Provider Verification Guide

Multi-source provider verification and composite integrity scoring. The Provider Verification Service aggregates six federal data sources into a single 0–100 integrity score for every provider in your network — surfaced in the portal, cached on the provider record, and available as a real-time claims adjudication pre-check.

1. Overview

Health plans are required to verify that providers are eligible to participate in federal healthcare programs before paying claims. An excluded provider payment triggers False Claims Act liability. A deactivated NPI means the provider cannot legally bill. An expired license means the provider cannot legally practice.

The CHO Provider Verification Service automates this process. It queries up to six public and licensed data sources in parallel, normalizes the results, and produces a composite integrity score with per-dimension breakdowns and machine-readable flags. The score is cached on the Provider and ProviderContract entities for sub-millisecond lookup at claims adjudication time.

Why this matters

OIG recovers over $3 billion annually from providers excluded from federal healthcare programs. A single excluded-provider claim paid in error can trigger treble damages under the False Claims Act. Automated, continuous verification replaces manual quarterly spreadsheet checks with real-time, auditable screening.

🔍

6 Data Sources

NPPES, OIG/LEIE, PECOS, CMS Open Payments, Medicare Utilization, and FSMB license data — queried in parallel.

📊

0–100 Score

Weighted composite score across five dimensions with configurable weights per deployment. Clear, Advisory, Caution, Alert, or Blocked rating.

⚡

Claims Pre-check

Cached integrity score on the provider record enables sub-millisecond claims adjudication gating without a network round-trip.

2. Data Sources

Each data source is implemented as an independent adapter behind a clean interface. Adapters handle their own HTTP clients, retry policies, response normalization, and caching. The orchestrator fans out to all configured adapters in parallel and assembles the results.

Source	What It Provides	Auth	Update Frequency
NPPES Registry	NPI validation, provider demographics, taxonomy codes, practice addresses, enumeration status	None (free)	Real-time API + weekly bulk
OIG/LEIE	Federal exclusion screening — providers barred from Medicare/Medicaid	None (bulk download)	Monthly
PECOS	Medicare FFS enrollment status, provider type, specialty, reassignment relationships	None (bulk CSV)	Monthly
CMS Open Payments	Industry payments to providers — conflict of interest screening	None (SODA API)	Annual (June release)
Medicare Utilization	Service volumes, top HCPCS codes, Part D prescribing patterns, opioid indicators	None (SODA API)	Annual
FSMB (Premium)	State license verification, disciplinary actions, DEA registration, board certifications	Paid API contract	Real-time

NLM Taxonomy Crosswalk

NPPES taxonomy codes are automatically enriched with Medicare provider type and specialty codes via the NLM Clinical Tables API. This bridges the gap between NUCC taxonomy codes used in NPPES and Medicare specialty codes used in claims adjudication.

3. Integrity Scoring

The composite integrity score is a weighted average of five independently-scored dimensions. Each dimension produces a 0–100 score. Dimensions that were not evaluated (e.g., FSMB when not configured) are excluded from the weighted average rather than counted as zero.

Scoring dimensions

Dimension	Default Weight	What It Measures
NPI Validation	30	Active NPI, primary taxonomy present, practice location on file
Exclusion Screening	30	OIG/LEIE/SAM exclusion status — hard stop if excluded (score = 0)
Medicare Enrollment	15	PECOS enrollment status, provider type, reassignment relationships
License Verification	15	Active state licenses, disciplinary actions, DEA status (FSMB tier)
Conflict of Interest	10	CMS Open Payments total — ownership interests and high-value transfers

Rating bands

Score Range	Rating	Meaning
80–100	Clear	All checks passed. No action required.
60–79	Advisory	Minor warnings (e.g., address mismatch, no primary taxonomy). Informational only.
40–59	Caution	Significant concerns (e.g., expired license, moderate industry payments). Review recommended.
20–39	Alert	Critical issues (e.g., possible exclusion match pending review). Adjudication hold recommended.
0–19	Blocked	Hard stop. Confirmed LEIE exclusion or deactivated NPI. Claims must not be paid.

Hard stops override scoring

If a provider is confirmed excluded (OIG/LEIE), the composite score is immediately set to 0 and the rating to Blocked regardless of all other dimensions. This is not a weighted calculation — it is an absolute override.

Configurable weights

Scoring weights are configurable per deployment via appsettings.json or environment variables. This allows health plans to tune the composite score based on their risk tolerance and regulatory requirements.

# Override scoring weights via environment variables
ProviderVerification__ScoringWeights__NpiValidation=30
ProviderVerification__ScoringWeights__ExclusionScreening=30
ProviderVerification__ScoringWeights__MedicareEnrollment=15
ProviderVerification__ScoringWeights__LicenseVerification=15
ProviderVerification__ScoringWeights__ConflictOfInterest=10

4. Verification Tiers

The service supports three verification tiers that control which data sources are queried. Higher tiers include all sources from lower tiers.

