Attachment 2 - Statement of Objectives (NPD Work Area A and E).pdf

National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services

Statement of Objectives (SOO) for

National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services

24 July 2026

Product Vision

Scope

Context

NPD Program Structure

How WA A and WA E Work Together

Definitions

Statement of Need

Objectives

Category 1 – WA A: Ground Truth Data Access and Licensing

Category 2 – WA A: Data Normalization and Delivery

Category 3 – WA E: Data Aggregation, Quality, and Assurance Services

Anticipated Data Sources and Service Providers

Table 1 – Required Datasets: All Offerors Must Propose and Price

Table 2 — Supplemental Datasets: Market Capabilities and Experience

Table 3 — Known Government-Furnished Information: Provider Data Assets

What CMS Is NOT Seeking Under This Contract

Approach

Operating Model

How WA A and WA E Work Together

Contractor's Role Within the NPD Program

Flexibility and Iteration

Constraints

Constraint 1 – License-Free Output: Government Preference and Field-Level Publication Model

Constraint 2 – Intake Validation Scope

Constraint 3 – Issue Escalation Responsibility

Constraint 4 – Independent Licensing Requirement

Constraint 5 – CMS Approval for All Agreements

Constraint 6 – Security and Compliance

Constraint 7 – No Direct Database Access

Constraint 8 – Out of Scope Activities

Data Rights and Portability

CMS-Furnished Tools and Collaboration Environment

Allow Third Parties to Use Our Data and Logic

Open Source/ Re-use

Delivery of Artificial Intelligence (AI) Solutions

Contractor Personnel

General Expectations for Agile Teams working at CMS

Understand What People Need

Work towards outcomes, not outputs

Build the Service using Agile and Iterative Processes

Use Data to Drive Decisions

Metrics

Delivery

Deliverables Summary

Standup, Sprint Cadence, Program Increments

Communication and Collaboration

Documentation Standards

Testing & Validation

Definition of Done

Delivery of Materials and Government Ownership

Quality Control and Assurance

Inspection and Acceptance Criteria

Reporting

Initial Operating Capability

Pricing and Award Structure

Cost Drivers

Award Structure

Period of Performance

Place of Performance

Timing and Deliverable Notifications

Federal Holidays and Delivery Deadlines

General CMS & Related Technical Standards

Section 508

Government Furnished Equipment, Information, and Software (GFE, GFI, GFS)

Cloud Services

Data Storage and Delivery

Publications

Contract Transition In/Out

Joint Operating Agreements (JOAs)

Appendix A: Security Requirements

Appendix B: Quality Assurance Surveillance Plan (QASP)

Product Vision

Scope

The National Provider Directory (NPD) will establish a trusted, accurate, and comprehensive source of healthcare provider information that serves as the foundation for improved care coordination, reduced administrative burden, and enhanced transparency across the U.S.

healthcare system.

The NPD supports CMS's interoperability and transparency goals by creating high-quality, reconciled provider data that is freely accessible without licensing constraints. By addressing critical data quality issues that currently plague provider directories —including outdated addresses, incorrect affiliations, and fragmented information across NPPES, PECOS, state licensing boards, and commercial sources —the NPD will enable:

2+ million active healthcare providers to maintain accurate directory information through streamlined processes

Medicare Advantage plans, payers, and health systems to build accurate provider networks and reduce "ghost networks" where providers appear available but aren't

100+ million Medicare and Medicaid beneficiaries to find the right provider at the right location

CMS programs to improve oversight, reduce fraud, and support value-based care initiatives

Note on Acquisition Scope

This acquisition covers Work Areas A and E — Ground Truth Datasets and Data Aggregation, Quality & Assurance Services. Work Areas B, C, and D are supported through separate government and/or contractor teams. Follow-on or concurrent awards may address WA B and WA C as the NPD program matures; the specific structure and sequencing of those procurements is under active development.

Context

Organizational Background

CMS provides health coverage to more than 100 million people through Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and programs established under the Affordable Care Act. Accurate, interoperable provider data is foundational to these programs — yet provider directory data today is fragmented, inaccurate, and difficult to access.

Current State and Critical Problems

Healthcare provider directory data is currently fragmented across multiple systems — including NPPES, PECOS, state licensing boards, payer directories, and commercial sources — with inconsistent formats, varying update frequencies, and no standardized cross-system identifiers beyond NPIs. This fragmentation creates significant problems across the healthcare ecosystem:

For Beneficiaries:

"Ghost networks" plague Medicare Advantage plans, where providers appear available in directories but do not practice at listed locations, creating false appearances of network adequacy

100+ million Medicare and Medicaid beneficiaries struggle to find accurate information about where providers practice, what services they offer, and how to contact them

Outdated directory information leads to wasted time, missed appointments, delayed care, and beneficiary frustration

For Providers:

2+ million active healthcare providers must manually update their information across multiple disconnected systems (NPPES, PECOS, state licensing boards, payer directories)

