[Federal Register Volume 89, Number 43 (Monday, March 4, 2024)]
[Notices]
[Pages 15581-15584]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-04517]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
[CMS-0059-N]
RIN 0938-ZB82
National Plan and Provider Enumeration System (NPPES) Data
Changes
AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of
Health and Human Services (HHS).
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: This notice provides information on changes to data elements
that providers are required to submit to the National Plan and Provider
Enumeration System (NPPES) to obtain and maintain a National Provider
Identifier (NPI). The changes to the required data elements affect the
data that is made available to the public from NPPES in downloadable
files and in a query-only database on the internet.
DATES: This notice is applicable on April 3, 2024.
FOR FURTHER INFORMATION CONTACT: Christopher S. Wilson, (410) 786-3178
or Beth A. Karpiak, (312) 353-1351.
SUPPLEMENTARY INFORMATION:
I. Background
A. Legislative and Regulatory Background
Through subtitle F of title II of the Health Insurance Portability
and Accountability Act of 1996 (HIPAA), Congress added Part C,
``Administrative Simplification'' to title XI of the Social Security
Act (the Act). (Pub. L. 104-191). Part C of title XI consists of
sections 1171 through 1179 of the Act. These sections define various
terms and impose requirements on the Secretary of the Department of
Health and Human Services (HHS) (hereinafter referred to as the
Secretary), health plans, health care clearinghouses, and certain
health care providers concerning the adoption of standards and
implementation specifications relating to health information. The
Secretary delegated authority for administering and enforcing HIPAA
Administrative Simplification provisions related to transactions, code
sets, unique identifiers, and operating rules, implemented in 45 CFR
parts 160 and 162, to the Centers for Medicare & Medicaid Services
(CMS) (see 68 FR 60694).
Section 1173(b) of the Act requires the Secretary to adopt a
standard unique health identifier for each individual, employer, health
plan, and health care provider for use in the health care system and to
specify the purposes for which the identifiers may be used. On May 7,
1998 (63 FR 25320), HHS proposed a standard unique health identifier
for health care providers and requirements concerning its
implementation (hereinafter referred to as the National Provider
Identifier (NPI) proposed rule). On January 23, 2004 (69 FR 3434), HHS
published a final rule that adopted the NPI as the standard unique
health identifier for health care providers (hereinafter referred to as
the NPI final rule). The NPI final rule established that HIPAA covered
entities must use NPIs to identify health care providers in electronic
transactions for which the Secretary has adopted a standard. Covered
entities include health plans, health care clearinghouses, and health
care providers who transmit any health information in electronic form
in connection with a transaction for which the Secretary has adopted a
standard.
B. Operational and System Background
The NPI final rule established that NPIs are assigned to health
care providers through the National Provider System (NPS). The preamble
to the NPI final rule included an ``NPS Data Elements Table'' (69 FR
3457) that listed the data elements HHS expected to collect about a
health care provider and include in the NPS. The NPS, now called the
National Plan and Provider Enumeration System (NPPES),\1\ uniquely
identifies health care providers through an application process and
assigns NPIs. NPPES creates a record for each health care provider to
whom it assigns an NPI. The records are updated when health care
providers furnish updates to NPPES.
---------------------------------------------------------------------------
\1\ https://nppes.cms.hhs.gov/#/.
---------------------------------------------------------------------------
Health care providers are categorized by NPPES into two types:
Individuals, such as physicians; and organizations, such as hospitals.
A health care provider may apply for an NPI in one of three ways, by:
(1) completing form CMS-10114 (NPI Application/Update Form) and mailing
it to NPPES; (2) applying online at https://NPPES.cms.hhs.gov/; or (3)
having an approved Electronic File Interchange Organization (EFIO)
submit its NPI application data to NPPES in an electronic format
defined by HHS.2 3 Health care providers who apply online
have electronic access to the information in their own NPPES records by
using user identifiers and passwords they select. This access allows
those health care providers to submit updates to their NPPES data
electronically via the internet.
---------------------------------------------------------------------------
\2\ The information collection request is currently approved
under OMB control number 0938-0931. (https://www.reginfo.gov/public/do/DownloadNOA?requestID=311118).
