APA Urges Vigilance as Public Gains Access to Physician Data

Ready or not, the National Provider Identifier (NPI) is here, and with its arrival anyone may be able to access information about physicians and health plans that was previously not available in one place.

At press time the Centers for Medicare and Medicaid Services (CMS) was expected to begin disseminating data early next month via the Internet to the public about health care providers and plans with an NPI as part of the National Plan and Provider Enumeration System (NPPES).

Data will be available in two forms: a query-only database, known as the NPI Registry, and a downloadable file. The NPI Registry is expected to go live on September 4, and the downloadable file should be available about one week later.

NPIs are unique identification numbers to be used in all electronic administrative and financial transactions with payers; it was mandated as part of the Health Insurance Portability and Accountability Act (HIPAA).

Most psychiatrists and other physicians must have and use an NPI, but even those who do not use electronic transactions and are not covered by HIPAA are advised to have an identifier; for instance, patients may need to have a physician's NPI when they file their own insurance claims, and physicians are required to have an NPI should they decide to opt out of Medicare.

The date of the public access had been pushed back several times, and APA, the AMA, and other physician groups have opposed the government's plan for making the information available to the general public.

APA is recommending that members check the data for accuracy and edit data that are inaccurate; edits to the NPI information can be made at any time, according to APA's Office of Healthcare Systems and Financing.

In comments submitted to CMS this summer, APA Medical Director James H. Scully Jr., M.D., noted that while some information can be deleted, much of it cannot.

Scully wrote in the comments, “The information required on the NPI application that CMS can disclose and that cannot be deleted by the provider is [the] provider's first, middle, and last names with prefixes and suffixes (or organization names); credentials; IRS employer identification number (EIN) (for organizations); full business location and mailing addresses and phone and fax numbers; date, state, country of birth; NPI number; primary health care provider taxonomy code to identify specialties; provider gender code; provider license number and provider license number state code; provider enumeration date with last update; NPI deactivation reason code and date and NPI reactivation date; and authorized official's full name, authorized official title or position, and telephone number (for organizations).”

In addition, Scully urged the agency to delay disseminating the physician information.

“After waiting over two years to publish this policy strategy, a little more time could be afforded to consider the ramifications of this policy and to ensure privacy protections and enforcement,” Scully said.“ CMS should also promulgate regulations that specifically prohibit any commercial use for any of these data, such as reselling them or using them for direct marketing.”

APA members having problems or questions regarding the NPI can contact the Managed Care Helpline at (800) 343-4671.

Information about the NPI is posted at<www.cms.hhs.gov/NationalProvIdentStand>. Physicians can apply for an NPI at no charge at<https://nppes.cms.hhs.gov> or by calling (800) 465-3203 to request a paper application.▪