The administrative burden of maintaining accurate data in fragmented systems diverts time and resources from patient care

Providers have no single authoritative source to update their information once and have it propagated across the healthcare ecosystem

For Payers and Health Systems:

Medicare Advantage plans, Medicaid managed care organizations, and commercial payers struggle to build and maintain accurate provider networks

Lack of interoperable data forces reliance on expensive commercial data sources with licensing restrictions

Data quality issues create compliance risks and operational inefficiencies

For CMS Programs:

Fragmented provider data prevents a unified view across systems

Inability to validate data accuracy in real-time allows inaccuracies to persist for months or years

Lack of FHIR-compliant, freely accessible provider data hinders CMS's interoperability policies and transparency initiatives

Business Drivers and Stakeholder Engagement

In October 2022, CMS published a Request for Information on the National Directory of Healthcare concept and received 332 unique comment letters expressing strong industry need for accurate, interoperable provider data. CMS subsequently conducted Human Centered Design research, established a federal working group, and received public comments on the CMS Interoperability and Prior Authorization proposed rule — all of which confirmed the critical need for a National Provider Directory.

CMS conducted an NPD Proof of Concept in January 2026 with five contractors. The POC confirmed that no single vendor can comprehensively address all NPD requirements, that real-world validation is essential to complement automated processes, and that a modular, multi-work-area approach is necessary — findings that directly inform the WA A and WA E structure of this acquisition.

Legislative and Policy Considerations

This acquisition supports CMS's interoperability goals, provider data transparency initiatives, and statutory obligations related to provider enumeration and enrollment. The work performed under Work Areas A and E directly advances the following priorities:

Interoperability and Provider Directory Accuracy: The CMS Interoperability and Prior Authorization Final Rule establishes CMS's commitment to making accurate, accessible provider data available to patients, payers, health systems, and the public. An authoritative, continuously improving National Provider Directory is foundational to these goals.

Fraud, Waste, and Abuse Reduction: Accurate provider directory data is a critical tool for identifying and reducing fraud, waste, and abuse in Medicare and Medicaid. Ghost networks — directories that list providers who are not actually available to patients — represent a significant and well-documented problem.

NPPES and PECOS Modernization: CMS has statutory authority to operate provider enumeration (NPPES) and enrollment (PECOS) systems and to replace them with modern infrastructure. The NPD is designed to eventually subsume the core functions of both systems.

License-Free Output: CMS's strong preference is that all data published through the NPD be free from licensing constraints. See Constraint 1 (License-Free Output:

Government Preference and Field-Level Publication Model) for the operative framework governing this requirement.

NPD Program Structure

CMS has organized the NPD program into five interconnected work areas. The table below identifies the focus of each work area and its scope relative to this acquisition. This acquisition covers Work Areas A and E only. Work Areas B, C, and D are referenced solely to describe the data pipeline context within which WA A and WA E operate.

Work Area Focus In Scope for this Acquisition?

WA A: Ground Truth Datasets

Direct licensing relationships with authoritative data sources for required provider datasets. The WA A contractor manages source relationships, negotiates redistribution-compatible terms, normalizes data, and delivers regular data files to CMS-designated storage.

Yes

WA B: Data Services:

Cleaning, Reconciliation, and Data Science

All data intake, cleaning, reconciliation, data science, ETL, and AI/ML functions that process and reconcile data flowing through the NPD ecosystem.

WA A delivers normalized data files to CMS-designated storage; WA B ingests and processes those deliveries. WA E corrections and enrichments are also submitted to CMS-designated storage and flow through the WA B pipeline

NOT in scope

WA C: Platform, Infrastructure, and FHIR

Cloud hosting, platform and database infrastructure, FHIR server hosting, and FHIR API delivery for the NPD. All FHIR-related functions — including FHIR server hosting and API delivery of reconciled NPD data — sit within WA C

NOT in scope

WA D: NPD Front End Provider-facing NPD application, data editing interfaces, and public-facing directory functions.

NOT in scope

WA E: Data Aggregation, Quality, and Assurance Services

Outcome-based data quality improvement operating at both ends of the NPD data lifecycle — validating the quality of WA A source data entering the WA B pipeline (upstream) and validating the

Yes accuracy of data published through the NPD (downstream).

Note on WA A and WA E Combined Award: This acquisition covers Work Areas A and E as a single combined award. WA A supplies authoritative data inputs; WA E validates and improves data quality at both ends of the workflow. Combining both work areas with a single contractor preserves the critical feedback loop between data sourcing and data quality improvement. The descriptions of WA B, WA C, and WA D above are provided solely to orient offerors to the data pipeline context — the structure, staffing, and procurement approach for those work areas is outside the scope of this SOO.

How WA A and WA E Work Together

WA A and WA E are the two work areas in scope for this acquisition. They are complementary functions that together anchor the NPD data lifecycle — one supplying authoritative inputs, the other ensuring the quality of data at both ends of the workflow.

