

How accurate is the NPPES database?

We cannot give a current correctness figure. The only federal measurement of the registry itself is from 2013 and rests on 126 survey responses. Ours counts filed change: 51.61% of active records show none in over five years.

How often is NPPES updated?

Two clocks get fused. CMS publishes weekly incremental files and a monthly full replacement: the file clock. The record clock is how often a record changes, and for the median record it is over five years.

Are providers required to update their NPI record?

It depends on who they are. A covered health care provider must report changes within 30 days (45 CFR 162.410(a)(4)); a provider that is not covered may obtain an NPI with no update duty attached (162.410(c)). The public file does not say which is which.

Does a stale record mean a wrong record?

No. An old record may be perfectly correct, and a recent update is not a verification. Use the share to decide whom to call first.

Is NPPES reliable enough to use as a provider directory?

CMS built it to enumerate providers, not as a directory. It is the right place to start for who exists and their identifier. Verify what a patient would use, such as a phone number or address, by other means.

A registry that cannot say what its own dates mean, and no federal accuracy score before 2029, leave a gap. The raw material is free and arrives every month, and the part we could not find anyone doing was measuring the registry's own clock. You now have the share, the cut, the limit and a method that reruns. If you would rather not build that loop yourself, Forage AI builds custom extraction and matching to the fields you name, on your cadence.

How to cite this page

HHS OIG, OEI-07-09-00440 (28 May 2013). CMS, Online Provider Directory Review report (28 November 2018). CMS, proposed rule 2026-21420 (20 October 2026). Consolidated Appropriations Act, 2026, section 6220. CMS NPPES files, download.cms.gov/nppes. Gilbert, "Modernizing NPPES" (5 April 2016). 45 CFR 162.410. Butala et al., BMC Health Services Research 2024;24:808. To cite: Forage AI, US provider record staleness, CMS NPPES October 2026 file, data as of 12 October 2026.

Related Articles

• US healthcare provider data: every public source, ranked
• B2B data decay statistics: how fast records go stale
• NPI data tools
• CEO turnover rate statistics