Same license, different number

Ask the federal NPI registry for a nurse's license number and you get one string. Ask the state board that issued the license and you often get a different one. Both strings describe the same license, held by the same person, issued by the same state. They just do not match.

I wanted to know how often that happens, and why. So I took two datasets I mirror - NPPES, the federal registry covering 9.7 million US healthcare providers, and the license rosters that state boards publish themselves - and matched every claim I could check: 678,938 self-reported license numbers across seven states and three professions.

The short version: 40.3% matched the board's published string character for character. Another 47.5% matched only after normalization. Of the claims that resolved to a board record at all, more than half agreed with the issuing board only after transformation.

This is not a story about carelessness, and as far as I can measure, no group in it is doing anything unreasonable. It is a story about two record systems that never agreed on what a license number looks like, because nothing requires them to.

One disclosure before we start: I run a license verification API, and this corpus is its production data. This analysis exists because my own matching pipeline kept tripping over these cases, and I wanted to know whether the problem was my code or the data. It was the data.

Two systems, one fact

When a US healthcare provider applies for an NPI - the ID number on every insurance claim and prescription - the federal NPPES registry asks for their state license numbers. These fields are self-reported. The provider types what is printed on their license, and NPPES records it as typed. There is no lookup against any state board. To be precise: CMS does verify licensure during Medicare enrollment, in a separate system called PECOS. NPPES itself checks nothing.

Separately, most state licensing boards publish rosters of the licenses they have issued: who holds them, their status, and the license number. The board issued the license, so its file is the authority on what the number is.

So we have two official records of the same fact - one written down by the person who holds the license, one published by the institution that issued it. If you have ever tried to join two datasets on a field that "should" match, you know where this is going. The interesting part is not that they disagree. It is how, and how consistently.

What I matched, exactly

NPPES contains 12,171,227 license claims from 9,726,865 providers. My mirror of state board rosters holds 9,686,090 records. The overlap I can actually check - claims where I hold the issuing board's own file for that state and profession - is 678,938 claims from 557,391 providers, across seven states (Colorado, Connecticut, Delaware, Florida, Illinois, Michigan, Washington) and three professions (nurses, physicians, pharmacists).

That is 5.6% of all NPPES license claims. It is not a national sample, and I will not pretend it is: these are the states that publish open data, checked in the professions where I hold complete rosters. Everything below is scoped to that subset.

The matching ladder is simple. For each claim I first look for the exact string in the board's roster for that profession. If that fails, I normalize - strip a credential prefix, remove zero-padding, compare the digits - and look again. If normalization matches more than one distinct license, the claim is flagged ambiguous and reported as unresolved, not as a match. If nothing matches it lands in the no-match bucket, which - as we will see - mostly measures my coverage rather than anything about the provider.

The result

Two out of five claims match the board exactly. Nearly half match only after cleanup.

Of the 598,035 claims that resolved to a board record at all, 54.3% resolved only after normalization. The rest of this piece is about why.

Three states, three mechanisms

Aggregates hide the interesting part. Within a single state the disagreement is not noise - it is nearly deterministic, and each state has its own signature. Shapes below are masked: 9 is any digit, A is any letter. No real license numbers appear in this piece.

Florida: the prefix on the card

A Florida license reads as a credential prefix followed by digits. That is what the state prints, so that is what providers type into NPPES. But Florida's published roster stores the digits alone, the board's internal key. Same license, two serializations, both produced by Florida.

This one mechanism accounts for 99.5% of Florida's normalized-only matches. The provider is faithfully copying the document the state gave them. The state is faithfully publishing its database. Neither is going to change.

Connecticut: the invisible zero

Connecticut's signature is zero-padding, and it accounts for 98.8% of the state's normalized-only matches.

This is the least visible mechanism and, I would argue, the most dangerous in practice, because both forms look like ordinary integers. Any pipeline that treats license numbers as numbers - and a single pass through a spreadsheet is enough - will silently rewrite one form into the other. Depending on which side of your join got that treatment, the discrepancy appears or vanishes without anyone deciding anything. If you have ever watched a spreadsheet eat leading zeros, you have watched this mechanism at work.