The NPD data lifecycle flows as follows: WA A (ground truth data sourcing) → delivers normalized data files to CMS-designated storage → WA B (data services: cleaning, reconciliation, data science, ETL, AI/ML) → processes and reconciles all data → WA C (platform, infrastructure, and FHIR) → hosts the NPD infrastructure and serves reconciled data via FHIR API → WA D (NPD front end) → provides provider-facing directory and editing functions → WA E (data aggregation, quality assurance) → validates data quality at both ends of this workflow – assessing WA A source data quality at the input end and assessing the accuracy of public-facing NPD outputs (WA C FHIR API and WA D directory) at the output end – submits corrections through the WA B pipeline, and feeds findings back to WA A. WA E is not simply another input service. It operates at both ends of the NPD data lifecycle:

Upstream: WA E assesses the quality of data entering the pipeline from WA A sources

— identifying errors, gaps, and patterns that trace back to specific ground truth sources

Downstream: WA E validates the accuracy of data published through NPD

— identifying ghost network indicators, stale records, and directory inaccuracies in the NPD's public output

Feedback loop: WA E findings are documented and fed back to WA A at each Program Increment, informing decisions about which data sources to prioritize, renegotiate, or replace

This creates a continuous quality improvement cycle — the NPD data ecosystem becomes more accurate over time, not just at a point in time. All coordination between WA A, WA E, and other work areas flows through CMS government staff.

Definitions

The following definitions apply throughout this Statement of Objectives and all associated contract documents, including the QASP (Appendix B), Appendix A (Security Requirements), and any task orders or modifications issued under this contract. Where a term is defined in full in another section of this SOO, this section provides the operative definition and a cross-reference to the fuller treatment.

Terms not defined here shall have the meanings ascribed to them in the Federal Acquisition Regulation (FAR), the Health and Human Services Acquisition Regulation (HHSAR), or common federal acquisition usage, in that order of precedence.

Accepted Correction: A data correction submitted by the WA E contractor that CMS, through the WA B pipeline, has applied to an NPD provider record. Acceptance constitutes CMS's determination that the correction is supported by sufficient authoritative source evidence, contains required metadata, and does not conflict with a higher-authority source. See Category 3 (WA E Objectives) and Appendix B (QASP) for the full acceptance definition, adjudication process, and appeal rights.

Authoritative Source: An organization that is the primary, legally recognized, or industry-standard source of a specific category of provider data — by statute, regulation, professional body designation, or established industry practice. An authoritative source maintains the underlying data as part of its core organizational function, performs ongoing maintenance to ensure accuracy, and possesses specialized domain expertise in the data it maintains. For purposes of WA A, authoritative sources include both sole/primary sources (where no reasonable competing alternative exists) and recognized aggregators of open or FOIA-covered data (where the underlying data is publicly available but aggregation provides material coverage or efficiency value). See Table 1 (Required Datasets) for the specific authoritative sources identified for each required dataset category.

Background IP: Pre-existing intellectual property — including commercial methods, platform capabilities, proprietary AI/ML engines, model weights, training corpora, and other assets — that the contractor brings to the engagement and that was developed independently of and prior to this contract. Background IP may remain vendor-owned subject to the documentation, audit rights, and transition conditions specified in the Background and Foreground Intellectual Property section. Contrast with Foreground IP.

CMS-Designated Storage: The CMS-managed storage location — currently Amazon S3 or an appropriate alternative as directed by CMS — to which WA A contractors deliver normalized data files and WA E contractors deliver corrections and enrichments. CMS-designated storage is the delivery point for all contractor data deliverables under this contract. Contractors do not have direct write access to the NPD database; all deliveries flow through CMS-designated storage and the WA B pipeline.

Correction: A data record submitted by the WA E contractor to CMS-designated storage or the NPD API write-back mechanism that proposes a change to one or more fields in an existing NPD provider record, or proposes the addition of a new provider record not currently in the NPD.

Each correction submission shall include the metadata specified in Category 3 (Competitive Quality Demonstration and Correction Acceptance). See also: Accepted Correction; Rejected Correction; WA B Pipeline Rejection.

Correction Acceptance Rate: The percentage of WA E corrections submitted in a given measurement period that are accepted and applied by CMS through the WA B pipeline, calculated on a difficulty-weighted basis so that a contractor cannot achieve a high acceptance rate by submitting only low-complexity corrections while avoiding difficult records. The correction acceptance rate clock starts on the WA E Performance Start Date. See Appendix B (QASP) for the applicable Acceptable Quality Level (AQL), difficulty weighting methodology, and measurement approach.

Data Quality Dashboard: The WA E contractor-maintained dashboard — hosted in CMS-furnished Confluence — that tracks correction delivery status, correction acceptance rates, quality assessment coverage, open quality issues, and feedback loop deliverables across all WA E activities. The Data Quality Dashboard shall be accessible to CMS government staff at all times without requiring contractor assistance.

