[Federal Register Volume 90, Number 145 (Thursday, July 31, 2025)]
[Notices]
[Pages 36061-36063]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-14478]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
[CMS-0063-N]
RIN 0938-ZB90
National Plan and Provider Enumeration System (NPPES) Data
Changes
AGENCY: Office of the Secretary, Department of Health and Human
Services (HHS).
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: This notice provides information on changes to a data element
collected by the National Plan and Provider Enumeration System (NPPES)
when a provider applies for a National Provider Identifier (NPI), which
changes are made pursuant to provisions of the January 20, 2025,
Executive Order, 14168 (90 FR 8615). This notice also provides an
explanation of the nature and rationale for the changes, and their
effect on public-facing data available in NPPES downloadable files and
the query-only database on the internet.
FOR FURTHER INFORMATION CONTACT: Michael Cimmino at (410) 786-6408;
[email protected].
SUPPLEMENTARY INFORMATION:
I. Background
A. Legislative and Regulatory Background
Through subtitle F of title II of the Health Insurance Portability
and Accountability Act of 1996 (HIPAA), Congress added Part C,
``Administrative Simplification'' to title XI of the Social Security
Act (the Act) (Public Law (Pub. L.) 104-191). Part C of title XI
consists of sections 1171 through 1180 of the Act. These sections
define various terms and require the Secretary of the Department of
Health and Human Services (HHS) (the Secretary) to adopt standards and
operating rules with respect to certain electronic transactions, unique
health identifiers, code sets, and associated implementation
specifications relating to health information. Health plans, health
care clearinghouses, and certain health care providers (collectively
known as covered entities) must comply with the provisions adopted by
the Secretary. The Secretary delegated authority for administering and
enforcing HIPAA Administrative Simplification provisions related to
transactions, code sets, unique identifiers, and operating rules,
implemented in 45 CFR parts 160 and 162, to the Centers for Medicare &
Medicaid Services (CMS) (68 FR 60694).
Section 1173(b) of the Act requires the Secretary to adopt a unique
standard health identifier for individuals, employers, health plans,
and health care providers for use in the health care system and to
specify the purposes for which the identifiers may be used. A proposed
rule titled ``National Standard Health Care Provider Identifier''
(hereinafter referred to as the national provider identifier (NPI)
proposed rule) appeared in the May 7, 1998, Federal Register (63 FR
25320), and proposed a standard unique health identifier, or NPI, for
health care providers (providers) and requirements concerning its
implementation. A final rule titled ``HIPAA Administrative
Simplification: Standard Unique Health Identifier for Health Care
Providers,'' (hereinafter referred to as the NPI final rule) appeared
in the January 23, 2004, Federal Register (69 FR 3434), and adopted the
NPI as the standard unique health identifier for health care providers.
The NPI final rule established that HIPAA covered entities must use
NPIs to identify health care providers in electronic transactions for
which the Secretary has adopted a standard.
In the March 4, 2024, Federal Register (89 FR 15581), we published
a notice that added additional gender code choices to align with
Executive Order
[[Page 36062]]
14075 ``Advancing Equality for Lesbian, Gay, Bisexual, Transgender,
Queer, and Intersex Individuals'' (87 FR 37189) (hereinafter, Executive
Order 14075). Executive Order 14075 was rescinded on January 20, 2025,
by Executive Order 14168, ``Defending Women from Gender Ideology
Extremism and Restoring Biological Truth to the Federal Government''
(hereinafter, ``Defending Women E.O.'').
B. Operational and System Background
The NPI final rule established that NPIs are assigned to health
care providers through the National Provider System (NPS). The preamble
to the NPI final rule included an ``NPS Data Elements Table'' (69 FR
3457) that listed the data elements HHS expected to collect from health
care providers via the NPS, and certain data, including the NPI itself,
that are NPS-generated. The NPS, now called the National Plan and
Provider Enumeration System (NPPES),\1\ uniquely identifies health care
providers through an application process and assigns NPIs. NPPES
creates a record for each health care provider to whom it assigns an
NPI. The records are updated when health care providers furnish updates
to NPPES; regulations at 45 CFR 162.410(a)(4) require health care
providers to notify the NPPES within 30 days of any change in required
data elements.
---------------------------------------------------------------------------
\1\ https://nppes.cms.hhs.gov/#/.
---------------------------------------------------------------------------
NPPES categorizes health care providers into two types:
individuals, such as physicians, and organizations, such as hospitals.
