Virginia provider directory audit
State-scoped view of the AINPI audit of the CMS National Provider Directory.
NPD release 2026-05-08 · methodology v0.2.0 · commit 4bee6b1
Eugene Vestel — Founder, FHIR IQ · Health interoperability consultant
BioLinkedIngene@fhiriq.com· Last reviewed 2026-05-08
Why this page exists
On 2026-04-23 the Centers for Medicare & Medicaid Services issued a letter to all 50 State Medicaid Directors requesting a comprehensive two-year provider revalidation strategy within 30 days, citing 42 CFR §§ 431.107, 455.410, 455.414, 455.416, 455.21, and 455.450. The letter explicitly asks for “links to any public-facing data or reporting” that demonstrate ongoing verification of provider enrollment data. This page is one such artifact: a state-scoped, reproducible, source-cited slice of an independent audit of the federal NDH bulk export. Your state agency is welcome to cite it directly in its CMS response. See /methodology for the full versioned methodology and audit trail.
Virginia program context
- Program
- Cardinal Care
- State agency
- Department of Medical Assistance Services (DMAS)
- Approximate enrollment
- ~1.8M enrollees
- Managed care plans
- 6 plans
View MCOs
- Anthem HealthKeepers Plus
- Sentara Community Plan
- Aetna Better Health of Virginia
- Molina Complete Care
- United Healthcare Community Plan
- Virginia Premier
NDH resources tied to Virginia
Counts of resources where the FHIR resource's service-address state equals VA. These are the state-level denominators against which the findings below are computed.
- Practitioner
- 130,127
- Organization
- 67,291
- Location
- 34,157
Findings, Virginia vs national
Each row links to the published national finding for full methodology, null hypothesis, and audience implications.
| Finding | Hypotheses | VA rate | National |
|---|---|---|---|
| NPI and taxonomy correctness 129,470 of 130,127 VA practitioner NPIs (99.4951%) match NPPES; 4,090 are flagged deactivated in NPPES while still active in the federal NDH. | H9, H10, H11, H12, H13 | 99.50% | — |
| Duplicate detection VA has 67,291 Organization resources covering 39,833 unique NPIs — 27,458 excess resources (40.8049%) appear duplicated. | H14, H15 | 40.80% | 13.55% |
| Temporal staleness 0 of 231,575 VA-resident resources carry a meta.lastUpdated on the 2026-05-08 release day. As at the national level, meta.lastUpdated is a release-time stamp; state-scoping does not change this finding. | H18 | 0.00% | 0.00% |
| Endpoint liveness Not state-computable: FHIR Endpoints in NDH do not carry a state field. State scoping requires joining Endpoint.managingOrganization to Organization._state. Approximately 97% of NDH Endpoints have no populated managingOrganization back-reference (see /findings/referential-integrity), so a state-scoped endpoint-liveness number would only cover the 3% with a resolvable back-reference. The national rate is the defensible reference. | H1, H2, H3, H4, H5 | n/a | 85.37% |
| Referential integrity Not state-computable: Cross-resource references in NDH are graph-level. State filtering on the source side (PractitionerRole.practitioner) is straightforward, but the target side (Organization, Location) may be in a different state, so a per-state integrity rate conflates two distinct populations. The national rate is the defensible reference. | H6, H7, H8 | n/a | 0.00% |
| Network adequacy gauge Not state-computable: Same constraint as endpoint-liveness: FHIR Endpoints lack a state field, and the indirect join via managingOrganization covers only ~3% of Endpoints. The 85% Medicare Advantage network-adequacy implied ceiling is itself a national reference, so a state-scoped recomputation here would not be meaningful for state Medicaid PR strategy. | H22 | n/a | 90.35% |
Verify a sample yourself
The records below are concrete NPIs that AINPI flagged on this state's population. Each row links to the authoritative public NPPES NPI Registry so you can independently confirm the flag. Disagreement on any record can be filed as a data quality bug with a reproducible counter-example.
