NPD_WA_A_and_E_DataSourcingQuality_SOO.pdf

National Provider Directory Data Services Work Area 1 – Data Sourcing SOO

Statement of Objectives (SOO) for

National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services

24 June 2026

Product Vision

Scope

Mission Impact

Context

Organizational Background

Current State and Critical Problems

Business Drivers and Stakeholder Engagement

Unfulfilled Needs Being Addressed

Legislative and Policy Mandates

NPD Program Structure

How WA A and WA E Work Together

Note on Acquisition Scope

Statement of Need

Objectives

Category 1 – WA A: Ground Truth Data Access and Licensing:

Category 2 – WA A: Data Normalization and Delivery:

Category 3 – WA E: Data Aggregation, Quality, and Assurance

Category 4 – WA A and E: Data Delivery

Anticipated Data Sources and Service Providers

WA A – Ground Truth Data Sources

Provider Credentialing and Licensure Data

Pharmacy Data

Hospital Data

Organizational Credentials and Accreditation Data

Health Plan and Payer Data

WA E – Data Aggregation and Quality Service Providers

Data Aggregation and Enrichment Services

Commercial and Supplemental Validation Sources

Provider Engagement and Attestation Platforms

What CMS Is NOT Seeking Under This Contract

Approach

1. Operating Model

2. How WA A and WA E Work Together

3. Contractor's Role Within the NPD Program

4. Flexibility and Iteration

Constraints

General Expectations for Agile Teams working at CMS

Understand What People Need

Work towards outcomes, not outputs

Build the Service using Agile and Iterative Processes

Make it Simple and Intuitive

Use Data to Drive Decisions

Metrics

WA A Performance Metrics

WA E Performance Metrics

Allow Third Parties to Use Our Data and Logic

Open Source/ Re-use

Delivery of Artificial Intelligence (AI) Solutions

Contractor Personnel

Delivery

Deliverables Summary

Tooling, Metrics, and Dashboards

Communication and Collaboration

Documentation Standards

Testing & Validation

Definition of Done

Packaging, Packing, and Shipping Instructions:

Quality Control and Assurance

Inspection and Acceptance Criteria

Reporting

Pricing and Award Structure

Cost Drivers

Pricing Structure

WA A — Ground Truth Data Sourcing

WA E — Data Aggregation, Quality & Assurance Services

Award Structure

Initial Operating Capability

Period of Performance

Place of Performance

Occasional Travel

Timing

Holidays

General CMS & Related Technical Standards

Section 508

Government Furnished Equipment (GFE)/ Information (GFI)/ Software or Service (GFS)

Cloud Services

Publications

Contract Transition In/Out

Joint Operating Agreements (JOAs)

Appendix A: Security Requirements

Appendix B: Quality Assurance Surveillance Plan (QASP)

Product Vision

Scope

The National Provider Directory (NPD) will establish a trusted, accurate, and comprehensive source of healthcare provider information that serves as the foundation for improved care coordination, reduced administrative burden, and enhanced transparency across the U.S.

healthcare system.

The NPD supports CMS's interoperability and transparency goals by creating high-quality, reconciled provider data that is freely accessible without licensing constraints. By addressing critical data quality issues that currently plague provider directories —including outdated addresses, incorrect affiliations, and fragmented information across NPPES, PECOS, state licensing boards, and commercial sources —the NPD will enable:

• 2+ million active healthcare providers to maintain accurate directory information through streamlined processes

• Medicare Advantage plans, payers, and health systems to build accurate provider networks and reduce "ghost networks" where providers appear available but aren't

• 100+ million Medicare and Medicaid beneficiaries to find the right provider at the right location

• CMS programs to improve oversight, reduce fraud, and support value-based care initiatives

The National Provider Directory (NPD) — Work Areas (WA) A and E: Ground Truth Datasets and Data Aggregation, Quality & Assurance Services award will establish reliable, cost-effective access to authoritative external data sources that form the foundation of accurate provider directory information, and will ensure that the data flowing through and out of the NPD ecosystem meets the highest standards of accuracy and completeness. Together, these two work areas anchor the NPD data lifecycle — WA A supplies the authoritative inputs that feed the data pipeline, and WA E validates and improves data quality at both ends of the workflow, creating a continuous improvement loop that ensures the NPD remains accurate and trustworthy over time.

This award will ensure that CMS has consistent, high-quality data flowing from state licensing boards, credentialing organizations, and other authoritative sources into the NPD data ecosystem — and that the data published by the NPD is continuously validated, corrected, and improved through competitive data aggregation and quality assurance services.

Mission Impact

Success in this work area directly supports CMS's mission to strengthen and modernize the nation's healthcare system. Accurate, interoperable provider data is foundational to:

• Better beneficiary care through accurate provider directories

• Reduced fraud, waste, and abuse through improved oversight

• Lower administrative burden on providers and payers

• Enhanced interoperability across the healthcare ecosystem

• Greater transparency in healthcare delivery

This acquisition is a critical first step in establishing the National Provider Directory as a trusted, authoritative source of provider information that serves the entire U.S. healthcare system.

