Provider Data Management vs Master Data Management: Which One Your Directory Problem Needs
Regulation and sources checked 23 October 2026. CMS's directory rule is proposed, not final.
Put your network operations lead and your enterprise data architect in one meeting, and the provider data management vs master data management argument starts on its own. One side wants a PDM platform. The other wants to extend the MDM the plan already runs. The directory is still wrong.
They are not rival products. They are different layers of work. PDM runs the provider-data workflow: outreach, attestation, network and contract data, directory updates and reporting. MDM decides which records describe the same provider, and which held value survives.
Both work on data the plan already holds. Neither checks a phone number or an address against the real world. Under CMS's proposed rule of 20 October 2026, internal plan data cannot prove those two elements for the new directory accuracy score, and together they carry 40% of it.
Below, ten common directory problems are each matched to the layer that fixes it, including the three neither fixes alone, with a 10-question check to find where yours sits.
Provider data management (PDM): No regulator or standards body defines provider data management; Gartner's market description frames it as payer-specific software. Our guide to healthcare data management treats the PDM system as the destination provider data flows into.
Master data management (MDM): Gartner defines MDM as "a technology-enabled business discipline" for keeping shared master data uniform and governed. In CMS's own provider MDM, records whose similarity clears a threshold "are presumed to represent the same entity." This guide covers provider MDM, not the patient index (EMPI).
Vendors split on whether PDM is provider MDM or a payer application, so this guide compares layers of work, not labels.
- PDM runs the workflow: it carries outreach, attestation, network and contract data, directory updates and reporting.
- MDM decides identity: it settles which records are the same provider and which held value wins, using only what the plan holds.
- Neither knows a provider moved: an MDM sees only staleness that one of its own sources already recorded.
- The proposed score draws the line: as proposed, CMS will not accept internal plan data for phone and address, 40% of the score.
- No outcome evidence: we found no independent study showing either tool raises measured directory accuracy (searched 23 October 2026).
The problem-to-layer map
Find your problem, then read its numbered section below.
| Problem | Which layer fixes it | What it takes when neither does |
|---|---|---|
| 1. Same provider recorded several times | MDM (matching); some PDM products also match, so check | Not needed |
| 2. Directory disagrees with your own files | MDM makes files consistent, not correct | Provider contact to settle which value is right |
| 3. Wrong network participation status | PDM (contract and network data) | Not needed |
| 4. Running the 90-day verification cycle | PDM (outreach, attestation, cadence) | Not needed |
| 5. Wrong phone or address | Neither alone | Fresh external data to find the likely change; phone, e-mail or attestation to confirm |
| 6. Provider moved and told nobody | Neither alone | Fresh external data to find the move; contact to verify |
| 7. Conflicting NPI, taxonomy or specialty | MDM (survivorship), within limits | Licence and credentialing checks; an NPI proves no licence |
| 8. Ghost networks | PDM, with claims or encounter data | Contact to correct the listing |
| 9. Proving phone and address for the score | Neither alone | As proposed, only phone, e-mail or provider attestation counts |
| 10. One provider ID across every system | MDM | Not needed |
"Neither alone" means neither layer fixes it without fresh external data plus provider contact, whichever product you buy.
Scoring references are to CMS's proposed rule of 20 October 2026 (comments close 15 December 2026). They may change in the final rule.
How this map was built: from each layer's defined and documented job, and from what the proposed rule lets internal data prove. The layer is the decision; the product label is not.
Ten directory problems and the layer that fixes each
Each problem below says whose job it is, what the other layer does, the evidence and a verdict.
1. Duplicate records for the same provider
If your problem is duplicate provider records, this is an MDM job, because matching and linking records under one ID is what MDM is built to do. The same practitioner appears in credentialing, claims and the directory under name variants.
CMS's own MDM matches records within and across sources such as PECOS and NPPES, and links them under an enterprise identifier. Matches are "presumed to represent the same entity." A false merge fuses two providers, and its blast radius includes the second record, now gone and unchecked; a false split keeps one provider twice, and one twin goes stale. See how entity matching resolves duplicate provider records.
