How to verify an NPI number

What an NPI is, and what verifying it means

The National Provider Identifier is the 10-digit number HIPAA requires health care providers to use on standard transactions such as claims. Individuals get a Type 1 NPI; organizations such as clinics, group practices and pharmacies get a Type 2. The number never changes, even when the provider moves or changes specialty.

Verifying an NPI is not one check but a ladder. At the bottom, you confirm the number is well-formed. At the top, you confirm that the person in front of you is the person the number belongs to, that they are licensed, that Medicare will pay for their work, and that they aren’t excluded. Most mistakes happen when someone stops at the first or second rung.

The seven checks at a glance

Check 1 and 2: format and check digit

Every NPI has 10 digits and starts with 1 or 2. The last digit is a check digit, calculated by CMS from the first nine with the Luhn formula, after adding the prefix 80840 (CMS, NPI check digit). The prefix always adds the same amount, 24, so you can work with the nine digits directly:

1. Starting from the right of the first nine digits, double every other digit (the 9th, 7th, 5th, 3rd and 1st).
2. If doubling gives a two-digit number, add its digits together (for example 14 becomes 1 + 4 = 5).
3. Add up all nine resulting digits, then add 24.
4. The check digit is the number that brings the total up to the next multiple of 10.

Worked example: CMS’s own sample, 123456789?

The digits add up to 2 + 2 + 6 + 4 + 1 + 6 + 5 + 8 + 9 = 43. Adding 24 gives 67. The next multiple of 10 is 70, so the check digit is 3, and the full number is 1234567893. Our NPI lookup does this as you type.

A second example: 1821137118

Take the first nine digits, 1 8 2 1 1 3 7 1 1. Doubling every other digit from the right (the 1st, 3rd, 5th, 7th and 9th) gives 2, 8, 4, 1, 2, 3, 5 (from 14), 1, 2. Those add up to 28; plus 24 makes 52. The next multiple of 10 is 60, so the check digit must be 8, and it is: the number passes. Now swap the last two digits by mistake, 1821137181: the first nine digits are now 182113718, whose check digit works out as 3, but the number ends in 1, so the typo is caught. Passing the test only says the number is well-formed; the registry check says whether it was issued.

Check 3: the registry record

The CMS NPI Registry (NPPES) is the official public record. Search it by number on the CMS registry or with our lookup, which shows the full record. Look for:

• Status. The public registry shows active NPIs. If a valid-looking number returns nothing, it may be deactivated. CMS’s deactivation reason codes are death, disbandment (an organization that dissolved), fraud and other (CMS code values). A deactivated NPI can be reactivated, and the record then shows a reactivation date.
• Type. Type 1 is a person, Type 2 an organization. A Type 2 NPI on a claim that needs an individual (for example, the ordering provider) is a problem.
• Name and other names. Including former names, which matter for exclusion screening.
• Taxonomy. The specialty code the provider chose. One is marked primary.
• Addresses. Practice location and mailing address, plus any other practice locations.
• Last updated. A record untouched for many years is more likely to be stale. Providers must report changes within 30 days (45 CFR 162.410), but many don’t.

Check 4: is it really this person’s NPI?

NPIs are public, so anyone can copy one. Matching the record to the person is what makes the check meaningful. Compare the registry record with the person’s photo ID, license and application: full name (and former names), credential, specialty and city or state. A nurse practitioner whose NPI belongs to a physician of the same surname, or an organization whose NPI lists a different address and authorized official, deserves a direct question.

Check 5: the license

Open the state board’s official search for every state where the person practices. Our license lookup links the search for all 50 states and DC, and Nursys for nurses. Confirm the status, the expiration date, and any public orders or restrictions.

Check 6: Medicare status

If you bill Medicare, or rely on a provider’s orders and referrals, three CMS public datasets tell you a lot:

• Enrollment. CMS’s Revalidation Due Date List lists Medicare enrollments with state, provider type, specialty and, when it is within six months, the revalidation due date (CMS).
• Ordering and referring. The Order and Referring file lists individuals eligible to order or refer, by category. Medicare denies claims for ordered services when the orderer isn’t eligible; see our guide to checking ordering and referring.
• Opt-out. The Opt Out Affidavits list shows providers who opted out of Medicare and the dates (CMS).

Our NPI lookup shows all three on every result. For a billing decision, confirm in PECOS or with your Medicare Administrative Contractor.

Check 7: exclusions

An NPI says nothing about exclusions. Screen the person and the NPI against the OIG list, SAM.gov and the state Medicaid lists. Our lookup does this for every result, by NPI and by name, against 32 state lists, and our guide to OIG vs SAM vs state lists explains why all three matter.

Type 1, Type 2 and common situations

Most confusion comes from mixing up whose NPI goes where. A few rules of thumb:

NPI vs the other numbers in a provider file

An NPI is one of several identifiers, and each answers a different question. The NPI identifies the provider in HIPAA transactions. A state license number shows the right to practice in that state. A DEA registration number allows prescribing controlled substances. A Medicare PTAN is the number Medicare assigns to an enrollment, and a state Medicaid ID does the same for Medicaid. A tax identification number identifies who gets paid. A complete provider file holds each of them, verified at its own source; none substitutes for another.