Context

Organizational Background

The Centers for Medicare & Medicaid Services (CMS) provides health coverage to more than 100 million people through Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and programs established under the Affordable Care Act. CMS seeks to strengthen and modernize the nation's healthcare system to provide access to high-quality care and improve health at lower costs.

Current State and Critical Problems

Healthcare provider directory data is foundational to the U.S. healthcare system, yet it is currently fragmented, inaccurate, unreliable, and difficult to access. This creates cascading problems that harm Medicare and Medicaid beneficiaries, burden healthcare providers, and undermine CMS's interoperability and transparency goals.

Provider directory data today is fragmented across multiple systems:

• NPPES (National Plan and Provider Enumeration System): Contains 7-8 million registered NPIs with limited validation of accuracy

• PECOS (Provider Enrollment, Chain, and Ownership System): Medicare enrollment data with different update cycles for different providers

• Other CMS Internal Databases: Including data on laboratories, hospitals, skilled nursing facilities, payers, and other entities, many of which have associated data published on data.cms.gov, Lantern database, and other HHS and/or CMS data publishing resources

• State licensing boards and Other Authoritative Sources: Credential data, licensure status, and disciplinary actions with inconsistent formats and accessibility across 50+ state boards

• Payer and Healthcare System directories: Insurance companies and health systems often have conflicting information about healthcare providers

• Commercial data sources: Varying quality and licensing restrictions that prevent free redistribution

Provider information is often inconsistent across these sources due to:

• Different data collection methods and validation processes

• Varying update frequencies and lag times

• Lack of standardized identifiers beyond NPIs

• Provider name variations and address formatting differences

• Uncoordinated updates of information, especially telephone and address information – credentialing personnel must update numerous disconnected systems even for a simple change such as phone number update

• Incomplete or outdated contact information

This fragmentation creates significant problems across the healthcare ecosystem:

For Beneficiaries:

• "Ghost networks" plague Medicare Advantage plans, where providers appear available in various directories but actually don't practice at listed locations, creating false appearances of network adequacy

• 100+ million Medicare and Medicaid beneficiaries struggle to find accurate information about where providers practice, what services they offer, and how to contact them

• Outdated directory information leads to wasted time, missed appointments, delayed care, and beneficiary frustration

For Providers:

• 2+ million active healthcare providers shall manually update their information across multiple disconnected systems (NPPES, PECOS, state licensing boards, payer directories)

• The administrative burden of maintaining accurate data in fragmented systems diverts time and resources from patient care

• Providers have no single authoritative source to update their information once and have it propagated across the healthcare ecosystem

For Payers and Health Systems:

• Medicare Advantage plans, Medicaid managed care organizations, and commercial payers struggle to build and maintain accurate provider networks

• Lack of interoperable data forces reliance on expensive commercial data sources with licensing restrictions

• Data quality issues create compliance risks and operational inefficiencies

For CMS Programs:

• Fragmented provider data prevents a unified view across systems

• Inability to validate data accuracy in real-time allows inaccuracies to persist for months or years

• Lack of FHIR-compliant, freely accessible provider data hinders CMS's interoperability policies and transparency initiatives

Business Drivers and Stakeholder Engagement

In October 2022, CMS published a Request for Information (RFI) on the National Directory of Healthcare (NDH) concept and received 332 unique comment letters expressing strong industry need for accurate, interoperable provider data. CMS launched Human Centered Design (HCD) research in fall 2022 and established a federal working group to explore solutions. Public comments on the CMS Interoperability and Prior Authorization proposed rule further emphasized the critical need for a National Provider Directory to support interoperability policies.

More recently, CMS conducted an NPD Proof of Concept (POC) in January 2026 with five contractors. The POC demonstrated that:

• Diverse Industry Approaches: Industry solutions and vendors exhibit significant variation in their methods for data reconciliation, quality validation, and API delivery, utilizing a range of techniques from rule-based systems to advanced AI/ML models.

• No Single Vendor Solution: A recurring finding is that no single vendor can comprehensively address all NPD requirements, which necessitates a modular, multi-work-area approach to solve specific use-cases.

• Essential Role of Real-World Validation: Automated data quality checks alone are insufficient. Real-world validation services, such as site visits and phone verification, are essential to complement automated processes and significantly improve data accuracy.

• Promise of AI/ML: Advanced AI/ML techniques show considerable promise for enhancing data quality, particularly in scoring, anomaly detection, and entity resolution.

• Complexity of FHIR Endpoint Discovery: The process of finding and validating FHIR endpoints is complex, often requiring a combination of discovery methods including DNS queries, UDAP directory lookups, and manual verification.