Some products sold as PDM include matching and some do not; the label does not tell you. We found no published precision or recall for provider-record matching (searched October 2026), so a vendor's "match rate" is not a measurement.
This is an MDM job; if the product is labelled PDM, ask whether it matches records at all.
2. A directory that disagrees with your own files
If your problem is a directory that disagrees with your credentialing, contract or claims files, this is an MDM job, because reconciling conflicting copies is what survivorship does. In Pennsylvania's ACA Marketplace for plan year 2024, only about a third (35.3%) of the mental health counselor listings carriers filed with regulators fully matched their own consumer directories, and 19.9% were absent from them (Haeder and Zhu, American Journal of Managed Care, September 2025).
Survivorship picks one value per field from what your sources hold. PDM carries the outreach that can settle which value is right. A mismatch tells you the files disagree, not which one is wrong, and reconciling to the wrong value makes the error consistent in every system. A data quality framework helps validate inputs before they reach the master.
Consistency is an MDM job; settling which value is right still takes the provider.
3. Wrong network participation status
If your problem is wrong network status, this is a PDM job, because contract and network data are what PDM carries. Gartner's PDM feature list (updated May 2023) includes validating "the demographic and contract data of providers" and in- and out-of-network combinations. An MDM gets status right only if the contract system feeds the master.
Status carries 40% of CMS's proposed score, and cost sharing rides on it. Under the No Surprises Act (NSA), for commercial and exchange plans since 2022, a member who relied on a listing showing a provider as participating pays no more than in-network cost sharing. For Medicare Advantage (MA), proposed § 422.124 would set a similar limit from contract year 2028.
As proposed, internal plan information and claims data may score this element. A contract feed still misses a provider who quietly left a group still under contract.
This is a PDM job, and internal data may score it.
4. Running the 90-day verification cycle
If your problem is keeping up with the 90-day verification cycle, this is a PDM job, because outreach, attestation and cadence are its workflow. Attestation tracking, the unable-to-verify flag, updates and reporting sit in PDM; MDM documents none of them.
The NSA requires verification at least every 90 days and an update within 2 business days of receiving a provider's or facility's submitted information. Today's MA rule, 42 CFR 422.111(m), requires an update within 30 days of becoming aware of a change and attestation at least annually. DataSpring (formerly CAQH), the industry attestation utility, works from data "entered, updated, and confirmed directly from physician practices". Practice-side portal work sits upstream of both layers.
The cycle has not fixed the measured number. In a JAMA Health Forum study of PPO mental health listings at the largest commercial carrier in each of five states, October 2025 to March 2026, errors affected 55.6% of evaluable calls, more than three years after the NSA provisions took effect. An update date records a touch, not a verification, so store last-verified separately.
This is a PDM job.
5. Wrong phone numbers and addresses
If your problem is wrong phone numbers and addresses, neither layer fixes it alone, because both work from copies of the value you already hold. CMS called provider offices in MA reviews from 2022 to 2024 and found at least one deficiency in 44.29% of 18,852 location listings (about 8,350), including wrong phones and addresses. That is a CMS finding, not a national rate. In the JAMA Health Forum study, contact errors were the most common type (31.0% of evaluable calls), and 257 calls (11.4%) reached a disconnected or out-of-service number.
Survivorship cannot output a fact no source holds, and address standardisation fixes format, not currency. PDM runs the outreach that can confirm a value.
The fix has two steps: fresh external data finds which records probably changed, then provider contact confirms. Neither layer supplies step one.
Neither layer fixes this alone.
6. A provider who moved and told nobody
If your problem is providers who move without telling you, neither layer fixes it alone, because no source you hold records the move. About 4% of physicians billing traditional Medicare moved practice each year in the 2010s (3.7% in 2010, 4.2% in 2014), according to a study of all traditional Medicare billing (Bond et al., Annals of Internal Medicine, 2023).
An MDM sees only staleness that one of its own sources already recorded: a claims gap, a returned mailing, a last-verified date past 90 days. If no held source has the move, the reconciled record is confidently stale. PDM's cycle catches it only if outreach reaches the provider.
