---
title: "The NPI Registry connector is reference data, not targeting"
date: "2026-08-24"
summary: "Anthropic's NPI connector is reference data for cleaning HCP inputs, not a targeting tool — and the NPI join is a privacy call, not analytics'."
tags: [analytics, measurement]
faq:
  - q: "Can the NPI Registry connector build an HCP targeting list?"
    a: "No — that's the one use it can't support. It returns no reliable market total and pagination caps at 1,200 records, so you can enumerate a metro but not a country. It holds no prescribing volume, claims data, verified affiliation, or measure of clinical influence. The value is upstream: list hygiene, provider verification, and account entity resolution."
  - q: "Is it safe to join NPI data to your analytics?"
    a: "The public registry creates no exposure — the join does. NPI is a direct identifier that converts anonymous behavior into identified prescriber behavior, so never pass it into GA4 (Google's terms prohibit PII), and treat the join as a privacy and legal decision rather than one the analytics team makes alone."
---

Anthropic shipped an [NPI Registry connector for Claude](https://academy.claude.com/tutorials/using-the-npi-registry-connector-in-claude), giving the model direct access to the CMS NPPES registry: validate an NPI, pull a full provider record, or search millions of providers by name, specialty, and geography.

The tutorial suggests Medical Affairs use it to identify key opinion leaders. That is the framing most pharma marketers will latch onto, and it is the one thing the connector cannot support.

I ran it against real brand team questions. Five findings, all reproducible in about ten minutes.

**Default address behavior corrupts geographic queries.** A search for medical oncologists in Madison, Wisconsin returned providers practicing in Dallas, Augusta, and Minneapolis, because the default matches mailing addresses too. Roughly 15% of results were wrong. Setting `address_purpose=PRIMARY` removed every false positive.

**Specialty search matches hidden taxonomies.** Providers register up to fifteen taxonomy codes and search matches all of them, but results return only the primary. My oncology search surfaced a neuro-oncologist listed as Neurology. Filter on the returned field and you drop relevant physicians. Count raw results and you inflate the universe.

**Brand names are not legal entity names.** A regional health system search returned three affiliates operating under entirely different names, and the parent authority held four separate pharmacy NPIs within ten results. NPI count is not site count or account count.

**The data is unverified.** In a handful of queries: a hospital name misspelled in its own record, a phone number of `000-000-0000`, an active provider last updated in 2022. CMS does not validate what providers submit.

**You cannot size a market.** The API returns no reliable total and pagination caps at 1,200 records. You can enumerate a metro, not a country.

## The compliance question

NPPES is public. Querying it creates no exposure. The join does.

NPI is the key that converts anonymous digital behavior into identified prescriber behavior. Your consent architecture and MLR-approved data use language were almost certainly not written to cover that.

- **Never pass an NPI into GA4.** It is a direct identifier and Google's terms prohibit sending PII. This is the most likely way the connector gets implemented badly.
- **Full records expose DIRECT secure messaging endpoints.** Those are clinical interoperability addresses for exchanging patient information, not a marketing channel.
- **NPI is the identifier used in Open Payments.** Systematic tracking of a named prescriber carries perception risk independent of whether it is permissible.

The join is a privacy and legal decision, not one the analytics team makes alone.

## Where the value is

Upstream of campaign execution, in the reference data layer pharma marketing has historically outsourced and rarely audited.

- **Target list hygiene.** `npi_validate` runs a local Luhn check with no API call, catching transposition typos before they cost a match rate or corrupt a report. Least glamorous, highest immediate return.
- **Speaker and investigator verification.** Confirm identity, specialty, licensure state, and active enumeration in about fifteen seconds. A first pass ahead of a state board check, not a substitute for one.
- **Account entity resolution.** Map brand names to legal entities to NPI sets so ABM account structure reflects how a system is actually enumerated.
- **Vendor audience QA.** When a media partner sells you a verified HCP audience, ask for a sample of the NPI list and check specialty and status yourself. You learn something either way.

It holds no prescribing volume, no claims data, no verified affiliation, and no measure of clinical influence. Treat it as free, fast, imperfect reference data that improves the quality of everything downstream.

The teams that get value here will use it to clean the inputs. The teams that get in trouble will use it to build a targeting list.