Unfulfilled Needs Being Addressed

This acquisition addresses critical unfulfilled needs identified through extensive stakeholder engagement:

• No Centralized Strategy for Authoritative Data Access CMS currently has no systematic approach to procuring and managing access to the authoritative external data sources needed for the NPD. The most trusted provider data — state licensing credentials, board certifications, pharmacy data, hospital and facility information, payer data, and credentialing and accreditation status — resides outside CMS systems, held by organizations with inconsistent formats, varying accessibility, and complex licensing terms. Each source requires separate negotiation, different delivery mechanisms, and ongoing relationship management. Without a dedicated function to manage this complexity, data access is ad hoc, expensive, and unreliable.

• Licensing Constraints That Prevent Free Data Distribution Many authoritative data sources carry licensing restrictions that would prevent CMS from freely redistributing reconciled NPD data to industry, academia, and the public. Without careful licensing negotiation upfront — specifically negotiating terms that preserve CMS's right to freely publish derived data — CMS risks building a provider directory it cannot publish without ongoing commercial licensing obligations. This would directly undermine the NPD's core mission of freely accessible, authoritative provider data.

• No Systematic Mechanism for Continuous Data Quality Improvement Even when authoritative source data is acquired, provider directory data degrades continuously as providers change locations, affiliations, credentials, and practice status. CMS currently has no structured, competitive mechanism for engaging data aggregators and enrichment vendors to identify and correct errors in provider records on an ongoing basis. Rule-based validation and periodic manual review cannot keep pace with the scale and complexity of 7–8 million registered NPIs across dozens of data sources.

• No Closed-Loop Quality Feedback Between Data Outputs and Data Inputs The NPD's data quality cannot be treated as a one-time problem to be solved at ingestion. Data quality must be continuously assessed at both ends of the workflow — validating the accuracy of data entering the pipeline from authoritative sources, and validating the accuracy of data published through the NPD's public-facing directory. Without a mechanism to feed quality findings back to inform data sourcing decisions, errors and gaps in ground truth sources will persist undetected and unaddressed.

• No Escalation Path for Source Data Quality Issues When downstream systems identify problems with source data — wrong formats, missing fields, stale records, or delivery failures — there is currently no dedicated function to triage these issues with data providers and drive resolution. This allows data quality problems to persist and propagate through the NPD ecosystem.

Legislative and Policy Mandates

This acquisition supports CMS's interoperability goals, provider data transparency initiatives, and statutory obligations related to provider enumeration and enrollment. The work performed under Work Areas A and E directly advances several legislative and policy priorities:

• Interoperability and Provider Directory Accuracy The CMS Interoperability and Prior Authorization Final Rule and related interoperability policies establish CMS's commitment to making accurate, accessible provider data available to patients, payers, health systems, and the public. An authoritative, continuously improving National Provider Directory is foundational to these goals.

• Fraud, Waste, and Abuse Reduction Accurate provider directory data is a critical tool for identifying and reducing fraud, waste, and abuse in Medicare and Medicaid. Ghost networks — directories that list providers who are not actually available to patients — represent a significant and well-documented problem in the healthcare system.

• NPPES and PECOS Modernization CMS has statutory authority to operate provider enumeration (NPPES) and enrollment (PECOS) systems and to replace them with modern infrastructure. The NPD is designed to eventually subsume the core functions of both systems.

• License-Free Data Output Mandate All data released from the NPD shall be free from licensing constraints. CMS intends to ensure that published provider data can be fully utilized by industry, academia, payers, health systems, and the public without copyright or licensing restrictions. This requirement flows directly from CMS's interoperability and transparency commitments and from the program's goal of serving as a freely accessible public good.

NPD Program Structure

CMS has organized the NPD program into five distinct, yet interconnected, work areas. The overarching goal is to create a comprehensive data ecosystem that serves as the authoritative source for provider information. This enhances beneficiary care, reduces administrative burden, and increases healthcare transparency.

The table below outlines the focus and acquisition scope for each work area:

Work Area Focus In Scope for this Acquisition?

WA A: Ground Truth Datasets

Direct licensing relationships with sole/primary authoritative sources for specific datasets (FSMB, ABMS, CAQH, NABP, AHA, etc.)

Yes

WA B: Data Intake, Infrastructure, Cleaning, Reconciliation, and Data Science

ETL pipeline, data infrastructure, reconciliation logic, AI/ML NOT in scope

WA C: AWS Cloud Infrastructure & FHIR Server Hosting

Cloud hosting for NPD; FHIR Server Hosting NOT in scope

WA D: NPD Front End NPD application development; provider data editing interfaces; enumeration and enrollment functions

NOT in scope

WA E: Data Aggregation, Quality, and Assurance Services

Aggregators and enrichment vendors who correct and improve NPD records;

competitive quality improvement model

Yes

How WA A and WA E Work Together

WA A and WA E are the two work areas in scope for this acquisition. They are complementary functions that together anchor the NPD data lifecycle — one supplying authoritative inputs, the other ensuring the quality of data at both ends of the workflow.