"Real-time" moves data faster, not fresher. The MA Provider Directory API under 42 CFR 422.120 runs on the same 30-day clock as the directory.
Neither layer fixes this alone: it takes fresh external data that shows the move, then provider contact to verify it.
7. Conflicting NPI, taxonomy or specialty
If your problem is sources that disagree on NPI, taxonomy or specialty, this is an MDM job, because survivorship rules decide which held value wins. The rule is the plan's choice: source priority, most recent, or field-by-field trust. "Most recent wins" reads a date that records a touch, not a check.
The National Provider Identifier (NPI) has limits as a key. A group NPI identifies the organisation, not who works there. Non-primary practice locations sit in a separate NPPES file, so a master loading only the main file holds one address per provider. A record can carry up to 15 taxonomy codes with one flagged primary, which makes "the specialty" a survivorship decision.
An NPI is enumeration, not attestation: CMS says issuing one "does not ensure or validate" that a provider is licensed or credentialed. No published rule settles contract data against provider-attested data, so that tie-break is your documented choice. Our roundup of NPI data tools covers datasets built on the registry.
This is an MDM job within limits: it picks among held values, and an NPI proves no licence.
8. Ghost networks
If your problem is ghost networks, this is a PDM job, run with claims data, because the evidence is activity the plan already records. In an October 2025 report, HHS-OIG used MA and Medicaid encounter data and counted network providers who "did not provide a service to any enrollees in that plan in 2023" as inactive. On average, 55% of listed behavioural health providers in the selected MA plans served none of that plan's enrollees (28% in Medicaid managed care). That is a utilisation figure, not a directory error rate.
OIG concluded that encounter data "can be used to identify inactive providers listed in a plan's network directory." An MDM would see this only if claims were loaded at provider-location grain. Plans do not run the join by default, but nothing prevents it. Correction still takes contact: is the provider gone, or only not seeing your members?
This is a PDM job with claims data; fixing the listing takes contact.
9. Proving phone and address for CMS's score
If your problem is proving phone and address for CMS's proposed score, neither layer fixes it alone, because as proposed only the provider can supply that evidence. The annual analysis, from contract year 2028, would use "a random sample of providers" plus each high-inaccuracy specialty, with scores published from 2029. PDM is where this reporting workflow would sit.
For the score only, internal data may confirm network status and specialty; contact information and address need telephone, e-mail or provider attestation. CMS's reason: internal data "may be dated and contain information about a provider that is not current (for example, an old address)." Public data sets are not on the proposed list.
A perfectly reconciled master still loses those points. Keep scoring and verification apart: for the 90-day verification itself, internal plan information is an unrestricted method.
Neither layer fixes this alone: it takes telephone, e-mail or provider attestation, run through PDM's outreach.
10. One provider ID across every system
If your problem is one provider identity across claims, CRM, analytics and the directory, this is an MDM job, because cross-domain identity is what MDM is defined to deliver. Gartner frames MDM around "the enterprise's official shared master data assets". CMS links records across programs and states. PDM, by Gartner's description, is payer-specific.
Grain matters: a directory needs provider-location-network rows, not only a person record (CMS's reviews counted 18,852 location listings for 11,360 providers). An enterprise ID is a key, not a verification. See matching across many source systems.
For health systems, the MDM question is usually credentialing and affiliation data; directory exposure comes through the plans they contract with.
This is an MDM job.
What CMS's proposed directory score measures
This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for legal guidance specific to your situation.
Problems 3, 5 and 9 all turn on one proposed score. The score is a proposed obligation on the payer. CMS published proposed rule CMS-4214-P at 91 FR 66408 on 20 October 2026, implementing the REAL Health Providers Act (section 6220 of the Consolidated Appropriations Act, 2026) for Medicare Advantage. Comments close 15 December 2026.
| Element | Weight | Methods that may score it (as proposed) | Evidence comes from |
|---|---|---|---|
| Network participation status | 40% | Internal plan data, claims, attestation | Plan records or the provider |
| Specialty | 10% | Internal plan data, claims, attestation, phone, e-mail | Plan records or the provider |
| Contact information, incl. telephone | 20% | Phone, e-mail, attestation | The provider |
| Primary office or facility address | 20% | Phone, e-mail, attestation | The provider |
| Accepting new patients | 3% | Phone, e-mail, attestation | The provider |
| Accommodations for people with disabilities | 3.5% | Phone, e-mail, attestation | The provider |
| Telehealth | 3.5% | Phone, e-mail, attestation | The provider |
Grades run from A (90 and above) to F (49 and below).
