89 FR 43 pgs. 15581-15584 - National Plan and Provider Enumeration System (NPPES) Data Changes
Type: NOTICEVolume: 89Number: 43Pages: 15581 - 15584
Pages: 15581, 15582, 15583, 15584Docket number: [CMS-0059-N]
FR document: [FR Doc. 2024-04517 Filed 3-1-24; 8:45 am]
Agency: Health and Human Services Department
Sub Agency: Centers for Medicare & Medicaid Services
Official PDF Version: PDF Version
[top]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
Centers for Medicare & Medicaid Services
[CMS-0059-N]
RIN 0938-ZB82
National Plan and Provider Enumeration System (NPPES) Data Changes
AGENCY:
Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).
ACTION:
Notice.
SUMMARY:
This notice provides information on changes to data elements that providers are required to submit to the National Plan and Provider Enumeration System (NPPES) to obtain and maintain a National Provider Identifier (NPI). The changes to the required data elements affect the data that is made available to the public from NPPES in downloadable files and in a query-only database on the internet.
DATES:
This notice is applicable on April 3, 2024.
FOR FURTHER INFORMATION CONTACT:
Christopher S. Wilson, (410) 786-3178 or Beth A. Karpiak, (312) 353-1351.
SUPPLEMENTARY INFORMATION:
I. Background
A. Legislative and Regulatory Background
Through subtitle F of title II of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Congress added Part C, "Administrative Simplification" to title XI of the Social Security Act (the Act). (Pub. L. 104-191). Part C of title XI consists of sections 1171 through 1179 of the Act. These sections define various terms and impose requirements on the Secretary of the Department of Health and Human Services (HHS) (hereinafter referred to as the Secretary), health plans, health care clearinghouses, and certain health care providers concerning the adoption of standards and implementation specifications relating to health information. The Secretary delegated authority for administering and enforcing HIPAA Administrative Simplification provisions related to transactions, code sets, unique identifiers, and operating rules, implemented in 45 CFR parts 160 and 162, to the Centers for Medicare & Medicaid Services (CMS) (see 68 FR 60694).
Section 1173(b) of the Act requires the Secretary to adopt a standard unique health identifier for each individual, employer, health plan, and health care provider for use in the health care system and to specify the purposes for which the identifiers may be used. On May 7, 1998 (63 FR 25320), HHS proposed a standard unique health identifier for health care providers and requirements concerning its implementation (hereinafter referred to as the National Provider Identifier (NPI) proposed rule). On January 23, 2004 (69 FR 3434), HHS published a final rule that adopted the NPI as the standard unique health identifier for health care providers (hereinafter referred to as the NPI final rule). The NPI final rule established that HIPAA covered entities must use NPIs to identify health care providers in electronic transactions for which the Secretary has adopted a standard. Covered entities include health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction for which the Secretary has adopted a standard.
B. Operational and System Background
The NPI final rule established that NPIs are assigned to health care providers through the National Provider System (NPS). The preamble to the NPI final rule included an "NPS Data Elements Table" (69 FR 3457) that listed the data elements HHS expected to collect about a health care provider and include in the NPS. The NPS, now called the National Plan and Provider Enumeration System (NPPES), 1 uniquely identifies health care providers through an application process and assigns NPIs. NPPES creates a record for each health care provider to whom it assigns an NPI. The records are updated when health care providers furnish updates to NPPES.
Footnotes:
1 ? https://nppes.cms.hhs.gov/#/.
Health care providers are categorized by NPPES into two types: Individuals, such as physicians; and organizations, such as hospitals. A health care provider may apply for an NPI in one of three ways, by: (1) completing form CMS-10114 (NPI Application/Update Form) and mailing it to NPPES; (2) applying online at https://NPPES.cms.hhs.gov/; or (3) having an approved Electronic File Interchange Organization (EFIO) submit its NPI application data to NPPES in an electronic format defined by HHS. 2?3 Health care providers who apply online have electronic access to the information in their own NPPES records by using user identifiers and passwords they select. This access allows those health care providers to submit updates to their NPPES data electronically via the internet.
Footnotes:
2 ?The information collection request is currently approved under OMB control number 0938-0931. ( https://www.reginfo.gov/public/do/DownloadNOA?requestID=311118 ).
3 ?The Electronic File Interchange (EFI), also referred to as "bulk enumeration," is a process by which a provider or group of providers can have an EFIO apply for NPIs on their behalf. EFIOs are approved by CMS through a certification process and submit information in a format designated by CMS; https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/efi.
The NPI final rule requires that the NPS (now NPPES) disseminate data in response to approved requests. Following publication of the NPI final rule, CMS, as the administrator of NPPES, published a notice in the May 30, 2007 Federal Register (72 FR 30011) describing the data dissemination strategy for NPI data maintained in NPPES and the process by which CMS would carry out the strategy (hereinafter referred to as the NPPES Data Dissemination notice). The NPPES Data Dissemination notice included a list of data elements that CMS determined are required to be disclosed under the Freedom of Information Act (FOIA) (see 72 FR 30012).
