Is It Legal to Market to Doctors Using NPPES Data? What to Check Before You Start

Using NPPES data to reach doctors is common, and the registry itself is public. The part that trips people up is not where the data comes from but how you contact people with it. This guide walks through the main considerations by channel. It is general information, not legal advice, so check your plans with a qualified attorney.

Where the data comes from

NPPES is the National Plan and Provider Enumeration System, the registry maintained by the Centers for Medicare and Medicaid Services that assigns NPI numbers to US healthcare providers. Provider names, practice locations, phone numbers, and taxonomy codes in the registry are published as public records. Our NPPES data explainer covers what each field means.

Direct mail

Postal mail to a practice address is the least restricted channel. You still want an accurate return address and a clear offer, but there is no registry to scrub against and no opt in requirement in the way there is for email or fax.

Phone calls

The National Do Not Call Registry is aimed at personal phone numbers, so calls to a business line are generally treated differently. Calls to mobile numbers that use automated dialing or prerecorded messages carry their own restrictions, and some states add extra telemarketing rules. If you use a call team, keep an internal do not call list and honor requests to stop right away.

Fax

Advertising sent by fax to recipients you have no relationship with is the most restricted channel of all. Because fax numbers are included in the records, it is tempting to use them, but a safer approach is to treat the fax field as reference information rather than an outreach channel unless you have confirmed permission.

Email

The records in this database contain address, phone, and fax details rather than email addresses, so any email outreach depends on addresses you collect separately. If you send commercial email, the CAN-SPAM Act applies even when you are writing to businesses. It requires accurate sender information, a real physical address, and a working way to opt out. Our guide to building a healthcare email list covers the process from the ground up.

What about HIPAA

HIPAA governs protected health information held by covered entities and their business associates. A directory of provider business contact details is not patient data, so HIPAA is generally not the rule that decides whether you can contact a doctor. It does matter if you later handle any patient information as part of a working relationship.

A short checklist

Identify yourself and your company clearly. Keep a suppression list and honor opt outs. Do not imply endorsement by CMS or any government agency. Match your channel to the rules above, and have counsel review your campaign before you scale it.