Verification is a separate clock: plans would verify each listed provider at least every 90 days using one or more of seven methods: internal plan information, telephone, e-mail, provider attestation, claims data, CMS data sources, and "other verification methods specified by CMS". Publicly available data sets are in the statute but not on that list. Plans would remove non-participating providers within 5 business days, update within 30 days, and flag providers they cannot verify. CMS is considering third-party certification of the score.
| Inputs (hypothetical) | Contribution |
|---|---|
| Status and specialty 100% right | 0.40 + 0.10 = 0.50 |
| Phone and address 56% right | 0.20 × 0.56 × 2 = 0.224 |
| Other three elements 100% right | 0.10; total 0.824, a score of 82 (B) |
As proposed in October 2026, internal plan data cannot score either element.
Under the No Surprises Act, the directory duties for group plans and issuers are statutory and in force, but the Departments (Labor, HHS and Treasury) never issued implementing regulations. Their August 2021 FAQ asked for "a good faith, reasonable interpretation of the statute" and said a plan would not be deemed out of compliance if it held misled members to in-network cost sharing. Medicaid managed care must update an electronic directory "no later than 30 calendar days" after receiving new information (§ 438.10(h)(3)(ii)).
Where do PDM and MDM both stop?
In practice, the score's refusal of internal data for an address, because it may be old, marks where both layers stop. Both stop at the edge of what the plan holds, because reconciling is not verifying: CMS's own MDM calls a match "presumed". Its directory team puts it plainly: "There is no reliable single source of truth for accurate provider information."
Without outside data, neither layer sees a move, a phone change or a closed location.
"Providers move, change phone numbers, leave practices or otherwise become unavailable, but those changes aren't always reflected in insurance directories." Simon F. Haeder, PhD, MPA, associate professor at The Ohio State University College of Public Health and lead author of the JAMA Health Forum study (16 October 2026).
It takes external change detection to find which records probably changed, then phone, e-mail or attestation to verify them. See our inventory of US healthcare provider data sources.
We looked for a peer-reviewed or government before-and-after measurement of directory accuracy following a PDM or MDM rollout, and found none (searched 23 October 2026). Vendor case studies exist, without a baseline or control. The one neutral study of a data-technology change found machine-readable directories "are not more accurate than the conventional provider directories" (AJMC, 2019).
Files seeded from the same registry extract or the same attestation can agree and all be wrong.
Forage AI collects provider data from public sources the plan specifies (practice websites, state licensing boards, public registries), structured to the plan's fields, and builds custom entity matching of provider records, delivered into the plan's PDM, MDM or warehouse. The plan owns the output. Its use is finding which records changed and which providers to verify first. As proposed, external data is not a scoring method, so it directs outreach and does not replace it.
Do you need PDM, MDM or both?
The answer follows from which rows of the map dominate your directory:
- PDM only: problems 3, 4 and 8 dominate, and records already resolve to one ID in your core administration system.
- MDM only: problems 1, 2, 7 and 10 dominate, and you have no directory publication duty, the typical health-system case.
- Both layers: duplicates and conflicts (1 and 2) feed a directory that will be scored on 3, 5 and 9. Whether one product carries both is a vendor question.
- Neither is enough on its own: problems 5, 6 and 9 dominate. Budget for external change detection and contact-based verification, whichever tool you choose.
Two shortcuts fail an honest diagnosis: choosing by label, and "you need both" as a default, unsupported by any outcome study. Once you know the layer, the next decision is who runs it.
How products package the two layers
The label tells you less than the layer. Gartner's PDM market lists 28 products, matching and reference-data products among them, and PDM-labelled pages we read on 23 October 2026 split on whether they match records. Classify by layer:
- Payer PDM applications: directory, network and contract workflow.
