Open Payments recipient validation, explained.

What recipient validation is: proving which doctor a payment belongs to before the government publishes it

One payment record, from a rep's expense app to a public website

1. A payment is madeA meal, a fee, a grant, a research payment. It is captured in an expense, events, finance, research or grants system.
2. Lines come togetherEach year's lines are pulled into one place, with the recipient as someone wrote it.
3. The recipient is provedName, license, NPI, address and type are checked against the registries, and a person decides the unclear ones. This step is what this guide is about.
4. CMS checks and an officer attestsThe company uploads between February 1 and March 31, fixes what fails, and an officer attests.
5. The recipient reviews, then the public sees itDoctors can review and dispute from April 1. CMS publishes by June 30.

The dates are the ones CMS uses each year.1

Nearly every published record has an NPI, and three more surprises about Open Payments recipients

Covered recipient, NPI, transfer of value, attestation: four words this work runs on

Fourteen terms are defined in the one-page summary.

The covered recipient definition: six kinds of physician, five kinds of practitioner and one list of hospitals

In shortA covered recipient is a physician, physician assistant, nurse practitioner, clinical nurse specialist, nurse anesthetist or anesthesiologist assistant, or certified nurse-midwife who is not the reporting company's own employee, or a teaching hospital on CMS's list for that year. Registered nurses, pharmacists and medical residents do not count. By our count of CMS's 2025 file, non-physician practitioners now make up 37 of every 100 general payment records.

Until 2021 this report was about physicians and teaching hospitals. Five more groups have since joined, and CMS's first data for them is Program Year 2021.7,1 That change explains much of today's matching work: the credential on an expense line now decides whether a payment is reportable at all. "RN" is outside the rule. "CRNA", short for certified registered nurse anesthetist, is inside it, and a rep may write either for the same person.

Hospitals identify differently: the record uses the name and address from CMS's list, and none of the 35,569 teaching hospital general records for 2025 carries an NPI, by our count.6,9

Sunshine Act reporting requirements and the yearly calendar, from February 1 submission to June 30 publication

In shortThe rule is 42 CFR Part 403, Subpart I, in the Code of Federal Regulations (CFR), and the calendar repeats yearly: collect through December 31, submit and attest by the 90th day of the next year, let recipients review from April 1, correct by the end of May, and publication follows by June 30. For 2026, a payment of at least $13.82 is reportable, and smaller ones count once a recipient's yearly total passes $138.13.

What identifies a covered recipient on a record: name, address, specialty, NPI and license, and which source proves each

In shortNo single field proves who was paid. The registry is the reference for the name and the NPI, a state board is the reference for the license and its status, and your contract or sign-in sheet says whom you meant. A match is the agreement of those sources, field by field.

Identifiers an analyst has to line up for one person

NPPES, CMS's validated physician list and the teaching hospital list: what each is and how often it changes

In shortNPPES is the public registry, with about 9.9 million records including deactivated ones, by our count. CMS gives reporting companies validated lists of physicians and practitioners, inside its system and for reference only. The teaching hospital list changes yearly: 1,538 hospitals for 2026 and 1,586 for 2027, by our count. Use the list for the year of the payment.

The NPI check digit, worked through, and why 39 J. Smiths in Columbus cannot be sorted by name

In shortAn NPI's last digit is a check digit, worked out from the other nine, so a mistyped number can often be caught in a second without any lookup. A correct check digit says only that the number is well formed. The name is much weaker: by our own query on November 3, 2026, the registry held 397 people named Smith with an address in Columbus, Ohio, and 39 whose first name starts with J.

Test any NPI in four steps, with CMS's own example

This small test catches many typing errors, since a change to any one digit changes the result. It cannot tell you whether the number belongs to the person on the line. For that you need the registry, and then more than a name.

So a typed "Dr. J. Smith" in one city leaves 14 people of a covered kind before anyone compares the contract's specialty, street or license. Two of those are internists and two work in emergency medicine, by the same query. A surname can be this common, and a first initial may be all you get. That is why a license number or a practice address on the contract carries so much weight: each is close to unique, where a name is far from it.

How to score a candidate field by field: agree, variant or differ, and where to draw the line for a person

In shortCompare each field of the payment line with each candidate, mark it agrees, is a variant or differs, weigh identifiers above names, and combine the marks into a score. Above a score you approve, called the auto-match line, the match stands by itself. Below it, a person decides. CMS sets no method, so yours has to be written down, tested and defensible.

Here is the guide's fictional case with its three candidates: two physicians and a nurse practitioner, whose license reads APRN-CNP. No field settles it by itself except the last two, and those are the ones a hand-written name never gives you.

