[Federal Register Volume 63, Number 88 (Thursday, May 7, 1998)]
[Proposed Rules]
[Pages 25320-25357]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-11692]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Part 142
[HCFA-0045-P]
RIN 0938-AH99
National Standard Health Care Provider Identifier
AGENCY: Health Care Financing Administration (HCFA), HHS.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: This rule proposes a standard for a national health care
provider identifier and requirements concerning its use by health
plans, health care clearinghouses, and health care providers. The
health plans, health care clearinghouses, and health care providers
would use the identifier, among other uses, in connection with certain
electronic transactions.
The use of this identifier would improve the Medicare and Medicaid
programs, and other Federal health programs and private health
programs, and the effectiveness and efficiency of the health care
industry in general, by simplifying the administration of the system
and enabling the efficient electronic transmission of certain health
information. It would implement some of the requirements of the
Administrative Simplification subtitle of the Health Insurance
Portability and Accountability Act of 1996.
DATES: Comments will be considered if we receive them at the
appropriate address, as provided below, no later than 5 p.m. on July 6,
1998.
ADDRESSES: Mail written comments (1 original and 3 copies) to the
following address: Health Care Financing Administration, Department of
Health and Human Services, Attention: HCFA-0045-P, P.O. Box 26585,
Baltimore, MD 21207-0519.
If you prefer, you may deliver your written comments (1 original
and 3 copies) to one of the following addresses:
Room 309-G, Hubert H. Humphrey Building, 200 Independence Avenue, SW.,
Washington, DC 20201, or
Room C5-09-26, 7500 Security Boulevard, Baltimore, MD 21244-1850.
[[Page 25321]]
Comments may also be submitted electronically to the following e-
mail address: [email protected]. E-mail comments should include the
full name, postal address, and affiliation (if applicable) of the
sender and must be submitted to the referenced address to be
considered. All comments should be incorporated in the e-mail message
because we may not be able to access attachments.
Because of staffing and resource limitations, we cannot accept
comments by facsimile (FAX) transmission. In commenting, please refer
to file code HCFA-0045-P and the specific section or sections of the
proposed rule. Both electronic and written comments received by the
time and date indicated above will be available for public inspection
as they are received, generally beginning approximately 3 weeks after
publication of a document, in Room 309-G of the Department's offices at
200 Independence Avenue, SW., Washington, DC, on Monday through Friday
of each week from 8:30 a.m. to 5 p.m. (phone: (202) 690-7890).
Electronic and legible written comments will also be posted, along with
this proposed rule, at the following web site: http://aspe.os.dhhs.gov/
admnsimp/.
Copies: To order copies of the Federal Register containing this
document, send your request to: New Orders, Superintendent of
Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date
of the issue requested and enclose a check or money order payable to
the Superintendent of Documents, or enclose your Visa or Master Card
number and expiration date. Credit card orders can also be placed by
calling the order desk at (202) 512-1800 or by faxing to (202) 512-
2250. The cost for each copy is $8. As an alternative, you can view and
photocopy the Federal Register document at most libraries designated as
Federal Depository Libraries and at many other public and academic
libraries throughout the country that receive the Federal Register.
This Federal Register document is also available from the Federal
Register online database through GPO Access, a service of the U.S.
Government Printing Office. Free public access is available on a Wide
Area Information Server (WAIS) through the Internet and via
asynchronous dial-in. Internet users can access the database by using
the World Wide Web; the Superintendent of Documents home page address
is http://www.access.gpo.gov/su__docs/, by using local WAIS client
software, or by telnet to swais.access.gpo.gov, then login as guest (no
password required). Dial-in users should use communications software
and modem to call 202-512-1661; type swais, then login as guest (no
password required).
FOR FURTHER INFORMATION CONTACT: Patricia Peyton, (410) 786-1812.
SUPPLEMENTARY INFORMATION:
I. Background
[Please label written and e-mailed comments about this section with
the subject: Background.]
In order to administer their programs, the Department of Health and
Human Services, other Federal agencies, State Medicaid agencies, and
private health plans assign identification numbers to the providers of
health care services and supplies with which they transact business.
These various agencies and health plans, all of which we will refer to
as health plans in this proposed rule, routinely, and independently of
each other, assign identifiers to health care providers for program
management and operations purposes. The identifiers are frequently not
standardized within a single health plan or across plans. This lack of
uniformity results in a single health care provider having different
numbers for each program and often multiple billing numbers issued
within the same program, significantly complicating providers' claims
submission processes. In addition, nonstandard enumeration contributes
to the unintentional issuance of the same identification number to
different health care providers.
Most health plans have to be able to coordinate benefits with other
health plans to ensure appropriate payment. The lack of a single and
unique identifier for each health care provider within each health plan
and across health plans, based on the same core data, makes exchanging
data both expensive and difficult.
All of these factors indicate the complexities of exchanging
information on health care providers within and among organizations and
result in increasing numbers of claims-related problems and increasing
costs of data processing. As we become more dependent on data
automation and proceed in planning for health care in the future, the
need for a universal, standard health care provider identifier becomes
more and more evident.
In addition to overcoming communication and coordination
difficulties, use of a standard, unique provider identifier would
enhance our ability to eliminate fraud and abuse in health care
programs.
Payments for excessive or fraudulent claims can be reduced
by standardizing enumeration, which would facilitate sharing
information across programs or across different parts of the same
program.
A health care provider's identifier would not change with
moves or changes in specialty. This facilitates tracking of fraudulent
health care providers over time and across geographic areas.
A health care provider would receive only one identifier
and would not be able to receive duplicate payments from a program by
submitting claims under multiple provider identifiers.
A standard identifier would facilitate access to sanction
information.
A. National Provider Identifier Initiative
In July 1993, the Health Care Financing Administration (HCFA)
undertook a project to develop a provider identification system to meet
Medicare and Medicaid needs and ultimately a national identification
system for all health care providers to meet the needs of other users
and programs. Representatives from the private sector and Federal and
State agencies were invited to participate. Active participants
included:
Department of Defense, Office of Civilian Health and
Medical Program of the Uniformed Services.
Assistant Secretary for Planning and Evaluation, HHS.
Department of Labor.
Department of Veterans Affairs.
Office of Personnel Management.
Public Health Service, HHS.
Drug Enforcement Administration
State Medicaid agencies and health departments including
those of Alabama, California, Maryland, Minnesota and Virginia.
Medicare carriers and fiscal intermediaries.
Professional and medical associations, including the
National Council for Prescription Drug Programs.
One of the group's first tasks was to decide whether to use an
existing identifier or to develop a new one. They began by adopting
criteria recommended for a unique provider identifier by the Workgroup
for Electronic Data Interchange (WEDI), Technical Advisory Group in
October 1993, and recommended by the American National Standards
Institute (ANSI), Healthcare Informatics Standards Planning Panel, Task
Group on Provider Identifiers in February 1994. The workgroup then
examined existing identifiers and concluded that no existing identifier
met all the criteria that had been recommended by the WEDI and ANSI
workgroups.
Because of the limitations of existing identifiers, the workgroup
designed a
[[Page 25322]]
new identifier that would be in the public domain and that would
incorporate the recommendations of the WEDI and ANSI workgroups. This
identifier, which we call the national provider identifier, or NPI, is
an 8-position alphanumeric identifier.
B. The Results of the NPI Initiative
As a result of the project on the NPI, and before legislation
required the use of the standard identifier for all health care
providers (see section I.C. Legislation, below), HCFA and other
participants accepted the workgroup's recommendation, and HCFA decided
that this new identifier would be implemented in the Medicare program.
HCFA began work on developing a national provider system (NPS) that
would contain provider data and be equipped with the technology
necessary to maintain and manage the data. Plans for the NPS included
assigning the NPI and storing the data necessary to identify each
health care provider uniquely. The NPI was designed to have no embedded
intelligence. (That is, information about the health care provider,
such as the type of health care provider or State where the health care
provider is located, would not be conveyed by the NPI. This information
was to have been recorded by the NPS in each health care provider's
record but would not be part of the identifier.)
The NPS was designed so that it could also be used by other Federal
and State agencies and private health plans to enumerate their health
care providers that do not participate in Medicare.
C. Legislation
The Congress included provisions to address the need for a standard
identifier and other administrative simplification issues in the Health
Insurance Portability and Accountability Act of 1996 (HIPAA), Public
Law 104-191, which was enacted on August 21, 1996. Through subtitle F
of title II of that law, the Congress added to title XI of the Social
Security Act a new part C, entitled ``Administrative Simplification.''
(Public Law 104-191 affects several titles in the United States Code.
Hereafter, we refer to the Social Security Act as the Act; we refer to
the other laws cited in this document by their names.) The purpose of
this part is to improve the Medicare and Medicaid programs in
particular and the efficiency and effectiveness of the health care
system in general by encouraging the development of a health
information system through the establishment of standards and
requirements to facilitate the electronic transmission of certain
health information.
Part C of title XI consists of sections 1171 through 1179 of the
Act. These sections define various terms and impose several
requirements on HHS, health plans, health care clearinghouses, and
certain health care providers concerning electronic transmission of
health information.
The first section, section 1171 of the Act, establishes definitions
for purposes of part C of title XI for the following terms: code set,
health care clearinghouse, health care provider, health information,
health plan, individually identifiable health information, standard,
and standard setting organization.