Tier	Sources	Cost	Use Case
Basic	NPPES + NLM Crosswalk	Free, instant	Quick NPI validation during data entry or enrollment
Standard (default)	+ LEIE/SAM + PECOS + Open Payments + Utilization	Free, may use cached bulk data	Network onboarding, monthly re-verification, credentialing
Premium	+ FSMB license verification	Requires paid FSMB contract	Full credentialing, delegated credentialing, high-risk providers

5. API Reference

All endpoints are available at /api/v1/providers. The service exposes Swagger UI at /swagger for interactive testing.

Verify a single provider

# Full multi-source verification (Standard tier)
curl -s http://localhost:8080/api/v1/providers/1497758544/verify | jq .

# Premium tier — includes FSMB license verification
curl -s "http://localhost:8080/api/v1/providers/1497758544/verify?tier=Premium" | jq .

Returns the full ProviderVerificationRecord including NPPES data, exclusion screening, PECOS status, Open Payments summary, and the composite integrity score with per-dimension breakdowns.

NPPES lookup (lightweight)

# Direct NPPES NPI lookup — no exclusion screening or scoring
curl -s http://localhost:8080/api/v1/providers/1497758544/nppes | jq .

# Search by name and state
curl -s "http://localhost:8080/api/v1/providers/search/nppes?\
lastName=Smith&state=TX&limit=20" | jq .

Integrity score only (claims pre-check)

# Lightweight endpoint for claims adjudication gating
curl -s http://localhost:8080/api/v1/providers/1497758544/integrity-score | jq .

# Response
{
  "npi": "1497758544",
  "compositeScore": 92,
  "rating": "Clear",
  "status": "Verified",
  "flags": [],
  "verifiedAt": "2026-04-03T12:00:00Z"
}

Batch verification

# Verify up to 100 providers in a single request
curl -s -X POST http://localhost:8080/api/v1/providers/verify/batch \
  -H "Content-Type: application/json" \
  -d '{
    "npis": ["1497758544", "1234567893", "1003000126"],
    "tier": "Standard"
  }' | jq .

# Response includes per-provider results and aggregate summary
{
  "count": 3,
  "summary": {
    "verified": 2,
    "warnings": 1,
    "excluded": 0,
    "failed": 0,
    "manualReview": 0
  },
  "results": [ ... ]
}

6. Portal Integration

The Provider Verification page is accessible in the Blazor portal under Members & Providers → Provider Verification. The integrity score will surface on the provider profile card as a color-coded badge:

Rating	Badge Color	Portal Behavior
Clear (80–100)	Green	No action required. Normal claims processing.
Advisory (60–79)	Cyan	Informational flags displayed. No claims impact.
Caution (40–59)	Yellow	Warning banner on provider profile. Review recommended.
Alert (20–39)	Orange	Claims held for manual review. Notification sent to compliance.
Blocked (0–19)	Red	Claims auto-denied. Provider flagged for immediate review.

7. Claims Integration

The integrity score is cached on the Provider and ProviderContract entities as four fields:

Field	Type	Purpose
`IntegrityScore`	`int?`	Composite 0–100 score
`IntegrityRating`	`string?`	Clear, Advisory, Caution, Alert, or Blocked
`LastVerifiedAt`	`DateTimeOffset?`	Timestamp of last verification
`NextVerificationDue`	`DateTimeOffset?`	When re-verification is scheduled (default: 30 days)

During claims adjudication, the Claims Engine reads the cached IntegrityRating from the provider record. If the rating is Blocked, the claim is denied with CARC 96 (non-covered charge) and RARC N56 (provider not eligible). If the rating is Alert, the claim is pended to the compliance work queue. No network call to the verification service is needed at adjudication time.

8. Batch Re-verification

The service supports scheduled full-network re-verification as a background job. The default re-verification interval is 30 days, configurable via ProviderVerification:ReverificationInterval.

# Configuration for re-verification scheduling
ProviderVerification__ReverificationInterval=30.00:00:00
ProviderVerification__MaxConcurrentVerifications=10

The batch endpoint uses a semaphore to throttle concurrent verifications, preventing rate-limit issues with upstream APIs. For full-network re-verification of thousands of providers, the recommended approach is to use the batch background worker rather than the HTTP batch endpoint.

Rollout roadmap

Phase	Sources	Status
Phase 1	NPPES Registry API (real-time + NLM crosswalk)	Implemented
Phase 2	OIG/LEIE + SAM.gov exclusion screening	Planned
Phase 3	PECOS enrollment + CMS Open Payments	Planned
Phase 4	Medicare Utilization + Part D prescribing	Planned
Phase 5	FSMB license verification (paid tier)	Planned