Two kinds of matching error, and why the line is a policy decision

Moving the line trades one against the other. A higher line sends more lines to people and lets fewer wrong matches through. Set it on a sample of your own lines where you know the answer, and have your compliance committee approve it. Keep the document: the optional assumptions document CMS accepts is a natural home for your method, and it stays private.4 The Justice Department (DOJ) also asks how a company measures "accuracy, precision, or recall" of analytics it uses for compliance.22

Foundations, practices, name changes, expired licenses and group meals: the Open Payments calls a rule cannot make

In shortEight situations need judgment. A payment made to a foundation or practice may belong in a covered recipient's name. A person who changed names or moved looks like someone else. A credential on a sign-in sheet can be wrong. Each has a rule behind it, and each needs a written reason.

Open Payments validation and matching: four steps, and the errors E-405 to E-427 that a bad recipient draws

In shortCMS's system checks your file, then each record, then tries to match the recipient to its own sources. A record that cannot be matched fails, and CMS says it must be corrected before it is eligible for final submission.9 Passing tells you the identifiers agree with CMS's sources. It does not tell you that you chose the right person from the contract.

The CMS error codes behind a wrong recipient

CMS also provides a validation utility, which matches physician and practitioner details against its validated resources before you report them, and which it says can reduce matching errors.9 A rehearsal before February leaves time that a failure found in late March does not.

How to tell if unresolved Open Payments matches will clear in time: the backlog arithmetic, worked on 412 open matches

In shortAn open match is a recipient question waiting for a person's decision. Count what is open, how fast new matches arrive and how fast people decide them. If arrivals beat decisions, the backlog grows until December 31 and only then falls. In the fictional case, 412 open matches clear on January 18 at today's pace, ten days after the January 8 internal target, and about four more decisions a day close that gap.

Two more things shape this curve. The number of decisions is the measure, since one decision may fix many records: in the example, 412 open matches stand behind 3,068 records. And the people doing the deciding are also the people answering audit questions and setting up next year's list. We found no public figure for how seasonal this work is. Your own month-by-month count of new matches will tell you how early to start.

Open Payments penalties and enforcement: from $14,432 per record to Veloxis's record $1.55 million in August 2026

In shortThe rule sets penalties per record, adjusted for inflation, with yearly caps. CMS itself imposed none in fiscal 2025, while it wrote warning letters and ran audits. The large numbers have come through Justice Department cases that pair kickback claims with reporting failures, and the record, $1.55 million, arrived in August 2026. Expense data is the common thread.

"Knowing" is broader than it sounds. The rule counts actual knowledge, deliberate ignorance and reckless disregard, and it needs no proof of a specific intent to defraud.7 When setting an amount, CMS may weigh how long the failure lasted, culpability, what was reported in error and "the degree of diligence exercised in correcting" it.5 Your record of how you found and fixed errors therefore counts for something.

Three settlements where wrong payment records carried a price

The Veloxis facts matter here because they run through recipient data. In its deferred prosecution agreement, Veloxis admitted that employees falsified expense reports by adding names to attendee lists, which lowered the apparent cost per person, and by leaving off health care professionals who did attend, to avoid this reporting. Two dinners with outside guests were written up as an "Internal meeting".29

In the civil settlement, the government says reports to CMS for calendar years 2019 to 2022 rested on those records and understated or left out what physicians received, and Veloxis paid $1.55 million to resolve that claim.27 DOJ calls it "the largest Sunshine Act recovery since the law was passed in 2010".26 The wider kickback conduct ran from about October 2016 to June 2023.30

The attendee list, the record your matching work depends on, was the point of failure. Good matching cannot detect a false attendee on its own, though a pattern of names signing in far from their practice is worth a second look. One law firm's reading is that such a claim has rarely been brought, and that this work should no longer be treated as routine administration.31

In 2020, Medtronic's $1.11 million concerned payments to a surgeon's restaurant across more than 130 events over nine years, with only the food reported.23

CMS says its audits are moving to "more issue-based and desk audits and fewer random selection audits".1 Its 2026 audit guide asks for documents behind a sample of records, such as receipts, and says audits may require a general ledger review.32

What the public file shows about disputes, and what it hides

A low count may mean few wrong records, or few doctors looking. Reviewing is voluntary.1

Early complaints were louder: in 2014 a trade journal reported that CMS had found records pairing an "NPI for one doctor and a license number for another".33 That was the system's first year, so treat it as history. We found no recent public measure of how often a record names the wrong person. The HHS Inspector General's 2018 review of 2015 data looked at required fields and product names, with less than 1% of 11.9 million records missing required data.34 Its published summary reports no finding on recipient identity.

Open Payments volume keeps climbing: 17.07 million records and $14.67 billion for Program Year 2025

In shortCMS's latest publication covers 1,833 companies. Records grew by about two-fifths in four years, and the number of practitioners with data grew by more than half. We found no reliable public market size for this software, so we show what you can measure.