Section 1172 of the Act makes any standard adopted under part C
applicable to (1) all health plans, (2) all health care clearinghouses,
and (3) any health care providers that transmit any health information
in electronic form in connection with the transactions referred to in
section 1173(a)(1) of the Act.
This section also contains requirements concerning standard
setting.
The Secretary may adopt a standard developed, adopted, or
modified by a standard setting organization (that is, an organization
accredited by the American National Standards Institute (ANSI)) that
has consulted with the National Uniform Billing Committee (NUBC), the
National Uniform Claim Committee (NUCC), WEDI, and the American Dental
Association (ADA).
The Secretary may also adopt a standard other than one
established by a standard setting organization, if the different
standard will reduce costs for health care providers and health plans,
the different standard is promulgated through negotiated rulemaking
procedures, and the Secretary consults with each of the above-named
groups.
If no standard has been adopted by any standard setting
organization, the Secretary is to rely on the recommendations of the
National Committee on Vital and Health Statistics (NCVHS) and consult
with each of the above-named groups.
In complying with the requirements of part C of title XI, the
Secretary must rely on the recommendations of the NCVHS, consult with
appropriate State, Federal, and private agencies or organizations, and
publish the recommendations of the NCVHS in the Federal Register.
Paragraph (a) of section 1173 of the Act requires that the
Secretary adopt standards for financial and administrative
transactions, and data elements for those transactions, to enable
health information to be exchanged electronically. Standards are
required for the following transactions: health claims, health
encounter information, health claims attachments, health plan
enrollments and disenrollments, health plan eligibility, health care
payment and remittance advice, health plan premium payments, first
report of injury, health claim status, and referral certification and
authorization. In addition, the Secretary is required to adopt
standards for any other financial and administrative transactions that
are determined to be appropriate by the Secretary.
Paragraph (b) of section 1173 of the Act requires the Secretary to
adopt standards for unique health identifiers for all individuals,
employers, health plans, and health care providers and requires further
that the adopted standards specify for what purposes unique health
identifiers may be used.
Paragraphs (c) through (f) of section 1173 of the Act require the
Secretary to establish standards for code sets for each data element
for each health care transaction listed above, security standards for
health care information systems, standards for electronic signatures
(established together with the Secretary of Commerce), and standards
for the transmission of data elements needed for the coordination of
benefits and sequential processing of claims. Compliance with
electronic signature standards will be deemed to satisfy both State and
Federal requirements for written signatures with respect to the
transactions listed in paragraph (a) of section 1173 of the Act.
In section 1174 of the Act, the Secretary is required to adopt
standards for all of the above transactions, except claims attachments,
within 18 months of enactment. The standards for claims attachments
must be adopted within 30 months of enactment. Generally, after a
standard is established it cannot be changed during the first year
except for changes that are necessary to permit compliance with the
standard. Modifications to any of these standards may be made after the
first year, but not more frequently than once every 12 months. The
Secretary must also ensure that procedures exist for the routine
maintenance, testing, enhancement, and expansion of code sets and that
there are crosswalks from prior versions.
Section 1175 of the Act prohibits health plans from refusing to
process or delaying the processing of a transaction that is presented
in standard format. The Act's requirements are not limited to health
plans; however, each person to whom a standard or implementation
[[Page 25323]]
specification applies is required to comply with the standard within 24
months (or 36 months for small health plans) of its adoption. A health
plan or other entity may, of course, comply voluntarily before the
effective date. Entities may comply by using a health care
clearinghouse to transmit or receive the standard transactions.
Compliance with modifications and implementation specifications to
standards must be accomplished by a date designated by the Secretary.
This date may not be earlier than 180 days after the notice of change.
Section 1176 of the Act establishes a civil monetary penalty for
violation of the provisions in part C of title XI of the Act, subject
to several limitations. The Secretary is required by statute to impose
penalties of not more than $100 per violation on any person who fails
to comply with a standard, except that the total amount imposed on any
one person in each calendar year may not exceed $25,000 for violations
of one requirement. The procedural provisions in section 1128A of the
Act, ``Civil Monetary Penalties,'' are applicable.
Section 1177 of the Act establishes penalties for a knowing misuse
of unique health identifiers and individually identifiable health
information: (1) A fine of not more than $50,000 and/or imprisonment of
not more than 1 year; (2) if misuse is ``under false pretenses,'' a
fine of not more than $100,000 and/or imprisonment of not more than 5
years; and (3) if misuse is with intent to sell, transfer, or use
individually identifiable health information for commercial advantage,
personal gain, or malicious harm, a fine of not more than $250,000 and/
or imprisonment of not more than 10 years.
Under section 1178 of the Act, the provisions of part C of title XI
of the Act, as well as any standards established under them, supersede
any State law that is contrary to them. However, the Secretary may, for
statutorily specified reasons, waive this provision.
Finally, section 1179 of the Act makes the above provisions
inapplicable to financial institutions or anyone acting on behalf of a
financial institution when ``authorizing, processing, clearing,
settling, billing, transferring, reconciling, or collecting payments
for a financial institution.''
(Concerning this last provision, the conference report, in its
discussion on section 1178, states:
``The conferees do not intend to exclude the activities of
financial institutions or their contractors from compliance with the
standards adopted under this part if such activities would be
subject to this part. However, conferees intend that this part does
not apply to use or disclosure of information when an individual
utilizes a payment system to make a payment for, or related to,
health plan premiums or health care. For example, the exchange of
information between participants in a credit card system in
connection with processing a credit card payment for health care
would not be covered by this part. Similarly sending a checking
account statement to an account holder who uses a credit or debit
card to pay for health care services, would not be covered by this
part. However, this part does apply if a company clears health care
claims, the health care claims activities remain subject to the
requirements of this part.'') (H.R. Rep. No. 736, 104th Cong., 2nd
Sess. 268-269 (1996))
D. Process for Developing National Standards
The Secretary has formulated a 5-part strategy for developing and
implementing the standards mandated under Part C of title XI of the
Act:
1. To ensure necessary interagency coordination and required
interaction with other Federal departments and the private sector,
establish interdepartmental implementation teams to identify and assess
potential standards for adoption. The subject matter of the teams
includes claims/encounters, identifiers, enrollment/eligibility,
systems security, and medical coding/classification. Another team
addresses cross-cutting issues and coordinates the subject matter
teams. The teams consult with external groups such as the NCVHS'
Workgroup on Data Standards, WEDI, ANSI's Health Informatics Standards
Board, the NUCC, the NUBC, and the ADA. The teams are charged with
developing regulations and other necessary documents and making
recommendations for the various standards to the HHS' Data Council
through its Committee on Health Data Standards. (The HHS Data Council
is the focal point for consideration of data policy issues. It reports
directly to the Secretary and advises the Secretary on data standards
and privacy issues.)
2. Develop recommendations for standards to be adopted.
3. Publish proposed rules in the Federal Register describing the
standards. Each proposed rule provides the public with a 60-day comment
period.
4. Analyze public comments and publish the final rules in the
Federal Register.
5. Distribute standards and coordinate preparation and distribution
of implementation guides.
This strategy affords many opportunities for involvement of
interested and affected parties in standards development and adoption:
Participate with standards development organizations.
Provide written input to the NCVHS.
Provide written input to the Secretary of HHS.
Provide testimony at NCVHS' public meetings.
Comment on the proposed rules for each of the proposed
standards.
Invite HHS staff to meetings with public and private
sector organizations or meet directly with senior HHS staff involved in
the implementation process.
The implementation teams charged with reviewing standards for
designation as required national standards under the statute have
defined, with significant input from the health care industry, a set of
principles for guiding choices for the standards to be adopted by the
Secretary. These principles are based on direct specifications in HIPAA
and the purpose of the law, principles that are consistent with the
regulatory philosophy set forth in Executive Order 12866 and the
Paperwork Reduction Act of 1995. To be designated as a HIPAA standard,
each standard should:
1. Improve the efficiency and effectiveness of the health care
system by leading to cost reductions for or improvements in benefits
from electronic health care transactions.
2. Meet the needs of the health data standards user community,
particularly health care providers, health plans, and health care
clearinghouses.
3. Be consistent and uniform with the other HIPAA standards--their
data element definitions and codes and their privacy and security
requirements--and, secondarily, with other private and public sector
health data standards.
4. Have low additional development and implementation costs
relative to the benefits of using the standard.
5. Be supported by an ANSI-accredited standards developing
organization or other private or public organization that will ensure
continuity and efficient updating of the standard over time.
6. Have timely development, testing, implementation, and updating
procedures to achieve administrative simplification benefits faster.
7. Be technologically independent of the computer platforms and
transmission protocols used in electronic transactions, except when
they are explicitly part of the standard.
8. Be precise and unambiguous, but as simple as possible.
9. Keep data collection and paperwork burdens on users as low as is
feasible.
[[Page 25324]]
10. Incorporate flexibility to adapt more easily to changes in the
health care infrastructure (such as new services, organizations, and
provider types) and information technology.
A master data dictionary providing for common data definitions
across the standards selected for implementation under HIPAA will be
developed and maintained. We intend for the data element definitions to
be precise, unambiguous, and consistently applied. The transaction-
specific reports and general reports from the master data dictionary
will be readily available to the public. At a minimum, the information
presented will include data element names, definitions, and appropriate
references to the transactions where they are used.
