Nobody's data is wrong; everybody's data disagrees
Every organization that owns a provider directory has had the same meeting. Accuracy is poor, somebody proposes a cleanup, a project runs, the numbers improve, and eighteen months later the directory is in roughly the state it started in. The conclusion usually drawn is that the cleanup was not thorough enough. That is the wrong conclusion. The directory degrades continuously because the facts in it change continuously and the people who know they changed are not the people who maintain the record. A cleanup is a snapshot applied to a moving object. It works exactly as long as it takes for the object to move.
The second reason is structural. One row in a directory looks like one fact about one person, and it is actually a claim about the relationship between four separate things:
The clinician — a licensed individual with a national identifier, a specialty, credentials and a career that moves.
The organization — a legal entity with its own identifier, which bills, holds contracts, merges, is acquired, and changes names without changing anything a patient would notice.
The location — a physical site with an address, a phone number, hours, accessibility attributes, and a relationship to the organization that is often a lease rather than ownership.
The network participation — whether this clinician, at this location, under this organization's contract, is in-network for a specific product from a specific plan. This is the attribute members care most about and the one that is asserted rather than observed.
Most directory data models collapse these into a single denormalized row because that is the shape the published output takes. Once collapsed, there is no place to record that the address was confirmed last week and the panel status has not been confirmed in a year, so both are presented with equal confidence to somebody making a decision about their health care.
You are probably here because
- An audit or a member complaint pattern put directory accuracy on somebody's list
- You maintain a provider dataset for analytics or ratings and cannot reconcile it against a second source
- Outbound attestation campaigns get low response and you are not sure they are worth running
- A cleanup finished and the numbers went back
The decay table is the map. The section on verification signals decides where to spend money. The measurement section is the one that makes an audit survivable, because a single accuracy percentage will not.
Attributes decay at completely different rates
Treating a directory record as uniformly fresh or stale wastes most of the effort. The fields have wildly different half-lives, and the cheapest improvement available to most organizations is simply to verify the fast-decaying fields more often and the slow ones less.
| Attribute | Who actually knows | How to verify without asking |
|---|---|---|
| Accepting new patients | The front desk, and it can change within a week | Hard. Recent new-patient claim activity is a weak proxy. This one usually requires contact |
| Practice location and suite | The practice manager, on the day of the move | Service facility address on recent claims is a strong signal |
| Phone number | The practice, and it changes with the phone system | Automated reachability testing, carefully and infrequently, plus attestation |
| Network participation | Contracting, and it changes on contract dates | Your own contract system is authoritative here. Do not infer it from anywhere else |
| Organization affiliation | The clinician and the group, at hire and at departure | Billing organization identifier on recent claims is the best available signal |
| Specialty and taxonomy | The clinician. Slow to change and often wrong from the start | Procedure mix on claims is a surprisingly good corroborator |
| License status | The state board, definitively | Primary-source verification against the board. Authoritative and available |
| Name and identifier | The national registry, mostly stable | Registry lookup. Beware name changes and identifiers that were never updated |
Two entries in that table deserve emphasis. Network participation should never be inferred. It is a contractual fact your own systems hold, and inferring it from claims or from another directory is how a member ends up at an out-of-network provider believing otherwise. Accepting new patients is the hardest field in the directory, it changes fastest, and it is the one members act on most directly. Any accuracy program that does not treat it as a special case is optimizing the easy fields.
The regulatory shape, without the false precision
Federal law arising from the No Surprises Act placed real obligations on plans regarding directory accuracy: a periodic verification cycle for listed provider information, a duty to respond to a member's inquiry about whether a provider is in-network within a short defined window, a requirement to remove or correct information that cannot be verified, and a protection limiting a member's cost sharing where they relied on inaccurate directory information. Separately, the Centers for Medicare & Medicaid Services has conducted multi-year reviews of Medicare Advantage online directories and published findings on how many listed locations contained at least one inaccuracy; the reported share has been large enough to make the point on its own.
The exact verification interval, the exact response window, the scope of the cost-sharing protection and how each applies to your specific product lines are set in statute and implementing guidance, and they have been adjusted since enactment. Pull the current text with your compliance lead. Do not build a verification cadence off a figure quoted in an article, including this one, and do not assume a rule written for one plan category applies to another.
The engineering consequence of the regulatory frame is worth stating plainly: you will be asked to prove when a field was last verified and how. That is a data model requirement, not a reporting requirement, and it has to be there before the audit rather than reconstructed afterward.
Stop building one golden record
The instinct is to merge every source into a single best row per provider. That instinct comes from customer master data work and it does not transfer well here, because the sources disagree in structured, informative ways and merging destroys the information in the disagreement.
The design that holds up keeps every source's assertion and resolves at the field level. For each attribute you store the value, the source, the date it was observed or asserted, and the method. The published value is then a function — the highest-ranked source that has spoken recently enough — and it can be recomputed when a new observation arrives without a re-merge. Contradiction becomes a first-class signal instead of a merge conflict: two credible sources disagreeing about an address is exactly the case a human should look at, and in a merged model it is invisible by the time anyone sees the row.
This also produces the audit answer for free. When someone asks why the directory says what it says, the answer is a row with a source and a date rather than a shrug.
How much to trust each verification signal — our read
Our engineering judgment, per attribute type, not a published ranking. The bottom row is the one that quietly propagates other people's errors into yours.
The bottom row is worth dwelling on. Copying from another directory feels efficient and it is how errors become industry-wide. A wrong suite number entered once can appear in a dozen datasets, each citing the others, and no amount of cross-source agreement makes it true. Corroboration only counts when the sources are actually independent, and in this domain they very often are not.