A growing file adds identities to check, and in our reading practitioners may take more checking than the early years' physicians did: the group is newer to the rule, and a master list may have been built around prescribing physicians. CMS's newest numbers come with one small trap: the alt text of its pie chart still says $12.79 billion for an older year, while the page's figures total $14.67 billion.3

AI in NPI matching: what it does well, which rules do not reach it, and the decisions that stay with a person

In shortSoftware can search the registry, compare fields, read a contract's purpose clause and draft the reason in seconds. A wrong person on a public file is costly, so people should decide unclear matches, and a named person should sign off on anything that keeps a payment out of the file. FDA's AI draft, its electronic records rule (Part 11) and the draft EU manufacturing annex on AI (Annex 22) do not aim at this work. The Justice Department's questions do.

Matching identities across messy records, called entity matching, is a well-studied job, and language models do it well. One academic test across standard benchmarks found the best models about level with models fine-tuned on thousands of examples, while needing few or no examples.36 Those are general data sets, with nothing about provider identity, so test any tool on your own lines.

A score alone does not show when a model cannot tell, so the supporting evidence matters as much as the score: each mark should open the record it came from, and a person should see the fields that differ.

How transparency teams match recipients today: who does what, and where 15 hours per 100 uncertain matches go

In shortAn aggregate spend team pulls lines from five or so systems, a rules engine settles the easy ones, and analysts search the registry and boards for the rest. They paste screenshots into a spreadsheet for evidence. We assume 6 to 12 minutes by hand for each uncertain match. We found no public time study behind that or any other figure, so time your own.

Transparency analyst to attesting officer: who touches a recipient match

From five payment systems to an attested file, step by step

Where the analyst's hours go on 100 uncertain Open Payments matches

Spreadsheets, spend platforms, services or matching software: four ways teams resolve recipients

Three J. Smiths in Columbus: how nine payment records reach the right NPI, on October 7, 2026

In shortNorthwind Bio ran a Dravenzo heart-failure advisory board in Columbus on September 12. Nine records in three systems, worth $14,860, say "Dr. J. Smith". Six software agents find the candidates and draft the reason overnight, and Lena Ortiz, a transparency analyst, confirms the match in a few minutes. Her one decision fixes all nine records and lowers the count on the submission clock.

1

The candidates appear side by side, and the score says a person decides

Lena opens exception M-2039. The agents recommend Jennifer T. Smith, MD, at a match score of 92%. The auto-match line is 0.95, or 95%, so the screen sends the decision to her. Beside the payment record sit three candidates, with each field marked as agreeing, a variant or differing.

Below the recommendation, the screen says what confirming would do: 9 records, $14,860, 3 systems.

2

Practice address and license number settle it

Name and credential cannot decide this one: all three people are variants of "Dr. J. Smith". Two rows are highlighted "settles it". The contract's 2200 Riverside Dr and OH 35.998214 agree with candidate A and differ for the others.

One click on the license opens the Ohio board's record on the right: Jennifer Tess Smith, MD, active, expiring July 1, 2027, looked up October 6.

3

The signed agreement, with the cited fields highlighted

The source tab shows consulting agreement CA-26-0918, a $6,000 honorarium, the service and the signature, "J. T. Smith". The practice address and license number are marked because the reason cites them.

4

A reason in plain sentences, with a citation on each claim

Under the table, the evidence writer says why, in numbered citations. Each number opens a source passage. Below the reason sits the master-data fix it proposes: link the license and the NPI to master record HM-140 377. It goes to Dana Okafor, the steward, when Lena confirms.

5

What each agent did overnight, in order

The steps run from the feed through the name and address normalizer, the registry matcher, the license and address checks, and the classifier, each with its timing. The initial "J." stays a partial first name, and "Dr" is set aside. The sample's registry holds 41 Smiths in Ohio and 3 with the initial J in Columbus, which is far fewer than the real registry in section 6.

6

Nine records from three systems behind one name

The records tab lists what the decision will touch: consulting fees through the year, a food and beverage line, and how each was captured: "Dr. J. Smith", "J. T. Smith", "Jennifer T. Smith, MD". Three spellings in three systems are one person.

7

One confirmation, four things done

Lena confirms. The NPI goes onto all nine records, the master-data fix goes to Dana, the recipient's details are pre-checked against the federal profile file with no errors in the sample, and the records join submission batch 41. Her name is on the decision. It can be reopened.

8

The submission clock counts what is left and the pace to clear it

Now 411 matches stand open, behind 3,059 records and $4,791,540. The window opens in 117 days. The last 30 days ran at 36.8 decisions and 39.7 new matches a day, so the last match lands on January 18, ten days past the January 8 internal target. Four more decisions a day close the gap, and this is the same arithmetic as section 10.

