What a Provider Directory File Actually Contains: Fields, Sources and Refresh Cadence

Fields and sources checked 26 October 2026. CMS's new directory rule is proposed, not final.

Open a vendor's sample file and the columns look familiar: NPI, name, specialty, address, phone, network, accepting new patients. The dictionary rarely says who wrote each column or how old it is, so teams trust fields the file never asserted and find out at load or audit.

Provider directory data is not one dataset. It is about a dozen fields written by seven origins, on clocks that run from daily to five years. This is provider data, not patient data.

Below are the 12 fields a directory file usually carries, where each comes from, how often that source refreshes, and ten checks to run on a sample first.

Provider directory fields at a glance

Each field, who writes it, and how often that writer republishes.

Field	Written by	Published refresh (as stated)	Watch-out
NPI and entity type	NPPES	Monthly, weekly updates	Type 1 and 2 are separate keys
Name and credential text	NPPES, PECOS	Monthly	Typed, not verified
Specialty and taxonomy	Provider, PECOS, plan	NUCC: January and July	Self-selected; not a licence
Licence and board certification	State boards; DataSpring (formerly CAQH)	Varies by board	NPPES slot is self-reported
Practice address	NPPES, PECOS, plan	Monthly	Mailing and practice mixed
Phone	NPPES, PECOS, plan	Monthly	Blank may mean several numbers
Network participation	The plan only	MA: 30 days	Varies by location and plan
Accepting new patients	The plan	30 days	Per location and network
Telehealth	Medicare claims, or the plan	Monthly	Billed vs offered
Accessibility and languages	The plan	30 days	No accuracy study found
Group and hospital affiliation	PECOS; Facility Affiliation file	Monthly	Two separate files
Record dates	NPPES and each origin	Monthly deactivation file	Updated is not verified

Cadences as each publisher states them, read 26 October 2026. A release date is not when each value was checked; no source publishes a last-verified date per field.

What must a provider directory contain?

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for legal guidance specific to your situation.

Four lists set the minimum columns behind CMS provider directory requirements, and each is the plan's obligation, not the vendor's.

Field	MA API (422.120)	Medicaid (438.10(h)(1))	REAL Health Providers Act (from 2028)	CMS-4214-P (proposed)
Name	Yes	Yes	Yes	Yes
Group affiliation	No	Yes	No	No
Address	Yes	Yes	Yes	Yes
Phone	Yes	Yes	Yes	Yes
Website	No	Yes	No	No
Specialty	Yes	Yes	Yes	Yes
Accepting new patients	No	Yes	Yes	Yes
Languages and cultural capabilities	No	Yes	Yes	Yes
Accessibility	No	Yes	Yes	Yes
Telehealth	No	Yes	Yes	Yes
Ownership or control disclosure	No	No	No	Yes

NPI and licence appear in none of the four lists. Medicare Advantage (MA) and Medicaid run 30-day update clocks (42 CFR 422.111(m), 438.10(h)(3)); commercial plans verify every 90 days (No Surprises Act). CMS's proposed directory rule would add 90-day practitioner verification from 2028; comments close 15 December 2026.

Where do provider directory fields come from?

Seven origins write provider directory data, each on its own clock.

• NPPES (National Plan and Provider Enumeration System): the NPI registry, updated by the provider.
• PECOS (Provider Enrollment, Chain, and Ownership System): Medicare enrolment, behind the Doctors and Clinicians files.
• NUCC (National Uniform Claim Committee): the taxonomy code set.
• State licensing boards: issue and verify licences.
• DataSpring (formerly CAQH): where providers attest their own profile.
• The health plan: its directory and Provider Directory API (HL7 Plan-Net is the format CMS encourages).
• LEIE: OIG's List of Excluded Individuals/Entities.

For what each holds and how to access it, see every public provider data source, ranked by coverage and freshness.

The 12 provider directory fields, one by one

Each field card below comes from CMS, NUCC and Plan-Net documentation read in October 2026. Here's how it actually works.

Identity fields

Both come from NPPES; see what NPI datasets and APIs contain.

