If you work in medical billing or revenue cycle management, you've looked up an NPI number thousands of times. You type it into a claim, verify it in your practice management system, and move on. But here's what most billing teams miss: an active NPI in NPPES is only one piece of a much larger verification picture. A provider can have a valid, active NPI and still be excluded from Medicare. They can be enrolled in NPPES but not in PECOS. They can have received hundreds of thousands of dollars in undisclosed payments from pharmaceutical companies. Each of these facts lives in a different federal database, on a different website, with a different search interface — until now.

This guide walks you through everything a billing professional, compliance officer, or revenue cycle manager needs to know about NPI lookup and complete provider verification. We'll cover the four federal databases that matter, when and why to check each one, and what the data actually means for your billing decisions.

What Is an NPI Number?

A National Provider Identifier (NPI) is a unique 10-digit identification number assigned to every covered healthcare provider in the United States. It was mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) under the Administrative Simplification provisions, with CMS completing the rollout between 2004 and 2008.

Before NPIs, payers had their own proprietary provider ID systems. A single physician might have had dozens of different ID numbers — one for Medicare, another for Medicaid, separate IDs for each commercial payer. The NPI replaced all of that with a single, permanent, payer-agnostic identifier that follows a provider throughout their career regardless of where they work or which payers they contract with.

NPI-1 vs. NPI-2: Understanding the Two Types

There are two types of NPIs that billing teams encounter regularly:

• NPI-1 (Individual providers) — Assigned to human healthcare providers: physicians, nurse practitioners, physician assistants, physical therapists, dentists, and anyone else who provides healthcare services. Each individual gets exactly one NPI-1 that they keep for life.
• NPI-2 (Organizational providers) — Assigned to healthcare organizations: hospitals, group practices, clinics, laboratories, pharmacies, nursing homes, and any other entity that bills for services. An organization may have multiple NPI-2s for different sub-parts (a hospital system, for example, might have separate NPI-2s for its emergency department and its outpatient imaging center).

On claims, you'll typically see both: the billing provider's NPI-2 (the group or facility) in Box 33 of the CMS-1500, and the rendering provider's NPI-1 (the individual clinician) in Box 24J. Getting these right is fundamental to clean claim submission — and verifying them is where this guide comes in.

The Four Federal Databases Behind a Complete Provider Verification

Most billing teams stop at the NPI registry. That's a problem. A full provider verification requires checking four separate federal databases — and CMS scatters them across four different government websites with four different search interfaces. Here's what each one tells you and why it matters.

Database	What it tells you	Who maintains it	Check frequency
NPPES	Name, specialty, address, taxonomy code, enrollment date, NPI status	CMS	Before first claim; when data changes
OIG LEIE	Active sanctions, exclusions from federal healthcare programs	HHS Office of Inspector General	Monthly — at minimum
PECOS / Care Compare	Medicare enrollment status, assignment, MAC jurisdiction, group affiliations	CMS	Before billing Medicare; when re-credentialing
Open Payments	Payments from pharma/device companies — consulting, speaking, royalties, meals	CMS (Sunshine Act)	During compliance reviews; credentialing

The NPPES NPI Registry is the starting point. It tells you who the provider is, what they specialize in, and where they practice. But it tells you nothing about whether they're currently sanctioned, whether they're enrolled in Medicare, or whether they have financial relationships with drug companies that could raise compliance flags.

OIG Exclusion Checks: The One Verification You Can't Skip

Of all the checks in provider verification, the OIG exclusion check carries the highest stakes. The OIG List of Excluded Individuals and Entities (LEIE) tracks every provider, supplier, and organization that has been formally excluded from participating in Medicare, Medicaid, and all other federally funded healthcare programs.

Exclusions happen for a range of reasons: Medicare fraud convictions, patient abuse, controlled substance violations, license revocations, obstruction of federal investigations. As of early 2026, there are over 73,000 active exclusions in the LEIE database.

Why Monthly Checks Are the Legal Standard

The Social Security Act and OIG guidance make it clear: if you submit a claim for services rendered by an excluded provider — even unknowingly — your organization is liable. The consequences are severe:

• Civil monetary penalties of up to $20,000 per claim submitted for an excluded provider
• Repayment of all amounts received from federal healthcare programs for those services
• Potential exclusion of your own organization from federal programs
• Personal liability for compliance officers who failed to implement adequate monitoring

The good news is that this check is free and takes seconds. The OIG exclusion portal allows individual searches by NPI, name, or date of birth. The CureAdvantage NPI scanner above runs this check automatically every time you look up a provider, so you get your NPPES data and your OIG exclusion check in the same query.