The NPD data lifecycle flows as follows:

WA A (Ground Truth Data Sourcing) → delivers normalized data files to CMS-designated storage → WA B (ETL, reconciliation, data science) → processes and reconciles all data → WA C (Cloud hosting and FHIR server) → hosts the NPD infrastructure → WA D (CMS government team — NPD front end) → publishes provider data to the public-facing directory → WA E (Data Aggregation, Quality & Assurance) → validates data quality at both ends of this workflow and feeds findings back to WA A

WA E is not simply another input service. It operates at both ends of the NPD data lifecycle:

• Upstream: WA E assesses the quality of data entering the pipeline from WA A sources

— identifying errors, gaps, and patterns that trace back to specific ground truth sources

• Downstream: WA E validates the accuracy of data published through WA D

— identifying ghost network indicators, stale records, and directory inaccuracies in the NPD's public output

• Feedback loop: WA E findings are documented and fed back to WA A at each Program Increment, informing decisions about which data sources to prioritize, renegotiate, or replace

This creates a continuous quality improvement cycle — the NPD data ecosystem becomes more accurate over time, not just at a point in time. All coordination between WA A, WA E, and other work areas flows through CMS government staff; there is no direct contractor-to-contractor coordination.

Note on Acquisition Scope

This acquisition covers Work Areas A and E — Ground Truth Datasets and Data Aggregation, Quality & Assurance Services. Work Areas B, C, and D are supported through separate government and/or contractor teams. Follow-on or concurrent awards may address WA B and WA C as the NPD program matures; the specific structure and sequencing of those procurements is under active development.

Statement of Need

CMS cannot build an accurate National Provider Directory without reliable access to authoritative external data sources. The most trusted provider data — state licensing credentials, board certifications, and credentialing information — resides outside CMS systems, held by organizations with inconsistent data formats, varying accessibility, and complex licensing terms.

Today, this creates three critical gaps:

• No Centralized Data Access Strategy CMS currently has no systematic approach to procuring and managing access to authoritative external data sources needed for the NPD (addressed by WA A), nor a structured mechanism for engaging data aggregators and enrichment vendors to validate and improve NPD data quality across the full data lifecycle (addressed by WA E).

• Licensing Constraints Prevent Free Data Distribution Many authoritative data sources carry licensing restrictions that would prevent CMS from freely redistributing reconciled NPD data to industry, academia, and the public. Without careful licensing negotiation upfront, CMS risks building a provider directory it cannot publish without ongoing commercial licensing obligations — directly undermining the NPD's mission of freely accessible, authoritative provider data. The License-Free Output Mandate (see Constraint 1) addresses this by requiring that all agreements executed under this contract explicitly permit license-free redistribution of NPD output as a non-negotiable condition.

• No Escalation Path for Source Data Quality Issues When downstream systems identify problems with source data (wrong formats, missing fields, stale records), there is currently no dedicated function to triage these issues with data providers and drive resolution. This allows data quality problems to persist and propagate through the NPD ecosystem.

• No Systematic Mechanism for End-to-End Data Quality Validation CMS currently has no structured approach to engaging commercial data aggregators and enrichment vendors to identify and correct errors in NPD provider records — either as data enters the workflow from WA A sources or as data exits the NPD system through WA D.

Provider data quality degrades continuously as providers change locations, affiliations, and credentials. Without a mechanism for data quality validation and correction operating across the full data lifecycle, NPD data quality will deteriorate over time regardless of the quality of ground truth source data. WA E addresses this gap by establishing a competitive framework for data quality improvement services that operates at both ends of the data workflow and feeds findings back to WA A to continuously improve data sourcing.

Objectives

The contractor shall deliver data sourcing and licensing management services that achieve the following objectives:

Category 1 – WA A: Ground Truth Data Access and Licensing:

• Negotiate and maintain direct licensing relationships with organizations that are the sole or primary authoritative source for specific provider datasets, including but not limited to: clinician license data, board certification data, pharmacy data, payer data, hospital data, credentialing and accreditation data, and other data sources identified through life of award

• Ensure all data licensing agreements and service agreements comply with the License- Free Output Mandate (Constraint 1) - CMS shall be able to freely publish reconciled NPD data without downstream licensing obligations

• Minimize data acquisition costs to the government by leveraging existing contractor data relationships, negotiating favorable multi-year terms, and identifying opportunities for CMS direct procurement where advantageous

• Provide transparent, itemized pricing for each data source to enable CMS to make informed decisions about data source prioritization and cost management

Category 2 – WA A: Data Normalization and Delivery:

• Deliver normalized data files meeting CMS-specified format, completeness, and cadence requirements

• Monitor data quality at the source level and proactively flag known issues or changes in source data availability

• Respond to CMS-identified data quality issues and coordinate resolution with source organizations

Category 3 – WA E: Data Aggregation, Quality, and Assurance

Upstream Quality Validation (Input Side — data going into WA B):

• Assess the quality of data delivered by WA A contractors before it enters the WA B processing pipeline

• Identify errors, gaps, and inconsistencies in ground truth data from WA A sources

• Deliver corrections and enrichments via CMS-designated storage location or NPD API write-back to improve data quality before WA B processing

Downstream Quality Validation (Output Side — data coming out of WA D):

• Assess the quality and accuracy of provider data published through the NPD system (WA D outputs)

