Vendor-published endpoint files can name most of what the NDH cannot
The point of a provider directory is to get someone from a name they recognise to a system they can connect to. A patient leaves an appointment and wants their records; an app has to turn "the clinic I visited" into "the FHIR endpoint that serves it". H50 found that 94,711 of the NDH’s FHIR endpoints carry no organization, which breaks exactly that lookup. H51 asks whether the missing names exist anywhere. They do: certified EHR vendors publish their own endpoint directories, naming the organization against the same URLs. Matching eight of the largest against the NDH, 61,432 of the 94,711 unattributed endpoints (65%) could be named from files that are public today, and 29,745 resolve to an NPI directly. That moves endpoint attribution from 14.7% to 70.0% without anyone collecting new data.
Headline
Vendors already publish the organization behind 61,432 of the 94,711 NDH FHIR endpoints that carry no owner (65%). 29,745 of those resolve to an NPI directly. Ingesting files that are public today would move endpoint attribution from 14.7% to 70.0%.
61.4K / 94.7K = 64.86%
unit: count
What this means
CMS publishing the data
This changes the ask from "get vendors to populate a field" to "ingest the field the vendors already publish". PointClickCare publishes 4,015 endpoints and the NDH holds exactly 4,015 of them at zero attribution, so the name was available at ingest time. ONC’s Lantern already aggregates over 200 of these sources.
FHIR implementers
Epic publishes a SMART User-access Brands bundle rather than a flat list: 96,190 organizations hanging off 764 endpoint URLs, every one resolving through partOf, refreshed daily. The hierarchy is the more useful shape, because naming one endpoint names every care site beneath it. Resolving it requires handling urn:uuid references and walking partOf; a naive resolver returns zero matches.
Startups + integrators
The merged crosswalk ships as a CSV: URL, organization, NPI where the vendor publishes one, and whether the NDH already knows the owner. It is the missing half of the post-appointment connection problem, which needs an organization-to-endpoint lookup rather than a provider search.
Methodology readers
Two traps worth repeating. Epic references bundle entries by urn:uuid rather than Type/id, and a naive resolver silently returns zero rather than erroring, which is the same failure that produced a wrong published claim about Epic in H47. And the vendor files carry visible test data, including an organization called "Practice Fusion Test Test account" and an address line reading "Helloooo This is important", so anything built on them needs a junk filter.
Null hypothesis
The organization behind an unattributed NDH endpoint is not recorded in any public source, so the gap can only be closed by new collection. Rejected: 65% of the gap is already published by the EHR vendors against the same URLs.
Denominator
The 94,711 Endpoint resources with connectionType.code = hl7-fhir-rest and no managingOrganization in the pinned 2026-08-20 NDH release. The vendor side is eight of the largest publishers catalogued in ONC’s Lantern; over 200 further sources exist, so every figure here is a floor.
Data source
Eight public vendor endpoint files (Epic’s SMART User-access Brands bundle plus HTI-1 service base URL lists from athenahealth, eClinicalWorks, Office Ally, Practice Fusion, PointClickCare, Veradigm and Oracle Health), matched by exact normalized URL against one capped scan of cms_npd.endpoint. Compute script: analysis/h51_vendor_endpoint_attribution.py.
Notes
The gap measured in H50 is not absent data. It is data published by the EHR vendors and not carried into the directory. PointClickCare publishes 4,015 endpoints and the NDH holds exactly 4,015 of them at zero attribution, so the name was available at ingest time. Two publication styles. Most vendors ship a flat HTI-1 service base URL list, one endpoint per practice. Epic ships a SMART User-access Brands bundle, where care sites hang off a parent brand and the endpoint sits on the brand. The hierarchy is the more useful shape: naming one endpoint names every care site beneath it. Reference resolution decides whether this works at all. Epic references bundle entries by urn:uuid rather than Type/id and links care sites by partOf. A naive resolver returns zero matches, which is the same failure that produced a wrong published claim about Epic in H47. Both reference styles and both link directions are handled, and the hierarchy rollup is asserted against the organization count so a double-count cannot pass silently. Every figure is a floor. These are the largest publishers; ONC's Lantern catalogues over 200 sources. Matching is exact on a normalized URL, so a vendor that spells a path differently from the NDH is counted as a miss. The vendor files carry visible test data. Practice Fusion publishes an organization named 'Practice Fusion Test Test account' and an address line reading 'Helloooo This is important'. Anything built on these needs a junk filter, or it republishes that as fact.
Get the next finding in your inbox. One email per release, no filler.