Data Sources
VeriflowAPI aggregates and normalizes data from multiple authoritative government sources. This page explains what each source covers, how frequently data is refreshed, and what happens when a source is temporarily unavailable.Federal Sources
These sources are checked on every verification request regardless of state.NPPES NPI Registry
The National Plan and Provider Enumeration System is the federal database of all healthcare providers who have been assigned a National Provider Identifier.
The NPPES database is the foundation of every verification. Even when a state board is temporarily unavailable, NPI data ensures you always receive a meaningful baseline response.
OIG Exclusion List
The Office of Inspector General maintains a list of individuals and entities excluded from participation in federal healthcare programs (Medicare, Medicaid, etc.). Hiring or contracting with an excluded provider can result in significant civil penalties.
If
oig_excluded is true, the provider must not be employed or contracted by any entity receiving federal healthcare funding. This is a hard disqualifier in most onboarding workflows.
State Sources — Live
Deep state license data is available for thirty states today. Texas, New York, Pennsylvania, Ohio, and Michigan are live per-query scrapes; the rest are full mirrors (refreshed daily, or monthly for California). Any other state returnsstatus: "unsupported_state" on live keys — we never fabricate data we don’t have.
Texas Medical Board
Florida Department of Health (MQA)
Illinois IDFPR
Washington Department of Health
Colorado DORA
Connecticut DCP
Alabama Board of Medical Examiners
New York Office of the Professions
New York licenses do not “expire”; the triennial registration does. A currently registered licensee returns
status: "active"; a lapsed registration returns status: "expired". For physicians, disciplinary actions are published by the NYS Department of Health (OPMC) rather than the Office of the Professions, so enforcement flags on 060 (Medicine) records come from that separate source.
Pennsylvania Licensing System (PALS)
PALS lists every license a person holds (for example an expired training permit alongside an active MD license); we resolve to the active, highest-tier license. Licensee contact details returned by the state are never stored.
Ohio eLicense
Ohio’s top-level status is coarse (Active / Inactive / Closed); the informative detail is the sub-status (Expired, Lapsed, Suspended, Retired, …), which we normalize. eLicense Ohio states that the Joint Commission and NCQA accept its online status as primary-source verification. Address and alias data returned by the state are never stored.
Delaware Division of Professional Regulation (DPR)
Delaware publishes its whole licence database as open data, refreshed every morning. The licence file has a disciplinary column of its own, but it reads “no” on every row in the state including revoked licences, so we ignore it and join the state’s separate disciplinary register on the licence number instead. That distinction matters: several hundred Delaware licensees are currently active and carry a board action, which the licence file alone would have reported as clean. Delaware publishes no NPI, and no street address, email or phone appears in either dataset.
New Jersey Division of Consumer Affairs (DCA)
New Jersey publishes a roster download rather than requiring a per-name lookup, so the whole state is mirrored daily. The roster carries status and expiry but no disciplinary history column. We report a sanction where the state encodes one in the licence status itself, such as a suspension or a voluntary surrender, but a board action taken against a licence that is otherwise current will not appear. Roughly one row in seven is an application that never became a licence and carries no licence number; those are dropped rather than counted as licensees. New Jersey publishes no NPI. Address and email data in the roster is never stored.
Michigan LARA (MiPLUS)
Michigan publishes no bulk licensee file, so the portal is queried at verification time. Two limits are worth planning around. Michigan labels a license whose expiry has passed but which is still inside the renewal window as “Active - In Late Renewal”; we report that as expired, because the date has passed and practice is not authorized. And LARA publishes no NPI anywhere, so Michigan resolves on name alone. Discipline appears as current conditions such as probation or suspension, without the order narrative, which LARA issues separately in monthly disciplinary reports. Address data returned by the state is never stored.
California Department of Consumer Affairs (DCA)
The DCA files carry status and expiry but no disciplinary history, and the Speech-Language Pathology board’s public file is empty, so SLP is not yet covered in California. Discipline and SLP will follow via DCA’s iServices API. The Dental Board also issues sedation, anesthesia and oral surgery permits as separate records; those are endorsements a dentist holds on top of a license rather than licenses, so they are never returned as a verification on their own. No street address, email or phone is stored from any DCA file.
Massachusetts (MA)
Massachusetts is the first live state that publishes NPI, so a request carrying an NPI returns
high match confidence. The disciplinary flag is raised by any board or facility action, criminal conviction, or malpractice record, and the four categories are kept separately in the raw payload. Both names are matched loosely by the board’s search, so we require an exact surname before confirming anyone. Physicians only: the boards for the other professions were not reachable from our infrastructure.
Rhode Island (RI)
The detail page carries no per-licensee disciplinary record, only a link to the board’s published list, so the disciplinary flag is derived from the licence status alone (probation, restriction, suspension, surrender, revocation). A board action against an otherwise active licence will not surface. Names are matched by prefix at the source, so we require an exact surname before confirming anyone. No NPI.
District of Columbia (DC)
The disciplinary flag is raised by a public board order on the record or by a sanction status, and the order documents are kept in the raw payload. DC’s search matches both names loosely, so we require an exact surname and a confirmed given name; a nickname resolves only when it is contained in the registered name. No NPI.
