Short answer
An NPI record holds two addresses and CMS discloses both. The mailing address can be any address that receives your mail, including a box. The location address answers where you practice, and since April 3, 2024 it can be a post office box or a private mailbox only when the NPI is entity type code 1 and the provider has no physical location other than their home.
Key takeaways
- The application shows two address boxes, and they answer different questions. Mixing them up puts a home address on a provider lookup page, and the two fields sit close enough together to make that easy.
- Both addresses are disclosed. CMS publishes them through a lookup site and through a file that anyone can download.
- A 2024 notice opened the location field to a post office box or a private mailbox, but only for entity type code 1 and only when there is no physical location other than the provider's home.
- Entity type 2, the organization NPI, was left outside that sentence. A solo practice that files under a company can hold both types, and the location field on the organization record still cannot take that box.
- Medicare enrollment is a separate record with separate address rules. Correcting one does not correct the other.
Who this is for
- Solo clinicians who see patients only by telehealth and file from a home office
- Therapists, counselors, and other licensed professionals opening a private practice
- Anyone who found their home address on a provider lookup page and wants to know which field put it there
Two boxes go into one published record
Applying for a National Provider Identifier means filling in two addresses. The screen labels one the practice location and the other the mailing address, and the pair reads like a formality. It is not. The two fields ask different questions, and the record that comes out of them is published.
The official names are worth copying down before anything else, because the screen label and the data element are spelled differently. The system behind the application is the National Plan and Provider Enumeration System, or NPPES, and the notice the Centers for Medicare and Medicaid Services published in 2024 renames the location element only, in two lines: the provider first line location address and the provider second line location address. The monthly file is where both addresses sit next to each other, as Provider First Line Business Practice Location Address and Provider First Line Business Mailing Address. When a payer, a credentialing packet, or a directory asks about the address on your NPI, the first useful question is which of the two it means.
| Location address | Mailing address | |
|---|---|---|
| What the field asks | Where you practice | Where your mail should go |
| Name in the monthly file | Provider First Line Business Practice Location Address | Provider First Line Business Mailing Address |
| Post office box or private mailbox | Only when the NPI is entity type code 1 and there is no physical location other than the provider's home | Accepted |
| Disclosed by CMS | Yes | Yes |
Screen labels on the left, with the column names the monthly file uses for the same two addresses. The box rule comes from the March 4, 2024 notice and from the current application form.
Both fields are public, and the file is the version that lasts
Disclosure here is not an accident or a leak. It is the design. The NPI final rule requires the enumeration system to disseminate data in response to approved requests, and CMS followed that rule with a notice in the Federal Register of May 30, 2007 at 72 FR 30011, setting out the dissemination strategy. That notice carried a list of the data elements CMS determined are required to be disclosed under the Freedom of Information Act, at 72 FR 30012. The 2024 notice discussed below cites both of those pages in its background section, and it states separately that the changes to these elements do not affect the assessment of what is releasable under FOIA.
Public takes two shapes, and the second one is the one people underestimate. The first is a lookup page where anyone can search a single provider and read the record. The second is a full file that CMS publishes for download every month, one row per NPI, with the location columns and the mailing columns side by side. A lookup page reveals your address to someone who is already looking for you. A monthly file puts your address into a spreadsheet that gets copied, merged, resold, and mirrored by sites you will never contact.
That difference decides how durable the exposure is. A directory entry can be corrected. A copy of last month's file cannot be recalled, and the mirrors keep what they downloaded.
Why the field matters more than the filing
Nothing in this process is a mistake you can undo by asking. The addresses you type are the addresses CMS is required to disclose, so the decision that matters happens at the keyboard, before the record exists.
What changed on April 3, 2024
On March 4, 2024, CMS published a notice in the Federal Register, document CMS-0059-N, amending the description of the location address elements. The notice says the system would be updated thirty days after publication, and its own dates line reads that the notice is applicable on April 3, 2024.
The operative sentence is narrow, and the exact wording carries two conditions and an example rather than one blanket permission. This is the description CMS assigned to the location address element:
Federal Register, March 4, 2024 (CMS-0059-N)
"This address can only include the USPS post office box location or personal mailbox offered by a private delivery service if the provider's NPI is Entity type code = 1 and the provider does not have a physical location other than their home address (for example, a provider that exclusively provides telehealth services from their home)."
- The NPI has to be entity type code 1, which is the individual provider record.
- The provider must have no physical location other than their home address, so a clinician who also works a day a week out of a clinic does not qualify on that record.
- CMS added an example rather than a third condition: a provider who exclusively provides telehealth services from their home, which is the case the sentence was written around.
Ready to set up your business address?
See which US cities fit — about a minute, no card needed.
Entity type 1 and entity type 2 read the same sentence differently
The exception is attached to a code, not to a person, and that is where solo practices get caught. An NPI is either entity type code 1, the individual provider, or entity type code 2, the organization. A therapist who forms a professional company and bills under it can end up holding both, one for themselves and one for the company.
The sentence CMS wrote covers only the first of those, and the application form says so in plainer words. The form notes that the location address can include a post office box only for individual providers who have no physical location other than their home. On the organization record the field keeps its original meaning, so the privacy question has to be answered somewhere other than that field. Two records, one practice, and the same screen gives two different answers.