Washington: nobody is wrong

Washington is my favourite, because it dissolves the idea that one side holds the correct answer. In Florida and Connecticut you can still squint and tell a story where one form is casual shorthand and the other is canonical. Washington refuses that story. In more than 80% of its normalized-only matches, both systems use a letter prefix - just not the same one.

Both sides of every one of those pairs were issued by the state of Washington. Both carry a credential prefix on purpose. They disagree about which prefix. There is no version of this in which somebody is simply being careless - there is simply no canonical serialization of a Washington license number, because the state itself uses several.

Washington also broke my tooling, which is its own small proof. My first mechanism classifier tested whether the provider's string starts with a digit while the board's starts with a letter - a rule that cleanly explains Florida. On Washington it reported almost nothing, because both strings start with letters and the test never fires. The classifier assumed mismatches come from one side dropping the letters. Washington's mismatches come from two letter-bearing formats that never agreed. I had to read the shapes directly to see it. If your mental model is "an identifier is a string, and one of the strings is right", this state is where the model fails. Mine included.

Every mismatch in this study is a small version of Washington: not an error on either side, but the absence of an agreement about how to write the fact down.

Colorado mixes the first two mechanisms: 87.9% credential prefix, 11.8% zero-padding. Nothing new, just both at once.

Is normalization finding the same person?

Matching after normalization raises an obvious question: am I finding the same person, or just a similar-looking number? I did not assume; I tested. For a random sample I checked whether the provider's surname in NPPES appears in the holder name on the matched roster row. Crucially I ran the identical test on the exact matches as a control, because surnames legitimately differ between systems - marriage, name order, transliteration - and the test has its own error rate.

Normalized matches sit three points under the exact-match control - about the gap you would expect from name differences alone. That is the same person. The ambiguous bucket sits 58 points under. That is not an answer, and I report it as unresolved.

Why you cannot just strip the letters

The obvious engineering fix is to throw away everything but the digits and compare. That is the fallback I used, and it is what most people reach for. It is also lossy, and the loss is measurable.

For 1,985 claims the digits-only key stopped being unique: it collided with more than one distinct license issued by the same board for the same profession. Those are the ambiguous rows, and their surname agreement is 37.1% against a 95.1% control - meaning most of them, if reported as matches, would attribute a stranger's license to somebody.

The letters that look like decoration are doing disambiguation work.

In some states the prefix is the only thing separating two licenses that are otherwise the same number. Strip it for convenience and you have not cleaned the identifier, you have merged distinct people and produced confident wrong answers. The honest handling is a third outcome that is neither yes nor no.

Three stories this data does not tell

The honest part of a measurement project is the list of headlines you wanted and could not keep. Here are mine.

"X% of self-reported license numbers cannot be confirmed"

This is the story I set out to write. The data does not support it. My no-match rate ranges from 1.4% to 78.5% depending on the source, and that spread tracks my own roster completeness, not anything about providers. Worked example: my Connecticut therapist roster holds exactly two license types across 10,150 rows against 25,270 NPPES therapist claims for the state, because the file I hold excludes psychologists and clinical social workers entirely. Every one of those providers lands in my no-match bucket, and every one of them is my gap, not theirs.

Where my coverage is genuinely complete the no-match rate falls to 1-6%: Florida nurses 4.3%, Illinois nurses 4.2%, Washington nurses 6.3%, Connecticut pharmacists 1.4%. In a sample of 796 no-match records, a further 3.8% turned out to exist in the same state under a different profession than the one I searched, and 2.0% existed for the profession in a different state. The no-match column mostly measures me.

"Two-thirds of license numbers are written differently"

This was my first headline, and it was arithmetically indefensible: it silently counted the no-match bucket as "written differently", immediately after I had established that the bucket measures coverage. The numbers I can defend are the ones you have already seen - 40.3% of checkable claims match exactly, and 54.3% of resolved claims match only after normalization.

"These are just old records"

The most predictable objection is staleness: the provider typed the then-correct format years ago and the board has changed formats since. I tested it. Average years since the NPPES record was last updated, by outcome: exact matches 5.7, normalized matches 6.2, no-match records 6.1, with medians of 4.0 across all three. No-match records are no older than matching ones. If format drift over time explained the mismatches, that column would look different. It does not.