Matching is the part that breaks quietly
Before any of the above works, records from different sources have to be recognized as being about the same clinician at the same place. This is ordinary entity resolution with two domain-specific traps.
The first is that identifiers are not as identifying as they look. An individual identifier is stable, but the same clinician appears at several organizations and several locations, so the identifier alone does not resolve a row. An organizational identifier can cover a large system with hundreds of sites. Matching on identifier alone over-merges; matching on name alone is worse, because common names collide constantly and the failure is silent.
The second is addresses. Suite numbers migrate between address lines, buildings have several valid street forms, and campus addresses are frequently a mailing address rather than where care is delivered. Normalize addresses through a real standardization step before comparing, treat the suite as a separate field, and accept that a residual share will need human eyes.
Practically: match on identifier plus normalized address plus a name similarity check, score the match, auto-accept above a high threshold, auto-reject below a low one, and route the middle to a review queue. The review queue is not a failure of the system. It is the system — sized correctly, it is a person for a few hours a week, and it produces labeled examples that improve the thresholds. Measure over-merge and under-merge separately, because they have opposite consequences and a single accuracy number hides which one you have.
How to measure it so the number means something
“Our directory is ninety-two percent accurate” is not a measurement. Accurate on which field, against what truth, sampled how?
A defensible measurement has four parts. A defined truth procedure — what counts as confirmation for each attribute, written down before sampling. A random sample, drawn from the published directory rather than from the records most recently touched. Per-attribute reporting, because a directory can be excellent on license status and poor on panel status and the average tells you nothing. A stated denominator and date, so two measurements are comparable.
Then measure the thing members actually experience, which no field-level metric captures: starting from the published directory, can a member reach a provider who is in-network for their product, at the listed location, and be seen. That end-to-end rate is lower than any field-level accuracy figure, it is the number a regulator's own review approximates, and it is the only one that tracks complaints.
Mistakes we see
- A cleanup project with no ongoing verification, which decays back within a year or two
- One golden row per provider, so contradictions between sources are destroyed rather than surfaced
- No per-field observation date, which makes both prioritization and audit response impossible
- Inferring network participation from claims or another directory instead of from the contract
- Copying from other published directories and counting the agreement as corroboration
- Matching on name similarity without an identifier or address constraint
- Reporting a single accuracy percentage across attributes with different decay rates
- Outbound attestation as the only mechanism, when response rates make it insufficient on its own
When you do not need help with this
If your directory covers a few hundred clinicians in a handful of locations, this is not a systems problem. It is a person with a spreadsheet, a quarterly cycle, and a habit of updating on the day a change is known. That will beat any platform, and it costs nothing.
If your data already carries a source and an observation date per field, you have the hard part. What remains is prioritization arithmetic — verify fast-decaying attributes often, slow ones rarely — and that is a week of analysis by someone who knows your data, not an engagement.
The problems genuinely worth outside help are the ones where sources have to be reconciled at scale without a shared key, where matching has to run continuously with a measured and bounded error rate, or where an auditor is going to ask when a field was verified and the current model has nowhere to put the answer. Those are engineering problems with real depth. Directory hygiene, at a small scale, is not one.
What a directory program that holds looks like
- Four entities modeled separately — clinician, organization, location, network participation
- Source, date and method stored per attribute, not per record
- Published value computed from a source ranking, recomputed as observations arrive
- Contradictions routed to review rather than resolved silently by a merge rule
- Verification cadence set per attribute by decay rate, above the regulatory floor
- Network participation sourced only from the contract system
- Matching with scored thresholds and a sized human review queue
- Over-merge and under-merge measured separately
- Random-sample accuracy per attribute, with a written truth procedure
- An end-to-end reachability measure that reflects what a member experiences
Bottom line
Provider directories are wrong because they are a continuous reconciliation problem being managed as an occasional cleanup, and because one row is hiding four entities with four lifecycles. The fix is not a better cleanup. It is a model that records who said what, when, and how, resolves per field rather than per record, verifies each attribute at a cadence matched to how fast it decays, and never infers network participation from anything other than the contract. Measure per attribute against a written truth procedure, and separately measure whether a member can actually reach a provider the directory listed. That last number is the honest one, and it is the one that moves complaints.
Frequently asked questions
Because the underlying facts change continuously and a cleanup is a snapshot. Clinicians move, groups are acquired, panels close, phone systems change. Without a mechanism that captures changes as they happen — claims signals, credentialing events, contract dates, attestation — the record can only drift from the day the project ends. The cleanup was not too shallow; it was the wrong shape of intervention.
For some attributes, well. Recent claim activity is a strong signal for practice location and organizational affiliation, and procedure mix corroborates specialty better than most people expect. It is a poor signal for whether a panel is open, and it is not a valid source for network participation, which is a contractual fact your own systems hold. Use it as corroboration with a recorded observation date rather than as a source of record.
Yes, but not as the only mechanism, and not applied uniformly. Attestation is the only reliable way to establish panel status, so target it where passive signals cannot help and where the record is stale on a fast-decaying attribute. Blanket campaigns across the whole roster produce low response and consume the goodwill you need when you genuinely have to reach someone.
Purchased data is useful as an additional source with a known lineage, and harmful when it is treated as truth. Ask any vendor where each attribute originated and when it was last observed. If they cannot answer per field, you are buying somebody else's merged row, and merged rows are exactly what propagates errors between organizations. Rank it as one source among several rather than importing it over your own.
Adding a source and an observation date to every attribute. It is unglamorous and it is the prerequisite for everything else — prioritizing verification, surfacing contradictions, answering an auditor, and reporting accuracy in a way that means something. Most organizations that struggle here are missing that one column, and every downstream problem traces back to it.