Where US licence data comes from: a state-by-state map

The three ways a state publishes licence data

Every US licensing board holds the same core record: a person, a licence number, a type, a status, an issue date, an expiry date, and usually some indicator of discipline. How that record reaches the public falls into three shapes, and the shape decides how fresh and how reliable a downstream verification can be.

1. A free bulk file

The best case is a whole-database export on a schedule. Delaware puts its entire Division of Professional Regulation database on Socrata (data.delaware.gov, dataset pjnv-eaih): 353,352 rows, every profession, refreshed each morning. Illinois, Washington, Colorado and Connecticut do the same on their own Socrata portals. Vermont does it for physicians only (25,794 rows on vtmbl-reporting.data.socrata.com). A federated catalogue search across the 23 least-requested states found licensee datasets on exactly two Socrata domains, Delaware's and Vermont's; Nevada, West Virginia, Kansas, South Dakota, Wyoming, North Dakota, Arkansas, Oklahoma, Alaska and DC have no Socrata portal at all.

Bulk also arrives in less tidy containers. Maryland's Board of Physicians publishes CSVs on the 1st of each month with seven preamble lines before the header. Louisiana's medical board publishes a 1,265-page PDF every month. New Hampshire publishes a 13 MB .xlsx whose filename carries its as-of date. New Jersey's roster is a pipe-delimited text file generated on demand behind a confirmation screen that charges $0.00. Wyoming's small boards publish Google Sheets. Each of these is a real, free, complete file, and each needs its own parser.

A bulk file makes verification fast and lets you see the whole population, but it is only as fresh as the state's publication schedule, which ranges from every morning (Delaware) to roughly quarterly with an eight-month gap observed (New Hampshire). A mirror must carry the file's as-of date, or a licence revoked after the last export reads as active.

2. A live lookup portal

Most states publish no file and offer a search form instead. What the form runs on matters more than what it looks like: an ASP.NET WebForms application (Texas, Oregon's medical board, Maine), an Accela portal (Michigan), a Salesforce community (Ohio, Missouri, DC, New Mexico), a MyLicense/Versa instance (Rhode Island, Kansas, Nebraska), or a JavaScript search application (Pennsylvania, New York, Massachusetts physicians, Louisiana psychologists). A live lookup is as fresh as the board's own database, often same-day, but every check is a round trip to a server you do not control, the result may be capped or prefix-matched, and a board can turn on bot defence overnight without notice.

3. Nothing usable

The third shape is a search form behind an interactive CAPTCHA or a web application firewall, with either no bulk product or one that arrives by post. Arizona's every board sits behind Cloudflare, an AWS WAF CAPTCHA or an Azure gateway 403, and the one purchasable file is a CD-ROM. South Carolina has CAPTCHA-gated all 46 of its boards continuously for more than a decade. Georgia's Secretary of State roster is, by the state's own description, a $3,000 CD paid by cheque. For a verification product that does not solve CAPTCHAs or evade firewalls, these states are not slow; they are unavailable, and the only honest routes are a public-records request, a data agreement, or a sanctioned API key from the vendor.

The platform effect: the vendor decides, not the profession

An easy assumption is that physician data is open because medical boards are large and well funded, and behavioural-health data is closed because counselling boards are small. The evidence does not follow profession lines. It follows which software vendor each board consolidated onto, which is a procurement accident.

Oregon and Mississippi are exact inverses. In Oregon the medical board runs an in-house ASP.NET lookup that is open, returns board actions with linked order PDFs, and describes itself as a primary source per Joint Commission and NCQA standards; the six psychology, counselling, social work, PT, OT and SLP boards all moved to Thentia Cloud, and every one of their tenants returns an AWS WAF Human Verification page. In Mississippi the medical board is the one with reCAPTCHA v2 on its search, while the psychology, counselling, social work and MFT, PT, and health department OT/SLP registers all run on in-house or state-IT software and are wide open, updated daily. South Carolina blocks both equally with one shared control.

What each platform typically means, from the states where it was confirmed:

One methodological trap is worth stating because it produced a wrong conclusion once. Thentia's WAF answers any subdomain of portalus.thentiacloud.net with the byte-identical Human Verification page, including a made-up control name that does not exist. Finding that <state>.portalus.thentiacloud.net is WAF-blocked therefore proves nothing about whether the state uses Thentia. Tenancy has to be confirmed from the board's own site linking to the tenant, which is how the Oregon finding stands and why a Thentia hit for South Carolina turned out to be a false positive (its real lookup is an in-house application).