Data Source Catalog: A WA A contractor-maintained document — hosted in CMS-furnished Confluence — that records all active and prospective data sources, including: what each source provides, its licensing terms and status, delivery cadence, known limitations, field-level publication tier status, and current agreement status. Updated within five (5) business days of any material change.

Data Source Status Dashboard: The WA A contractor-maintained dashboard — hosted in CMS-furnished Confluence — that tracks, for each required and active supplemental dataset:

agreement status, delivery cadence, last successful delivery, known issues, field-level publication tier status, and source contact information. The Data Source Status Dashboard shall be accessible to CMS government staff at all times without requiring contractor assistance. See Appendix B (QASP) for dashboard currency requirements.

Derived Data: Data produced by transforming, aggregating, or combining source data in a manner that does not expose the underlying source data in its original form. Derived data may be published in the public-facing NPD if the source agreement expressly permits derived-publication rights or does not restrict derived outputs, and if the underlying restricted data is not exposed in the published output. See Constraint 1 (Derived and Aggregated Outputs) for the operative framework.

Do Not Use: A field-level publication tier designation indicating that a specific data field cannot be used by CMS for any purpose under the terms of the applicable source agreement. The contractor shall not propose or execute source agreements that result in a Do Not Use designation for any field that CMS has identified as essential to the public-facing NPD. See Constraint 1 (Field-Level Publication Tiers) for the full three-tier model.

Foreground IP: Intellectual property developed specifically under this contract, including: all correction outputs, associated metadata, and provenance records; all methodology specifications, decision logic, rule libraries, confidence threshold documentation, and human-review criteria developed under this contract; all NPD-specific implementation artifacts, interfaces, configurations, and audit records; and all source code, scripts, validation tooling, prompts, and rule libraries written specifically for NPD performance. CMS holds unlimited rights to all foreground IP as defined in FAR 52.227-14. Contrast with Background IP. See the Background and Foreground Intellectual Property section for the full framework.

Government-Furnished Information (GFI): Data, systems, or other information provided by the Government to the contractor for use in contract performance, at no cost to the contractor. For purposes of this contract, GFI includes the provider data assets listed in Table 3 — NPPES, PECOS, data.cms.gov holdings, Lantern, and APS data (subject to final CMS determination). GFI sources do not count toward the five-source WA A IOC threshold and shall not be independently procured under this contract. The GFI list in Table 3 is not exhaustive — the contractor is responsible for identifying additional GFI sources through the pre-award data inventory process. See Table 3 (Known Government-Furnished Information) for the full GFI list and operative framework.

Ground Truth: Data obtained directly from an authoritative source that has been validated as accurate and current as of the date of delivery. Ground truth data is the foundational input to the NPD data pipeline — it represents the most reliable available information about a provider's credentials, licensure, certification, or other attributes as maintained by the issuing authority. Ground truth data may require normalization before delivery but its substantive content reflects the authoritative source's current record.

Initial Operating Capability (IOC): The milestone at which the WA A contractor has demonstrated the ability to deliver normalized data files from at least five (5) qualifying authoritative sources to CMS-designated storage in conformance with CMS delivery specifications. See the Initial Operating Capability section for the full IOC definition, qualifying source criteria, clock start date, and CMS-side dependency provisions.

Minimum Public Field Schema: The set of data fields that CMS determines must be in the Publish tier for the NPD to fulfill its public directory mission. The minimum public field schema will be developed collaboratively with the contractor in the first Program Increment and published as a post-award deliverable. CMS anticipates that provider identity fields (NPI, name, taxonomy, practice location) will be in the Publish tier for all required datasets. See Constraint 1 (Minimum Public Field Schema) for the full framework.

Normalization: The process of transforming raw source data into a standardized format conforming to CMS-specified schema, field definitions, naming conventions, and completeness requirements before delivery to CMS-designated storage. Normalization includes but is not limited to: standardization of provider identifiers (NPI where applicable), address standardization to USPS CASS-certified format, name normalization, taxonomy code standardization, and removal of duplicate or malformed records. Normalization is performed by the WA A contractor in the contractor's environment before delivery — raw, un-normalized source data shall not be delivered to CMS-designated storage.

NPD Provider Record: A single provider entity record in the NPD database, identified by NPI or other CMS-assigned identifier, containing the set of data fields maintained by the NPD for that provider. A provider record may be updated by WA A data deliveries, WA E corrections and enrichments, or provider-submitted attestations flowing through the WA B pipeline.

Program Increment (PI): A six-week planning and delivery cycle used by the NPD program team, consisting of three two-week sprints. PI planning ceremonies occur at the start of each PI.

All WA A and WA E performance reporting, feedback loop summaries, and QASP self-assessments are organized around the PI cadence.

Provenance: The documented chain of custody from a data element's authoritative primary source to its delivered form in a WA A data file or WA E correction submission. Provenance documentation shall identify: the issuing authority (the state board, certification body, or regulatory authority that maintains the underlying data), the collection or aggregation method used, the date of collection, and any transformations applied between collection and delivery.