1. NPI and entity type

Attribute	Detail
What it means	10-digit ID; Type 1 person, Type 2 organisation
Originates at	NPPES; the provider applies
That source's published refresh	Monthly file, weekly updates, deactivation file
Required by	No list; it is the join key
Documented failure	No published measurement found (October 2026)
How to test it	Match NPIs to the latest deactivation file; keep Type 1 and Type 2 apart

CMS states that issuing an NPI "does not ensure or validate" a licence or credential. NPIs are never reassigned (45 CFR 162.408), and per CMS's NPPES data dissemination page, weekly files carry new deactivations. An NPI list is identity, not a directory.

2. Name and credential text

Attribute	Detail
What it means	Legal name, other names, credentials (MD, DO, NP)
Originates at	NPPES (self-reported); PECOS
That source's published refresh	Monthly
Required by	All four lists
Documented failure	No published measurement found (October 2026)
How to test it	Confirm a Version 2 build

NPPES dropped Version 1 on 3 March 2026; Version 2 extends first-name and legal-business-name limits, so older Version 1 loads may hold truncated names. Credential text is typed, not verified, though CMS's proposed score calls name "likely to be correct."

Specialty and licensure fields

3. Specialty and taxonomy code

Attribute	Detail
What it means	NUCC taxonomy code; specialty text
Originates at	Provider picks the code; PECOS; plan
That source's published refresh	NUCC: dated January and July (current 26.1)
Required by	All four lists; proposed weight 10
Documented failure	Specialty errors in 22.2% of 2,252 evaluable mental health calls (JAMA Health Forum, October 2026)
How to test it	Check codes against the current release

NUCC says codes "are self-selected by the provider" and scope of licensure "is not within the purview of the taxonomy code set." Doctors and Clinicians specialty is "reported by the individual clinician." A mismatch shows the files disagree, not which is wrong; see which layer fixes it.

4. Licence number, state and board certification

Attribute	Detail
What it means	Licence number, state, status, expiry; board certification
Originates at	State board; certifiers such as the American Board of Medical Specialties
That source's published refresh	No national cadence; Alabama (2020 statement) and Minnesota daily
Required by	None of the four lists
Documented failure	Alabama: licensee-submitted specialty and location "not verified" (2020 statement)
How to test it	Use a dated board lookup

DataSpring prompts providers to re-attest every 120 days (its current FAQ, written for dentists; CAQH's 2015 guide gives 120, or 180 in Illinois), confirming a profile, not each field. Exclusion is a monthly LEIE screen.

Location and contact fields

5. Practice address

Attribute	Detail
What it means	Where care is delivered; often several
Originates at	NPPES and Practice Location Reference File; PECOS; plan
That source's published refresh	Doctors and Clinicians monthly (next 12 November 2026)
Required by	All four lists; proposed weight 20
Documented failure	21% of in-network maternal health providers did not work at one or more listed locations (OIG, June 2026)
How to test it	Label practice vs mailing

CMS's own README calls mailing and practice addresses "consistently conflated." Medicare-enrolled providers must report practice-location changes in PECOS within 30 days (42 CFR 424.516(d)(1)), but a duty to report is not proof of a report.

6. Phone

Attribute	Detail
What it means	Office number for that location
Originates at	NPPES; Doctors and Clinicians; plan
That source's published refresh	As the address origins
Required by	All four lists; proposed weight 20
Documented failure	Contact errors in 31.0% of evaluable calls; 11.4% hit disconnected numbers (JAMA Health Forum, October 2026)
How to test it	Call a random sample

Doctors and Clinicians lists a phone "only when there is a single phone number available for the address," so a blank can mean several numbers. OIG found 33 percent of in-network providers reported at least one inaccurate phone number and/or address.

Network and availability fields

7. Network and plan participation

Attribute	Detail
What it means	Plans and networks, per location
Originates at	The plan only
That source's published refresh	MA: 30 days; commercial: verify every 90
Required by	Not a list element; proposed weight 40
Documented failure	9% of listed providers said they were not in network; 22% in network were unlisted (OIG, June 2026)
How to test it	Confirm by phone, per location

Weight 40 is CMS's view of importance, not error frequency. The No Surprises Act's 2 business days run from a provider's submission, not from the change. Plan-Net puts a network reference on each PractitionerRole, so one clinician's status can differ by location.