State by state: physicians, behavioural health, access

The behavioural-health column covers psychology, clinical social work, professional counselling, marriage and family therapy, and, where the state groups them the same way, physical therapy, occupational therapy and speech-language pathology. States marked verified by us are the fourteen VeriflowAPI verifies today; their rows describe the same public source we use, which is also simply what the state publishes.

Network caveat: the research sandbox could not resolve or connect to several state hosts (all of wi.gov, the small North Dakota, South Dakota and West Virginia board domains, nebraska.gov, in.gov, and the Massachusetts and South Carolina MyLicense and LLR hosts). Those are recorded as unverified, never as blocked, because a connection that never left our network says nothing about the state.

Case studies: what the files actually do

What primary source verification actually means here

Primary source verification means reading the credential from the body that issued it. Several boards say so in their own words: Illinois IDFPR and eLicense Ohio cite Joint Commission and NCQA acceptance; the Oregon Medical Board's detail page states it is a primary source consistent with those standards; Virginia's DHP says its lookup data serves as primary source verification of the credential; the Maryland OARS boards, the Mississippi psychology and counselling boards, the North Carolina social work board and even Wyoming's psychology spreadsheet make the same claim. A mirror of a board's own published file, stamped with the file's as-of date, is a copy of the primary source at a known time. A vendor's mirror of somebody else's mirror is not.

Freshness is the second half. The same board can expose the same data at very different ages: Utah's public lookup prints Information Current as of the previous day, so a purchased file is no staler than the state's own search; Maryland's physician CSV was dated 1 August on 7 September while its allied-health CSV was dated 1 September; Georgia's file is as old as your last $500. A third-party physician mirror that is free and open in Georgia turns out to be an extract dated 1 May 2019 on every record. Any verification record should carry the date the source was read, and any file mirror should carry the date the file was generated.

The third half is absence. Alabama's roster, Georgia's self-serve roster, Mississippi's $300 roster, Louisiana's monthly PDF, New Hampshire's spreadsheet and Maryland's physician CSV all publish current licensees only. New Hampshire's file has zero Expired, zero Lapsed, zero Revoked rows, while the office's own status definitions describe all three. Virginia's lookup excludes anything that expired before 2000. In every one of these sources a revoked clinician is not marked revoked; they vanish. Absence from a current-licensees roster must be read as not found, never as not licensed and never as no discipline.

Commercial-use restrictions a builder must read

Several open or purchasable sources carry terms that a commercial user should read before building on them. These are reported as text to check, not as legal advice.

• Georgia Composite Medical Board data file: no part of the data will be distributed in any form or by any means for the purpose of resale; any other use constitutes unlawful usage. The North Carolina Medical Board's $150 roster and the Mississippi medical board's $300 roster use materially the same clause.
• Mississippi medical board $500-per-year profile licence: for internal credentials verification only; use on a website or web application of any kind is strictly prohibited. The state's Public Records Act process is the route without a contractual clause.
• Maryland Board of Physicians Practitioner Profile System disclaimer: commercial use of this information is not appropriate. The monthly rosters are published under a Public Information Act framing instead; whether that separates the two is a question for counsel.
• Oregon Medical Board terms of service: the service is for personal and non-commercial use, and users may not copy, distribute, publish or sell information obtained from it. The same pages invite bulk-data enquiries by email, which is the route to a written exception.
• Virginia DHP lookup banner: Not For Commercial Use, with volume limits and a $95 per user per year subscription for regular or high-volume verification. Whether that subscription permits programmatic access is not published.
• AIM DocFinder (a free third-party physician mirror for several states): intended for non-commercial use of the general public only; commercial users may be blocked.
• Oklahoma medical board: the search is not intended for mass harvesting and data mining results in IP blocking.
• South Carolina licensee lists: a signed certification under Code section 30-2-50 that the records will not be used for commercial solicitation, with a misdemeanour penalty. The statute targets solicitation, and the form has an Other box, but it must be signed once per board.
• Louisiana social work board: robots.txt is Disallow: / on the whole site. A crawl directive rather than a contract, and worth a written permission before automating.

None of the Socrata states, Delaware, New Jersey, Maine, Kansas, Rhode Island, DC or the open Maryland and Mississippi boards were found to publish any restriction on automated access in the pages retrieved. That is different from a board having sanctioned it.

Using this page

If you are building or buying licence verification, the table above tells you which states can be automated at all, which need a purchase order, and which need a phone call. What VeriflowAPI verifies today, board by board, is on the coverage page; the live health of each of those sources is on the status page. If a state here matters to you and is not there yet, the research is the reason, and the homepage has the contact.