9

Where every payment of the year stands

The flow shows 1,215,699 records of the program year by source system and outcome: matched on their own, confirmed by a reviewer, waiting or not covered.

The penalty box prints the rule's unadjusted $1,000 to $10,000 and $100,000. The current maximums are $14,432 and $144,329 (section 11).

The solution's design targets are 97.6% of records matched on their own and a median of 2.6 minutes for a person to decide. In the sample, the last 30 days show 97.6%, the whole program year 97.0%, and the most recent night 97.1%. These are targets and sample figures. Measure yours on your own records.

A foundation grant, an "RN", a practice paid instead of a doctor, a pharmacist, and the screens around them

In shortEach exception says why it needs a person. Hospitals and foundations always go to a person and need a second sign-off, as does any "not covered" call. These screens show those cases, the list of exceptions, a recipient's profile for a dispute, the nightly run, the dashboard and the settings.

Six agents, one analyst and two second signatures: what feeds a federal Open Payments file and what comes out

In shortSix agents read, compare, classify, cite and build the file. They read the registries, your HCP master and your source systems, and change none of them. A transparency analyst decides every match below the line, and a second named person signs teaching hospital, foundation, "not covered" and duplicate master record decisions.

What each of the six matching agents does, and what it never does

Who signs which Open Payments decision

Spend lines and registries in, a pre-checked file and a reason for each match out

Works with your expense, events, grants and master-data systems

Your data stays in the systems you run. The solution reads your expense system, events platform, accounts payable, clinical payment and grants systems, your customer master, and the public registries. Enterprise needs are built in: named roles, a second signature (maker-checker) on the riskiest calls, an audit trail on each decision, rule change and setting, and exportable evidence. Botminds' information security is managed to ISO 27001 and audited under SOC 2 Type II.

Results here are design targets and sample data. The solution has no independent accuracy test behind it, and we would rather measure it on your records.

What a wrong recipient costs you: analyst hours, public disputes and a penalty that runs per record

In shortHours are the part you can count. On our illustrative estimate, 100 uncertain matches take 15 hours by hand. The rest is harder to price, such as a doctor's name on a wrong record or an officer's signature on a file nobody can explain. Published penalties frame the exposure, and they say nothing about your own odds, so start with what you can measure.

Timing 20 matches and sampling 50 records to find your Open Payments baseline

A doctor's trust, an officer's signature and other costs a matching calculator misses

What automating recipient matching returns: minutes per decision, fixes made once and disputes answered from the file

In shortPut in your own numbers. Every default marked illustrative is an assumption to replace. At 12,000 uncertain matches a year, hours roughly cover a $100,000 yearly cost and leave about $31,000. Below about 9,000, they will not, and a written method with a shared evidence folder may serve you better.

Decision minutes, master fixes, disputes: where recipient matching can pay back

Uncertain matches a year, minutes each and hourly cost: your Open Payments numbers

At 3,000 matches a year, $100,000 of cost returns about $33,000 in hours, so a written method, a shared evidence folder and CMS's own validation utility may be the better first step. In the sample company, 11,420 matches were raised by early October, which is where the arithmetic starts to work.

How ready your transparency team is: volume, master data, a written match policy and who signs a "not covered"

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

A low score means writing the match policy before buying anything

What to ask aggregate spend and NPI matching software about evidence, the auto-match line, hospitals and upload errors

In shortAsk every vendor the same questions, us included. The answers show how each match is proved, who can change the line, how the rule's edge cases are handled, and how you could test the claims on your own past payments.

With no published independent test to lean on (section 18), a replay on your own past payments is the fairest comparison, and it also measures your current process.

Replay last year's hand decisions, then run one quarter of payments in parallel before the February window

In shortWrite down your match policy, build a test set from decisions you already made, replay them, and run one live quarter beside your usual queue. None of this commits you to a vendor, and the policy and the test set improve your next file either way.

1. Time 20 matches and re-check 50, so you know your minutes and how often two people disagree.
2. Write the match policy on two pages, with the line, the sign-offs, and how you treat hospitals, foundations and practices.
3. Build a test set of 500 or so past lines with known answers, weighted toward your hard cases.
4. Replay them, then run one quarter in parallel, with your usual queue still deciding the file.
5. Decide on four numbers: precision above the line, share reaching a person, minutes a decision, and upload errors.

Precision above the line, minutes a decision, upload errors: scoring a recipient matching pilot

Open Payments and Sunshine Act questions answered: covered recipients, NPIs, deadlines, disputes and penalties

In shortCommon questions from transparency teams and buyers, each answered on its own.