• Identify errors, outdated records, and inaccuracies in published NPD data

• Deliver corrections and enrichments via NPD API write-back to improve the accuracy of published provider records

Feedback Loop to WA A:

• Provide structured findings to CMS government staff identifying patterns of data quality issues that trace back to specific WA A data sources

• Recommend improvements to WA A data sourcing strategies, source prioritization, and agreement terms based on observed data quality patterns

• Support CMS in making evidence-based decisions about WA A data source portfolio management

Competitive Quality Demonstration:

• Demonstrate measurable improvement in NPD data accuracy through per-data-point corrections or delivery of alternative/additional datasets that improve upon existing NPD records

• Provide sufficient documentation and metadata to enable CMS to evaluate the quality and provenance of all corrections and enrichments delivered

License-Free Output Compatibility:

• Ensure all data delivered under WA E is compatible with CMS's requirement to freely redistribute reconciled NPD data without downstream licensing obligations

Category 4 – WA A and E: Data Delivery

• WA A: Deliver normalized data files to CMS-designated storage location on a regular cadence. File formats, naming conventions, and delivery specifications to be defined by CMS in coordination with the WA B contractor.

• WA E: Deliver data corrections and enrichments via CMS-designated storage location or NPD API write-back integration, as directed by CMS. All deliveries must include sufficient metadata to enable CMS to evaluate the quality and provenance of corrections. WA E deliveries may target both the input data stream (upstream of WA B) and the published NPD data (downstream of WA D).

Anticipated Data Sources and Service Providers

CMS anticipates that the following categories of external data will be needed to support NPD accuracy and completeness. This list is illustrative, not exhaustive — the contractor shall work with CMS to continuously identify, prioritize, and onboard authoritative sources based on evolving NPD data quality needs and feedback from across the NPD work areas.

For each category below, the objective describes why CMS needs this data. Specific organizations listed are examples of the types of sources CMS anticipates engaging; the contractor is expected to identify the most authoritative and cost-effective sources within each category in collaboration with CMS.

WA A – Ground Truth Data Sources

WA A covers direct licensing relationships with organizations that are the sole or primary authoritative source for a specific dataset. These organizations maintain foundational, ground-truth information about providers and clinical organizations, perform ongoing maintenance of the underlying data to ensure its accuracy, and possess specialized expertise in the domain their dataset represents. There are no or few reasonable competing alternatives for obtaining the same information.

CMS recognizes that some offerors responding to this solicitation may themselves be the authoritative source for one or more data categories described below — for example, a board certification organization responding directly, or a credentialing platform that is both an authoritative source and a data aggregator. Offerors who are the authoritative source for a data category are encouraged to respond and should describe both their role as the source and any licensing terms applicable to federal government use and license-free redistribution.

Provider Credentialing and Licensure Data

Objective: To verify that providers hold valid, current credentials and licenses in the states where they practice. State licensing boards are the most authoritative source of provider qualification data but are highly fragmented across 50+ jurisdictions with inconsistent formats and accessibility. This data cannot be derived from CMS enrollment systems alone.

• Federation of State Medical Boards (FSMB) and/or State Licensing Boards (50+ states):

Clinician license status, disciplinary actions, and credential verification across all states and territories

• American Board of Medical Specialties (ABMS), American Board of Physician Specialties (ABPS), American Osteopathic Association Bureau of Osteopathic Specialists (AOA-BOS), National Commission on Certification of Physician Assistants (NCCPA), American Nurses Credentialing Center (ANCC), American Academy of Nurse Practitioners Certification Board (AANPCB), American Dental Association (ADA), American Association of Oral and Maxillofacial Surgeons (AAOMS), American Optometric Association (AOA): Board certification and specialty credential data across physician and non-physician provider types

• CAQH and/or equivalent credentialing platforms: Standardized credentialing information used across the healthcare industry

Provider Network Participation Data

Objective: To identify which health plans a provider is contracted with, their network participation status, and whether their panel is open or closed to new patients. This data is directly relevant to ghost network detection and Medicare Advantage network adequacy oversight — it is the data element that most directly enables CMS to identify providers listed in plan directories who are not actually available to patients. Network participation data complements credentialing and licensure data by answering not just "is this provider qualified?"

but "is this provider actually available to patients in this network?"

• Health plan provider rosters and network participation files — payer-maintained provider directories, Medicaid managed care organization provider lists, Medicare Advantage plan network data (HPMS), as identified by CMS

• Provider panel status data — open/closed panel indicators, accepting new patients status, network tier designation

Pharmacy Data

Objective: To verify pharmacy provider credentials, licensure status, and drug program participation data that are not captured in standard physician credentialing sources and are essential for complete NPD coverage of the full provider population.

• National Council for Prescription Drug Programs (NCPDP): Pharmacy identification and drug program participation data

Hospital Data

Objective: To capture facility-level identification, classification, and organizational data for hospitals and health systems that is not available through individual provider credentialing sources and is essential for accurate organizational-level directory entries.

