AINPI 2026-05-08 update — first comparable-release deltas
For: AINPI subscribers Date: 2026-05-08 Methodology version: 0.6.0-draft Source data: 2026-05-08 CMS National Provider Directory bulk export
What changed
CMS pushed a new NPD bulk export to directory.cms.gov today. AINPI re-ingested every resource and re-ran every H-series check. This is the first time we have two comparable releases under the same methodology, so the deltas are the news.
The shape of the export changed materially
| Resource | April 2026-04-09 | May 2026-05-08 | Δ |
|---|---|---|---|
| Practitioner | 7,441,213 | 7,441,211 | flat |
| Organization | 3,603,262 | 3,414,375 | −5.2% |
| Location | 3,494,239 | 1,362,869 | −61% |
| Endpoint | 5,043,524 | 1,360,585 | −73% |
| PractitionerRole | 7,178,732 | 7,028,001 | −2.1% |
| OrganizationAffiliation | 439,599 | 1,086,694 | +147% |
| Total | 27,200,569 | 21,693,735 | −20% |
CMS appears to have de-duplicated multi-address Endpoints and Locations, and built out the OrganizationAffiliation graph. Useful for downstream consumers, but a strong reminder that release-to-release shape is not stable and any audit pinned to a specific date needs explicit re-validation.
Two source-side schema breaks AINPI caught
These are the kind of changes that silently break consumers. We ate them so you don't have to:
- NPI identifier system URL changed from
http://hl7.org/fhir/sid/us-npi→http://terminology.hl7.org/NamingSystem/npi. Any consumer that string-matched on the old URL just lost 7.4M practitioner NPIs without throwing an error. - PractitionerRole.specialty codes shifted from CMS Medicare format (
14-50) to NUCC taxonomy codes (207R00000X). Consumers joining to the CMS Medicare crosswalk will see spurious "invalid code" warnings.
Both are documented in the cms_npd ingest script.
Findings, refreshed against May 2026-05-08
| Hypothesis | April 2026-04-09 | May 2026-05-08 |
|---|---|---|
| H6-H8 referential integrity | 0 dangling refs | 0 dangling refs |
| H9 NPI Luhn (combined) | 3 / 10.85M | 2 / 10.85M |
| H10 NPPES not-enumerated | 95K | 86K |
| H10 NPPES deactivated | 445K | 379K |
| H14 Practitioner duplicates | 0 | 0 |
| H15 Organization NPI dup excess | 383K | 1.41M |
| H18 release-day-staleness | 100% | 100% |
| H23 critical-risk cohort (≥ 1.5) | 8,116 | 8,115 |
| H24 OIG LEIE → NDH practitioner | 7,990 | 8,008 |
| H25 SAM → NDH practitioner | 6,797 | 6,829 |
| H26 VA cohort in payer directories | 4 / 125 (Cigna) | 2 / 131 (Cigna) |
| H27 confirmed SSN exposures | 46 | 41 |
Three results worth pausing on:
CMS partially scrubbed SSNs (but did not eliminate)
Confirmed SSN exposures dropped from 46 → 41 between releases (−11%). The hot-spot still leads with Illinois (13, down from 18). The qualification[].identifier[].value slot continues to be the most common landing place. Independent verification of the 2026-04-30 Washington Post story holds — the leak is real, has been partially addressed, and is not yet remediated.
→ https://ainpi.dev/findings/pii-exposure-ndh
Organization NPI duplicates jumped 4×
The number of Organization NPIs appearing more than once in the bulk export grew from 383K excess in April to 1.41M excess in May. Same dataset shape that produced the original NPPES "Walmart Pharmacy on every block" story. If you are trying to count "how many physical organizations are in the network," the right denominator is the distinct NPI count (1.999M), not the resource count (3.41M).
→ https://ainpi.dev/findings/duplicate-detection
Federally-excluded providers still appear in payer directories
The H26 cross-reference of the AINPI VA federally-excluded cohort against four publicly queryable payer FHIR directories (Humana, Cigna, UHC via Optum FLEX, Molina via Sapphire360) found 2 LEIE/SAM-excluded NPIs in the Cigna network on 2026-05-08, down from 4 in April. Movement is in the right direction; the floor is not zero.
→ https://ainpi.dev/findings/mco-exposure-va
Virginia state slice — refreshed
The VA briefing rebuilt from May 2026-05-08 numbers:
| Metric | April 2026-04-09 | May 2026-05-08 |
|---|---|---|
| VA practitioners in NDH | 141,660 | 130,127 |
| NPPES match rate | 99.39% | 99.50% |
| Deactivated in NPPES, still listed in NDH | 4,657 | 4,090 |
| Org-NPI duplicate rate | 42.50% | 40.80% |
| Federally-excluded VA NPIs (critical cohort) | 125 | 131 |
→ https://ainpi.dev/states/va → Downloadable cohort (DMAS-shareable): https://ainpi.dev/api/v1/states/va-cohort-critical.csv
What's reproducible from a clean checkout
Every number above is generated by a script in analysis/h*.py against the BigQuery dataset thematic-fort-453901-t7.cms_npd. The two new ingestion utilities that landed with this release:
analysis/fast_ingest_ndh.py— replaces the streaming-insert pipeline withbq loadjobs. ~30 minutes end-to-end vs 3-4 hours.analysis/build_va_briefing.py— composes the consolidated VA payload (findings + cohort breakdown + H26) for the state briefing page.
Pin to a release tag for audit reproducibility: https://github.com/FHIR-IQ/AINPI/releases.
Anchored regulations (unchanged from May 2 update)
- 42 CFR § 455.436 — federal database checks (NPPES, LEIE, SAM, SSA-DMF). AINPI closes 3 of 4.
- 42 CFR § 438.602 — Medicaid managed care directory oversight.
- 42 USC § 1306c — SSA-DMF access restrictions.
- 5 USC § 8902a — OPM debarment from FEHBP.
- CMS-9115-F — Patient Access API rule.
Share + subscribe
- Live site: https://ainpi.dev
- Source: https://github.com/FHIR-IQ/AINPI
- Subscribe to the next update: https://ainpi.dev/subscribe