Why an NPI is not a license
A National Provider Identifier is an administrative number, not proof of licensure or authority to practice. The distinction, from the source, and how we handle it.
Builders routinely treat a National Provider Identifier as proof that a provider is licensed and authorized to practice. It isn't — and conflating the two can put a wrong "this clinic is legit" decision into your product. Here's the distinction, from the source, and how we handle it.
What an NPI actually is
Per CMS, the NPI is a HIPAA Administrative Simplification standard: a "10-position, intelligence-free numeric identifier." CMS is explicit that the number does "not carry other information about health care providers, such as the state in which they live or their medical specialty." It's an administrative identifier for standard transactions — nothing more. It does not convey licensure, qualifications, or authority to practice. (Source: CMS — National Provider Identifier Standard; CMS NPI Fact Sheet PDF.)
What a state license is
A license is issued by a state medical (or nursing/pharmacy) board, can be restricted, suspended, or revoked, and lives in a separate system from NPPES. Having an NPI tells you a provider is enumerated; it tells you nothing about whether their license is active or in good standing.
Our data reality — stated honestly
At the current snapshot we have 769 providers with an NPI matched but only 75 with a state license on file. NPI coverage is broad; license data is sparse and every state formats and exposes it differently. We do not present license coverage as a headline metric, and we do not claim to verify anyone's legal authority to practice. Where we have a license, we label it with the state and source; where we don't, the field is empty and marked not-yet-verified — never inferred from an NPI.
What this means for you
If your product needs to reason about whether a provider can lawfully prescribe, don't read an NPI as a green light. We give you layered signals — NPI presence, license-on-file, LegitScript status, FDA screening — with sources, and let you set the threshold. We surface the signals; we don't hand you a legal conclusion.
curl "https://xcircl.com/api/v1/coverage/" # npi_present vs license_on_file, live
Data as of the 2026-07-12 12:48 UTC snapshot, pulled live from /api/v1/coverage/. Every figure above is substituted from that endpoint at request time — nothing is hardcoded.