\3\ The Electronic File Interchange (EFI), also referred to as
``bulk enumeration,'' is a process by which a provider or group of
providers can have an EFIO apply for NPIs on their behalf. EFIOs are
approved by CMS through a certification process and submit
information in a format designated by CMS; https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/efi.
---------------------------------------------------------------------------
The NPI final rule requires that the NPS (now NPPES) disseminate
data in response to approved requests. Following publication of the NPI
final rule, CMS, as the administrator of NPPES, published a notice in
the May 30, 2007 Federal Register (72 FR 30011) describing the data
dissemination strategy for NPI data maintained in NPPES and the process
by which CMS would carry out the strategy (hereinafter referred to as
the NPPES Data Dissemination notice). The NPPES Data Dissemination
notice included a list of data elements that CMS determined are
required to be disclosed under the Freedom of Information Act (FOIA)
(see 72 FR 30012).
The health care industry needs NPPES health care provider data to
know the NPIs of health care providers to be able to submit HIPAA-
compliant health care transactions. In anticipation
[[Page 15582]]
of an extraordinary demand from the health care industry for FOIA-
disclosable NPPES health care provider data, in September 2007, CMS
began making this information available to the public, in accordance
with the Electronic Freedom of Information Act Amendments of 1996 (Pub.
L. 104-231), via the internet in two forms:
NPI Registry: The NPI Registry is a query-only database
that is updated daily to enable users to query NPPES (for example,
search by NPI, provider name, etc.) and retrieve the FOIA-disclosable
data from the search results. There is no charge to view the data.
NPI Downloadable File: Full Replacement Monthly NPI File,
Weekly Incremental NPI File, and Full Replacement NPI Deactivation
File. There is no charge to download the data.
II. Provisions of the Notice
A. Changes to NPPES Data Elements
The NPI final rule acknowledged that the data elements and
information presented in the data elements table were not intended to
be used for data design purposes and that during the NPS design and
development, the names and attributes of the data elements could be
revised.\4\ The table was included to show the kind of information that
CMS expected to collect about health care providers and that could be
disseminated by the NPS (69 FR 3455).
---------------------------------------------------------------------------
\4\ HIPAA Administrative Simplification: Standard Unique Health
Identifier for Health Care Providers (NPI final rule) (69 FR 3455)
https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
---------------------------------------------------------------------------
The data elements table in the NPI final rule included the
following health care provider data elements addressed by this notice:
provider first line address location, provider second line address
location, and provider gender code. Thirty days after publication of
this notice in the Federal Register, the NPPES system, NPPES Registry,
paper form, and associated data files will be updated to begin
collecting and disseminating for these health care provider data
elements: (1) amend the description of the provider first line location
address and second line location address data elements to permit a
provider that does not have a physical location other than their home
address to enter a United States Postal Service (USPS) post office box
or personal mailbox provided by private delivery services as their
provider location address; and (2) add additional choices for provider
gender codes. All other attributes assigned to these data elements
remain unchanged.
The data elements relevant to this notice are listed in Table 1.
Description of the information contained in each column of this table
is as follows:
Data Element Name: The name of the data element residing
in the NPPES.
Description: The definition of the data element and
related information.
Data Status: The instruction for furnishing the
information being requested in the data element. The abbreviations used
in this column are as follows:
++ Required (R): Required for NPI assignment.
++ NPPES-generated (NG): Generated or assigned by the NPPES.
++ Optional (O): Not required for NPI assignment.
++ Situational (S): If a certain condition exists, the data element
is required. Otherwise, it is not required.
++ Repeat (RPT): Indicates that the data element is a repeating
field. A repeating field is one that can accommodate more than one
separate entry. Each separate entry must meet the edits, if any,
designated for that data element.
Data Condition: Describes the condition(s) under which a
``Situational'' data element must be furnished. NOTE: The abbreviation
NA means ``not applicable.''
Entity Types: The ``Entity type codes'' to which the data
element applies. Code describing the type of health care provider that
is being assigned an NPI. Codes are as follows:
++ 1 = (Person): individual human being who furnishes health care.
++ 2 = (Non-person): entity other than an individual human being
that furnishes health care (for example, hospital, SNF, hospital
subunit, pharmacy, or HMO).