This proposed rule would establish the standard health care
provider identifier and is the first proposed standard under HIPAA. The
remaining standards will be grouped, to the extent possible, by subject
matter and audience in future regulations. We anticipate publishing
several more separate documents to promulgate the remaining standards
required under HIPAA.
II. Provisions of the Proposed Regulations
[Please label written and e-mailed comments about this section with
the subject: Provisions.]
In this proposed rule, we propose a standard health care provider
identifier and requirements concerning its implementation. This rule
would establish requirements that health plans, health care providers,
and health care clearinghouses would have to meet to comply with the
statutory requirement to use a unique identifier in electronic
transactions.
We propose to add a new part to title 45 of the Code of Federal
Regulations for health plans, health care providers, and health care
clearinghouses in general. The new part would be part 142 of title 45
and would be titled ``Administrative Requirements.'' Subpart D would
contain provisions specific to the NPI.
A. Applicability
Section 262 of HIPAA applies to all health plans, all health care
clearinghouses, and any health care providers that transmit any health
information in electronic form in connection with transactions referred
to in section 1173(a)(1) of the Act. Our proposed rules (at 45 CFR
142.102) would apply to the health plans and health care clearinghouses
as well, but we would clarify the statutory language in our regulations
for health care providers: we would have the regulations apply to any
health care provider only when electronically transmitting any of the
transactions to which section 1173(a)(1) of the Act refers.
Electronic transmissions would include transmissions using all
media, even when the transmission is physically moved from one location
to another using magnetic tape, disk, or CD media. Transmissions over
the Internet (wide-open), Extranet (using Internet technology to link a
business with information only accessible to collaborating parties),
leased lines, dial-up lines, and private networks are all included.
Telephone voice response and ``faxback'' systems would not be included.
The ``HTML'' interaction between a server and a browser by which the
elements of a transaction are solicited from a user would not be
included, but once assembled into a transaction by the server,
transmission of the full transaction to another corporate entity, such
as a health plan, would be required to comply.
Our regulations would apply to health care clearinghouses when
transmitting transactions to, and receiving transactions from, a health
care provider or health plan that transmits and receives standard
transactions (as defined under ``transaction'') and at all times when
transmitting to or receiving electronic transactions from another
health care clearinghouse. The law would apply to each health care
provider when transmitting or receiving any electronic transaction.
The law applies to health plans for all transactions.
Section 142.104 would contain the following provisions (from
section 1175 of the Act):
If a person desires to conduct a transaction (as defined in
Sec. 142.103) with a health plan as a standard transaction, the
following apply:
(1) The health plan may not refuse to conduct the transaction as a
standard transaction.
(2) The health plan may not delay the transaction or otherwise
adversely affect, or attempt to adversely affect, the person or the
transaction on the ground that the transaction is a standard
transaction.
(3) The information transmitted and received in connection with the
transaction must be in the form of standard data elements of health
information.
As a further requirement, we would require that a health plan that
conducts transactions through an agent assure that the agent meets all
the requirements of part 142 that apply to the health plan.
Section 142.105 would state that a person or other entity may meet
the requirements of Sec. 142.104 by either--
(1) Transmitting and receiving standard data elements, or
(2) Submitting nonstandard data elements to a health care
clearinghouse for processing into standard data elements and
transmission by the health care clearinghouse and receiving standard
data elements through the clearinghouse.
Health care clearinghouses would be able to accept nonstandard
transactions for the sole purpose of translating them into standard
transactions for sending customers and would be able to accept standard
transactions and translate them into nonstandard formats for receiving
customers. We would state in Sec. 142.105 that the transmission of
nonstandard transactions, under contract, between a health plan or a
health care provider and a health care clearinghouse would not violate
the law.
Transmissions within a corporate entity would not be required to
comply with the standards. A hospital that is wholly owned by a managed
care company would not have to use the standards to pass encounter
information back to the home office, but it would have to use the
standard claims transaction to submit a claim to another health plan.
Another example might be transactions within Federal agencies and their
contractors and between State agencies within the same State. For
example, Medicare enters into contracts with insurance companies and
common working file sites that process Medicare claims using government
furnished software. There is constant communication, on a private
network, between HCFA Central Office and the Medicare carriers,
intermediaries and common working file sites. This communication may
continue in nonstandard mode. However, these contractors must comply
with the standards when exchanging any of the transactions covered by
HIPAA with an entity outside these ``corporate'' boundaries.
B. Definitions
Section 1171 of the Act defines several terms and our proposed
rules would, for the most part, simply restate the law. The terms that
we are defining in this proposed rule follow:
1. Code set.
We would define ``code set'' as section 1171(1) of the Act does:
``code set'' means any set of codes used for encoding data elements,
such as tables of terms, medical concepts, medical diagnostic codes, or
medical procedure codes.
[[Page 25325]]
2. Health care clearinghouse.
We would define ``health care clearinghouse'' as section 1171(2) of
the Act does, but we are adding a further, clarifying sentence. The
statute defines a ``health care clearinghouse'' as a public or private
entity that processes or facilitates the processing of nonstandard data
elements of health information into standard data elements. We would
further explain that such an entity is one that currently receives
health care transactions from health care providers and other entities,
translates the data from a given format into one acceptable to the
intended recipient and forwards the processed transaction to
appropriate health plans and other clearinghouses, as necessary, for
further action.
There are currently a number of private clearinghouses that perform
these functions for health care providers. For purposes of this rule,
we would consider billing services, repricing companies, community
health management information systems or community health information
systems, value-added networks, and switches performing these functions
to be health care clearinghouses.
3. Health care provider.
As defined by section 1171(3) of the Act, a ``health care
provider'' is a provider of services as defined in section 1861(u) of
the Act, a provider of medical or other health services as defined in
section 1861(s) of the Act, and any other person who furnishes health
care services or supplies. Our regulations would define ``health care
provider'' as the statute does and clarify that the definition of a
health care provider is limited to those entities that furnish, or bill
and are paid for, health care services in the normal course of
business.
The statutory definition of a health care provider is broad.
Section 1861(u) contains the Medicare definition of a provider, which
encompasses institutional providers such as hospitals, skilled nursing
facilities, home health agencies, and comprehensive outpatient
rehabilitation facilities. Section 1861(s) defines other Medicare
facilities and practitioners, including assorted clinics and centers,
physicians, clinical laboratories, various licensed/certified health
care practitioners, and suppliers of durable medical equipment. The
last portion of the definition encompasses any appropriately licensed
or certified health care practitioners or organizations, including
pharmacies and nursing homes and many types of therapists, technicians,
and aides. It also includes any other individual or organization that
furnishes health care services or supplies. We believe that an
individual or organization that bills and is paid for health care
services or supplies is also a health care provider for purposes of the
statute.
Section 1173(b)(1) of the Act requires the Secretary to adopt
standards for unique identifiers for all health care providers. The
definition of a ``health care provider'' at section 1171(3) includes
all Medicare providers and ``any other person furnishing health care
services and supplies.'' These two provisions require that provider
identifiers may not be limited to only those health care providers that
bill electronically or those that bill in their own right. Instead
provider identifiers will eventually be available to all those that
provide health services. Penalties for failure to use the correct
identifiers, however, are limited to those that fail to use the
identifiers or other standards in the nine designated electronic
transactions. As we discuss under a later section in this preamble,
III. Implementation of the NPI, we do not expect to be able to assign
identifiers immediately to all health care providers that do not
participate in electronic transactions.
Our proposed definition of a health care provider would not include
health industry workers who support the provision of health care but
who do not provide health services, such as admissions and billing
personnel, housekeeping staff, and orderlies.
We describe two alternatives for defining general categories of
health care providers for enumeration purposes. In the first, we would
categorize health care providers as individuals, organizations, or
groups. In the second, we would categorize health care providers as
individuals or organizations, which would include groups. The data to
be collected for each category of health care provider are described in
the preamble in section IV.
B. Data Elements. We welcome your comments on whether group providers
need to be distinguished from organization providers.
Individuals are treated differently than organizations and groups
because the data available to search for duplicates (for example, date
and place of birth) are different. Organizations and groups may need to
be treated differently from each other because it is possible that a
group is not specifically licensed or certified to provide health care,
whereas an organization usually is. It may, therefore, be important to
be able to link the individual members to the group. It would not be
possible to distinguish one category from another by looking at the
NPI. The NPS would contain the kinds of data necessary to adequately
categorize each health care provider.
The categories are described as follows:
Individual--A human being who is licensed, certified or otherwise
authorized to perform medical services or provide medical care,
equipment and/or supplies in the normal course of business. Examples of
individuals are physicians, nurses, dentists, pharmacists, and physical
therapists.
Organization--An entity, other than an individual, that is
licensed, certified or otherwise authorized to provide medical
services, care, equipment or supplies in the normal course of business.
The licensure, certification, or other recognition is granted to the
organization entity. Individual owners, managers, or employees of the
organization may also be certified, licensed, or otherwise recognized
as individual health care providers in their own right. Each separate
physical location of an organization, each member of an organization
chain, and each subpart of an organization that needs to be identified
would receive its own NPI. NPIs of organization providers would not be
linked within the NPS to NPIs of other health care providers. Examples
of organizations are hospitals, laboratories, ambulance companies,
health maintenance organizations, and pharmacies.
