NDH payer endpoint and organization coverage
The NDH is discussed in the CMS provider-directory community as the place where payer API endpoints and organization identifiers will live, so a consumer could discover a payer’s public Provider Directory API from one federal index instead of hunting developer portals payer by payer. H49 measures how far the shipped release is from that. Result at 2026-10-07: 997 organizations carry a "pay" type coding and own 7,575 health plans, but none of the 997 carries an endpoint or a telecom entry. At least 194 of 111,259 FHIR REST endpoints are payer provider-directory addresses (25 matched by URL path only, 144 by host only, 25 by both), and none of them is linked to a payer organization or a health plan from either side. So the file says who the payers are and, separately, lists some of their directories, without connecting the two. The Capital BlueCross control directory URL is not in the index, though the same payer’s Medicare Advantage directory is, at another address. The 2026-10-14 figure of 50 directory addresses counted only URLs that name a directory and was a floor; see the correction in the notes.
Headline
The 2026-10-07 release names 997 payer organizations and 7,575 health plans, and 0 of those organizations carry an endpoint. At least 194 of 111,259 FHIR REST endpoints are payer provider-directory addresses (50 by URL path and 144 only by host), none of them attached to a payer organization; the Capital BlueCross control directory URL is not in the index, though another Capital BlueCross directory address is.
194 / 111.3K = 0.17%
unit: count
What this means
CMS publishing the data
Two concrete gaps, both additive rather than breaking. No payer organization carries an endpoint, and none of the payer directory addresses the file does carry names a managingOrganization or is listed by a payer organization or health plan, so a directory cannot be resolved to the payer it serves. And at least one live, mandated directory is indexed under an address other than the one the payer publishes: the Capital BlueCross control URL is absent while its Medicare Advantage directory is present elsewhere, which means coverage cannot be checked by URL alone.
Startups + integrators
The 2026-10-07 release carries at least 194 payer provider-directory addresses (25 matched by URL path only, 144 by host only, 25 by both). By URL shape, 138 are CMS Medicare Advantage bulk files, 50 are FHIR API base addresses and 6 are unfilled templates. Probed on 2026-10-16 without credentials, 38 of the 50 API addresses returned data to a Practitioner search and 117 of the 138 bulk files returned their index; 9 sit on QA or UAT hosts. None is linked to a payer organization or a health plan from either side. You can find a directory in the file, but you cannot get from a payer or plan to its directory through the NDH.
Researchers
Classifying payers by organization name does not work here. Every Pennsylvania organization matching payer-like name patterns is a provider, such as KEYSTONE RURAL HEALTH CENTER. Host-based classification of the endpoint URL is the workable route, and the per-endpoint CSV ships alongside this finding.
Methodology readers
The directory count is a floor, not a census. An address counts when its URL names a directory or its host is shown to serve a payer’s directory (a CMS contract ID from the release’s InsurancePlan resources, or a short hand-checked list); a directory that does neither is missed, and 86 addresses in the same CMS batch match neither signal. Payer-name matching is not used, because it matches provider EHR servers. The control probe still matters: it separates "payers built nothing" from "the index does not carry it".
Null hypothesis
The NDH carries payer organizations and their public Provider Directory API endpoints, so it can serve as a discovery index for payer directories. Rejected on both halves at 2026-05-08. At 2026-10-07 the first half holds: 997 payer organizations own 7,575 health plans. The second half still fails as an index: at least 194 payer directory addresses are in the file, but none is linked to a payer organization or plan, and no payer organization carries an endpoint.
Denominator
The 111,259 Endpoint resources with connectionType.code = hl7-fhir-rest in the pinned 2026-10-07 NDH release (Direct Trust HISP addresses are messaging endpoints and are excluded per H28). The organization-type denominator is the Organization resources that carry any type coding.
Data source
The 2026-10-07 NDJSON streamed directly (analysis/h49_recheck_release.py) for the headline, classification and linkage, with directory classification in analysis/payer_directory.py: URL path or host, where the host signal comes from CMS contract IDs in the release’s own InsurancePlan resources and short hand-checked host lists. Capped BigQuery scans of cms_npd.endpoint and cms_npd.organization (analysis/h49_ndh_payer_endpoints.py) refresh the detail block. Each classified address and the control directory are probed by curl with no credentials, and the results are recorded with the probe date.