Kansas (KS)
Both boards publish board actions, which raise the disciplinary flag. Physician profiles publish a cancellation date rather than an expiry date, and we surface that as the expiry. Speech-language pathology is licensed by a different department and is not covered. No NPI.
Vermont (VT)
The roster carries 35 distinct status strings and we map every one explicitly. A licence the board marks inoperable has no practice agreement behind it and is reported as inactive, not active. Sanctions (reprimand, conditions, surrender, suspension, revocation) are encoded in the status and raise the disciplinary flag; the roster’s notes column is not a discipline signal. Vermont’s psychology, social work, counselling and therapy professions are licensed by a separate office and are not covered. No NPI.
Wyoming (WY)
Physicians are not covered: the Board of Medicine’s lookup sits behind a web application firewall and we do not work around it. The rosters are hand-maintained spreadsheets, so their layout is validated on every run and the previous day’s data is kept if a sheet changes shape. The expired speech-language roster carries no discipline column. No NPI.
Idaho (ID)
The division publishes a discipline indicator per licence, which raises the flag for several hundred currently active licensees; suspension and revocation raise it too. Lapsed licences are reported as expired. Residents, interns and provisional licences are labelled as such. No NPI.
Mississippi (MS)
Physicians are not covered: the medical board’s free search is CAPTCHA-gated and its paid channels forbid resale. The psychology board is excluded because it publishes no licence status at all. Mississippi refreshes weekly rather than daily because no board offers a bulk download and each refresh is thousands of individual requests. No NPI.
Maryland (MD)
The physician roster lists current licensees only: an expired, suspended or revoked physician is absent from it rather than listed with that status, so a Maryland
not_found is not evidence that someone was never licensed. Probation is reported as active with the disciplinary flag raised. The source is monthly, so every certificate carries the as-of date. Physicians and allied health only; the behavioural-health boards are not yet covered. No NPI.
New Mexico (NM)
Both boards publish disciplinary records with case numbers, which we return. New Mexico uses revocation and suspension wording for an ordinary end-of-term administrative lapse; we report those as expired, not as sanctions. No NPI.
Louisiana (LA)
The physician roster is active licensees only, so a lapsed, suspended or revoked physician is absent rather than listed with that status: a Louisiana physician
not_found is not evidence of never being licensed. It carries no disciplinary column. Louisiana’s other boards publish no usable lookup, so the remaining six professions are not covered. No NPI.
Iowa (IA)
Nursing, pharmacy and emergency medical services are licensed on separate systems and are not covered, so an Iowa result speaks only to the professions listed. Iowa records a relinquished licence as the ordinary way a physician licence ends and we do not treat it as a sanction. The Board of Medicine caps a name search, so we narrow by given name and status when the cap is hit. No NPI.
Arkansas (AR)
Social work and physical therapy are not covered: those lookups sit behind a blocked host and an image challenge. Counselling and marriage & family therapy are excluded because that board’s register has not been updated since 2023, and publishing it would report long-expired licences as active. The medical and psychology boards publish a disciplinary signal; the speech board’s discipline column reads clear even on revoked licensees, so we declare no signal there rather than imply a clean record. No NPI.
Kentucky (KY)
Social work and physical therapy are not covered: both searches require a challenge we do not attempt. The physician application holds current credentials only, so a lapsed Kentucky physician is absent rather than returned as expired. Kentucky marks some licensees active but not practising or not eligible to practise; we report those as inactive, because the board is saying the holder may not practise. Disciplined physicians can still read as active on the board’s own status, so the board-action field is what we use. No NPI.
West Virginia (WV)
Physicians are not covered, and not because of any restriction on us: both West Virginia medical board lookups resolve to an address that answers on no port from any resolver we tried, so they are unavailable to everyone. Physical therapy and speech-language pathology sit behind a firewall and a challenge respectively. Where a board publishes no disciplinary signal we say so rather than implying a clean record. Licences marked active but non-practising are reported as inactive. No NPI.
Oklahoma (OK)
Two professions only. Physicians, physical therapy and occupational therapy sit with the state medical board, whose published policy asks that its search not be harvested; we respect that and do not query it, so those professions are not covered and will not be. Counselling, MFT and social work are behind a firewall. The psychology board publishes real case references, which we return, and publishes no expiry date. The speech board publishes no disciplinary signal and sanctioned licensees leave its register, so we declare no signal rather than a clean record. No NPI.
What happens when a source is down
Government websites experience downtime — planned maintenance, traffic spikes, infrastructure migrations. VeriflowAPI is architected to handle this gracefully. When a source is unavailable during a request:- VeriflowAPI serves the most recent cached data for that source
- The response includes
"source_live": falseand"cached": true - The
cache_expires_atfield tells you when fresh data will next be fetched - Our monitoring system detects the outage and begins retry attempts automatically
status: "source_unavailable" with verified: false, which is deliberately distinct from not_found. not_found means the board answered and holds no matching record; source_unavailable means we could not ask it. Treat the first as an exception to investigate and the second as a retry. The federal signals in the same response (NPPES identity and OIG exclusion) are still valid.
This approach ensures our 99.9% uptime SLA holds even when individual government sites experience extended downtime.
You can always check current source availability at veriflowapi.com/status.