| NPI | Display name | Flag | Reason | Verify |
|---|---|---|---|---|
| 1992651053 | COLLIVER, SAMANTHA | npi-taxonomy-correctness | Not present in NPPES npi_raw | NPPES → |
| 1497601843 | MAHONEY, KATHRYN | npi-taxonomy-correctness | Not present in NPPES npi_raw | NPPES → |
| 1255289013 | LIBICKI, ARIELLA | npi-taxonomy-correctness | Not present in NPPES npi_raw | NPPES → |
| 1841147360 | WOODY, KATIE | npi-taxonomy-correctness | Not present in NPPES npi_raw | NPPES → |
| 1851244834 | ADDAIR, ROSLY | npi-taxonomy-correctness | Not present in NPPES npi_raw | NPPES → |
How to cite this page in your CMS PR strategy response
CMS's 2026-04-23 letter requests, in element 2: “The metrics you will use to measure the effectiveness and progress of your PR strategy, including links to any public-facing data or reporting.” Suggested citation language:
We have adopted the AINPI methodology framework (Vestel, FHIR IQ, v0.2.0) for ongoing verification of Virginia provider-directory data against the federal CMS National Provider Directory and NPPES. State-scoped findings are published at https://ainpi.dev/states/va, with a versioned methodology and reproducible analysis code under Apache-2.0.See CITATION.cff for a Zotero / EndNote-importable form. Pin to a specific release tag for academic reproducibility.
Methodology lineage
- NDH source
- CMS National Provider Directory, release 2026-05-08
- NPPES snapshot
bigquery-public-data.nppes.npi_raw, dated 2026-02-09- NUCC taxonomy
- v17.0, January 2026 release
- CMS Medicare/NUCC crosswalk
- October 2025 release
- Methodology version
- 0.2.0
- Generated
- 2026-05-08T20:58:48+00:00
What this audit does NOT cover
- Non-NPI providers. AINPI is NPI-keyed end-to-end. Atypical providers (e.g. personal-care assistants in some state programs) are out of scope. CMS's 2026-04-23 letter specifically calls these out as a population to address; a complementary state-roster join is required.
- CAQH credentialing data. Not in the NDH ingestion pipeline. See /insights for the full provenance discussion.
- Real-time attestation logs. NPD bulk files are periodic exports (current pinned release: 2026-05-08).
- Managed care plan internal directories. AINPI measures the federal NDH artifact only. Live MCO directory parity against the state FFS roster is a separate effort.
- Beneficiary or claims data. AINPI is provider-directory only. Nothing here implicates utilization, quality, or fraud evidence on individual providers.
Correction protocol
If you can demonstrate that any number on this page is wrong with a reproducible counter-example, file a data quality bug issue on GitHub. Confirmed corrections trigger a methodology version bump, an entry in the changelog, and a re-run of the affected JSON. The history is auditable in the public Git log.
Payer directory exposure to federally excluded providers
H26 (methodology demo). 2 of 131 federally excluded VA-resident providers (LEIE or SAM, score >= 1.5) appear in at least one of 4 wired payer provider directories. Per-payer: Humana 0, Cigna 2, UnitedHealthcare 0, Molina 0. See the full finding →
Verify a sample yourself (2 NPIs)
- 1710496161 — BURKHEAD, JASON — matched: Cigna
- 1801070313 — BREWER, STEVEN — matched: Cigna
- v1 of H26 is a methodology demonstration covering 2 publicly-queryable payer FHIR endpoints (Humana, Cigna). Neither is a primary VA Medicaid carrier; the actual VA Medicaid MCO products (Anthem HealthKeepers Plus, Aetna BH of VA, UHC Community Plan, Sentara Community Plan, Molina Complete Care, Virginia Premier) all require credentialed access and are deferred to Stage B follow-on.
- Anthem's TotalView FHIR endpoints (HealthKeepersInc, AnthemBlueCross via /resources/registered/...) return 403 on every Practitioner query without app registration. Aetna requires OAuth from developerportal.aetna.com. UnitedHealthcare's URL captured in our `ProviderDirectoryAPI` Supabase table is stale (DNS-fails); current public URL is unconfirmed.
- Cigna's CapabilityStatement does not list `identifier` as a Practitioner search parameter, so we name-search (`?family=&given=`) and post-filter Bundle entries for the target NPI. False negatives are possible if the cohort name (`FAMILY, GIVEN`) does not exactly match the payer's listing.
- Provider directory listing alone does not establish current network participation, billing privileges, or active patient assignment.
- Each match is a data-quality and triage flag, not a fraud determination — investigation, hearing rights, and reinstatement claims belong to the payer and the excluding agency.