Provenance documentation is required for all WA A deliveries and all WA E corrections regardless of sourcing approach.

Publish: A field-level publication tier designation indicating that a specific data field may be freely published in the public-facing NPD without restriction. CMS's goal is to maximize the number of fields in this category across all required datasets. See Constraint 1 (Field-Level Publication Tiers) for the full three-tier model.

Reconciled Data: Data produced by the WA B pipeline by resolving conflicts among multiple source inputs — WA A ground truth deliveries, WA E corrections and enrichments, and provider-submitted attestations — into a single best-answer record for each provider.

Reconciled data is the output of the WA B pipeline and the input to the NPD's public-facing outputs. The WA B contractor is responsible for reconciliation logic; WA A and WA E contractors deliver inputs to the reconciliation process but do not perform reconciliation.

Rejected Correction: A WA E correction that CMS has determined does not meet acceptance criteria — specifically, a correction that is unsupported by sufficient authoritative source evidence, contains insufficient metadata, conflicts with a higher-authority source without sufficient justification, proposes a change to a Do Not Use field, or is a duplicate of a previously adjudicated correction. Rejection is recorded with a rejection category code and brief explanation sufficient for the WA E contractor to understand the basis for rejection and prepare an appeal if warranted. See Category 3 (Correction Acceptance Definition) for the full rejection definition and appeal process.

Use Internally Only: A field-level publication tier designation indicating that a specific data field may be used by CMS and authorized downstream users for internal purposes (e.g., enrollment validation, fraud detection, network adequacy assessment) but may not be published in the public-facing NPD. Use Internally Only designations are an acceptable and anticipated outcome of WA A licensing negotiations and do not constitute a failure to meet the license-free output preference, provided the publicly publishable field set remains sufficient for a complete and useful public directory. See Constraint 1 (Field-Level Publication Tiers) for the full three-tier model.

WA B Pipeline: The data processing infrastructure operated by the WA B contractor that ingests WA A data deliveries and WA E corrections from CMS-designated storage, applies reconciliation logic, and produces reconciled NPD provider records. The WA B pipeline is the mechanism through which WA E corrections are adjudicated and applied to NPD records. WA A and WA E contractors do not have direct write access to the WA B pipeline or the NPD database.

WA B Pipeline Rejection: A correction submission that fails to process through the WA B pipeline due to a technical or format error in the WA B system — not due to a quality determination about the correction itself. WA B pipeline rejections are not counted against the

WA E contractor's correction acceptance rate and shall be tracked separately. See Appendix B (QASP) for the WA B pipeline rejection attribution metric and process.

WA E Performance Start Date: The date on which the WA B write-back mechanism is confirmed operational by CMS, from which the correction acceptance rate clock and all WA E QASP performance measurement begins. CMS shall notify the WA E contractor in writing when the WA B write-back mechanism is confirmed operational. See the Initial Operating Capability section and Appendix B (QASP) for the full clock start definition and pre-Performance Start Date obligations.

Statement of Need

CMS cannot build an accurate National Provider Directory without reliable access to authoritative external data sources. The most trusted provider data — state licensing credentials, board certifications, and credentialing information — resides outside CMS systems, held by organizations with inconsistent data formats, varying accessibility, and complex licensing terms.

Today, this creates four critical gaps:

No Centralized Data Access Strategy CMS currently has no systematic approach to procuring and managing access to authoritative external data sources needed for the NPD (addressed by WA A), nor a structured mechanism for engaging data aggregators and enrichment vendors to validate and improve NPD data quality across the full data lifecycle (addressed by WA E).

Licensing Constraints Prevent Free Data Distribution Many authoritative data sources carry licensing restrictions that would prevent CMS from freely redistributing reconciled NPD data to industry, academia, and the public. Without careful licensing negotiation upfront, CMS risks building a provider directory it cannot publish without ongoing commercial licensing obligations — directly undermining the NPD's mission of freely accessible, authoritative provider data. Constraint 1 (License-Free Output) establishes the operative framework for addressing this risk through field-level licensing negotiation.

No Escalation Path for Source Data Quality Issues When downstream systems identify problems with source data (wrong formats, missing fields, stale records), there is currently no dedicated function to triage these issues with data providers and drive resolution. This allows data quality problems to persist and propagate through the NPD ecosystem.

No Systematic Mechanism for End-to-End Data Quality Validation CMS currently has no structured approach to engaging commercial data aggregators and enrichment vendors to identify and correct errors in NPD provider records — either as data enters the workflow from WA A sources or as data exits the NPD system through the NPD’s public-facing directory. Provider data quality degrades continuously as providers change locations, affiliations, and credentials. WA E addresses this gap by establishing a competitive framework for data quality improvement services that operates at both ends of the data workflow and feeds findings back to WA A to continuously improve data sourcing.