8. Accepting new patients

Attribute	Detail
What it means	New patients taken, per location and network
Originates at	The plan, from the practice
That source's published refresh	30 days from receipt
Required by	Medicaid, REAL Act, proposed rule; weight 3
Documented failure	No published measurement found (October 2026)
How to test it	Ask the flag's grain, then call

Plan-Net models it "by location and network" with four codes: not accepting, accepting, accepting existing patients, and accepting existing patients and their families. A per-provider Y/N loses two states and the grain. CMS weights it 3 because it "could change more frequently."

9. Telehealth

Attribute	Detail
What it means	Billed telehealth, or offers it now
Originates at	Medicare claims, or the plan
That source's published refresh	Monthly; 12-month claims lookback
Required by	Medicaid, REAL Act, proposed rule; weight 3.5
Documented failure	No published measurement found (October 2026)
How to test it	Check which meaning applies

Same column, two meanings. In Doctors and Clinicians, "Y" means Medicare fee-for-service claims indicate the clinician offers telehealth, refreshed "as technically feasible." In a plan directory, it is what the plan says the provider offers. Never merge the two silently.

10. Accessibility and languages

Attribute	Detail
What it means	Disability accommodations; languages, including ASL
Originates at	The plan (Plan-Net: accessibility on location, languages on clinician)
That source's published refresh	30 days from receipt
Required by	Medicaid, REAL Act, proposed rule; accommodations 3.5
Documented failure	No published measurement found (October 2026)
How to test it	Check whose claim, at what grain

Medicaid's wording is the most specific we found: offices, exam rooms, equipment, American Sign Language and skilled medical interpreters. Because Plan-Net holds the halves at different grains, one per-provider value loses one. CMS leaves languages unscored as "difficult to consistently evaluate."

Affiliation and record-status fields

11. Group and hospital affiliation

Attribute	Detail
What it means	Group practice; hospitals served
Originates at	PECOS via Doctors and Clinicians; Facility Affiliation file (CCN)
That source's published refresh	Monthly; next 12 November 2026
Required by	Group: Medicaid; hospital: none
Documented failure	No published measurement found (October 2026)
How to test it	Deduplicate to one row per NPI

Doctors and Clinicians holds one row per NPI, enrolment, group and address, so a naive NPI join multiplies rows and widens the blast radius of every later error. CMS obtains or verifies part of PECOS group data using claims; see matching one provider across files.

12. Record dates and the missing "last verified"

Attribute	Detail
What it means	Enumeration, update, deactivation dates
Originates at	NPPES; each dataset's metadata
That source's published refresh	Monthly deactivation file
Required by	None; proposed rule adds a "may not be up to date" flag
Documented failure	None of the sources we read publishes a per-field last-verified date (October 2026)
How to test it	Ask for a verified date per field

The NPPES Last Update Date records a touch, not a check. Plan-Net's only date is an optional resource-level meta stamp, with no verification-date element, and PECOS edits can take up to four months to reach the public file.

How fast each field's source must record a change

Refresh has two meanings: how often a file is reissued (the roster) and how old a value in it can be (these clocks). Weights show importance, not error frequency.

Field	Who must record a change, and how fast	What it does not certify	CMS weight (proposed)
NPI and entity type	NPPES 30 days (covered only)	A licence	Not scored
Name and credential text	As NPI	A credential	Not scored
Specialty and taxonomy	NPPES 30; PECOS 90; plan 30 days	Scope of licensure	10
Licence and board certification	Board; re-attest every 120 days (DataSpring)	Anything, if from NPPES	Not scored
Practice address	PECOS 30; plan 30; then up to 4 months	Current practice there	20
Phone	NPPES 30; plan 30 days	That it connects	20
Network participation	Plan: 30 days (MA); verify every 90	Every location	40
Accepting new patients	Plan, 30 days	Every location and network	3
Telehealth	Claims lookback, or plan	Offered today	3.5
Accessibility and languages	Plan, 30 days	An on-site check	3.5 (languages unscored)
Group and hospital affiliation	PECOS: no day count; hospital: no duty	Current privileges	Not scored
Record dates	Not applicable	Last updated is not last verified	"May not be up to date" flag

Which fields go stale fastest?