In the first alternative for categorizing health care providers, as
described above, we would distinguish a group from an organization. We
would define a group as follows:
Group--An entity composed of one or more individuals (as defined
above), generally created to provide coverage of patients' needs in
terms of office hours, professional backup and support, or range of
services resulting in specific billing or payment arrangements. It is
possible that the group itself is not licensed or certified, but the
individual(s) who compose the group are licensed, certified or
otherwise authorized to provide health care services. The NPIs of the
group member(s) would be linked within the NPS to the NPI of the group.
An individual can be a member of multiple groups. Examples of groups
are (1) two physicians practicing as a group where they bill and
receive payment for their services as a group and (2) an incorporated
individual billing and receiving payment as a corporation.
The ownership of a group or organization can change if it is sold,
consolidated, or merged, or if control changes due to stock
acquisition. In many cases, the nature of the provider
[[Page 25326]]
itself (for example, its location, staff or types of services provided)
is not affected. In general, the NPI of the provider should not change
in these situations unless the change of ownership affects the nature
of the provider. (Example: If a hospital is acquired and then converted
to a rehabilitation center, it would need to obtain a new NPI.) There
may also be circumstances where a new NPI should be issued. (Example: a
physicians' group practice operating as a partnership dissolves that
partnership and another partnership of physicians acquires and operates
the practice.) We solicit comments on rules to be applied.
We discuss the enumeration of health care providers in more detail,
in III. Implementation of the NPI, later in this preamble.
4. Health information.
``Health information,'' as defined in section 1171 of the Act,
means any information, whether oral or recorded in any form or medium,
that--
Is created or received by a health care provider, health
plan, public health authority, employer, life insurer, school or
university, or health care clearinghouse; and
Relates to the past, present, or future physical or mental
health or condition of an individual; the provision of health care to
an individual; or the past, present, or future payment for the
provision of health care to an individual.
We propose the same definition for our regulations.
5. Health plan.
We propose that a ``health plan'' be defined essentially as section
1171 of the Act defines it. Section 1171 of the Act cross refers to
definitions in section 2791 of the Public Health Service Act (as added
by Public Law 104-191, 42 U.S.C. 300gg-91); we would incorporate those
definitions as currently stated into our proposed definitions for the
convenience of the public. We note that many of these terms are defined
in other statutes, such as the Employee Retirement Income Security Act
of 1974 (ERISA), Public Law 93-406, 29 U.S.C. 1002(7) and the Public
Health Service Act. Our definitions are based on the roles of plans in
conducting administrative transactions, and any differences should not
be construed to affect other statutes.
For purposes of implementing the provisions of administrative
simplification, a ``health plan'' would be an individual or group
health plan that provides, or pays the cost of, medical care. This
definition includes, but is not limited to, the 13 types of plans
listed in the statute. On the other hand, plans such as property and
casualty insurance plans and workers compensation plans, which may pay
health care costs in the course of administering nonhealth care
benefits, are not considered to be health plans in the proposed
definition of health plan. Of course, these plans may voluntarily adopt
these standards for their own business needs. At some future time, the
Congress may choose to expressly include some or all of these plans in
the list of health plans that must comply with the standards.
Health plans often carry out their business functions through
agents, such as plan administrators (including third party
administrators), entities that are under ``administrative services
only'' (ASO) contracts, claims processors, and fiscal agents. These
agents may or may not be health plans in their own right; for example,
a health plan may act as another health plan's agent as another line of
business. As stated earlier, a health plan that conducts HIPAA
transactions through an agent is required to assure that the agent
meets all HIPAA requirements that apply to the plan itself.
``Health plan'' includes the following, singly or in combination:
a. ``Group health plan'' (as currently defined by section 2791(a)
of the Public Health Service Act). A group health plan is a plan that
has 50 or more participants (as the term ``participant'' is currently
defined by section 3(7) of ERISA) or is administered by an entity other
than the employer that established and maintains the plan. This
definition includes both insured and self-insured plans. We define
``participant'' separately below.
Section 2791(a)(1) of the Public Health Service Act defines ``group
health plan'' as an employee welfare benefit plan (as currently defined
in section 3(1) of ERISA) to the extent that the plan provides medical
care, including items and services paid for as medical care, to
employees or their dependents directly or through insurance, or
otherwise.
It should be noted that group health plans that have fewer than 50
participants and that are administered by the employer would be
excluded from this definition and would not be subject to the
administrative simplification provisions of HIPAA.
b. ``Health insurance issuer'' (as currently defined by section
2791(b) of the Public Health Service Act).
Section 2791(b)(2) of the Public Health Service Act currently
defines a ``health insurance issuer'' as an insurance company,
insurance service, or insurance organization that is licensed to engage
in the business of insurance in a State and is subject to State law
that regulates insurance.
c. ``Health maintenance organization'' (as currently defined by
section 2791(b) of the Public Health Service Act).
Section 2791(b) of the Public Health Service Act currently defines
a ``health maintenance organization'' as a Federally qualified health
maintenance organization, an organization recognized as such under
State law, or a similar organization regulated for solvency under State
law in the same manner and to the same extent as such a health
maintenance organization. These organizations may include preferred
provider organizations, provider sponsored organizations, independent
practice associations, competitive medical plans, exclusive provider
organizations, and foundations for medical care.
d. Part A or Part B of the Medicare program (title XVIII of the
Act).
e. The Medicaid program (title XIX of the Act).
f. A ``Medicare supplemental policy'' as defined under section
1882(g)(1) of the Act.
Section 1882(g)(1) of the Act defines a ``Medicare supplemental
policy'' as a health insurance policy that a private entity offers a
Medicare beneficiary to provide payment for expenses incurred for
services and items that are not reimbursed by Medicare because of
deductible, coinsurance, or other limitations under Medicare. The
statutory definition of a Medicare supplemental policy excludes a
number of plans that are generally considered to be Medicare
supplemental plans, such as health plans for employees and former
employees and for members and former members of trade associations and
unions. A number of these health plans may be included under the
definitions of ``group health plan'' or ``health insurance issuer'', as
defined in a. and b. above.
g. A ``long-term care policy,'' including a nursing home fixed-
indemnity policy. A ``long-term care policy'' is considered to be a
health plan regardless of how comprehensive it is. We recognize the
long-term care insurance segment of the industry is largely unautomated
and we welcome comments regarding the impact of HIPAA on the long-term
care segment.
h. An employee welfare benefit plan or any other arrangement that
is established or maintained for the purpose of offering or providing
health benefits to the employees of two or more employers. This
includes plans and other arrangements that are referred to as multiple
employer welfare
[[Page 25327]]
arrangements (``MEWAs'') as defined in section 3(40) of ERISA.
i. The health care program for active military personnel under
title 10 of the United States Code.
j. The veterans health care program under chapter 17 of title 38 of
the United States Code.
This health plan primarily furnishes medical care through hospitals
and clinics administered by the Department of Veterans Affairs for
veterans with a service-connected disability that is compensable.
Veterans with non-service-connected disabilities (and no other health
benefit plan) may receive health care under this health plan to the
extent resources and facilities are available.
k. The Civilian Health and Medical Program of the Uniformed
Services (CHAMPUS), as defined in 10 U.S.C. 1072(4).
CHAMPUS primarily covers services furnished by civilian medical
providers to dependents of active duty members of the uniformed
services and retirees and their dependents under age 65.
l. The Indian Health Service program under the Indian Health Care
Improvement Act (25 U.S.C. 1601 et seq.).
This program furnishes services, generally through its own health
care providers, primarily to persons who are eligible to receive
services because they are of American Indian or Alaskan Native descent.
m. The Federal Employees Health Benefits Program under 5 U.S.C.
chapter 89.
This program consists of health insurance plans offered to active
and retired Federal employees and their dependents. Depending on the
health plan, the services may be furnished on a fee-for-service basis
or through a health maintenance organization.
(Note: Although section 1171(5)(M) of the Act refers to the
``Federal Employees Health Benefit Plan,'' this and any other rules
adopting administrative simplification standards will use the correct
name, the Federal Employees Health Benefits Program. One health plan
does not cover all Federal employees; there are over 350 health plans
that provide health benefits coverage to Federal employees, retirees,
and their eligible family members. Therefore, we will use the correct
name, the Federal Employees Health Benefits Program, to make clear that
the administrative simplification standards apply to all health plans
that participate in the Program.)
n. Any other individual or group health plan, or combination
thereof, that provides or pays for the cost of medical care.
We would include a fourteenth category of health plan in addition
to those specifically named in HIPAA, as there are health plans that do
not readily fit into the other categories but whose major purpose is
providing health benefits. The Secretary would determine which of these
plans are health plans for purposes of title II of HIPAA. This category
would include the Medicare Plus Choice plans that will become available
as a result of section 1855 of the Act as amended by section 4001 of
the Balanced Budget Act of 1997 (Public Law 105-33) to the extent that
these health plans do not fall under any other category.
6. Medical care.
``Medical care,'' which is used in the definition of health plan,
would be defined as current section 2791 of the Public Health Service
Act defines it: the diagnosis, cure, mitigation, treatment, or
prevention of disease, or amounts paid for the purpose of affecting any
body structure or function of the body; amounts paid for transportation
primarily for and essential to these items; and amounts paid for
insurance covering the items and the transportation specified in this
definition.
