How to Update the Authorized Official on Your NPI Record?

First, Figure Out Which “Authorized Official” You’re Actually Changing

This trips up almost everyone, so let’s clear it up right away. There’s the Authorized Official field inside your Type 2 NPI record in NPPES. This is just data. A name, a title, a phone number, displayed on the record. Updating it is a quick online edit, and it doesn’t require the old AO to do anything. Then there’s the Authorized Official role inside the CMS Identity and Access (I&A) system. This is the actual legal access, the person who can log in and act on behalf of the organization. Changing who holds this role is a different process entirely, and it’s the one people usually need when someone has left the organization for good. One more thing worth knowing up front: Authorized Officials only exist for Type 2 (organization) NPIs. If you’re an individual provider with a Type 1 NPI, there’s no AO to swap out. You’re the sole signatory on your own record, full stop. Here’s the quick comparison before you dive into either process:

• System involved: NPPES (for updating the AO name) vs. I&A, with EUS for the final step (for changing AO authority)
• Documentation needed: None (AO name update) vs. EIN proof, CP 575 or Letter 147C, unless already approved in PECOS (AO authority change)
• Old AO’s cooperation required: No, for either process
• Typical time: About 10 to 15 minutes (AO name update) vs. varies, depending on IRS document turnaround and approval (AO authority change)
• Best for: The record just shows the wrong name or number (AO name update) vs. the old AO is gone and someone else needs actual signing authority (AO authority change)

Updating the AO Name Shown on the Record (The Quick Fix)

If your login access is fine and you just need the record itself to show the correct name, title, and phone number, this takes about ten or fifteen minutes.

1. Log into NPPES with your I&A credentials, MFA and all.
2. Go to Manage NPIs, then select Manage on the Type 2 NPI in question.
3. Click Edit, then navigate to the Organizational Provider Profile page using the left-hand menu. That’s where the Authorized Official section actually lives. It’s not on the Contact Information page, and people look there constantly.
4. Fill in the new AO’s legal first name, last name, title, and phone number. All required. Prefix, middle name, suffix, and credentials are optional if you want to include them.
5. Continue to the Submission page and check the Certification Statement box. The Submit button won’t activate until you do.
6. Submit, and save the confirmation with its tracking number. Screenshot it or print it. Payers sometimes ask when a change was made, and having that proof on hand saves you a headache later.

No documents to upload for this step. No IRS paperwork. Just the edit itself.

Changing Who Actually Holds AO Authority (When the Old AO Is Gone)

This is the scenario that usually brings people here in the first place. Someone was the AO, they’ve moved on, and now you need to be the one with legal signing authority in the system, not just the name on a form. Here’s how CMS designed this to work, and it’s worth saying plainly: you do not need the old AO’s cooperation for any of it.

1. The new AO (that’s you) registers for an I&A account if you don’t already have one. The “Create or Manage an Account” option on the NPPES login page routes you there.
2. From your I&A profile, add the organization as an employer and select the Authorized Official role, checking the attestation box that goes with it. The I&A Quick Reference Guide walks through this step by step if you want the full detail.
3. Get approved. If you’re already listed as an AO or Access Manager on an approved Medicare enrollment for the organization in PECOS, approval happens automatically. If not, you’ll need to submit IRS documentation to prove the organization’s EIN, most commonly the CP 575 confirmation letter the IRS sends when an EIN is first assigned.
4. Lost your CP 575? The IRS won’t reissue the original, but they’ll send a Letter 147C instead, which works just as well. Call the IRS Business and Specialty Tax Line to request it.
5. Once you’re approved, get the old AO disassociated. Contact CMS External User Services (EUS) and give them the organization’s EIN and NPI. That’s it.

Per CMS’s own guidance, EUS will remove the old AO based on that information alone, even if you’ve never had I&A access before and aren’t currently associated with the organization in the system. You genuinely don’t need anyone’s permission or password to make this happen. A worth-knowing nuance: holding the AO or Access Manager role in I&A doesn’t automatically hand you signing authority on Medicare enrollment applications. Per NGS Medicare guidance, that authority only exists if you’re also identified in the individual control section of the actual PECOS enrollment record. So the I&A role governs system access, while PECOS enrollment governs who can actually sign. If you’re relying on an approved PECOS enrollment for automatic approval, note that access can take up to three hours to propagate through the system after that approval goes through.

A Few Things That Catch People Off Guard

A handful of situations show up again and again with this process, so it’s worth flagging them before you run into one.

1. Can’t log in at all. If it’s a forgotten password or username rather than an AO issue, that’s a separate fix through the “Forgot User ID or Password” link on the NPPES login page, which routes through I&A. Three failed login attempts locks the account, and self-service won’t unlock it. You’ll need to call the NPI Enumerator directly. The NPPES FAQ page covers most of these login scenarios if you want to check something before calling.
2. Can log in, but the NPI isn’t showing up. That’s an access permissions issue rather than a login problem. Someone with existing access, an AO or Access Manager, needs to grant you visibility into that NPI.
3. Need to demote an AO. You can’t do this from within I&A. Roles only move upward, from Staff End User to Access Manager to AO. If someone needs to step down to a lesser role, EUS has to disassociate them first, and then they get re-added at the correct level. There’s no self-service downgrade button.

Update Within 30 Days, and Don’t Stop at NPPES

Federal regulation 45 CFR 162.410(a)(4) requires reporting changes to your NPI record within 30 days of the change taking effect. Stale AO information is also a quiet but common source of claim denials and enrollment delays down the line, so this isn’t just paperwork housekeeping. One more thing worth remembering: updating NPPES doesn’t automatically update anything else. Medicare, Medicaid, your commercial payers, and your PECOS Medicare enrollment all need to be updated separately. NPPES is the source record, but it doesn’t push changes anywhere on its own. If you want to avoid ever going through this scramble again, register a second Authorized Official or Access Manager for the organization now, while things are calm. Set up a backup MFA method too. One person leaving shouldn’t be able to lock an entire organization out of its own NPI record, and a little redundancy up front means it never will.

Who to Call When You’re Stuck

Two different help desks handle two different problems, and knowing which one to call saves time.

• NPI Enumerator - Handles record content, locked accounts, and paper form requests. Phone: 1-800-465-3203, TTY 1-800-692-2326 (Mon-Fri, 9 a.m.-5 p.m. ET). Email: customerservice@npienumerator.com. Mailing address: NPI Enumerator, 7125 Ambassador Rd., Ste. 100, Windsor Mill, MD 21244-2751.
• CMS External User Services (EUS) - Handles I&A accounts, roles, and disassociating an Authorized Official. Phone: 1-866-484-8049, TTY 1-866-523-4759. Email: EUSSupport@cgi.com. Mailing address: External User Services (EUS) Help Desk, PO Box 792750, San Antonio, TX 78279.

If you’d rather go the paper route for any reason, the CMS-10114 NPI Application/Update Form (current Rev. 02/25, OMB No. 0938-0931, expires 03/2028) is available directly from CMS. Record content and login lockouts go to the Enumerator. Access and authority questions go to EUS. Once you know that split, the rest of the process is pretty straightforward.