A health care provider may apply for an NPI in one of three ways, by:
(1) completing form CMS-10114 (NPI Application/Update Form) and mailing
it to NPPES; (2) applying online at https://NPPES.cms.hhs.gov/; or (3)
having an approved Electronic File Interchange Organization (EFIO)
submit its NPI application data to NPPES in an electronic format
defined by HHS.2 3 Health care providers who apply online
self-select user identifiers and passwords to gain system access, and,
by virtue of that, obtain electronic access to the information in their
own NPPES records. This access allows those health care providers to
submit updates to their NPPES data electronically via the internet.
---------------------------------------------------------------------------
\2\ The information collection request is currently approved
under OMB control number 0938-0931. (https://www.reginfo.gov/public/do/DownloadNOA?requestID=311118.)
\3\ The Electronic File Interchange (EFI), also referred to as
``bulk enumeration,'' is a process by which a provider or group of
providers can have an EFIO apply for NPIs on their behalf. EFIOs are
approved by CMS through a certification process and submit
information in a format designated by CMS; https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/efi.
---------------------------------------------------------------------------
The NPI final rule requires that the NPS (now NPPES) disseminate
data in response to approved requests. Following publication of the NPI
final rule, CMS, as the NPPES administrator, published a notice that
appeared in the May 30, 2007, Federal Register (72 FR 30011) describing
the data dissemination strategy and process for NPI data maintained in
NPPES (hereinafter referred to as the NPPES Data Dissemination notice).
The NPPES Data Dissemination notice included a list of data elements
that CMS determined are required to be disclosed under the Freedom of
Information Act (FOIA) (72 FR 30012).
The health care industry needs access to NPPES health care provider
data to obtain provider NPIs to submit HIPAA-compliant health care
transactions. In anticipation of an extraordinary demand from the
health care industry for FOIA-disclosable NPPES health care provider
data, in September 2007, CMS began making this information available to
the public, in accordance with the Electronic Freedom of Information
Act Amendments of 1996 (Pub. L. 104-231), via the internet in two
forms:
NPI Registry: The NPI Registry is a query-only database
that is updated daily to enable users to query NPPES (for example,
search by NPI, provider name, etc.) and retrieve the FOIA-disclosable
data from the search results. There is no charge to view the data.
NPI Downloadable Data: These data include the following
files: (1) Full Replacement Monthly NPI File; (2) Weekly Incremental
NPI File; and (3) Full Replacement NPI Deactivation File. There is no
charge to download the data.
II. Provisions of This Notice
The ``Defending Women E.O.'' directed HHS to provide to the U.S.
Government, external partners, and the public clear guidance expanding
on the sex-based definitions it set forth.\4\ HHS's guidance \5\
recited the definition of sex provided in the Defending Women E.O.: a
person's immutable biological classification as either male or female,
stating there are only two sexes because there are only two types of
gametes. The guidance stated that HHS has long recognized that the
biological differences between females and males require sex-specific
practices in medicine and research to ensure optimal health outcomes
and rigorous research, including by considering sex as a biological
variable. The guidance also stated that recognizing the immutable and
biological nature of sex is essential to ensuring the protection of
women's health, safety, private spaces, sports, and opportunities, and
that restoring biological truth to the federal government is critical
to scientific inquiry, public safety, morale, and trust in government
itself.
---------------------------------------------------------------------------
\4\ Defending Women E.O. at section 3(a).
\5\ https://womenshealth.gov/sites/default/files/_images/2025/2.19.25%20Defining%20Sex%20Guidance%20for%20Federal%20Agencies%2C%20External%20Partners%2C%20and%20the%20Public%20FINAL.pdf.
---------------------------------------------------------------------------
The NPI final rule acknowledged that the data elements and
information presented in the data elements table were not intended for
data design purposes and that the names and attributes of the data
elements could be revised during the NPS design and development.\6\ As
such, while we anticipated collecting these types of data, the exact
data elements and values were not static and subject to change.
---------------------------------------------------------------------------
\6\ HIPAA Administrative Simplification: Standard Unique Health
Identifier for Health Care Providers (NPI final rule) (69 FR 3455)
https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
---------------------------------------------------------------------------
The data elements table in the NPI final rule included the data
element named ``provider gender code.'' \7\ Our operational experience
from nearly two decades with the enumeration system after the
publication of the final rule yields no evidence that this data element
was necessary to support the unique identification of a health care
provider. Therefore, we are making a change to the data element name
from ``provider gender code'' to ``provider sex code''; revising the
code description by replacing the word ``gender'' with ``sex,''; and
providing sex code selection choices of M (male) and F (female).
---------------------------------------------------------------------------
\7\ We note that while the NPI proposed rule used the term
``sex,'' (see 63 FR 25335 and 25338) this term was changed to
``gender'' in the NPI final rule.