7. Participant.
We would define the term ``participant'' as section 3(7) of ERISA
currently defines it: a ``participant'' is any employee or former
employee of an employer, or any member or former member of an employee
organization, who is or may become eligible to receive a benefit of any
type from an employee benefit plan that covers employees of such an
employer or members of such organizations, or whose beneficiaries may
be eligible to receive any such benefits. An ``employee'' would include
an individual who is treated as an employee under section 401(c)(1) of
the Internal Revenue Code of 1986 (26 U.S.C. 401(c)(1)).
8. Small health plan.
We would define a ``small health plan'' as a group health plan with
fewer than 50 participants.
The HIPAA does not define a ``small health plan'' but instead
leaves the definition to be determined by the Secretary. The Conference
Report suggests that the appropriate definition of a ``small health
plan'' is found in current section 2791(a) of the Public Health Service
Act, which is a group health plan with fewer than 50 participants. We
would also define small individual health plans as those with fewer
than 50 participants.
9. Standard.
Section 1171 of the Act defines ``standard,'' when used with
reference to a data element of health information or a transaction
referred to in section 1173(a)(1) of the Act, as any such data element
or transaction that meets each of the standards and implementation
specifications adopted or established by the Secretary with respect to
the data element or transaction under sections 1172 through 1174 of the
Act.
Under our definition, a standard would be a set of rules for a set
of codes, data elements, transactions, or identifiers promulgated
either by an organization accredited by the American National Standards
Institute or HHS for the electronic transmission of health information.
10. Transaction.
``Transaction'' would mean the exchange of information between two
parties to carry out financial and administrative activities related to
health care. A transaction would be any of the transactions listed in
section 1173(a)(2) of the Act and any determined appropriate by the
Secretary in accordance with section 1173(a)(1)(B) of the Act. We
present them below in the order in which we propose to list them in the
regulations text to this document and in the regulations document for
proposed standards for these transactions that we will publish later.
A ``transaction'' would mean any of the following:
a. Health claims or equivalent encounter information.
This transaction may be used to submit health care claim billing
information, encounter information, or both, from health care providers
to health plans, either directly or via intermediary billers and claims
clearinghouses.
b. Health care payment and remittance advice.
This transaction may be used by a health plan to make a payment to
a financial institution for a health care provider (sending payment
only), to send an explanation of benefits or a remittance advice
directly to a health care provider (sending data only), or to make
payment and send an explanation of benefits remittance advice to a
health care provider via a financial institution (sending both payment
and data).
c. Coordination of benefits.
This transaction can be used to transmit health care claims and
billing payment information between health plans with different payment
responsibilities where coordination of benefits is required or between
health plans and regulatory agencies to monitor the rendering, billing,
and/or
[[Page 25328]]
payment of health care services within a specific health care/insurance
industry segment.
In addition to the nine electronic transactions specified in
section 1173(a)(2) of the Act, section 1173(f) directs the Secretary to
adopt standards for transferring standard data elements among health
plans for coordination of benefits and sequential processing of claims.
This particular provision does not state that these should be standards
for electronic transfer of standard data elements among health plans.
However, we believe that the Congress, when writing this provision,
intended for these standards to apply to the electronic form of
transactions for coordination of benefits and sequential processing of
claims. The Congress expressed its intent on these matters generally in
section 1173(a)(1)(B), where the Secretary is directed to adopt ``other
financial and administrative transactions . . . consistent with the
goals of improving the operation of the health care system and reducing
administrative costs''. Adoption of a standard for electronic
transmission of standard data elements among health plans for
coordination of benefits and sequential processing of claims would
serve these goals expressed by the Congress.
d. Health claim status.
This transaction may be used by health care providers and
recipients of health care products or services (or their authorized
agents) to request the status of a health care claim or encounter from
a health plan.
e. Enrollment and disenrollment in a health plan.
This transaction may be used to establish communication between the
sponsor of a health benefit and the health plan. It provides enrollment
data, such as subscriber and dependents, employer information, and
primary care health care provider information. The sponsor is the
backer of the coverage, benefit, or product. A sponsor can be an
employer, union, government agency, association, or insurance company.
The health plan refers to an entity that pays claims, administers the
insurance product or benefit, or both.
f. Eligibility for a health plan.
This transaction may be used to inquire about the eligibility,
coverage, or benefits associated with a benefit plan, employer, plan
sponsor, subscriber, or a dependent under the subscriber's policy. It
also can be used to communicate information about or changes to
eligibility, coverage, or benefits from information sources (such as
insurers, sponsors, and health plans) to information receivers (such as
physicians, hospitals, third party administrators, and government
agencies).
g. Health plan premium payments.
This transaction may be used by, for example, employers, employees,
unions, and associations to make and keep track of payments of health
plan premiums to their health insurers. This transaction may also be
used by a health care provider, acting as liaison for the beneficiary,
to make payment to a health insurer for coinsurance, copayments, and
deductibles.
h. Referral certification and authorization.
This transaction may be used to transmit health care service
referral information between primary care health care providers, health
care providers furnishing services, and health plans. It can also be
used to obtain authorization for certain health care services from a
health plan.
i. First report of injury.
This transaction may be used to report information pertaining to an
injury, illness, or incident to entities interested in the information
for statistical, legal, claims, and risk management processing
requirements.
j. Health claims attachments.
This transaction may be used to transmit health care service
information, such as subscriber, patient, demographic, diagnosis, or
treatment data for the purpose of a request for review, certification,
notification, or reporting the outcome of a health care services
review.
k. Other transactions as the Secretary may prescribe by regulation.
Under section 1173(a)(1)(B) of the Act, the Secretary shall adopt
standards, and data elements for those standards, for other financial
and administrative transactions deemed appropriate by the Secretary.
These transactions would be consistent with the goals of improving the
operation of the health care system and reducing administrative costs.
C. Effective Dates--General
In general, any given standard would be effective 24 months after
the effective date (36 months for small health plans) of the final rule
for that standard. Because there are other standards to be established
than those in this proposed rule, we specify the date for a given
standard under the subpart for that standard.
If HHS adopts a modification to an implementation specification or
a standard, the implementation date of the modification would be no
earlier than the 180th day following the adoption of the modification.
HHS would determine the actual date, taking into account the time
needed to comply due to the nature and extent of the modification. HHS
would be able to extend the time for compliance for small health plans.
This provision would be at Sec. 142.106.
The law does not address scheduling of implementation of the
standards; it gives only a date by which all concerned must comply. As
a result, any of the health plans, health care clearinghouses, and
health care providers may implement a given standard earlier than the
date specified in the subpart created for that standard. We realize
that this may create some problems temporarily, as early implementers
would have to be able to continue using old standards until the new
ones must, by law, be in place.
At the WEDI Healthcare Leadership Summit held on August 15, 1997,
it was recommended that health care providers not be required to use
any of the standards during the first year after the adoption of the
standard. However, willing trading partners could implement any or all
of the standards by mutual agreement at any time during the 2-year
implementation phase (3-year implementation phase for small health
plans). In addition, it was recommended that a health plan give its
health care providers at least 6 months notice before requiring them to
use a given standard.
We welcome comments specifically on early implementation as to the
extent to which it would cause problems and how any problems might be
alleviated.
D. NPI Standard
[Please label written and e-mailed comments about this section with
the subject: NPI STANDARD.]
Section 142.402, Provider identifier standard, would contain the
national health care provider identifier standard. There is no
recognized standard for health care provider identification as defined
in the law. (That is, there is no standard that has been developed,
adopted, or modified by a standard setting organization after
consultation with the NUBC, NUCC, WEDI, and the ADA.) Therefore, we
would designate a new standard.
We are proposing as the standard the national provider identifier
(NPI), which would be maintained by HCFA. As discussed under the
Background section earlier in this preamble, the NPI is an 8-position
alphanumeric identifier. It includes as the 8th position a numeric
check digit to assist in identifying erroneous or invalid NPIs. The
check digit is a recognized International Standards Organization [ISO]
standard. The check digit algorithm must be computed from an all-
numeric base
[[Page 25329]]
number. Therefore, any alpha characters that may be part of the NPI are
translated to specific numerics before the calculation of the check
digit. The NPI format would allow for the creation of approximately 20
billion unique identifiers.
The 8-position alphanumeric format was chosen over a longer
numeric-only format in order to keep the identifier as short as
possible while providing for an identifier pool that would serve the
industry's needs for a long time. However, we recognize that some
health care providers and health plans might have difficulty in the
short term in accommodating alphabetic characters. Therefore, we
propose to issue numeric-only identifiers first and to introduce
alphabetic characters starting with the first position of the NPI. This
would afford additional time for health care providers and health plans
to accommodate the alphabetic characters.
1. Selection criteria.
Each individual implementation team weighted the criteria described
in section I.D., Process for Developing National Standards, in terms of
the standard it was addressing. As we assessed the various options for
a provider identifier against the criteria, it became apparent that
many of the criteria would be satisfied by all of the provider
identifier candidates. Consequently, we concentrated on the four
criteria (1, 2, 3, and 10) that were not satisfied by all of the
options. These criteria are described below in the specific context of
the provider identifier.
#1. Improve the efficiency and effectiveness of the health care
system.
In order to be integrated into electronic transactions efficiently,
standard provider identifiers must be easily accessible. Health plans
must be able to obtain identifiers and other key data easily in order
to use the identifier in electronic transactions. Existing health care
provider files have to be converted to the new standard. In addition,
health care providers will need to know other health care providers'
identifiers (for example, a hospital needs the identifiers of all
physicians who perform services in the facility). To meet this
criterion, we believe the identifier should not be proprietary; that
is, it should be possible to communicate identifiers freely as needed.