No study ranks fields by staleness, and pooled figures would mislead. A value is as current as its origin's clock plus processing lag, not the file's date (see timeliness as a data quality dimension). First, a practice change takes a 30-day PECOS duty, then up to four months of processing.

Second, NPPES providers that are not covered entities have no update duty. Third, CMS expects accepting new patients to change more often; fourth, contact information was the most prevalent error type in the JAMA Health Forum study.

So call on phone, address, network status and accepting new patients first, the four fields Medicaid's secret-shopper rule names (42 CFR 438.68(f)(1)(ii)). Stale is not wrong; a call settles it.

How do you test a provider directory file before relying on it?

A healthcare provider directory verification process for one file: cheap checks first, then a contact test, each from a published design.

File checks

1. Layout: NPPES Version 2, with the readme inside the zip, not the 2013 edition CMS still links.
2. Deactivations: NPIs matched to the monthly deactivation file and, per CMS, the weeklies.
3. Locations: practice and mailing addresses labelled.
4. Grain: Doctors and Clinicians deduplicated to one row per NPI.
5. Vintage: the release matches the origin's latest. This returns modified, released and nextUpdateDate:

curl -s "https://data.cms.gov/provider-data/api/1/metastore/schemas/dataset/items/mj5m-pzi6"

Contact test

6. Frame: a random sample unique on provider, address and phone (proposed rule).
7. Oversample: your priority specialties, as the proposed rule does (65% general, 35% mental health or substance use disorder).
8. Call first: network status, address, phone and accepting new patients.
9. Score per field: never one pass or fail per record.
10. Date it: record a verified date and method per field.

No published design sets a sample size or pass threshold; the proposed rule leaves sample size open, and its letter grades are the only provider network accuracy scoring proposed. Two files agreeing is consistency, not currency.

Then ask the vendor each field's origin, vintage, and verified date and method. Go deeper with building the pipeline that keeps those fields current.

Why Forage AI for provider directory data

Re-run the ten checks on every new vendor file and when CMS finalises CMS-4214-P. In practice, the 12 field cards become the specification for whoever builds or buys the file.

Where a field's only fresh origin is a public web source (practice websites, licensing board lookups, public registries), Forage AI builds and runs provider data extraction for the fields you specify, from sources you name, to your schema, with custom provider directory matching. You own the output, delivered as CSV, JSON or XML, by API or to your warehouse. It is not a pre-built provider file or dataset, directory platform or verification service; verification under CMS rules stays with the plan.

Choose Forage AI if you need specified fields collected fresh from public sources you name and matched to your directory.

Choose a licensed provider directory file if a vendor's existing coverage, refresh and per-field verification method already meet your specification.

Frequently asked questions

What are the CMS provider directory requirements?

Medicare Advantage plans report directory changes within 30 days of becoming aware, and their Provider Directory API carries names, addresses, phone numbers and specialties. Medicaid lists nine elements on a 30-day clock. CMS-4214-P is proposed, not final.

How often must provider directory data be verified?

Commercial plans verify at least every 90 days and update within 2 business days of a provider's submission. CMS's proposed rule would have Medicare Advantage plans verify practitioners every 90 days and facilities every 12 months.

What is the Provider Directory API, and is Plan-Net required?

Medicare Advantage, Medicaid and CHIP plans must offer one with names, addresses, phone numbers and specialties. Plan-Net is the HL7 guide CMS encourages. The API follows the directory's 30-day clock, so it is no more current than a file.

How often is the NPPES data dissemination file updated?

CMS publishes a monthly full file, weekly incrementals (which CMS says include newly deactivated NPIs) and a monthly deactivation file. Only Version 2 has been supported since 3 March 2026.

Related articles

• US Healthcare Provider Data Sources: every public provider data source, ranked by coverage and freshness.
• NPI Data Tools: what NPI datasets and APIs contain.
• Provider Data Management vs Master Data Management: which layer fixes which kind of directory error.
• Healthcare Data Extraction Guide: the practical challenges of pulling health data from public sources.