AINPI May 2026 update — H26, H27, and SMD-letter readiness
For: AINPI subscribers Date: 2026-05-02 Methodology version: 0.6.0-draft Source data: 2026-04-09 CMS National Provider Directory bulk export
What landed since the last update
Two new findings, one state-meeting briefing, and a strengthened cohort.
H27 — Social Security Numbers in the NDH bulk export
On 2026-04-30 the Washington Post reported that the same NDH bulk export AINPI ingests contains provider Social Security Numbers, leaked through "incorrect entries of provider or provider-representative-supplied information in the wrong places" (CMS).
AINPI independently verified and extended the finding with a two-pass BigQuery scan over cms_npd.practitioner + cms_npd.organization:
| Bucket | Count | JSON location |
|---|---|---|
| SSN dashed | 42 | qualification[].identifier[].value (state-license slot) |
| SSN dashed | 4 | name[].given[] (literal name token) |
| SSN undashed (9-digit-only token) | 17 | name[].given[] (provider entered SSN where their name belongs) |
| Total confirmed SSN exposures | 63 | |
| 10-digit NPI as a name token | 21 | name[].given[] / name[].family |
| Date-of-birth as name | 0 | — |
| Organization-side SSN-pattern strings | 2 | various |
| Intl phone false positives (filtered) | 5 | — |
Per-state hot-spots: IL 20, OH 7, NJ 2, TX 2, WA 2, AZ 2, FL 2, GA 2, MI 2, PA 2, TN 2.
Privacy posture: AINPI publishes counts, JSON locations, NPIs (professional IDs), and state breakdowns. We do not republish the SSN values themselves, even though they remain in the public NDH bulk file CMS distributed.
The finding extended the Washington Post number by 37% (46 → 63) using a different detection technique that the press did not apply.
→ https://ainpi.dev/findings/pii-exposure-ndh
H26 — VA payer-directory exposure (4 wired payers)
Cross-references the AINPI federally-excluded VA cohort (125 NPIs, LEIE or SAM, score ≥ 1.5) against live FHIR provider directories of 4 publicly-queryable payer endpoints:
| Payer | Endpoint | Method | Result |
|---|---|---|---|
| Humana | https://fhir.humana.com/api | ?identifier=NPI | 0 of 125 |
| Cigna | https://fhir.cigna.com/ProviderDirectory/v1 | name + post-filter | 4 of 125 |
| UnitedHealthcare | https://flex.optum.com/fhirpublic/R4 (Optum FLEX, covers UHC commercial + UHC Community Plan + OptumRx) | ?identifier=NPI | 0 of 125 |
| Molina Complete Care | https://api.interop.molinahealthcare.com/providerdirectory (Azure APIM → Sapphire360) | ?identifier=NPI | 0 of 125 |
Two of the six VA Medicaid MCOs (UHC Community Plan + Molina Complete Care) are now wired directly. The Cigna 4 are NPI-confirmed in the Bundle's identifier[] array.
Stage B fast-follow: Anthem HealthKeepers Plus (public cms_mandate/mcd/ endpoint exists but returns 500s on Practitioner queries — Elevance server bug; CapabilityStatement only supports name search), Aetna BH of VA (OAuth at developerportal.aetna.com), Sentara Community Plan, Virginia Premier.
→ https://ainpi.dev/findings/mco-exposure-va
Virginia case study
The most-developed of the per-state worked examples in the AINPI catalog. Pulls together § 455.436 framework + Virginia-specific data quality numbers + the 125-NPI Virginia federally-excluded cohort + H26 4-payer cross-reference + Stage B roadmap. Authored as independent public-good research; not produced for or guided by any state agency.
Live numbers: 141,660 VA practitioners; 99.39% NPPES match; 4,657 NPPES-deactivated providers still listed; 42.50% organization-NPI duplicate rate.
→ https://ainpi.dev/briefings/va → Downloadable cohort: https://ainpi.dev/api/v1/states/va-cohort-critical.csv
High-risk cohort v0.4.0 (3 of 4 § 455.436 federal database checks)
The H23 composite score now combines five independent signals:
| Signal | Weight | Source |
|---|---|---|
| oig_excluded | 1.5 | OIG LEIE active list |
| sam_excluded | 1.5 | SAM.gov active list (HHS overlap, OPM net-new) |
| not_in_nppes | 1.0 | NPPES join |
| nppes_deactivated | 0.8 | NPPES deactivation flag |
| luhn_fail | 1.0 | NPI Luhn check |
3 of the 4 federal database checks under 42 CFR § 455.436 are now covered (NPPES, OIG LEIE, SAM.gov). SSA Death Master File remains restricted-access.
→ https://ainpi.dev/findings/high-risk-cohort
Headline numbers as of 2026-05-02
| Metric | Value |
|---|---|
| NDH practitioners | 7,441,213 |
| NDH organizations | 3,603,262 |
| NDH locations | 3,494,239 |
| Federally-excluded NPIs in NDH (LEIE + SAM, critical bucket) | ~8,116 |
| Confirmed SSN exposures in the public NDH bulk | 63 |
| 10-digit NPIs typed where the name belongs | 21 |
| Federally-excluded NPIs found in payer directories (4 carriers) | 4 (all Cigna) |
Anchored regulations
This update touches the following federal-regulation surfaces:
- 42 CFR § 455.436 — federal database checks (NPPES, LEIE, SAM, SSA-DMF) for state Medicaid programs. AINPI now closes 3 of the 4.
- 42 CFR § 438.602 — Medicaid managed care directory oversight. H26 puts a number on payer-directory exposure to federally excluded providers.
- 42 USC § 1306c — SSA-DMF access restrictions. Out-of-scope until restricted-access procurement.
- 5 USC § 8902a — OPM debarment from FEHBP. The OPM slice of SAM is the net-new federal-screening signal beyond LEIE.
- CMS-9115-F — Patient Access API rule. Mandates payers' public Provider Directory FHIR endpoints; H26 exercises this rule's promise of public access.
Subscribe + share
If you found this useful, share AINPI with a colleague:
- Live site: https://ainpi.dev
- Source: https://github.com/FHIR-IQ/AINPI
- Subscribe to the next update: https://ainpi.dev/subscribe
The data and methodology are reproducible from a clean checkout. Pin to a specific release tag for audit reproducibility: https://github.com/FHIR-IQ/AINPI/releases.