Objectives

The contractor shall deliver data sourcing and licensing management services that achieve the following objectives:

Category 1 – WA A: Ground Truth Data Access and Licensing

The contractor shall negotiate and maintain licensing relationships with authoritative data sources for all required datasets identified in Table 1 and any supplemental or additional datasets directed by CMS post-award. The contractor shall:

Establish and maintain direct licensing relationships with authoritative data sources — whether primary sources, aggregators, or combinations — for all required datasets, and for supplemental or additional datasets as directed by CMS. CMS may also direct the contractor to pursue data through direct relationships with underlying sources (e.g., working directly with State Medical Boards rather than through FSMB) where CMS determines this is advantageous for coverage, cost, or redistribution rights

Ensure all data licensing and service agreements comply with Constraint 1 (License-Free Output) - specifically, that each agreement is reviewed for field-level publication compatibility before execution and that CMS written approval is obtained before any agreement is finalized

Identify and document, before finalizing any source agreement, all fields that will be designated Use Internally Only or Do Not Use under the proposed agreement terms;

clearly segregate Use Internally Only fields in all data deliveries to prevent inadvertent inclusion in public NPD output; flag any state legal constraints on publication of specific data fields - particularly for state licensing board data where state laws may restrict publication of certain disciplinary or personal information

Not make independent determinations about which fields to publish or withhold — CMS makes all field-level publication decisions

Negotiate independent licensing agreements for each required dataset directly on behalf of CMS. Where CMS already holds a license to a data source relevant to NPD, the contractor shall identify that existing license and coordinate with the COR to determine whether it can be expanded to cover NPD redistribution requirements before establishing a new independent agreement. New licenses established for NPD purposes should, where practicable, incorporate existing CMS uses until the NPD can serve as the authoritative source for that data category. The contractor shall not structure agreements in a way that ties CMS's data access to the contractor's own commercial relationships or creates a dependency on the contractor's continued performance for CMS to maintain data access

Provide transparent, itemized pricing for each data source — required and supplemental — to enable CMS to make informed decisions about data source prioritization and cost management. Bundled pricing that combines multiple data sources into a single line item is not acceptable

WA A Accountability Boundary: WA A is accountable for format and schema conformity at delivery — data files delivered to CMS-designated storage shall conform to CMS-specified format, completeness, and naming conventions. WA A is not accountable for semantic accuracy validation of published NPD records (WA E accountability) or for ETL, reconciliation, and data science functions (WA B accountability).

Category 2 – WA A: Data Normalization and Delivery

Normalization Location: Unless otherwise specified by CMS, normalization activities shall be performed by the contractor in the contractor's environment before delivery to CMS-designated storage. CMS-designated storage is the delivery point — not the normalization environment.

The contractor shall:

Deliver normalized data files to CMS-designated storage on a regular cadence for all required datasets, or more frequently as directed by CMS for high-velocity data categories (e.g., provider network participation data). File formats, naming conventions, field schemas, and delivery specifications shall be defined by CMS in coordination with the WA B contractor and documented in the Data Source Status Dashboard

Normalize all delivered data to CMS-specified standards before delivery, including:

standardized provider identifiers (NPI where applicable), address standardization to USPS CASS-certified format, name normalization, taxonomy code standardization, and any additional normalization requirements specified by CMS. Address verification and standardization tools are contractor-furnished — the contractor shall maintain USPS CASS-certified address standardization capability as part of its normalization workflow

Monitor data quality at the source level — track delivery completeness, timeliness, and format conformity for each required dataset; proactively flag known issues, changes in source data availability, or degradation in source data quality to CMS within one (1) business day of identification

Respond to CMS-identified data quality issues within the timeframes specified in the QASP; coordinate resolution directly with source organizations; document resolution status in the Data Source Status Dashboard; escalate unresolved issues to CMS with a recommended resolution path

Maintain a Data Source Status Dashboard (in CMS-furnished Confluence) that tracks, for each required and active supplemental dataset: agreement status, delivery cadence, last successful delivery, known issues, field-level publication tier status, and source contact information

Provide a weekly data delivery status report to CMS: datasets delivered, delivery completeness, known issues, and any changes in source agreement terms or data availability

Category 3 – WA E: Data Aggregation, Quality, and Assurance Services

WA E is the quality assurance backbone of the NPD data ecosystem. Unlike WA A, which establishes direct relationships with authoritative data sources, WA E is structured as an outcome-based quality improvement function that operates at both ends of the NPD data lifecycle — validating the quality of data entering the pipeline from WA A sources and validating the accuracy of data published through the NPD's public-facing directory. WA E findings feed back to WA A at each Program Increment, creating a continuous quality improvement loop.

All data and corrections delivered under WA E must be compatible with CMS's license-free output preference as described in Constraint 1. WA E contractors shall not deliver corrections or enrichments that would introduce downstream licensing obligations on NPD output data.