Two of those three were stories I had to give up. The third was an objection the data let me retire. All three are the same discipline: the number you publish has to survive the explanation you would rather not test.

What was already known

This is not the first look at NPPES data quality. In 2013 the HHS Office of Inspector General reported that 48% of NPPES records contained inaccurate data and 58% of PECOS records did, on a sample of 170 providers, and documented that CMS instructed its contractors to verify one variable in NPPES against four in PECOS, licensure among them. That was registry compared against registry.

The NBER NPI to State License Crosswalk publishes the NPPES-side linkage, but it reorganizes self-reported data rather than measuring agreement against board files. What is added here is narrow and specific: agreement measured against the issuing boards' own published rosters, at a scale where the per-state mechanism becomes visible.

Limitations

• Seven states and three professions, 5.6% of all NPPES license claims. Nothing here supports a national figure.
• The states are self-selected: they are the ones that publish open data, which may well correlate with how they format it.
• The surname validation and the no-match cause breakdown are sample-based, with counts stated where they appear.
• Roster files are point-in-time snapshots. A license issued after a snapshot legitimately will not appear in it.
• Therapists and EMS are excluded from every figure above. Therapist roster coverage is partial and the surname control fails on it, so it is untrustworthy in both directions. Both appear in the CSV, labelled.

What to do with this

If you join healthcare datasets on license number - credentialing systems, compliance tooling, researchers linking NPPES to state data - three things follow.

First, exact string comparison forfeits roughly half your true matches. In this corpus 54.3% of the claims that resolve to a board record do so only after normalization, and the required transformations are state-specific and learnable.

Second, digits-only normalization is not the safe version of that. The letters carry information: in 1,985 cases the digits-only key collided across distinct licenses, and surname agreement in that bucket was 37.1% against a 95.1% control. Report ambiguity as ambiguity.

Third, "not found" is a statement about your reference data before it is a statement about the record. My no-match rate swung from 1.4% to 78.5% purely with roster coverage. Any pipeline that reports "could not be confirmed" without stating its coverage is reporting its own gaps in someone else's voice.

The larger point is the one Washington makes on its own: an identifier is only as joinable as the agreement on how to serialize it, and for US professional license numbers no such agreement exists. The provider quotes the license card. The board publishes the database key. Both are right, and they do not match.

Common questions

Why does the NPI registry show a different license number than the state board?

Because two different parties write the two records. The provider types the number printed on their license into NPPES, and NPPES checks nothing. The board publishes its own database key. In Florida the card carries a credential prefix the roster omits, and in Washington the state itself uses several prefixes.

Does an NPI lookup verify a license?

No. The license numbers in NPPES are self-reported and recorded as typed, with no lookup against any state board. CMS does verify licensure during Medicare enrollment, but in a separate system called PECOS. To confirm a license is real and current, check the roster published by the board that issued it.

Which states and professions were measured?

Seven states - Colorado, Connecticut, Delaware, Florida, Illinois, Michigan and Washington - and three professions: nurses, physicians and pharmacists. That is 678,938 claims from 557,391 providers, 5.6% of all NPPES license claims, as of August 16, 2026. It is not a national sample.

Data

Both underlying datasets are public: the NPPES data dissemination file from CMS, and the roster files each state board publishes. The aggregate results are downloadable under CC BY 4.0:

• match-rates.csv - counts per state, profession and outcome, including the excluded therapist and EMS cells
• format-shapes.csv - masked format shape pairs and frequencies

Row-level results are deliberately not published. An outcome in this analysis says nothing about an individual. Shape cells below 250 observations are suppressed. Normalization used on both sides: uppercase, remove all non-alphanumeric characters; fallback key: remove all non-digits, strip leading zeros.

The normalization rules described here run in production at licenseverificationapi.com. But nothing in this analysis requires my product: NPPES is public, the seven boards publish their rosters, and the method fits in a paragraph. If you check my numbers, I would genuinely like to hear what you find. The methodology page documents how each source is obtained and refreshed.