[top] The health care industry needs NPPES health care provider data to know the NPIs of health care providers to be able to submit HIPAA-compliant health care transactions. In anticipation
• NPI Registry: The NPI Registry is a query-only database that is updated daily to enable users to query NPPES (for example, search by NPI, provider name, etc.) and retrieve the FOIA-disclosable data from the search results. There is no charge to view the data.
• NPI Downloadable File: Full Replacement Monthly NPI File, Weekly Incremental NPI File, and Full Replacement NPI Deactivation File. There is no charge to download the data.
II. Provisions of the Notice
A. Changes to NPPES Data Elements
The NPI final rule acknowledged that the data elements and information presented in the data elements table were not intended to be used for data design purposes and that during the NPS design and development, the names and attributes of the data elements could be revised. 4 The table was included to show the kind of information that CMS expected to collect about health care providers and that could be disseminated by the NPS (69 FR 3455).
Footnotes:
4 ?HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers (NPI final rule) ( 69 FR 3455 ) https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
The data elements table in the NPI final rule included the following health care provider data elements addressed by this notice: provider first line address location, provider second line address location, and provider gender code. Thirty days after publication of this notice in the Federal Register , the NPPES system, NPPES Registry, paper form, and associated data files will be updated to begin collecting and disseminating for these health care provider data elements: (1) amend the description of the provider first line location address and second line location address data elements to permit a provider that does not have a physical location other than their home address to enter a United States Postal Service (USPS) post office box or personal mailbox provided by private delivery services as their provider location address; and (2) add additional choices for provider gender codes. All other attributes assigned to these data elements remain unchanged.
The data elements relevant to this notice are listed in Table 1. Description of the information contained in each column of this table is as follows:
• Data Element Name: The name of the data element residing in the NPPES.
• Description: The definition of the data element and related information.
• Data Status: The instruction for furnishing the information being requested in the data element. The abbreviations used in this column are as follows:
++ Required (R): Required for NPI assignment.
++ NPPES-generated (NG): Generated or assigned by the NPPES.
++ Optional (O): Not required for NPI assignment.
++ Situational (S): If a certain condition exists, the data element is required. Otherwise, it is not required.
++ Repeat (RPT): Indicates that the data element is a repeating field. A repeating field is one that can accommodate more than one separate entry. Each separate entry must meet the edits, if any, designated for that data element.
• Data Condition: Describes the condition(s) under which a "Situational" data element must be furnished. NOTE: The abbreviation NA means "not applicable."
• Entity Types: The "Entity type codes" to which the data element applies. Code describing the type of health care provider that is being assigned an NPI. Codes are as follows:
++ 1 = (Person): individual human being who furnishes health care.
++ 2 = (Non-person): entity other than an individual human being that furnishes health care (for example, hospital, SNF, hospital subunit, pharmacy, or HMO).
• Use: The purpose for which the information is being collected or will be used. The abbreviations used in this column are as follows:
++ I: The data element supports the unique identification of a health care provider.
++ A: The data element supports administrative implementation specification.
| Data element name | Description | Data status | Data condition (situational status only) | Entity types | Use |
|---|---|---|---|---|---|
| Provider first line location address | The first line location address of the provider being identified. For providers with more than one physical location, this is the primary location. This address can only include the USPS post office box location or personal mailbox offered by a private delivery service if the provider's NPI is Entity type code = 1 and the provider does not have a physical location other than their home address (for example, a provider that exclusively provides telehealth services from their home) | R | NA | 1, 2 | A |
| Provider second line location address | The second line location address of the provider being identified. For providers with more than one physical location, this is the primary location. This address can only include a USPS post office box location or personal mailbox offered by a private delivery service if the provider's NPI is Entity type code = 1 and the provider does not have a physical location other than their home address (for example a provider that exclusively provides telehealth services from their home) | S | Required if it exists | 1, 2 | A |
| Provider gender code | The code designating the provider's gender if the provider is a person | S | Required if the provider's NPI is Entity type code = 1 | 1 | I |
[top]
1. Allowing Provider Address Location To Include Post Office Boxes
The NPI final rule acknowledged that many comments to the NPI proposed rule noted that health care provider practice addresses change frequently, will be burdensome and expensive to maintain, and will be unlikely to be maintained accurately. 5 In response to these comments, we concluded in the NPI final rule that, due to how frequently provider location addresses change, the data element is of limited use in electronic matching of health care providers (69 FR 3450). However, the rule did recognize that capturing one provider location address in NPPES could serve the administrative purpose of providing an address where a health care provider can be contacted in situations when a mailing address is insufficient. For example, a mailing address containing a USPS post office box number cannot be used for mail delivery by entities other than the USPS. The rule concluded that NPPES should collect a provider mailing address and one provider location address as required elements. To support this administrative purpose, both the provider first line location address and provider second line location address data element descriptions included a note indicating, "This address cannot include a post office box" (69 FR 3458).