Moreover, the issuer must be able to reliably issue each health care
provider only one identifier and to issue each identifier only once.
#2. Meet the needs of the health data standards user community.
The identifier must be comprehensive. It must accommodate all
health care provider types or must be capable of being expanded to do
so. Based on our definition of ``health care provider'', this includes
individual health care providers who are employed by other health care
providers and alternative practitioners who may not be currently
recognized by health plans. The identifier must have the capacity to
enumerate health care providers for many years without reuse of
previously-assigned identifiers. To meet this criterion, we believe
that, over time, the identifier must be capable of uniquely identifying
at least 100 million entities.
#3. Be consistent and uniform with other HIPAA and other private
and public sector health data standards in providing for privacy and
confidentiality.
Confidentiality of certain health care provider data must be
maintained. Certain data elements (for example, social security number
and date of birth) needed to enumerate an individual health care
provider reliably should not be made available to the public.
#10. Incorporate flexibility to adapt more easily to changes.
To meet this criterion, the identifier must be intelligence-free
(the identifier itself should not contain any information about the
health care provider). Intelligence in the identifier would require
issuing a new identifier if there is a change in that information. For
example, an identifier containing a State code would no longer be
accurate if the health care provider moves to another State.
2. Candidate identifiers.
We assessed a number of candidate identifiers to see if they met
the four specific criteria discussed above. We first assessed the
identifiers listed in the inventory of standards prepared for the
Secretary by the Health Informatics Standards Board. Those standards
are the unique physician identification number (UPIN), which is issued
by HCFA; the health industry number (HIN), which is issued by the
Health Industry Business Communications Council; the National
Association of Boards of Pharmacy (NABP) number, which is issued by the
National Council for Prescription Drug Programs in cooperation with the
NABP; and the national provider identifier (NPI), which is being
developed by HCFA.
Unique physician identification numbers are currently issued to
physicians, limited license practitioners, group practices, and certain
noninstitutional providers (for example, ambulance companies). These
numbers are issued to health care providers through Medicare carriers,
and generally only Medicare providers have them. The unique physician
identification number is used to identify ordering, performing,
referring, and attending health care providers in Medicare claims
processing. The computer system that generates the numbers is
maintained by HCFA and is able to detect duplicate health care
providers. The unique physician identification number is in the public
domain and could be made widely accessible to health care providers and
health plans. These numbers do contain intelligence (the first position
designates a provider type, e.g., physician) and are only six positions
long, which would not be able to accommodate a sufficient number of
future health care providers. The unique physician identification
number does not meet criteria 2 and 10.
The health industry number is used for contract administration in
the health industry supply chain, as a prescriber identifier for claims
processing, and for market analysis. It consists of a base 7-position
alpha-numeric identifier and a 2-position alpha-numeric suffix
identifying the location of the prescriber. The suffix contains
intelligence. Health industry numbers can enumerate individual
prescribers as well as institutional providers. They are issued via a
proprietary system maintained by the Health Industry Business
Communications Council, which permits subscriptions to the database by
data re-sellers and others. In addition, it does not collect sufficient
data for thorough duplicate checking of individuals. The health
industry number does not meet criteria 1, 3, and 10.
The National Association of Boards of Pharmacy number is a 7-digit
numeric identifier assigned to licensed pharmacies. It is used to
identify pharmacies to various payers. Its first two digits denote the
State, the next four positions are assigned sequentially, and the last
position is a check digit. We cannot assess data accessibility or
privacy and confidentiality at this time because of the very limited
applicability of the number. A 7-digit numeric identifier would not
yield a sufficient quantity of identifiers, and there is intelligence
in the number. This number does not meet criteria 2 and 10.
The NPI is intended to be a universal identifier, which can be used
to enumerate all types of health care providers, and the supporting
data structure incorporates a comprehensive list of provider types
developed by an ANSI Accredited Standards Committee X12N workgroup. It
is an intelligence-free 8-position alpha-numeric identifier, with the
eighth position being a check digit, allowing for approximately 20
[[Page 25330]]
billion possible identifiers. The NPI would not be proprietary and
would be widely available to the industry. The system that would
enumerate health care providers would be maintained by HCFA, and data
would therefore be safeguarded under the Privacy Act (5 U.S.C 552a).
The system would also incorporate extensive search and duplicate
checking routines into the enumeration process. The NPI meets all four
of these criteria.
In addition, we examined the social security number issued by the
Social Security Administration, the DEA number issued by the Drug
Enforcement Administration, the employer identification number issued
by the Internal Revenue Service, and the national supplier
clearinghouse number issued by the Medicare program and used to
identify suppliers of durable medical equipment and other suppliers.
Neither the social security number nor the DEA number meets the
accessibility test. The use of the social security number by Federal
agencies is protected by the Privacy Act, and the DEA number must
remain confidential in order to fulfill its intended function of
monitoring controlled substances. The employer identification number
does not meet the comprehensiveness test, because some individual
health care providers do not qualify for one. The length of the
national supplier clearinghouse number is 10 positions; to expand it
would make it too long. Also, it is not intelligence-free, since the
first portion of the identifier links health care providers together
into business entities. The last four positions are reserved for
subentities, leaving only the first six positions to enumerate unique
health care provider entities.
Based on this analysis, we recommend the NPI be designated as the
standard identifier for health care providers. It is the only candidate
identifier that meets all four of the criteria above. In addition, the
NPI would be supported by HCFA to assure continuity. As discussed in
section VII. of this preamble, on collection of information
requirements, the data collection and paperwork burdens on users would
be minimal, and the NPI can be used in other standard transactions
under the HIPAA. In addition, as discussed in sections III.B.,
Enumerators, and IX., Impact Analysis, implementation costs per health
care provider and per health plan would be relatively low, and we would
develop implementation procedures. The NPI would be platform and
protocol independent, and the structure of the identifier has been
precisely stated. The NPI is not fully operational, but it is
undergoing testing at this time, and comprehensive testing will be
completed before the identifier is implemented.
3. Consultations.
In the development of the NPI, we consulted with many
organizations, including those that the legislation requires (section
1172(c)(3)(B) of the Act). Subsequently, the NPI has been endorsed by
several government and private organizations:
a. The NCVHS endorsed the NPI in a Federal Register notice on July
24, 1997 (62 FR 39844).
b. The NUBC endorsed the NPI in August 1996.
c. The ADA indicated its support, in concept, of the development of
a unique, singular, national provider identifier for all health care
providers in December 1996.
d. The NUCC supported the establishment of the NPI in January 1997,
subject to the following issues being fully addressed:
The business needs and rationale for each identifier be
clearly established for health care, in both the private and government
sectors, as part of the identifier definition process.
The scope and nature of, and the rationale for, the
entities subject to enumeration be clearly defined.
All issues arising out of the health care industry's
review of the proposed identifier, including any ambiguities in the law
or proposed rule, be acknowledged and addressed.
Distribution of identifier products/maintenance to health
care providers, payers and employers be low cost and efficient. There
should be no cost to have a number assigned to an individual health
care provider or business.
e. WEDI indicated support for ``the general concept of the NPI as
satisfying the national provider identifier requirement of HIPAA'' in a
May 1997 letter to the Secretary. WEDI further stated that the NPI is
equal to or better than alternative identifiers, but noted that it
cannot provide an unqualified opinion until operational and technical
details are disclosed in this regulation.
f. The State of Minnesota endorsed the NPI in Minnesota Statutes
Section 62J.54, dated February 1996.
g. The Massachusetts Health Data Consortium's Affiliated Health
Information Networks of New England endorsed the NPI as the standard
provider locator for electronic data interchange in March 1996.
h. The USA Registration Committee approved the NPI as an
International Standards Organization card issuer identifier in August
1996, for use on magnetic cards.
i. The National Council for Prescription Drug Programs indicated
support for the NPI effort in an October 1996 letter to the Secretary.
E. Requirements
[Please label written and e-mailed comments about this section with
the subject: Requirements.]
1. Health plans.
In Sec. 142.404, Requirements: Health plans, we would require
health plans to accept and transmit, directly or via a health care
clearinghouse, the NPI on all standard transactions wherever required.
Federal agencies and States may place additional requirements on their
health plans.
2. Health care clearinghouses.
We would require in Sec. 142.406, Requirements: Health care
clearinghouses, that each health care clearinghouse use the NPI
wherever an electronic transaction requires it.
3. Health care providers.
In Sec. 142.408, Requirements: Health care providers, we would
require each health care provider that needs an NPI for HIPAA
transactions to obtain, by application if necessary, an NPI and to use
the NPI wherever required on all standard transactions that it directly
transmits or accepts. The process by which health care providers will
apply for and obtain NPIs has not yet been established. This proposed
rule (in section III., Implementation of the NPI) presents
implementation options by which health care providers will apply for
and obtain NPIs. We are seeking comments on the options, and welcome
other options for consideration. In one of the options we are
presenting, we anticipate that the initial enumeration of health care
providers that are already enrolled in Medicare, other Federal programs
named as health plans, and Medicaid would be done by those health
plans. Those health care providers would not have to apply for NPIs but
would instead have their NPIs issued automatically. Non-Federal and
non-Medicaid providers would need to apply for NPIs to a Federally-
directed registry for initial enumeration. The information that will be
needed in order to issue an NPI to a health care provider is discussed
in this preamble in section IV. Data. Depending on the implementation
option selected, Federal and Medicaid health care providers may not
need to provide this information because it would already be available
to the entities that would be enumerating them. In one of the options,
health care providers would be assigned their NPIs in the course of
enrolling in the Federal health plan or in Medicaid. Both options may
require, to some degree, the
[[Page 25331]]
development of an application to be used in applying for an NPI.
