How to Find Physicians by Specialty and State (NPI Registry Guide)

By the getdork team — Published June 12, 2026

Why the NPI registry is the right source

The National Provider Identifier (NPI) registry is a federal database maintained by CMS (Centers for Medicare & Medicaid Services) and updated continuously as providers register, move, or retire. Every licensed healthcare provider in the U.S. who bills insurance is required to have an NPI, which means coverage is nearly complete across physicians, nurse practitioners, physician assistants, physical therapists, and dozens of other provider types.

For sales, recruiting, or research purposes, it has several advantages over commercial physician databases: it is free, it is public (no license required), its data comes directly from providers at registration, and it is the same underlying source that many paid healthcare data services resell at a markup. Understanding how to query it directly saves cost and gives you access to the most current records.

For background on what an NPI number is and what data each record contains, see What is an NPI number and what can you look up?

taxonomy_description values for common specialties

The API performs a partial prefix match on taxonomy_description. A value of Cardiology matches both Cardiology and Interventional Cardiology. If you want only the more specific subspecialty, pass the full string: Interventional Cardiology. For the complete list of taxonomy values used in getdork's physician search, see the source at How to search the NPI registry.

Query structure and parameters

The NPI Registry API endpoint is:

https://npiregistry.cms.hhs.gov/api/

A specialty-and-state query looks like this:

# Cardiologists in Texas (individual providers, first 200 results)
https://npiregistry.cms.hhs.gov/api/?version=2.1
  &taxonomy_description=Cardiology
  &state=TX
  &enumeration_type=NPI-1
  &limit=200
  &skip=0

Step-by-step workflow

1. Choose your specialty. Pick the taxonomy_description value from the table above. If you are unsure of the exact string, test with a broader term first (e.g., Surgery) to see what subspecialties it matches, then narrow to the exact variant you need.
2. Identify your target states. List the two-letter state codes for every state in your territory or campaign. The NPI registry uses standard USPS abbreviations: CA, TX, NY, FL, IL, and so on.
3. Run the first request. Use the URL structure above with limit=200&skip=0. Read result_count from the response to know how many pages you need.
4. Page through results. Increment skip by 200 until you have retrieved all records. For large specialties in large states (e.g., Family Medicine in California), this may be 20–30 requests.
5. Extract the fields you need. From each record, pull basic.first_name, basic.last_name, addresses[practice location].address_1, addresses[practice location].city, addresses[practice location].state, addresses[practice location].postal_code, and addresses[practice location].telephone_number.
6. Export to CSV or your CRM. De-duplicate on the number field (the NPI number) before merging records from multiple queries. A provider registered in two states has one NPI number.

Building multi-state outreach lists

For multi-state sales or recruiting campaigns, the workflow is the same query repeated per state. A few practical points:

• De-duplicate on NPI number, not name. Some providers have offices in multiple states. Their NPI number is unique; their name is not. Using NPI as your primary key prevents double-outreach to the same person.
• Practice location vs. mailing address. Each NPI record contains two address slots. Use the practice location address for outreach — this is where the provider sees patients. The mailing address may be a billing service or legal agent.
• Active status. Filter on basic.status=A (active) to exclude deactivated or decommissioned NPI records. Inactive providers remain in the registry but are marked accordingly.
• Verify before calling. NPI data reflects what the provider submitted at registration. Phone numbers and addresses change. Use the list as a starting point and verify high-value contacts before a campaign.

Known limitations of the NPI registry

• No email addresses. The NPI registry does not collect or publish email addresses. Phone numbers and practice addresses are present when submitted by the provider.
• Self-reported data. All information is submitted by the provider or their authorized representative at registration. Address and phone accuracy depends on whether the provider keeps their record current.
• No private-practice vs. employed distinction. The registry does not distinguish between independent practitioners and those employed by a health system. A cardiologist at a large hospital group and one in a solo private practice both appear with their practice address.
• Taxonomy filters by primary taxonomy only. The API's taxonomy_description filter matches against the provider's listed taxonomy records, but providers can have multiple taxonomies. Filtering on Cardiology will include general internists who also listed a cardiology subspecialty.

For a walkthrough of the full search interface including zip-code radius search, see How to find cardiologists by zip code.

Frequently asked questions

Related guides

• How to search the NPI registry (free guide) — complete walkthrough of all NPI search parameters and what each field returns.
• How to find cardiologists by zip code — geographic radius search using the NPI registry.
• What is an NPI number and what can you look up? — background on the identifier and what data is in each record.
• OSINT for B2B sales: a practical playbook — broader prospecting workflow that includes NPI data alongside other public sources.