Footnotes:
5 ?HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers (NPI final rule)(69 FR 3455) https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
Since the publication of the NPI final rule, health plans, Medicare, and Medicaid programs, have expanded coverage for telehealth services. 6 As such, there are now a number of individual (Entity type code = 1) providers, such as behavioral health service providers, who exclusively furnish telehealth services from the providers' homes. In some instances, providers who exclusively furnish telehealth services from their own homes may not have a provider address location other than their home address. We understand that providers who furnish telehealth services exclusively from their homes often enter a post office box as their provider mailing address into NPPES when applying for an NPI. Given the prohibition on including a post office box for the provider location address data elements, they enter their home addresses into NPPES to satisfy the provider location address data elements and obtain an NPI.
Footnotes:
6 ? https://telehealth.hhs.gov/; https://data.cms.gov/summary-statistics-on-use-and-payments/medicare-service-type-reports/medicare-telehealth-trends; https://www.ama-assn.org/practice-management/digital/new-survey-data-shows-doctors-steadfast-commitment-telehealth.
In accordance with FOIA, NPPES address data, including provider mailing address and provider location address, is publicly available on the internet. Internet posting of provider home address information as a provider location may cause confusion, potentially leading patients and others who may access NPPES data to think that the provider can be accessed for treatment or administrative purposes at the listed home address. We have heard from providers that posting the information also poses privacy and potential safety concerns for themselves and their families.
To address these concerns, while still maintaining the administrative purpose of providing a provider location address that can be accessed by methods other than the USPS when such a location exists outside of the provider's own home, NPPES will keep the provider location address data element status as required, but will allow for submission of a post office box or personal mailbox offered by a private delivery service when a provider's NPI is Entity type code = 1 and the provider does not have a physical location other than their home address (for example, a provider that exclusively furnishes telehealth services from their home). This change is accomplished by removing the language "This address cannot include a post office box" from the data element descriptions for both the provider first line location address and provider second line location address and replacing it with "This address can include a post office box or personal mailbox offered by a private delivery service only if the provider's NPI is Entity type code = 1 and the provider does not have a physical location other than their home address (for example, a provider that exclusively provides telehealth services from their home)."
The change in the data element descriptions allows providers that are persons that do not currently have an NPI, and exclusively furnish telehealth services or other services out of their homes, to obtain an NPI without including their home address in NPPES. Should a provider with Entity type code = 1 that has as an existing NPI, and exclusively furnishes telehealth services or other services out of their homes, wish to remove their home address from NPPES and replace it with a post office box, they may do so by updating their NPPES records, either themselves or through the EFIO that submitted their NPI application data to NPPES. The change in the data element descriptions does not require providers that already have an NPI assigned through NPPES, including telehealth providers that do not have a physical location address other than their home address, from changing any existing information in NPPES. Should a provider who furnishes telehealth services or other services exclusively from their home address wish to maintain their home address as their provider location address within their NPPES record, they may do so.
2. Adding Additional Provider Gender Code Choices
The NPI final rule identified provider gender code as a required data element if the provider's NPI is Entity type code = 1. While neither the NPI final rule nor the NPPES Data Dissemination notice identified the gender codes that NPPES would collect and disseminate when applying for an NPI, providers are given the option to click on a box that captures gender as either male or female. NPPES stores that selection as code (F) should an individual select female and (M) should an individual select male. The NPI Registry query-only database displays the descriptions "Male" and "Female" to disseminate provider gender and NPI downloadable files display the information using the codes (M) and (F).
NPPES will permit selection of, and disseminate, gender code options beyond M and F to promote improved accuracy in publicly available data and support unique identification and enumeration of health care providers. The NPPES system, NPPES Registry, paper form, and associated data files will be updated to begin collecting and disseminating these new values 30 days after publication of this notice in the Federal Register . NPPES will provide additional guidance on the new codes and instructions for selecting gender codes when applying for an NPI and maintaining NPI data.
Adding gender codes aligns with HHS efforts, as described in E.O. 14075 (87 FR 37189), to advance equity and full inclusion of lesbian, gay, bisexual, transgender, queer, and intersex (LGBTQI+) individuals through inclusive federal data collection practices.
[top] Providers with Entity type code = 1 who previously furnished a provider gender code to NPPES may update or change their selection in NPPES, or have the EFIO that submitted their NPI application data to NPPES cause them to be changed in NPPES, at any time. HHS encourages providers who have
B. Impact on FOIA-Releasable NPPES Data
The NPPES Data Dissemination notice identified both the provider location address and provider gender code as NPPES data elements that must be released under FOIA. The changes to these data elements described in section II. of this notice do not affect HHS's assessment of their releasability under FOIA and the data elements will continue to be made available to the public through the NPI registry and the NPI downloadable files.
III. Collection of Information Requirements
This document imposes new information for collection and recordkeeping requirements. It makes reference to an existing information collection request that will be revised as a result of the revised data elements discussed in this notice. Specifically, we will submit a non-substantive change request to OMB for review and approval of the data element revisions associated with the information collection request currently approved under 0938-0931.
Chiquita Brooks-LaSure, Administrator of the Centers for Medicare & Medicaid Services, approved this document on February 27, 2024.
Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2024-04517 Filed 3-1-24; 8:45 am]
BILLING CODE 4120-01-P