Use: The purpose for which the information is being
collected or will be used. The abbreviations used in this column are as
follows:
++ I: The data element supports the unique identification of a
health care provider.
++ A: The data element supports administrative implementation
specification.
Table A--NPPES Data Elements at Issue in This Notice
----------------------------------------------------------------------------------------------------------------
Data condition
Data element name Description Data status (situational Entity types Use
status only)
----------------------------------------------------------------------------------------------------------------
Provider first line location The first line location R NA................ 1, 2........ A
address. address of the
provider being
identified. For
providers with more
than one physical
location, this is the
primary location. This
address can only
include the USPS post
office box location or
personal mailbox
offered by a private
delivery service if
the provider's NPI is
Entity type code = 1
and the provider does
not have a physical
location other than
their home address
(for example, a
provider that
exclusively provides
telehealth services
from their home).
Provider second line location The second line S Required if it 1, 2........ A
address. location address of exists.
the provider being
identified. For
providers with more
than one physical
location, this is the
primary location. This
address can only
include a USPS post
office box location or
personal mailbox
offered by a private
delivery service if
the provider's NPI is
Entity type code = 1
and the provider does
not have a physical
location other than
their home address
(for example a
provider that
exclusively provides
telehealth services
from their home).
Provider gender code........... The code designating S Required if the 1........... I
the provider's gender provider's NPI is
if the provider is a Entity type code
person. = 1.
----------------------------------------------------------------------------------------------------------------
[[Page 15583]]
1. Allowing Provider Address Location To Include Post Office Boxes
The NPI final rule acknowledged that many comments to the NPI
proposed rule noted that health care provider practice addresses change
frequently, will be burdensome and expensive to maintain, and will be
unlikely to be maintained accurately.\5\ In response to these comments,
we concluded in the NPI final rule that, due to how frequently provider
location addresses change, the data element is of limited use in
electronic matching of health care providers (69 FR 3450). However, the
rule did recognize that capturing one provider location address in
NPPES could serve the administrative purpose of providing an address
where a health care provider can be contacted in situations when a
mailing address is insufficient. For example, a mailing address
containing a USPS post office box number cannot be used for mail
delivery by entities other than the USPS. The rule concluded that NPPES
should collect a provider mailing address and one provider location
address as required elements. To support this administrative purpose,
both the provider first line location address and provider second line
location address data element descriptions included a note indicating,
``This address cannot include a post office box'' (69 FR 3458).
---------------------------------------------------------------------------
\5\ HIPAA Administrative Simplification: Standard Unique Health
Identifier for Health Care Providers (NPI final rule)(69 FR 3455)
https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
---------------------------------------------------------------------------
Since the publication of the NPI final rule, health plans,
Medicare, and Medicaid programs, have expanded coverage for telehealth
services.\6\ As such, there are now a number of individual (Entity type
code = 1) providers, such as behavioral health service providers, who
exclusively furnish telehealth services from the providers' homes. In
some instances, providers who exclusively furnish telehealth services
from their own homes may not have a provider address location other
than their home address. We understand that providers who furnish
telehealth services exclusively from their homes often enter a post
office box as their provider mailing address into NPPES when applying
for an NPI. Given the prohibition on including a post office box for
the provider location address data elements, they enter their home
addresses into NPPES to satisfy the provider location address data
elements and obtain an NPI.
---------------------------------------------------------------------------
\6\ https://telehealth.hhs.gov/; https://data.cms.gov/summary-statistics-on-use-and-payments/medicare-service-type-reports/medicare-telehealth-trends; https://www.ama-assn.org/practice-management/digital/new-survey-data-shows-doctors-steadfast-commitment-telehealth.
---------------------------------------------------------------------------
In accordance with FOIA, NPPES address data, including provider
mailing address and provider location address, is publicly available on
the internet. Internet posting of provider home address information as
a provider location may cause confusion, potentially leading patients
and others who may access NPPES data to think that the provider can be
accessed for treatment or administrative purposes at the listed home
address. We have heard from providers that posting the information also
poses privacy and potential safety concerns for themselves and their
families.