PECOS and Medicare Enrollment: What Billing Teams Actually Need to Know

Having an NPI does not automatically mean a provider can bill Medicare. Enrollment in PECOS (Provider Enrollment, Chain, and Ownership System) is a separate, mandatory process — and billing Medicare for a provider who is not enrolled, has opted out, or is in a pending status will result in claim denials and potential recoupment.

The Three Medicare Participation Statuses

When you look up a provider on Care Compare, their Medicare participation status falls into one of three categories:

• Participating (Accepts Assignment): The provider has agreed to accept Medicare's approved amount as full payment. They cannot balance-bill Medicare patients beyond the copay/deductible. This is the most favorable status for patients and the clearest signal for billing.
• Non-participating: The provider is enrolled in Medicare but has not accepted the assignment agreement. They can charge up to 15% above the Medicare fee schedule (the limiting charge), but patients pay more out of pocket.
• Opted Out: The provider has formally opted out of Medicare entirely and has signed private contracts with patients. Medicare will not pay for their services under any circumstances. Submitting a Medicare claim for an opted-out provider is a billing error with potential compliance consequences.

The Care Compare physician data also reveals group practice affiliations and hospital relationships — information that matters when you're verifying whether a rendering provider's NPI is properly linked to the billing provider's group NPI in your claims.

Open Payments: What Industry Payment Data Means for Your Compliance Program

The Open Payments program, established under the Physician Payments Sunshine Act as part of the Affordable Care Act, requires pharmaceutical and medical device manufacturers to report all payments and transfers of value made to physicians and teaching hospitals. The database is public, searchable by NPI, and updated annually.

Since the program launched in 2013, CMS has tracked over $60 billion in industry payments. The categories include consulting fees, speaker fees, research funding, royalties, education, meals, travel, and ownership interests.

Reading Open Payments Data as a Billing Professional

For most billing teams, Open Payments data is a compliance monitoring tool rather than a direct billing decision factor. Here's how experienced revenue cycle managers interpret it:

• Large consulting or speaking fees from a single manufacturer: May indicate a financial relationship worth noting in your compliance file, particularly if that provider frequently prescribes or recommends that company's products. Medical necessity reviewers and auditors sometimes flag these patterns.
• Royalty payments: The provider has an intellectual property relationship with the company — often a device they helped design. This is generally disclosed and legitimate but worth documenting during credentialing.
• High meal and travel totals: Not inherently problematic, but unusually high amounts from a single company relative to peers in the same specialty can indicate a close commercial relationship worth monitoring.
• No payments on file: The majority of providers have little or no reported industry payments. This is normal and expected, particularly for primary care providers and hospital-employed physicians.

How to Read an NPI Profile for Billing Compliance

When you pull a provider's NPI profile, there are several specific data points that experienced billing and compliance staff look at immediately. Here's what to check and what each field means in practice.

Taxonomy Code

The taxonomy code is a 10-character alphanumeric code from the NUCC Health Care Provider Taxonomy that defines the provider's type, classification, and specialty. It appears on claims in the NPI segment and affects which fee schedules and coverage policies apply. A mismatch between the taxonomy code on the claim and the taxonomy registered in NPPES is a common source of denials — particularly for specialty-specific procedures. Always verify that the taxonomy code used on your claims matches what's in NPPES.

Enumeration Date vs. Last Updated

The enumeration date tells you when the provider first registered their NPI. The last updated date tells you when they last made changes to their NPPES record. A record that hasn't been updated in several years can indicate stale address or phone data — important if you need to contact the provider's office directly or if your system uses the NPPES address for credentialing.

Deactivated NPI: What It Means and What to Do

A deactivated NPI is a serious red flag. NPIs are deactivated when a provider dies, when fraud or abuse is identified, or when a provider requests deactivation. Never submit a claim with a deactivated NPI. If you encounter a deactivated NPI in your system, pull the provider's profile to check whether they have a reactivated NPI or a new active NPI under a different number, and update your credentialing records accordingly before billing.

A Practical 4-Step Provider Verification Workflow

Here's the verification workflow that well-run billing departments use before adding a new provider to their billing system — and periodically for existing providers:

1. NPPES check: Confirm the NPI is active, the name and taxonomy code match your records, and the practice address is current. Note the enumeration date and last updated date.
2. OIG exclusion check: Search by NPI in the OIG LEIE. If excluded, stop — do not bill for this provider under any federal program. If clear, document the date and result in your credentialing file.
3. PECOS / Medicare enrollment check: Confirm the provider is enrolled and accepting assignment if you're billing Medicare. Note their MAC jurisdiction and any group affiliations.
4. Open Payments review (for new credentialing or compliance reviews): Review the payment history, particularly for high-value relationships with manufacturers of products the provider uses or prescribes.

The CureAdvantage NPI Scanner runs all four checks simultaneously. What used to take 15–20 minutes across four government websites takes under five seconds.

Frequently Asked Questions