- Enterprise or healthcare MDM: matching, survivorship and cross-system identity.
- The attestation utility: DataSpring (formerly CAQH), where practices confirm their own data.
- Credentialing systems: licence and credential checks.
- Directory remediation and verification services: outreach run for the plan.
- External reference data and matching: outside data delivered into either layer.
Questions to ask a PDM or MDM vendor
- Which § 422.123 method covers each scored element?
- Is last-verified stored separately from last-updated?
- What are precision and recall on a labelled sample of our provider-location records, with merges and splits reported separately?
- Is survivorship configurable per field, and who sets it?
- Was the identity model built for providers or adapted from patient MDM?
- When every source agrees, what would tell you they are all wrong?
- Does "real-time" mean fresher, or only faster?
- What would a third-party certifier of the score see?
For any quoted accuracy gain, ask for the baseline, sample, method, and whether outreach ran at the same time.
Which layer is your problem in?
No study will tell you which tool fixes your directory. Your own data can tell you which layer the problem is in.
| Ask your team | If no or can't tell, the problem is in |
|---|---|
| 1. Does each provider resolve to one record across your systems? | MDM |
| 2. Pick 20 providers: do all your systems agree on phone, address and specialty? | MDM |
| 3. Where systems disagree, can you tell which value is right without contacting the provider? | Neither: provider contact |
| 4. Is network status fed from the contract system? | PDM (or MDM, if it owns that feed) |
| 5. Do you store last-verified separately from last-updated? | PDM |
| 6. Can you produce today's unable-to-verify list? | PDM |
| 7. Do you meet the deadlines (NSA: 2 business days after a provider's submission; MA as proposed: 5 business days to remove)? | PDM |
| 8. Would you learn of a move the provider never reported? | Neither: external data, then contact |
| 9. Can you list directory providers with no claims or encounters last year? | PDM, with claims data |
| 10. Do you check licences, rather than treating an active NPI as proof? | Neither: licence and credentialing checks |
Mostly 1, 2 and 4 means MDM-shaped. Mostly 4 to 7 and 9 means PDM-shaped. Both sets means both layers. Any of 3, 8 or 10 means neither purchase closes it, so budget for the outside input and for contact-based verification.
Frequently asked questions
What is provider data management in healthcare?
The work, and the software category, that keeps a plan's provider records usable: outreach and attestation, network and contract data, directory updates and reporting. No regulator defines it; Gartner frames PDM applications as payer-specific software.
What is the difference between provider data management and master data management?
Provider data management runs the provider-data workflow. Master data management decides which records are the same provider and which held value wins. Both work on data the plan already holds.
Do I need master data management if I already have a provider data management system?
Only if your problems are duplicates, conflicts or one ID across systems, and your PDM product does not match records. Run the 10-question check above.
Can master data management fix provider directory accuracy on its own?
No. It reconciles held sources. If none holds the current phone or address, the master is confidently wrong, and as proposed CMS will not score those elements from internal data.
What does CMS's proposed provider directory accuracy score measure?
Seven weighted elements: network status 40%, specialty 10%, phone 20%, address 20%, and 10% across the other three. CMS proposed it on 20 October 2026. Today's MA rule, § 422.111(m), requires updates within 30 days of becoming aware of a change and annual attestation.
Does PDM mean product data management?
Outside healthcare it usually does. Here, PDM means provider data management. Many "PDM vs MDM" searches mean the product-data sense.
Related articles
- Healthcare Data Management: how provider data reaches the PDM system that stores and publishes it
- US Healthcare Provider Data: Every Public Source, Ranked: where outside provider data comes from and how fresh each source is
- Best NPI Data Tools: NPI datasets and the tools built on them
- AI Entity Matching: how matching resolves duplicate records across sources
Sai is a data infrastructure enthusiast who has spent the past two to three years following the AI space closely, from the infrastructure layer to the fast-growing world of data for AI. He is genuinely curious about how modern data pipelines get built and where the data industry is heading, and he writes insightful pieces on the core topics that shape this niche.