Red flags worth a second look

• The record’s specialty doesn’t fit the job, for example a dermatology taxonomy on a new physical therapist.
• The name differs from the ID, and there’s no former name to explain it.
• A Type 2 NPI where a person is expected, or the reverse.
• An enumeration date after the work started. Claims or orders dated before the NPI existed.
• A record last updated many years ago with an address or license that no longer matches anything else.
• The number passes the check digit but isn’t in the registry, with no clear explanation.

Each of these usually has an innocent explanation. Ask, write down the answer, and fix what needs fixing before claims go out.

If it’s your own NPI: keeping it right

Providers and organizations manage their records in NPPES. HIPAA rules require covered providers to report changes to their required NPI data within 30 days (45 CFR 162.410). Practices that keep their own providers’ records current avoid most of the mismatches in this guide:

• Update addresses, names and taxonomies when they change, and add every state license.
• Remove old practice locations so referral sources and directories stop using them.
• Remember that NPPES is separate from Medicare enrollment (PECOS) and from each health plan’s records. A change in one doesn’t update the others.
• When an organization closes or a provider dies, the NPI can be deactivated through NPPES; a deactivated NPI can later be reactivated if needed.

Five examples

The people and organizations below are invented.

1. A transposed digit

A billing specialist types 1234567839 instead of 1234567893. The check-digit test fails before the claim goes anywhere. Re-reading the source document fixes it in seconds.

2. Valid, but not found

A referral form carries an NPI that passes the check digit, but the registry returns nothing. The physician retired and his NPI was deactivated last year; his former group is still using old referral pads. The practice calls the group and gets the current ordering physician’s NPI.

3. The right number, the wrong person

A new hire, “Dr. A. Patel”, gives an NPI that looks up as an active internal medicine physician in another city. The new hire is a physical therapist. Both are real people with the same surname and initial; the applicant copied the wrong record by mistake. The practice gets the right NPI and checks it again.

4. Active NPI, opted out of Medicare

A clinic plans to bill Medicare for a psychiatrist’s visits. The NPI is active and the license is clear, but CMS’s opt-out list shows an opt-out running for two more years. The clinic can’t bill Medicare for her services during that time, and sets up private contracts for Medicare patients instead, as opt-out rules require.

5. A stale record

A home health agency’s referral source has an NPI record last updated eight years ago, listing an old address and an expired license number. The board shows a current license with a new number. The record is out of date, not wrong; the agency notes the board record in its file and moves on.

For billing teams: NPIs on incoming orders and claims

Billing teams see NPIs on referral forms, prescriptions, orders and claims from other providers, often hundreds a month. A light routine catches most problems before they cost money:

• Validate on entry. Reject a number that fails the check digit at the moment it’s typed, so a typo never reaches a claim.
• Look up new numbers once, then keep the verified name, type and NPI in your system so staff pick from a list rather than retyping.
• Re-check the list regularly. Monthly is a sensible rhythm for active referrers: NPIs get deactivated, enrollments lapse, opt-outs start.
• Match the name exactly as it appears in the provider’s enrollment, especially for ordering and referring providers.
• Use the individual NPI for people and the organization NPI for the billing entity. Swapping them is one of the most common rejection causes.

What evidence to keep

An auditor or payer asking “how did you know?” wants a dated record. For each provider you verify, keep:

• The registry record as it looked that day (a PDF or printout with the date).
• The license verification from each state board.
• The Medicare status you relied on, with the CMS dataset date.
• The exclusion screening record, with the lists and dates used.
• Who checked, when, and any note on findings and decisions.

Our lookup’s PDF record includes the screening lists and dates, and every result can be printed or emailed to yourself.

Printable checklist

Need to check many? The bulk NPI lookup runs checks 1–3, 6 and 7 for up to 100 NPIs and exports CSV and PDF.

What these checks can’t tell you

• None of them proves identity on its own; compare with ID.
• Registry details are self-reported and can be stale.
• CMS public datasets are official but are not PECOS; confirm enrollment there for billing decisions.
• Name matches on exclusion lists must be confirmed on the official source.

Questions

Sources

1. CMS, Requirements for the NPI check digit (Luhn formula with the 80840 prefix) — the NPI check-digit formula and CMS’s worked example
2. CMS, NPI Fact Sheet (December 2024) — an NPI does not ensure licensure or credentialing; NPPES data is self-reported
3. 45 CFR 162.410, Implementation specifications: health care providers (report changes within 30 days) — providers must report changes to NPI data within 30 days
4. CMS, NPPES Data Dissemination code values (deactivation reasons: death, disbandment, fraud, other) — deactivation reason codes
5. CMS, NPPES (apply for, update or deactivate an NPI) — applying for, updating and deactivating NPIs
6. CMS, NPPES NPI Registry API — the public registry search
7. CMS, Revalidation Due Date List dataset (due dates set for the next six months; others TBD) — Medicare enrollment
8. CMS, Order and Referring dataset — ordering and referring eligibility
9. CMS, Opt Out Affidavits dataset — Medicare opt-outs
10. HHS OIG, LEIE downloadable database — OIG exclusions

Checked October 27, 2026. General information, not legal or billing advice. Examples use invented people and organizations.