How to Verify NPI Numbers in Bulk

Method 1: The NPPES API

CMS provides a free API for querying the NPI registry. This is the most reliable method for bulk verification because you are checking directly against the authoritative source.

How the API Works

The NPPES API endpoint is https://npiregistry.cms.hhs.gov/api/. You can query by NPI number, provider name, taxonomy code, state, or a combination of fields. The API returns JSON with the full provider record including name, address, taxonomy, enumeration date, and deactivation status.

Key parameters for bulk verification:

• number: The 10-digit NPI number you want to verify
• version: Set to "2.1" for the current API version
• limit: Number of results per query (max 200)

A single query looks like: GET /api/?number=1234567890&version=2.1

The API returns a result_count field. If it is 0, the NPI does not exist in the registry. If it returns a record, check the deactivation fields to confirm the NPI is still active.

Rate Limits and Practical Throughput

CMS does not publish official rate limits for the NPPES API, but the practical limit is roughly 2-3 requests per second before you start getting throttled or receiving timeout errors. At that rate, verifying 10,000 NPIs takes approximately 60-90 minutes.

Tips for maximizing throughput:

• Batch your requests with a consistent delay (400-500ms between calls)
• Implement retry logic with exponential backoff for failed requests
• Run verification during off-peak hours (evenings and weekends) when the API is less loaded
• Cache results locally so you do not re-verify NPIs you already checked recently

Method 3: NPI Checksum Validation

Before you even hit the CMS API or database, you can catch obviously invalid NPIs using the Luhn algorithm. NPI numbers use a modified version of the Luhn check digit formula (the same algorithm used to validate credit card numbers).

The process:

1. Prefix the 10-digit NPI with "80840" (the CMS prefix)
2. Apply the Luhn algorithm to the resulting 15-digit number
3. If the check digit is valid, the NPI is structurally correct
4. If it fails, the NPI is definitely invalid (no need to look it up)

Checksum validation catches typos, transposed digits, and completely fabricated NPIs. It does not confirm that the NPI is active or that it belongs to the provider you think it does. Use it as a fast pre-filter before running API or database verification.

In practice, running Luhn validation first catches 2-5% of NPIs in a typical vendor-sourced list. Those are records that should never have been in the data in the first place.

Common NPI Data Errors and How to Handle Them

After verifying millions of NPI records, these are the errors that come up most often:

• Transposed digits: Two adjacent digits are swapped. Luhn validation catches most of these. When the checksum passes but the NPI returns the wrong provider, check for single-digit transpositions.
• Deactivated NPIs still in use: Vendors often do not remove deactivated NPIs from their databases. Roughly 1-2% of records in a typical commercial provider list have deactivated NPIs.
• Type 1 / Type 2 confusion: An organizational NPI (Type 2) is listed where an individual NPI (Type 1) should be, or vice versa. This happens when the practice NPI is used instead of the physician's individual NPI.
• Duplicate NPIs for the same provider: Some providers have multiple active NPIs, usually because they registered a new one when changing practices instead of updating the existing one. CMS tries to catch these, but some slip through.
• Stale taxonomy codes: A provider changed their practice focus but never updated their taxonomy code with CMS. The NPI is valid, but the specialty data is outdated.

When to Skip DIY and Use a Verified Data Source

Building and maintaining an NPI verification pipeline is worthwhile if your organization manages tens of thousands of provider records and has engineering resources to maintain the infrastructure. If you are a sales team that needs a verified provider list for a campaign, the time and effort of building this pipeline from scratch does not make sense.

Provyx runs NPI verification as part of every data delivery. Every record is checked against current CMS data, matched on name and taxonomy, and flagged if anything does not align. You get clean data without building the verification infrastructure yourself.

For teams that want to verify their existing data, send us a sample and we will run it through our verification pipeline and show you what your current error rate looks like. Most teams are surprised by the results.