5 Free US Health Data Sources Every Developer Should Know
A practical guide to the best public health data APIs and datasets: openFDA, CDC SODA, CMS Provider Data, NPI Registry, and NIH Reporter.
The five sources that matter
Most US health data applications pull from the same five government sources. Each has a different access method, update frequency, and data structure. Knowing which one to query for what saves hours of searching.
| Source | Best for | Access | Format |
|---|---|---|---|
| openFDA | Drug safety, recalls, labels | REST API | JSON |
| CDC (data.cdc.gov) | Disease surveillance, mortality | SODA API | JSON/CSV |
| CMS (data.cms.gov) | Hospitals, providers, pricing | Bulk CSV + API | CSV/JSON |
| NPI Registry | Provider identification | REST API | JSON |
| NIH Reporter | Research grants, funding | REST API | JSON |
1. openFDA (api.fda.gov)
What it covers: Drug adverse events (FAERS), drug labeling, recall/enforcement reports, NDC directory, drug approvals, medical device events, and food recalls.
Access method: Free REST API, no registration required.
Rate limits: 240 requests/minute, 120K requests/day.
Best features:
- Counting endpoint for instant aggregations
- Full-text search across labeling
- Bulk download files for large-scale analysis
Biggest limitation: Quarterly update cycle for adverse events means data is 1-3 months behind. No real-time streaming.
# Count adverse events for a drug by reaction type
curl "https://api.fda.gov/drug/event.json?search=patient.drug.openfda.brand_name:\"Eliquis\"&count=patient.reaction.reactionmeddrapt.exact&limit=5"
2. CDC SODA API (data.cdc.gov)
What it covers: COVID-19 surveillance, vaccination data, chronic disease indicators, NHANES survey data, BRFSS behavioral risk data, STI surveillance, and select mortality datasets.
Access method: SODA (Socrata Open Data Access) API. Free app tokens available for higher rate limits.
Rate limits: 1,000 requests/hour without token.
Best features:
- SQL-like query syntax (SoQL)
- Geospatial queries for location-based data
- Automatic API documentation per dataset
Biggest limitation: Not all CDC data is on this platform. Flagship datasets like detailed mortality statistics still require CDC WONDER's web interface.
# COVID-19 deaths by state, most recent week
curl "https://data.cdc.gov/resource/r8kw-7aab.json?\$limit=10&\$order=end_date DESC"
3. CMS Provider Data (data.cms.gov)
What it covers: Hospital quality metrics, physician compare, nursing home ratings, home health ratings, Medicare spending, drug pricing (NADAC, ASP), and Part D prescribing patterns.
Access method: Mixed. Some datasets have SODA API endpoints. Many are bulk CSV downloads only.
Update frequency: Varies by dataset (quarterly for quality metrics, monthly for pricing).
Best features:
- Hospital star ratings in structured format
- Drug pricing data at NDC level
- Geographic Provider Performance files for market analysis
Biggest limitation: Inconsistent access patterns. Some datasets are API-accessible, others require downloading multi-GB CSV files and parsing locally.
# Hospital general information (has star ratings)
curl "https://data.cms.gov/provider-data/api/1/datastore/query/xubh-q36u/0?limit=5"
4. NPI Registry (npiregistry.cms.hhs.gov)
What it covers: Every healthcare provider in the US. The National Provider Identifier (NPI) is the unique 10-digit number assigned to individual providers and organizations.
Access method: Free REST API with NPPES (National Plan and Provider Enumeration System).
Rate limits: Not officially documented, but approximately 1,200 requests per 5-minute window.
Best features:
- Real-time data (providers update their own records)
- Search by name, location, specialty, or NPI number
- Bulk download file updated monthly (7M+ records)
Biggest limitation: Provider data is self-reported and often stale. Address and specialty information may be years out of date.
# Search for cardiologists in San Francisco
curl "https://npiregistry.cms.hhs.gov/api/?version=2.1&taxonomy_description=Cardiovascular+Disease&city=San+Francisco&state=CA&limit=10"
5. NIH Reporter (reporter.nih.gov)
What it covers: All NIH-funded research grants, projects, publications, patents, and clinical trials. Covers $40B+ in annual research funding.
Access method: REST API (v2) with JSON payloads.
Rate limits: 150 requests per minute.
Best features:
- Full project abstracts and specific aims
- Publication links for each funded project
- Spending data by institution, state, and research area
Biggest limitation: Only covers NIH funding. NSF, DOD, VA, and private foundation research is not included.
# Search for Alzheimer's research funded in 2026
curl -X POST "https://api.reporter.nih.gov/v2/projects/search" \
-H "Content-Type: application/json" \
-d '{"criteria":{"advanced_text":"alzheimer","fiscal_years":[2026]},"limit":5}'
Choosing the right source for your use case
| Use case | Primary source | Secondary |
|---|---|---|
| Drug safety monitoring | openFDA (FAERS) | FDA MedWatch |
| Provider lookup/directory | NPI Registry | CMS Physician Compare |
| Hospital quality comparison | CMS Provider Data | Leapfrog (private) |
| Disease surveillance | CDC SODA | state health departments |
| Drug pricing | CMS (NADAC/ASP) | GoodRx API (private) |
| Research landscape mapping | NIH Reporter | PubMed |
| Drug-drug interactions | DailyMed (NLM) | openFDA labels |
The interoperability problem
Each source uses different identifiers:
- openFDA identifies drugs by NDC, application number, or generic name
- CMS identifies providers by NPI and hospitals by CMS Certification Number
- CDC uses FIPS codes for geography and ICD-10 for conditions
- NPI Registry uses NPI numbers and taxonomy codes for specialties
Joining data across sources requires crosswalk tables. The most useful one: NLM's RxNorm maps between NDC codes, ingredient names, clinical concepts, and ATC classifications.
FAQ
Which source has the freshest data? NPI Registry updates in near-real-time (providers can update any day). openFDA enforcement reports update weekly. CDC and CMS datasets are typically quarterly.
Do I need to register for API keys? openFDA and NPI work without registration. CDC SODA gives higher rate limits with a free app token. NIH Reporter requires no auth.
Can I use this data in a commercial product? Yes. All five sources provide data under public domain or open data terms. The data itself is free to use commercially. API terms of service restrict abusive access patterns, not commercial use.
What about HIPAA? None of these sources contain protected health information (PHI). All data is de-identified or aggregated. No HIPAA concerns for public API data.
Is there a unified API for all of these? Not from the government. Each agency maintains its own system independently. Third-party services (including what we are building at MyfitByte) aim to unify access across these fragmented sources.
Published on 2026-08-02 · 5 min read
← Back to all articles