To address these concerns, while still maintaining the
administrative purpose of providing a provider location address that
can be accessed by methods other than the USPS when such a location
exists outside of the provider's own home, NPPES will keep the provider
location address data element status as required, but will allow for
submission of a post office box or personal mailbox offered by a
private delivery service when a provider's NPI is Entity type code = 1
and the provider does not have a physical location other than their
home address (for example, a provider that exclusively furnishes
telehealth services from their home). This change is accomplished by
removing the language ``This address cannot include a post office box''
from the data element descriptions for both the provider first line
location address and provider second line location address and
replacing it with ``This address can include a post office box or
personal mailbox offered by a private delivery service only if the
provider's NPI is Entity type code = 1 and the provider does not have a
physical location other than their home address (for example, a
provider that exclusively provides telehealth services from their
home).''
The change in the data element descriptions allows providers that
are persons that do not currently have an NPI, and exclusively furnish
telehealth services or other services out of their homes, to obtain an
NPI without including their home address in NPPES. Should a provider
with Entity type code = 1 that has as an existing NPI, and exclusively
furnishes telehealth services or other services out of their homes,
wish to remove their home address from NPPES and replace it with a post
office box, they may do so by updating their NPPES records, either
themselves or through the EFIO that submitted their NPI application
data to NPPES. The change in the data element descriptions does not
require providers that already have an NPI assigned through NPPES,
including telehealth providers that do not have a physical location
address other than their home address, from changing any existing
information in NPPES. Should a provider who furnishes telehealth
services or other services exclusively from their home address wish to
maintain their home address as their provider location address within
their NPPES record, they may do so.
2. Adding Additional Provider Gender Code Choices
The NPI final rule identified provider gender code as a required
data element if the provider's NPI is Entity type code = 1. While
neither the NPI final rule nor the NPPES Data Dissemination notice
identified the gender codes that NPPES would collect and disseminate
when applying for an NPI, providers are given the option to click on a
box that captures gender as either male or female. NPPES stores that
selection as code (F) should an individual select female and (M) should
an individual select male. The NPI Registry query-only database
displays the descriptions ``Male'' and ``Female'' to disseminate
provider gender and NPI downloadable files display the information
using the codes (M) and (F).
NPPES will permit selection of, and disseminate, gender code
options beyond M and F to promote improved accuracy in publicly
available data and support unique identification and enumeration of
health care providers. The NPPES system, NPPES Registry, paper form,
and associated data files will be updated to begin collecting and
disseminating these new values 30 days after publication of this notice
in the Federal Register. NPPES will provide additional guidance on the
new codes and instructions for selecting gender codes when applying for
an NPI and maintaining NPI data.
Adding gender codes aligns with HHS efforts, as described in E.O.
14075 (87 FR 37189), to advance equity and full inclusion of lesbian,
gay, bisexual, transgender, queer, and intersex (LGBTQI+) individuals
through inclusive federal data collection practices.
Providers with Entity type code = 1 who previously furnished a
provider gender code to NPPES may update or change their selection in
NPPES, or have the EFIO that submitted their NPI application data to
NPPES cause them to be changed in NPPES, at any time. HHS encourages
providers who have
[[Page 15584]]
obtained NPIs to review their NPPES records to ensure that the
information they furnished when applying for their NPIs is up-to-date
and accurate.
B. Impact on FOIA-Releasable NPPES Data
The NPPES Data Dissemination notice identified both the provider
location address and provider gender code as NPPES data elements that
must be released under FOIA. The changes to these data elements
described in section II. of this notice do not affect HHS's assessment
of their releasability under FOIA and the data elements will continue
to be made available to the public through the NPI registry and the NPI
downloadable files.
III. Collection of Information Requirements
This document imposes new information for collection and
recordkeeping requirements. It makes reference to an existing
information collection request that will be revised as a result of the
revised data elements discussed in this notice. Specifically, we will
submit a non-substantive change request to OMB for review and approval
of the data element revisions associated with the information
collection request currently approved under 0938-0931.
Chiquita Brooks-LaSure, Administrator of the Centers for Medicare &
Medicaid Services, approved this document on February 27, 2024.
Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2024-04517 Filed 3-1-24; 8:45 am]
BILLING CODE 4120-01-P