• American Hospital Association (AHA): Hospital identification, classification, and organizational data across all U.S. hospitals and health systems

Organizational Credentials and Accreditation Data

Objective: To capture facility-level credentials, certifications, and accreditation status that are not captured in individual provider records and are essential for accurate network adequacy assessment and organizational-level directory accuracy.

• Joint Commission and American College of Surgeons: Trauma Center Status, Burn Unit Status, and other organizational-level credentials, certifications, and accreditation datasets

• Anticipated consumption model: Periodic batch delivery; lower frequency than individual provider data

Health Plan and Payer Data

Objective: To cross-reference provider network participation and identify discrepancies between payer directories and authoritative credentialing sources — directly supporting ghost network detection and Medicare Advantage network adequacy oversight.

• National Association of Insurance Commissioners (NAIC): Payer identification and insurance market data

• Health plan credentialing databases and provider rosters: Payer-maintained provider directories and Medicaid managed care organization provider lists, as identified by CMS

Note on Sensitive and Restricted Data Fields CMS recognizes that some data sources — particularly in the payer, health plan, and network participation categories — may contain individual fields that are sensitive, proprietary, or subject to legal restrictions that prevent public publication, even where the overall licensing agreement permits federal government use.

CMS distinguishes between three categories of data field handling under this contract:

• Publish: Fields that are licensed for federal use AND appropriate for public publication in the NPD — these are the primary target for WA A and are subject to the License-Free Output Mandate (Constraint 1)

• Use internally only: Fields that are licensed for federal use but contain sensitive, proprietary, or legally restricted information that CMS will use for internal validation and quality scoring only — not published in the public-facing NPD. Achieving "use internally only" rights for some fields within an otherwise licensable dataset is an acceptable and anticipated outcome of WA A negotiations and does not constitute a failure to meet the License-Free Output Mandate.

• Do not use: Fields that carry licensing restrictions incompatible with CMS's requirements — these shall not be procured under this contract (see "What CMS Is NOT Seeking")

The WA A contractor shall:

• Identify and document any fields in proposed source agreements that fall into the "use internally only" category before CMS approval is sought

• Clearly segregate "use internally only" fields in all data deliveries to prevent inadvertent inclusion in public NPD output

• Not make independent determinations about which fields to publish or withhold — CMS makes all field-level publication decisions in coordination with OGC, OFM, and the NPD program team

• Flag any state legal constraints on publication of specific data fields — particularly for state licensing board data, where state laws may restrict publication of certain disciplinary or personal information

WA E – Data Aggregation and Quality Service Providers

WA E covers vendors who aggregate, validate, or enrich provider data from multiple sources and compete on the measurable quality of their corrections and improvements to NPD records.

Unlike WA A, which establishes direct relationships with sole or primary authoritative sources, WA E is structured as an outcome-based quality assurance function. The contractor's WA E team shall not make unilateral decisions about data sourcing or WA A agreement terms based on WA E quality findings — all such decisions flow through CMS government staff. CMS retains full authority over WA A sourcing decisions informed by WA E findings.

For a description of how these two work areas relate to each other and to the broader NPD data lifecycle, see the 'How WA A and WA E Work Together' section

Data Aggregation and Enrichment Services

Objective: To improve the accuracy and completeness of NPD provider records by engaging commercial data aggregators and enrichment vendors who can identify and correct errors — including outdated locations, incorrect affiliations, missing credentials, and inaccurate contact information — that authoritative ground truth sources alone cannot address. WA E vendors may deliver corrections derived from proprietary datasets, AI/ML-driven analysis, or provider engagement workflows.

• Healthcare data aggregators with demonstrated experience correcting and enriching provider directory data at scale, including clinician, payer, and clinical organization data

Commercial and Supplemental Validation Sources

Objective: To fill coverage gaps where authoritative sources are incomplete, particularly for address validation, provider location data, and provider demographics not captured in credentialing systems. These sources complement WA A ground truth data and WA E enrichment services by providing additional validation signals.

• Commercial address validation and provider location services

• Other sources as identified by CMS based on NPD data quality needs and downstream team feedback

Provider Engagement and Attestation Platforms

Objective: To surface and validate data corrections through direct provider engagement — leveraging established provider networks and attestation workflows to verify and update provider information at the source, complementing automated data correction with provider-confirmed ground truth.