So the first thing to settle is not which address to use. It is which record you are editing.
What a thousand records look like
The rule tells you what is allowed. It does not tell you what providers actually do with the two fields, and that gap is easy to close because the registry answers questions in public. We pulled five queries through the public NPI Registry API on September 14, 2026: two hundred individual records from a Los Angeles, California query, and two hundred each from four state queries limited to a counselor classification in Montana, Wyoming, Vermont, and Maine.
Every record in both samples carried a location address and a mailing address, and the registry returned both. That is not a quirk of the sample. Both elements appear on the list of data CMS determined must be disclosed under FOIA, published with the 2007 dissemination notice, so neither field is the private one.
About half of the providers had already put different addresses in the two fields, which means the separation is not theoretical. People use it. The 2024 opening, on the other hand, is barely used at all: five records out of a thousand had a box in the location field, while one hundred thirty eight had one in the mailing field.
1,000
individual records sampled
200 in Los Angeles CA, 800 counselors in MT, WY, VT, ME
100%
returned both addresses
location and mailing, in every record we read
51%
used two different addresses
512 of 1,000 records
0.5%
had a box in the location field
5 of 1,000, none in the Los Angeles sample
What this sample is and is not
These are the first records the registry returned for each query, not a random draw, and they were read on one day. We counted a box when the first line of the location address began with a post office box or private mailbox marker. They are enough to show that both fields come back populated and public in every record we read, and enough to show that the 2024 route is rare in what we read. They are not a national rate.
The mailing field is the one that moves
Of the two addresses in your published record, the mailing address is the one that does not ask anything about where you work. It asks where your mail should go, and an address you rent for that purpose answers it honestly. The application form even tells you not to report a residential address there unless it is also your business mailing address. If your home address sits in both fields today, changing this one removes half of that exposure from the file that ships next.
It is a half fix, and the half it fixes is the half that moves. The other address is still there and still says where you are. What changes is the line CMS and payers write to, and the record can be updated at any time rather than at a renewal date.
If you are choosing an address for that field, the question to ask about it is not whether it looks professional. It is how the address is classified, because the same address can be fine in a mailing field and wrong in a field that asks for a physical location. Our free Address Checker exists to make that classification visible before you type it into a form.
The location field is not a mail problem
The location address is where honesty costs something. The field asks where care is delivered, and a mailing address is not an answer to that question. Renting a nicer address does not change where your patients meet you, and the field is not asking to be impressed.
There is one route out, and it is the 2024 sentence quoted above rather than a product. If your NPI is entity type code 1 and your home is the only physical location you have, the description CMS assigned to that element permits a post office box or a personal mailbox offered by a private delivery service. One caution about that wording, and it runs against our own interest: the current application form names only the post office box in its note on that field, not the private mailbox the notice also lists. If you also practice somewhere else, or if you are editing an organization record, neither version of the permission reaches you.
Read any vendor claim about this field against that sentence. A service can give you an address. It cannot give you an entity type code, and it cannot make a second practice location disappear.
Medicare enrollment is a different record
One correction that saves a lot of wasted effort: the NPI record is not the Medicare enrollment record. They are separate systems with separate address requirements, and a clean NPPES entry does not carry over.
Medicare enrollment runs on its own forms, and those forms print the difference. The practice location line on the physician enrollment application is labeled street name and number, not a post office box, while the correspondence mailing line on the same form accepts one. Federal rules back that up by reserving the right to verify enrollment information with an onsite review. If you are enrolling as well as enumerating, treat them as two forms that happen to ask similar-looking questions, and check each one against its own rule.
Frequently Asked Questions
Sources & References
Primary sources this guide is based on.
- 1U.S. Government Publishing Office, Federal Register · National Plan and Provider Enumeration System (NPPES) Data Changes, CMS-0059-N, 89 FR 15581 (March 4, 2024) (accessed September 14, 2026)
- 2Centers for Medicare and Medicaid Services · Data Dissemination, National Provider Identifier files and the data CMS discloses (accessed September 14, 2026)
- 3Centers for Medicare and Medicaid Services · NPI Files, monthly NPPES data dissemination downloads (accessed September 14, 2026)
- 4Centers for Medicare and Medicaid Services · NPI Application and Update Form, CMS-10114 (Rev. 02/25), address field instructions (accessed September 14, 2026)
- 5Centers for Medicare and Medicaid Services · Medicare Enrollment Application for Physicians and Non-Physician Practitioners, CMS-855I (accessed September 14, 2026)
- 6U.S. Government Publishing Office, Federal Register · HIPAA Administrative Simplification: NPPES Data Dissemination, CMS-6060-N, 72 FR 30011 (May 30, 2007) (accessed September 14, 2026)
- 7Centers for Medicare and Medicaid Services · NPI Registry public search and API (accessed September 14, 2026)
Not sure what you need?
Two short pages sort it out — what the products actually are, and which situation you're in.
save office
Published
I'm Henry, a hedgehog in a bow tie who explains the dull, scary parts of building and running a U.S. business.