We would require each health care provider that has an NPI to
forward updates to the data in the database to an NPI enumerator within
60 days of the date the change occurs. We are soliciting comments on
whether these updates should be applicable to all the data elements
proposed to be included in the national provider file (NPF) or only to
those data elements that are critical for enumeration. For example, we
would like to know whether the addition of a credential should be
required to be reported within the 60-day period, or whether such
updates should be limited to name or address changes or other data
elements that are required to enumerate a health care provider.
F. Effective Dates of the NPI
Health plans would be required to comply with our requirements as
follows:
1. Each health plan that is not a small health plan would have to
comply with the requirements of Secs. 142.104 and 142.404 no later than
24 months after the effective date of the final rule.
2. Each small health plan would have to comply with the
requirements of Secs. 142.104 and 142.404 no later than 36 months after
the effective date of the final rule.
3. If HHS adopts a modification to a standard or implementation
specification, the implementation date of the modification would be no
earlier than the 180th day following the adoption of the modification.
HHS would determine the actual date, taking into account the time
needed to comply due to the nature and extent of the modification. HHS
would be able to extend the time for compliance for small health plans.
Health care clearinghouses and affected health care providers would
have to begin using the NPI no later than 24 months after the effective
date of the final rule.
Failure to comply with standards may result in monetary penalties.
The Secretary is required by statute to impose penalties of not more
than $100 per violation on any person who fails to comply with a
standard, except that the total amount imposed on any one person in
each calendar year may not exceed $25,000 for violations of one
requirement. We will propose enforcement procedures in a future Federal
Register document once the industry has more experience with using the
standards.
III. Implementation of the NPI
[Please label written and e-mailed comments about this section with
the subject: Implementation.]
A. The National Provider System
We would implement the NPI through a central electronic enumerating
system, the national provider system (NPS). This system would be a
comprehensive, uniform system for identifying and uniquely enumerating
health care providers at the national level, not unlike the process now
used to issue social security numbers. HCFA would exercise overall
responsibility for oversight and management of the system. Health care
providers would not interact directly with the NPS.
The process of identifying and uniquely enumerating health care
providers is separate from the process health plans follow in enrolling
health care providers in their health programs. Even with the advent of
assignment of NPIs by the NPS, health plans would still have to follow
their own procedures for receiving and verifying information from
health care providers that apply to them for enrollment in their health
programs. Unique enumeration is less expensive than plan enrollment
because it does not require as much information to be collected,
edited, and verified. We welcome comments on the cost of provider
enrollment in a health plan.
NPIs would be issued by one or more organizations to which we refer
in this preamble as ``enumerators.'' The functions we foresee being
carried out by enumerators are presented in section B. Enumerators in
this preamble. The NPS would edit the data, checking for consistency,
formatting addresses, and validating the social security number. It
would then search the database to determine whether the health care
provider already has an NPI. If so, that NPI would be displayed. If
not, an NPI would be assigned. If the health care provider is similar
(but not identical) to an already-enumerated health care provider, the
information would be passed back to the enumerator for further
analysis. Enumerators would also communicate NPIs back to the health
care providers and maintain the NPS database. The number of enumerators
would be limited in the interest of data quality and consistency.
Because the Medicare program maintains files on more health care
providers than any other health care program in the country, we
envision using data from those files to initially populate the NPF that
is being built by the NPS and would be accessed by the enumerator(s).
The data we are considering for inclusion in this file are described in
section IV. Data in this preamble.
B. Enumerators
The enumerator(s) would carry out the following functions: assist
health care providers and answer questions; accept the application for
an NPI; validate as many of the data elements as possible at the point
of application to assure the submitted data are accurate and the
application is authentic; enter the data into the NPS to obtain an NPI
for the health care provider; research cases where there is a possible
match to a health care provider already enumerated; notify the health
care provider of the assigned NPI; and enter updated data into the NPS
when notified by the health care provider. Some of these functions
would not be necessary if the enumerator(s) is an entity that enrolls
health care providers in its own health plan and would be enumerating
health care providers at the time they are enrolling in the entity's
health plan. For example, if a Federal health plan is an enumerator,
some of the functions listed above would not have to be performed
separately from what the health plan would do in its regular business.
The major issue related to the operation of this process is
determining who the enumerator(s) will be.
1. Possible enumerators.
We had several choices in deciding who should enumerate health care
providers. There are advantages and disadvantages to each of these
choices:
A registry:
A central registry operated under Federal direction would enumerate
all health care providers. The Federally-directed registry could be a
single physical entity or could be a number of agents controlled by a
single entity and operating under common procedures and oversight.
For: The process would be consistent; centralized operation would
assure consistent data quality; the concept of a registry is easy to
understand (single source for identifiers).
Against: The cost of creating a new entity rather than enumerating
as part of existing functions (for example, plan enrollment) would be
greater than having existing entities enumerate; there would be
redundant data required for enumeration and enrollment in a health
plan.
Private organization(s):
A private organization(s) that meets certain selection criteria and
performance standards, which would post a surety bond related to the
number
[[Page 25332]]
of health care providers enumerated could enumerate health care
providers.
For: The organization(s) would operate in a consistent manner under
uniform requirements and standards; failure to maintain prescribed
requirements and standards could result in penalties which could
include suspension or debarment from being an enumerator.
Against: A large number of private enumerators would compromise the
quality of work and be difficult to manage; the administrative work
required to set up arrangements for a private enumerator(s) may be
significant; the cost of creating a new entity rather than enumerating
as part of existing functions (for example, plan enrollment) would be
greater than having existing entities enumerate; there might be
redundant data required for enumeration and enrollment in a health
plan; the legality of privatization would need to be researched.
Federal health plans and Medicaid State agencies:
Federal programs named as health plans and Medicaid State agencies
would enumerate all health care providers. (As stated earlier under the
definition of ``health plan'', the Federal Employees Health Benefits
Program is comprised of numerous health plans, rather than just one,
and does not deal directly with health care providers that are not also
health plans. Thus, the program would not enumerate health care
providers but would still require the NPI to be used.)
For: These health plans already assign numbers to their health care
providers; a large percentage of health care providers do business with
Federal health plans and Medicaid State agencies; there would be no
appreciable costs for these health plans to enumerate as part of their
enrollment process; a small number of enumerators would assure
consistent data quality.
Against: Not all health care providers do business with any of
these health plans; there would be the question of which health plan
would enumerate the health care provider that participates in more than
one; we estimate that approximately 5 percent of the State Medicaid
agencies may decline to take on this additional task.
Designated State agency:
The Governor of each State would designate an agency to be
responsible for enumerating health care providers within the State. The
agency might be the State Medicaid agency, State licensing board,
health department, or some other organization. Each State would have
the flexibility to develop its most workable approach.
For: This choice would cover all health care providers; there would
be a single source of enumeration in each State; States could devise
the least expensive mechanisms (for example, assign NPI during
licensing); license renewal cycles would assure periodic checks on data
accuracy.
Against: This choice would place an unfunded workload on States;
States may decline to designate an agency; there may be insufficient
funding to support the costs the States would incur; State licensing
agencies may not collect enough information during licensing to ensure
uniqueness across States; States may not be uniform in their
definitions of ``providers.''
Professional organizations or training programs:
We would enlist professional organizations to enumerate their
members and/or enable professional schools to enumerate their students.
For: Individuals could be enumerated at the beginning of their
careers; most health care providers either attend a professional school
or belong to an organization.
Against: Not all health care providers are affiliated with an
organization or school; this choice would result in many enumerators
and thus potentially lower the data quality; schools would not be in a
position to update data once the health care provider has graduated;
the choice would place an unfunded workload on schools and/or
organizations.
Health plans:
Health plans in general would have access to the NPS to enumerate
any of their health care providers.
For: Most health care providers do business with one or more health
plans; there would be a relatively low cost for health plans to
enumerate as part of enrollment; this choice would eliminate the need
for redundant data.
Against: Not all health care providers are affiliated with a health
plan; this choice would be confusing for the health care provider in
determining which health plan would enumerate when the health care
provider is enrolled in multiple health plans; there would be a very
large number of enumerators and thus potentially serious data quality
problems; the choice would place unfunded workload on health plans.
Combinations:
We also considered using combinations of these choices to maximize
advantages and minimize disadvantages.
2. Options:
If private organizations, as enumerators, could charge health care
providers a fee for obtaining NPIs, this enumeration option would be
attractive and more preferable than the other choices or combinations,
as it would offer a way to fund the enumeration function. In
researching the legality of this approach, however, we were advised
that we do not have the authority to (1) charge health care providers a
fee for obtaining NPIs, or (2) license private organizations that could
charge health care providers for NPIs. For these reasons, we chose not
to recommend private organizations as enumerators.
The two most viable options are described below. We solicit input
on these options, as well as on alternate solutions.