WA E Accountability Boundary: WA E is accountable for semantic and accuracy validation — assessing whether the content of delivered data is accurate, current, and consistent with authoritative sources — and for output-side validation of published NPD records. WA E is not accountable for format and schema conformity at delivery (WA A accountability) or for ETL, reconciliation, and data science functions (WA B accountability). WA E contractors shall not make unilateral decisions about WA A sourcing or agreement terms based on WA E quality findings — all such decisions flow through CMS government staff

Upstream Quality Validation (Input Side — data going into WA B Pipeline):

The contractor shall assess the quality of WA A source data as it flows through the NPD pipeline and deliver findings that enable CMS to make evidence-based decisions about WA A sourcing:

Identify errors, gaps, and inconsistencies in ground truth data from WA A sources — including patterns of error traceable to specific sources, coverage gaps by provider type or geography, and records where WA A source data is insufficient to support high-confidence reconciliation

Deliver corrections and enrichments via CMS-designated storage or NPD API write-back to improve data quality before WA B processing — with sufficient metadata for CMS to evaluate quality and provenance

Document input quality findings with sufficient specificity to enable CMS to evaluate whether WA A sourcing decisions should be adjusted

Downstream Quality Validation (Output Side — Data Published Through the NPD):

The contractor shall assess the accuracy of provider data published through the NPD's public-facing outputs — including the FHIR API (WA C) and the public-facing directory (WA D). WA E downstream validation is conducted from the perspective of an external consumer of NPD data

— querying the FHIR API, reviewing public directory records, and comparing published data against authoritative sources — without requiring direct access to the WA B internal database or WA D application code:

Identify ghost network indicators — providers listed as active and available who cannot be verified through WA E enrichment sources or provider engagement workflows

Identify stale records, outdated affiliations, and directory inaccuracies in published NPD data

Deliver corrections and enrichments via NPD API write-back to improve the accuracy of published provider records

Track output quality metrics over time and surface trends to CMS at each sprint review with specific, actionable recommendations

Study interoperability endpoints to ensure they are valid and associated with the correct entities, including correct associations with individual providers.

Feedback Loop to WA A:

The contractor shall provide structured quality findings to CMS government staff at each Program Increment that enable evidence-based decisions about WA A data source portfolio management:

Identify patterns of data quality issues traceable to specific WA A sources and recommend sourcing adjustments, source prioritization changes, or renegotiation priorities

Support CMS in making evidence-based decisions about which WA A sources to prioritize, deprioritize, renegotiate, or replace based on observed quality patterns

The feedback loop operates through CMS government staff — WA E findings are submitted to CMS; CMS routes actionable findings to WA A.

Competitive Quality Demonstration and Correction Acceptance:

The contractor shall demonstrate measurable improvement in NPD data accuracy through per-data-point corrections or delivery of alternative and additional datasets that improve upon existing NPD records:

Provide sufficient documentation and metadata with all corrections and enrichments to enable CMS to evaluate quality and provenance — at minimum: source of correction, methodology used, confidence level, provider records affected, and data category

Track correction acceptance rates and use acceptance rate trends to continuously improve correction methodology

Correction Acceptance Definition: A correction is "accepted" when CMS, through the WA B pipeline, applies the correction to the NPD record. A correction is "rejected" when CMS determines the correction is unsupported by sufficient authoritative source evidence, contains insufficient metadata, or conflicts with a higher-authority source. The correction acceptance rate clock starts on the date the WA B write-back mechanism is confirmed operational by CMS.

Acceptance rate is measured against all corrections submitted, weighted by data category and record complexity, so that a contractor cannot achieve a high acceptance rate by avoiding difficult records. Detailed acceptance criteria and adjudication timelines will be published with the solicitation.

WA E Sourcing Approach — Types of Service Providers

WA E encompasses three complementary types of service providers. Offerors may propose one or more of these approaches, provided they demonstrate measurable quality improvement outcomes:

Data aggregation and enrichment: Healthcare data aggregators with demonstrated experience correcting and enriching provider directory data at scale — including clinician, payer, and clinical organization data — using proprietary datasets, AI/ML-driven analysis, or provider engagement workflows

Commercial and supplemental validation: Commercial address validation, provider location services, and other sources that fill coverage gaps where authoritative sources are incomplete — particularly for address validation, provider location data, and provider demographics not captured in credentialing systems

Provider engagement and attestation: Platforms with established provider networks that enable providers to review, attest to, and correct their directory information, with corrections delivered to CMS-designated storage or NPD API write-back

WA E vendors may deliver corrections derived from proprietary datasets, AI/ML-driven analysis, or provider engagement workflows. Pre-existing commercial methods, platform capabilities, and proprietary AI/ML engines (background IP) may remain vendor-owned, provided: (i) CMS receives full documentation and audit rights for all background IP used to generate corrections;

(ii) all corrections carry sufficient metadata for CMS or a successor contractor to independently evaluate the correction without access to the underlying engine; and (iii) no background IP creates a dependency that prevents CMS from transitioning the WA E function to a successor contractor.