---------------------------------------------------------------------------
This effects a change in position from what we articulated in the
March 2024 notice, where we implemented a different policy for this
data element under the now-rescinded Executive Order 14075. Our change
in position is rational and justified given the lack of evidence that
the gender code was necessary to support the unique identification of a
health care provider as previously contemplated in the 2004 NPI final
rule (69 FR 3456), the rescission of the prior executive order that was
superseded by the ``Defending Women E.O.,'' and HHS's new guidance
issued on February 19, 2025. Our prior approach to this data element
has been rendered outmoded and would conflict with HHS's current policy
position.
[[Page 36063]]
We realize that, under our approach subsequent to the March 2024
notice, providers may have submitted information pertaining to this
data element to the NPPES; this notice makes providers aware how that
data will be treated going forward. In this section, we discuss our
prospective approach to the data element, how the previously collected
data will be stored and disseminated, and providers' options for
updating data elements previously submitted to the provider enumeration
system.
The data element relevant to this notice is listed in Table 1,
along with the descriptions of the information contained in each column
of Table 1 are as follows:
Data Element Name: The name of the data element
residing in the NPPES.
Description: The definition of the data element
and related information.
Data Status: The instruction for furnishing the
information requested for the data element. The abbreviations used in
this column are as follows:
++ Required (R): Required for NPI assignment.
++ NPPES-generated (NG): Generated or assigned by the NPPES.
++ Optional (O): Not required for NPI assignment.
++ Situational (S): If a certain condition exists, the data element
is required. Otherwise, it is not required.
++ Repeat (RPT): Indicates that the data element is a repeating
field. A repeating field is one that can accommodate more than one
separate entry. Each separate entry must meet the edits, if any,
designated for that data element.
Data Condition: Describes the condition(s) under which a
``Situational'' data element must be furnished.
Entity Types: The ``Entity type codes'' to which the data
element applies. Code describing the type of health care provider that
is being assigned an NPI. Codes are as follows:
++1 = (Person): individual human being who furnishes health care.
++2 = (Non-person): entity other than an individual human being
that furnishes health care (for example, hospital, SNF, hospital
subunit, pharmacy, or HMO).
Use: The purpose for which the information is being
collected or will be used. The abbreviations used in this column are as
follows:
++I: The data element supports the unique identification of a
health care provider.
++A: The data element supports administrative implementation
specification.
Table 1--NPPES Data Element at Issue In This Notice
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Entity
Data element name Description Data status Data condition types Use
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Provider sex code................... The code designates the O Collected if the provider's NPI is Entity type code = 1; submission of a missing or 1 I
provider's sex if the blank value will not cause an application to be rejected.
provider is a person.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The NPI final rule identified provider gender code as a required
data element if the provider's NPI is Entity type code = 1. While
neither the NPI final rule nor the NPPES Data Dissemination notice
identified the gender codes that NPPES would collect and disseminate
when an individual provider applied for an NPI, providers were given
the option to click on a box that captured gender as either male or
female. NPPES stored that selection as code (F) when an individual
selected female and (M) when an individual selected male. The NPI
Registry query-only database displayed the descriptions ``Male'' and
``Female'' in disseminating the provider gender information, and NPI
downloadable files displayed the information using the codes (M) and
(F).
NPPES will disseminate sex code options of M and F to promote
improved accuracy in publicly available data. Provider gender code
selections made after March 4, 2024, that are no longer available in
accordance with the Defending Women E.O. will now appear as blank (that
is, will have no value selected) in public facing files. Although the
provider sex code is collected on the NPI application when a provider
indicates their entity type is ``1,'' it will now be an optional data
element. For clarity, we emphasize that an applicant who is an
individual (Entity type code = 1) may leave the data field empty (doing
so will not affect an applicant's ability to enumerate), and this data
element will no longer fall within the contours of 45 CFR
162.410(a)(4), which requires reporting to the NPPES changes to
required data elements within 30 days of the change. Providers with
Entity type code = 1 who previously furnished to NPPES a provider
gender code other than M or F in accordance with the March 4, 2024
notice (89 FR 15581) may elect to update or change their selection in
NPPES to align with the new provider sex code's parameters (or have the
EFIO that submitted their NPI application data to NPPES cause them to
be changed in NPPES) or they may elect to do nothing, in which case the
sex code field will appear as blank in public facing files.
III. Collection of Information Requirements
This document does not impose any new information collection,
recordkeeping requirements, or budgetary changes. The information
collection request for these NPPES data is currently approved under OMB
control number 0938-0931 and expires March 31, 2028.
Robert F. Kennedy, Jr.
Secretary, Department of Health and Human Services.
[FR Doc. 2025-14478 Filed 7-30-25; 8:45 am]
BILLING CODE 4120-01-P