DowncodedWhat Does the Federal Record Say About Your Doctors?
CMS is running an open FHIR API over the national provider directory at directory.cms.gov, with 35.7 million rows and no login. Fifty-nine percent of it is the affiliation table, every practitioner record carries an HHS exclusion-list flag, and the Medicare Advantage plans feeding it now owe CMS a 30-day refresh clock and an annual accuracy attestation.
There is a government URL that will tell you every organization Medicare thinks one of your physicians is attached to, and it does not ask who you are.
It is directory.cms.gov/fhir. It answers FHIR R4, and it has no key, no registration form, and no login.
We pointed a plain unauthenticated request at it this morning and it returned records.
CMS spent Monday publishing a readout celebrating a year of its health technology push, and listed the National Provider Directory among the things it shipped. The celebration is the part that got written up.
The queryable API sitting under it is the part worth an hour of your week.
What Is Actually In There
35,672,939 records across six resource types, as of this morning (chart below).
The shape of that is the whole point. PractitionerRole is 59% of the file, and PractitionerRole is the join: this clinician, at this organization, at this location, in this specialty.
Practitioner on its own is a person with an NPI, which you already have from NPPES. Organization on its own is a tax ID with a name.
The affiliation row is the one a network dispute is actually about, and until now the only copies of it lived inside your credentialing system and inside the plan's.
Two more numbers worth having before you query it. Of the 21.1 million PractitionerRole rows, 4,106,116 come back on ?active=true, so the live affiliations are one parameter away.
And 7,196,365 of the 7.4 million Practitioner records are flagged active, against 244,846 that are not.
Records we sampled carry a meta.lastUpdated of July 14, and the server's own capability statement is dated July 29. Somebody is maintaining this.
The Four Flags Riding on Every Practitioner
Pull a single Practitioner record and the useful material is in the extensions, which follow HL7's US National Directory profiles. Four of them are plain booleans:
cms_medicare_enrollment, whether the NPI is enrolled in Medicarecms-identity-verified, whether CMS has verified the identity behind ithhs-in-exclusion-list, whether the practitioner appears on the HHS exclusion listcms_aligned_with_data_network, whether the record is aligned with the data network
Read that third one again.
Exclusion screening is a monthly chore that most groups run as a separate job against a separate file, and here it is as a boolean sitting next to the NPI in a record you are already pulling for other reasons. Same request, same response, no second vendor.
The record also carries the NPI with an effective period.start, work address, work phone and fax, and a reference out to the practitioner's Endpoint resource.
Why It Matters Before the Enrollment Season
The reason the plan-side half of this got serious is a rule most people filed under beneficiary experience and stopped reading.
CMS-4208-F2 published September 19, 2025, took effect November 17, and has been applicable since January 1. Its operative language is short:
"CMS is finalizing the proposal that MA provider directory data be updated within 30 days of the date an MA organization becomes aware of changes to that data. CMS is also finalizing the proposal to require MA organizations to attest at least annually that the MA provider directory information is accurate when the attestation is provided to CMS."
So the Medicare Advantage plans carrying your contracts owe CMS a directory refresh within 30 days of learning something changed, and an annual signature saying the result is accurate. That sits on top of the Provider Directory API obligation those plans have carried at 42 CFR 422.119(c) since January 2021.
What a plan tells the government about your roster now has a clock on it and a signature under it.
And you can read a federal version of the same thing for free, this afternoon, with three queries:
Practitioner?identifier=<NPI>for each clinician on your credentialing rosterPractitionerRole?organization=Organization/<id>for everyone the record attaches to your groupPractitionerRole?practitioner=Practitioner/<id>&active=truefor the reverse, every live affiliation the record gives one of your physicians
Anything on that third list you do not recognize is a claim that will route somewhere you did not expect.
Final Thoughts
Provider data has always been the one dataset everybody in the revenue cycle maintains privately, at real cost, and nobody can check against anything. Your credentialing file, the plan's directory, and the enrollment record disagree constantly, and the first time you find out is usually a denial with a network reason code on it.
A public copy does not settle that. It gives you a third document to hold the other two against, on a Wednesday, for the cost of a curl command.
That is a genuinely useful thing for CMS to have built, and it went out with far less noise than the rules that landed the same week.
Thanks for reading.