WA E Scope Limitations

The following are explicitly outside WA E scope:

WA E does not duplicate the ETL, reconciliation, and data science functions performed by the WA B pipeline team

WA E contractors do not have direct write access to the NPD database — all corrections and enrichments flow through the WA B pipeline

WA E does not make unilateral decisions about WA A sourcing or agreement terms — all sourcing decisions flow through CMS government staff

WA E corrections and enrichments that cannot be delivered via CMS-designated storage or the NPD API write-back mechanism are out of scope

Anticipated Data Sources and Service Providers

The Government has identified six (6) required data categories for which all offerors must propose a sourcing approach and provide pricing. These required datasets represent the core of the NPD's initial build-out and are the basis for consistent, comparable evaluation across all proposals. The Government has also identified supplemental data categories that represent additional provider data the NPD may seek to incorporate post-award. Offerors are not required to address supplemental datasets. Where offerors have existing experience or relationships with supplemental dataset sources, they are invited to describe that experience.

No pricing for supplemental datasets should be included in any proposal.

The "Known Authoritative Source(s)" column in Table 1 identifies the primary or most commonly used source(s) for each data category based on CMS market research. CMS is not prescribing a specific source. Before proposing source agreements, the contractor shall review the Government-Furnished Information (GFI) described in Table 3 below.

WA A – Ground Truth Data Sources

WA A covers direct licensing relationships with organizations that are the sole or primary authoritative source for a specific dataset. These organizations maintain foundational, ground-truth information about providers and clinical organizations, perform ongoing maintenance of the underlying data to ensure its accuracy, and possess specialized expertise in the domain their dataset represents.

Table 1 – Required Datasets: All Offerors Must Propose and Price

Offerors must provide a sourcing approach and itemized pricing for each of the six required datasets below. Proposals that do not address all six required datasets will be evaluated as incomplete for Work Area A.

# Required Dataset Known Authoritative Source(s)*

Notes for Offerors

Clinician licensure

— national physician/ osteopathic+allopat hic

Each State Medical Board maintains the medical license status for their state's clinicians. The Federation of State Medical Boards (FSMB) is one aggregation source for this data, but the underlying license data are generally covered by various Freedom of Information laws and represent open datasets.

Offerors may propose direct state board relationships, FSMB aggregation, alternative aggregators, or combinations. Provenance documentation is required regardless of sourcing approach.

Clinician licensure

— supplemental state boards (non- FSMB covered provider types and jurisdictions)

In some states there are more than one medical licensing board covering different types of clinicians.

Offerors should identify coverage gaps in their Dataset #1 approach and describe how supplemental state board relationships address those gaps.

Board certification

— physicians (MD, DO)

There are dozens of medical specialty boards that maintain the certification status of different types of physicians. The American Board of Medical Specialties (ABMS) is one aggregator of this data.

Physician board certification is directly linked to Medicare enrollment and network adequacy requirements and is therefore a required dataset. Non-physician board certification is addressed separately under Supplemental Dataset #10.

Provider network participation data

Each payer maintains multiple internal data sources that model their provider participation

This is the most complex dataset to aggregate due to the fragmented, multi-payer landscape. Offerors should

# Required Dataset Known Authoritative Source(s)*

Notes for Offerors network. Federal regulations require certain payers to publish machine-readable (FHIR-based) provider directories.

describe their approach to multi-payer FHIR directory aggregation, including how they address payers that are not yet compliant with machine-readable directory requirements. The CMS Interoperability and Prior Authorization Final Rule establishes the regulatory mechanism making this data accessible.

Pharmacy identification

The National Council for Prescription Drug Programs (NCPDP) is the authoritative source of pharmacy identifiers and maintains accurate metadata on pharmacies including address and associated pharmacists.

NCPDP is both the authoritative standards body and the primary data source for this category. Offerors should describe their approach to establishing redistribution-compatible terms with NCPDP, including any field-level restrictions that may apply.

Hospital/facility data

The American Hospital Association (AHA) annual survey is coded by CMS Certification Number and contains multiple data points on hospital facilities, including resources, bed counts, specific personnel, system affiliation, and web addresses.

Offerors should describe their approach to establishing redistribution-compatible terms with AHA and identify any field-level restrictions that may apply to public redistribution.

* "Known Authoritative Source(s)" identifies the primary or most commonly used source(s) for each data category based on CMS market research. CMS is not prescribing a specific source and recognizes that alternative sources, aggregators, or combinations of sources may provide equivalent or superior coverage, accuracy, or cost-effectiveness. Offerors are encouraged to propose the sourcing approach — including any alternative or supplemental sources — that best achieves the Government's objectives of comprehensive coverage, high accuracy, and license-free redistribution to the maximum extent practicable.

Table 2 — Supplemental Datasets: Market Capabilities and Experience

For each supplemental dataset below, briefly describe your organization's experience and existing relationships with the identified source(s), if any. Offerors shall not include supplemental datasets in their price proposals. This section is informational only — it is not evaluated comparatively during source selection and does not establish pricing obligations.

CMS may incorporate supplemental datasets post-award via contract modification based on program priorities and available funding.

Supplemental Datasets: Offeror Experience and Existing…