Notes
Re-measured against the 2026-10-07 release by streaming the published NDJSON directly, not through BigQuery. Classification rules are imported from analysis/payer_directory.py rather than copied, so this cannot drift from the finding it updates. 997 organizations carry the payer type (pay); 0 of them carry an endpoint and 0 a telecom entry, so no payer directory can be found from the payer organization record itself. A FHIR REST address counts as a payer provider directory on either of two signals. Path: the URL names a directory (providerdirectory, provider-directory, plan-net, pdex). Host: the address sits on a host that serves a payer's directory, shown either by a CMS contract ID that the release's own InsurancePlan resources carry (962 contract IDs, found on 26 hosts), or by a hand-checked list of payer directory hosts. Of the 194: 25 path only, 144 host only, 25 both. By URL shape, 138 are CMS Medicare Advantage bulk directory files (MPF index.json and similar), 50 are FHIR API base addresses, and 6 are template addresses submitted with the placeholder unfilled (such as ppp-cccc-nnn), counted but in neither group. 9 sit on hosts named as QA or UAT. A host signal never overrides a path that marks a patient-access, authorization, member or other non-directory API, and shared or multi-tenant hosts never lend it to a neighbouring address; 19 addresses carry the contract signal only through their host and are listed with the source contract IDs. Probed on 2026-10-16 with curl and no credentials: 38 of 50 FHIR API base addresses returned a FHIR Bundle to a Practitioner search, and 117 of 138 bulk files returned their index. 8 of the addresses that answered sit on QA or UAT hosts (9 probed). Per-address results are in detail.payer_directory_classification.probe. The count is a floor. 279 FHIR REST endpoints in this release share the name 'FHIR API' and carry no managingOrganization, which marks one CMS collection batch; 86 of them match neither signal, and many of those look like payer directories. Payer name matching is not used to classify: it matches provider EHR servers whose names resemble payers'. Linkage, both sides: 0 directory addresses name a payer organization as managingOrganization, 0 are listed in a payer organization's endpoint list, and 0 in an InsurancePlan's. 0 are linked to any organization at all. 30 endpoint links run from provider-typed records that carry a payer's exact name; they are listed in detail.payer_directory_classification.linkage and are mostly authenticated member APIs or EHR servers, not directories. The control directory Capital BlueCross (https://providerdirectory-api.capbluecross.com/r4) answered 200 to an unauthenticated request and is not in the index at that address; the same payer's directory is, at https://api.capitalbluecrossfhir.com/r4/public-ma/. Correction (2026-10-16, FHI-71): The 2026-10-14 finding counted 50 of 111,259 FHIR REST endpoints as provider-directory addresses. That counted only addresses whose URL names a directory, so it was a floor. Classified by the host as well (CMS contract IDs from the release's own InsurancePlan resources, and payer directory hosts checked by hand), the 2026-10-07 release carries at least 194: 25 by path only, 144 by host only, 25 by both. By URL shape, 138 are CMS Medicare Advantage bulk directory files, 50 are FHIR API base addresses and 6 are templates with the placeholder unfilled. Probed on 2026-10-16 with curl and no credentials, 38 of the 50 FHIR API base addresses returned a FHIR Bundle to a Practitioner search and 117 of the 138 bulk files returned their index; 9 addresses, 8 of which answered, sit on QA or UAT hosts. None of the 194 is linked to a payer organization or health plan from either side. The count is still a floor: 86 more addresses in the same CMS batch match neither signal, and many of them look like payer directories. Reproduce with analysis/h49_recheck_release.py --dir <release dir> --release <date>. Release watch, payer PIN: 0 of the 997 organizations typed 'pay' carry an identifier of any kind, and 0 carry a Payer Identification Number (an identifier whose type.coding has code PAYERID, from http://terminology.hl7.org/CodeSystem/v2-0203). The PIN slice is in the HL7 NDH STU2 draft (Jira FHIR-57606) and not in the published STU1 (https://hl7.org/fhir/us/ndh/STU1/), so its absence is not a conformance gap against the current standard. It is watched so the first release that carries it is reported when that release is measured. The match walks identifier[].type.coding[].code under any system in the raw resource JSON; no flattened column is read. The denominator is the positive control: 997 payer-typed organizations were found, so these counts come from a query that could see them.
Get the next finding in your inbox. One email per release, no filler.