• Platforms with established provider networks that enable providers to review, attest to, and correct their directory information, with corrections delivered to CMS-designated storage or NPD API write-back

What CMS Is NOT Seeking Under This Contract

The following data types are explicitly out of scope for procurement under this contract:

• Data already available to CMS at no cost through government systems — NPPES, PECOS, the Lantern database, and data.cms.gov holdings will be provided as Government-Furnished Information (GFI) and shall not be procured under this contract

• Data that carries licensing restrictions incompatible with the license-free NPD output mandate

• Aggregated or resold data where original source provenance cannot be verified

• Data that duplicates existing CMS holdings without adding incremental accuracy or coverage value

• Data broker arrangements where the contractor aggregates and resells data rather than managing direct source relationships on CMS's behalf

• WA E services that duplicate WA A ground truth sources without demonstrating incremental quality improvement

• WA E services that require direct write access to the NPD data base – all corrections flow through the WA B pipeline

• Data corrections or enrichments that cannot be delivered via CMS-designated storage or the

NPD API write-back mechanism

Approach

1. Operating Model

This contract is designed as a lean, outcome-focused managed service — not a large-scale technology development effort. CMS is not buying a platform, a system, or a data product. CMS is buying:

• WA A: A sustained, expert-managed function that establishes and maintains direct licensing relationships with authoritative data sources, normalizes and delivers data to CMS-designated storage, and continuously monitors and improves source data quality

• WA E: A competitive, outcome-based quality assurance function that validates data quality at both ends of the NPD data lifecycle, delivers measurable corrections and enrichments, and feeds findings back to improve WA A sourcing decisions

Both functions are ongoing operational services, not one-time deliverables. The value of this contract compounds over time — as WA A relationships mature and WA E quality findings accumulate, the NPD data ecosystem becomes progressively more accurate and reliable.

2. How WA A and WA E Work Together

WA A and WA E are complementary functions that together anchor the NPD data lifecycle. For a full description of how these work areas relate to each other and to the broader NPD data workflow, see 'How WA A and WA E Work Together' above.

3. Contractor's Role Within the NPD Program

The contractor operates as an integrated member of the NPD program team — not as a separate vendor organization. All coordination with other NPD work areas (WA B, WA C, WA D) flows through CMS government staff; there is no direct contractor-to-contractor coordination.

The contractor shall:

• Participate actively in NPD sprint ceremonies and PI planning alongside CMS government staff

• Treat CMS government staff as the primary customer and decision-maker — the contractor proposes, CMS decides

• Proactively surface issues, risks, and recommendations rather than waiting to be asked

• Operate transparently — all work products, dashboards, issue logs, and documentation shall be accessible to CMS government staff at all times without requiring contractor assistance

CMS retains full responsibility for: product ownership, policy decisions, governance, data standards, provider trust framework, budget authority, and acquisition oversight. The contractor supports CMS in executing the data sourcing and quality assurance functions — it does not own them.

4. Flexibility and Iteration

The data sourcing and quality assurance landscape will evolve over the life of this contract. New authoritative sources will be identified; existing sources will change their terms or delivery mechanisms; NPD data quality needs will shift as the program matures and as WA D output is evaluated against real-world provider data. The contractor shall be designed to accommodate this evolution — not locked into a fixed set of sources or correction methodologies established at award.

Specifically:

• WA A data source portfolio shall be treated as a living inventory — sources may be added, modified, or discontinued based on quality evidence and CMS direction

• WA E correction and enrichment priorities shall be continuously refined based on quality findings, correction acceptance rates, and feedback from CMS government staff

• The contractor shall propose, at each PI, at least one recommendation for improving either the WA A source portfolio or the WA E correction methodology based on evidence gathered during the PI

• CMS reserves the right to direct the contractor to onboard new data categories, discontinue underperforming sources, or adjust WA E correction priorities at any time with reasonable notice

Constraints

The following are non-negotiable requirements for technical acceptability:

1. License-Free Output Mandate (MANDATORY)

All data licensing agreements negotiated under this contract — whether for WA A ground truth data sources or WA E data aggregation and enrichment services — SHALL enable CMS to freely redistribute reconciled NPD data without downstream licensing obligations. This is a non-negotiable condition of every agreement executed under this contract.

Specifically:

• All agreements shall explicitly permit CMS to use licensed data as an input to a publicly available provider directory without triggering licensing fees or restrictions on downstream users of NPD output data

• The contractor shall obtain CMS written approval before finalizing any data licensing or service agreement

• The contractor shall provide legal analysis confirming each agreement's compatibility with this requirement before CMS approval is sought

• The contractor shall immediately notify CMS if any data provider or service vendor proposes terms that would restrict NPD data redistribution

• The contractor shall not enter into any agreement that creates a "pass-through" licensing obligation — where a downstream user of NPD data would be required to obtain a separate license from the original data provider

• This requirement applies equally to WA A ground truth data licensing agreements and WA E data correction and enrichment service agreements — all data and corrections delivered under this contract must be compatible with free redistribution of NPD output

Note: Vendors who can arrange restriction-free distribution of input data may need to include their upstream processing services as part of the arrangement — this is an acceptable and anticipated cost structure. CMS will consider proposals that include upstream processing costs as part of achieving license-free output compatibility.

Field-Level Publication Policy

The License-Free Output Mandate applies to NPD OUTPUT data — the reconciled provider information published through the NPD's public-facing directory and APIs.

CMS acknowledges that some INPUT data fields may be designated as "use internally only" and may not be appropriate for public publication, even where the overall licensing agreement permits federal use. This is an anticipated and acceptable outcome of WA A negotiations.

