Anthropic shipped an NPI Registry connector for Claude, giving the model direct access to the CMS NPPES registry: validate an NPI, pull a full provider record, or search millions of providers by name, specialty, and geography.
The tutorial suggests Medical Affairs use it to identify key opinion leaders. That is the framing most pharma marketers will latch onto, and it is the one thing the connector cannot support.
I ran it against real brand team questions. Five findings, all reproducible in about ten minutes.
Default address behavior corrupts geographic queries. A search for medical oncologists in Madison, Wisconsin returned providers practicing in Dallas, Augusta, and Minneapolis, because the default matches mailing addresses too. Roughly 15% of results were wrong. Setting address_purpose=PRIMARY removed every false positive.
Specialty search matches hidden taxonomies. Providers register up to fifteen taxonomy codes and search matches all of them, but results return only the primary. My oncology search surfaced a neuro-oncologist listed as Neurology. Filter on the returned field and you drop relevant physicians. Count raw results and you inflate the universe.
Brand names are not legal entity names. A regional health system search returned three affiliates operating under entirely different names, and the parent authority held four separate pharmacy NPIs within ten results. NPI count is not site count or account count.
The data is unverified. In a handful of queries: a hospital name misspelled in its own record, a phone number of 000-000-0000, an active provider last updated in 2022. CMS does not validate what providers submit.
You cannot size a market. The API returns no reliable total and pagination caps at 1,200 records. You can enumerate a metro, not a country.
The compliance question
NPPES is public. Querying it creates no exposure. The join does.
NPI is the key that converts anonymous digital behavior into identified prescriber behavior. Your consent architecture and MLR-approved data use language were almost certainly not written to cover that.
- Never pass an NPI into GA4. It is a direct identifier and Google's terms prohibit sending PII. This is the most likely way the connector gets implemented badly.
- Full records expose DIRECT secure messaging endpoints. Those are clinical interoperability addresses for exchanging patient information, not a marketing channel.
- NPI is the identifier used in Open Payments. Systematic tracking of a named prescriber carries perception risk independent of whether it is permissible.
The join is a privacy and legal decision, not one the analytics team makes alone.
Where the value is
Upstream of campaign execution, in the reference data layer pharma marketing has historically outsourced and rarely audited.
- Target list hygiene.
npi_validateruns a local Luhn check with no API call, catching transposition typos before they cost a match rate or corrupt a report. Least glamorous, highest immediate return. - Speaker and investigator verification. Confirm identity, specialty, licensure state, and active enumeration in about fifteen seconds. A first pass ahead of a state board check, not a substitute for one.
- Account entity resolution. Map brand names to legal entities to NPI sets so ABM account structure reflects how a system is actually enumerated.
- Vendor audience QA. When a media partner sells you a verified HCP audience, ask for a sample of the NPI list and check specialty and status yourself. You learn something either way.
It holds no prescribing volume, no claims data, no verified affiliation, and no measure of clinical influence. Treat it as free, fast, imperfect reference data that improves the quality of everything downstream.
The teams that get value here will use it to clean the inputs. The teams that get in trouble will use it to build a targeting list.