The contractor shall NOT be required to obtain license-free redistribution rights for fields that CMS designates as "use internally only." However, the contractor SHALL ensure that:

• "Use internally only" fields are clearly identified and documented in the licensing compliance log before any agreement is finalized

• "Use internally only" fields are segregated in all data deliveries and are not inadvertently included in public NPD output

• The existence of "use internally only" fields does not reduce the scope of fields available for public publication below what CMS requires for a complete and accurate public-facing provider directory

• Any field-level restrictions are disclosed to CMS before agreement execution — not discovered after the fact

CMS will maintain a field-level publication policy document — updated as agreements are established — that specifies for each data source and each field whether it is designated Publish, Use Internally Only, or Do Not Use. The WA A contractor shall maintain this document in Confluence and keep it current as agreements are negotiated and renewed.

2. Intake Validation Scope (MANDATORY)

WA A — Data Normalization and Delivery Scope: WA A contractor responsibilities are limited to data normalization, format compliance, and delivery to CMS-designated storage. Integration of WA A data into the NPD is performed by the government team through the WA B pipeline. Deep data quality scoring and reconciliation are performed by WA B.

WA E — Data Quality Validation Scope: WA E contractors deliver data corrections and enrichments via CMS-designated storage or NPD API write-back. WA E contractors operate at both the input end (upstream of WA B, assessing WA A data quality) and the output end (downstream of WA D, assessing published NPD data quality). WA E findings are provided to CMS government staff as structured recommendations for WA A portfolio improvement — WA E contractors do not directly modify WA A agreements or sourcing decisions without engagement with CMS government team.

3. Issue Escalation Responsibility (MANDATORY)

The contractor SHALL serve as the primary escalation point for source data quality issues, including:

• Issues identified through WA A intake validation

• Issues flagged by downstream NPD teams and escalated through CMS government staff. CMS recognizes that data quality issues may be identified at any point in the NPD data pipeline — including by end users of NPD data — and the contractor shall be prepared to receive and act on escalations originating from any downstream source, routed through the CMS WA A Government SME.

• Contractor shall triage issues, engage data providers, track resolution, and report status to CMS

• Contractor shall maintain an issue log with status, resolution timeline, and root cause documentation

4. CMS Approval for All Agreements (MANDATORY)

The contractor SHALL obtain CMS written approval before:

• Finalizing any new data access agreement

• Renewing any existing agreement with changed terms

• Adding any new data source not previously approved

• Modifying delivery format or cadence for any existing source

5. Pricing Transparency (MANDATORY)

Offerors SHALL provide separate pricing for management services and data licensing pass-through costs. Bundled pricing that obscures data licensing costs is not acceptable.

6. Security and Compliance (MANDATORY)

The contractor shall comply with CMS Acceptable Risk Safeguards (ARS) for secure handling of licensed data, including encryption of data in transit (TLS 1.2+) and at rest

(AES-256).

7. No Direct Database Access (MANDATORY)

WA E contractors shall not have direct write access to the NPD database. All corrections and enrichments must be delivered to CMS-designated storage or the NPD API write-back mechanism. CMS regains full control over which corrections are applied to NPD records and when.

8. What SHALL NOT Be Included

The contractor shall NOT:

• Perform ETL processing or API development, data reconciliation, or core NPD data pipeline development (WA B scope)

• Perform deep AI/ML quality scoring, entity resolution, or anomaly detection as part of the core NPD data pipeline (WA B scope)

• Build or operate the NPD cloud hosting infrastructure or FHIR server (WA C scope)

• Develop or operate the NPD front-end application, provider enrollment portal, or public-facing directory (WA D scope)

• Include costs for WA B, C, or D activities

Data Rights and Portability (MANDATORY)

CMS shall not be locked into any data source, contractor relationship, or proprietary process that cannot be transitioned without penalty or disruption. The contractor shall ensure that all data access agreements and operational processes explicitly preserve CMS's right to transition to alternative data sources or contractors. Specifically:

• All agreements shall include provisions allowing CMS to terminate or transition data access without incurring exit fees or data destruction obligations imposed by the data provider

• CMS shall retain full rights to all licensed data delivered under this contract, including the right to retain copies in CMS-managed storage beyond the contract period

• The contractor shall not enter into any agreement that creates exclusive data access arrangements that would prevent CMS from procuring the same data directly or through a successor contractor

• The contractor shall conduct periodic portability drills — at a frequency defined in the QASP — to verify that data, documentation, and processes can be transferred to CMS or a successor contractor without disruption

• The contractor shall always maintain a Transition Readiness Package, documenting: all active agreements and their key terms; data delivery specifications for each source;

contact information for all data provider relationships; and any processes used in data intake validation

The Transition Readiness Package shall be reviewed and validated at each Quarterly Review and updated within 5 business days of any material change to the data source portfolio

General Expectations for Agile Teams working at CMS

Understand What People Need

The services shall include exploring and pinpointing the needs of the people who will use the service as well as achieving the desired business value. The Contractor shall continually test the products with real people to ensure delivery is focused on providing user and business value.

As a part of this…