Option 1: Registry enumeration of all health care providers.
All health care providers would apply directly to a Federally-
directed registry for an identifier. The registry, while under Federal
direction, would probably be operated by an agent or contractor. This
option is favored by some health plans, which believe that a single
entity should be given the task of enumerating health care providers
and maintaining the database for the sake of consistency. It would also
be the simplest option for health care providers, since enumeration
activities would be carried out for all health care providers by a
single entity. The major drawback to this option is the high cost of
establishing a registry large enough to process enumeration and update
requests for the 1.2 million current and 30,000 new (annually) health
care providers that conduct HIPAA transactions. The costs of this
option are discussed in section J.2.d., Enumerators, in the impact
analysis in this Federal Register document. The statute did not provide
a funding mechanism for the enumeration/update process. Federal funds,
if available, could support the registry. We seek comments on funding
mechanisms for the registry.
This option does not offer a clear possibility for funding some of
the costs associated with the operation and maintenance of the NPS as
it becomes national in scope (that is, as the NPS enumerates health
care providers that are not Medicare providers). We solicit comments on
appropriate methods for funding the NPS under this option.
Option 2: A combination of Federal programs named as health plans,
Medicaid State agencies, and a Federally-directed registry.
Federal health plans and Medicaid State agencies would enumerate
their own health care providers. Each health care provider
participating in more than one health plan could choose the health
[[Page 25333]]
plan by which it wishes to be enumerated. All other health care
providers would be enumerated by a Federally-directed registry. These
latter health care providers would apply directly to the registry for
an identifier.
The number of enumerators, and the number of health care providers
per enumerator, would be small enough that each enumerator would be
able to carefully validate data received from and about each of its
health care providers. Moreover, enumerators (aside from the registry)
would be dealing with their own health care providers, an advantage
both in terms of cost equity and data quality. This option recognizes
the fact that Federal plans and Medicaid State agencies already assign
identifiers to their health care providers for their own programmatic
purposes. It would standardize those existing processes and, in some
cases, may increase the amount of data collected or validation
performed. We have concluded that the cost of concurrently enumerating
and enrolling a Medicare or Medicaid provider is essentially the same
as the cost of enrollment alone because of the high degree of
redundancy between the processes. While there would probably be
additional costs initially, they would be offset by savings in other
areas (e.g., there would be a simplified, more efficient coordination
of benefits; a health care provider would only have to be enumerated
once; there would be no need to maintain more than one provider number
for each health care provider; and there would be no need to maintain
more than one enumeration system).
The Federal Government is responsible for 75 percent of Medicaid
State agency costs to enumerate and update health care providers.
Because we believe that, on average, the costs incurred by Medicaid
State agencies in enumerating and updating their own health care
providers to be relatively low and offset by savings, there are no
tangible costs involved.
Allowing these health plans to continue to enumerate their health
care providers would reduce the registry workload and its operating
costs. We estimate that approximately 85 percent of billing health care
providers transact business with a Medicaid State agency or a Federal
health plan. We estimate that 5 percent of Medicaid State agencies may
decline to enumerate their health care providers. If so, that work
would have to be absorbed by the registry. This expense could be offset
by the discontinuation of the UPIN registry, which is currently
maintained with Federal funds. The costs of this option are discussed
in section J.2.d., Enumerators, of the impact analysis.
We welcome comments on the number of health care providers that
would deal directly with a registry under this option and on
alternative ways to enumerate them.
This option does not offer a clear possibility for funding some of
the costs associated with the operation and maintenance of the NPS as
it becomes national in scope (that is, as the NPS enumerates health
care providers that are not Medicare providers). We solicit comments on
appropriate methods for funding the NPS under this option.
We believe that option 2 is the most advantageous and the least
costly. Option 1 is the simplest for health care providers to
understand but has a significant Federal budgetary impact. Option 2
takes advantage of existing expertise and processes to enumerate the
majority of health care providers. This reduces the cost of the
registry in option 2 to a point where it would be largely offset by
savings from eliminating redundant enumeration processes.
3. Fees and costs.
Because the statute did not provide a funding mechanism for the
enumeration process, Federal funds, if available, would be required to
finance this function. We seek comment on any burden that various
financing options might impose on the industry.
We welcome comments on possible ways to reduce the costs of
enumeration.
While the NPS has been developed to date by HCFA with Federal
funds, issues remain as to sources of future funding as the NPS becomes
national in use. We welcome your comments on sources for this funding.
4. Enumeration phases.
We intend to implement the NPI in phases because the number of
potential health care providers to be enumerated is too large to
enumerate at one time, regardless of the number of enumerators. We
describe in a., b., and c. below how the process would work if option 2
were selected and in d. below how implementation of option 1 would
differ.
a. Health care providers that participate in Medicare (including
physicians and other suppliers that furnish items and services covered
by Medicare) would be enumerated first because, as the managing entity,
HCFA has data readily available for all Medicare providers. Health care
providers that are already enrolled in Medicare at the time of
implementation would be enumerated based on existing Medicare provider
databases that have already been reviewed and validated. These health
care providers would not have to request an NPI--they would
automatically receive one. After this initial enumeration, new and non-
Medicare health care providers not yet enumerated that wish to
participate in Medicare would receive an NPI as a part of the
enrollment process.
b. Medicaid and non-Medicare Federal health plans that need to
enumerate their health care providers would follow a similar process,
based on a mutually agreed-upon timetable. Those health plans' existing
prevalidated databases could be used to avoid requiring large numbers
of health care providers to apply for NPIs. If a health care provider
were already enumerated by Medicare, that NPI would be communicated to
the second program. After the initial enumeration, new health care
providers that wish to participate in Medicaid or a Federal health plan
other than Medicare would receive an NPI as a part of that enrollment
process. Health care providers that transact business with more than
one such health plan could be enumerated by any one of those health
plans. This phase would be completed within 2 years after the effective
date of the final rule.
c. A health care provider that does not transact any business with
Federal health plans or Medicaid but that does conduct electronically
any of the transactions stipulated in HIPAA (for example, submits
claims electronically to a private health plan) would be enumerated via
a Federally-directed registry. This enumeration would be done
concurrently with the enumeration described in b., above. Health care
providers would apply to the registry for an NPI.
After the first two phases of enumeration (that is, enumeration of
health care providers enrolled or enrolling in Federal health plans or
Medicaid or health care providers that do not conduct business with any
of those plans but that conduct any of the HIPAA transactions
electronically), the health care providers remaining would be those
that do not conduct electronically any of the transactions specified in
HIPAA. We refer to these health care providers as ``non-HIPAA-
transaction health care providers.'' The non-HIPAA-transaction health
care providers would not be enumerated in the first two phases of
enumeration. We do not intend to enumerate these health care providers
until all health care providers requiring NPIs by statute are
enumerated and funds are available. In some cases, these health care
providers may wish to be enumerated even though
[[Page 25334]]
they do not conduct electronic transactions. Health plans may prefer to
use the NPI for all health care providers, whether or not they submit
transactions electronically, for the sake of processing efficiency. In
addition, some health care providers may wish to be enumerated even
though they conduct no designated transactions and are not affiliated
with any health plan. Additional research is required on the time table
and method by which non-HIPAA-transaction health care providers would
be enumerated.
d. If option 1 were selected, the Federally-directed registry would
enumerate all health care providers. With a single enumeration point
(although it could consist of several agents controlled by a single
entity, as stated earlier), we would envision enumeration taking place
in the following phases: Medicare providers; Medicaid providers and
other non-Medicare Federal providers; health care providers that do not
transact any business with the aforementioned plans but that process
electronically any of the transactions stipulated in HIPAA; and all
other health care providers (i.e., non-HIPAA-transaction health care
providers).
C. Approved Uses of the NPI
The law requires that we specify the appropriate uses of the NPI.
Two years after adoption of this standard (3 years for small health
plans) the NPI must be used in the health care system in connection
with the health-related financial and administrative transactions
identified in section 1173(a). The NPI may also be used as a cross
reference in health care provider fraud and abuse files and other
program integrity files (for example, the HHS Office of the Inspector
General sanction file). The NPI may be used to identify health care
providers for debt collection under the provisions of the Debt
Collection Information Act of 1996 and the Balanced Budget Act of 1997,
and for any other lawful activity requiring individual identification
of health care providers. It may not be used in any activity otherwise
prohibited by law.
Other examples of approved uses would include:
Health care providers may use their own NPIs to identify
themselves in health care transactions or related correspondence.
Health care providers may use other health care providers'
NPIs as necessary to complete health care transactions and on related
correspondence.
Health care providers may use their own NPIs on
prescriptions (however, the NPI could not replace the DEA number or
State license number where either of those numbers is required on
prescriptions).
Health plans may use NPIs in their internal provider files
to process transactions and may use them on transactions and in
communications with health care providers.
Health plans may communicate NPIs to other health plans
for coordination of benefits.
Health care clearinghouses may use NPIs in their internal
files to create and process standard transactions and in communications
with health care providers and health plans.
NPIs may be used to identify treating health care
providers in patient medical records.
D. Summary of Effects on Various Entities
We summarize here how the implementation of the NPI would affect
health care providers, health plans, and health care clearinghouses, if
option 2 were selected. Differences that would result from selection of
option 1 are noted parenthetically.
1. Health care providers.
a. Health care providers interacting with Medicare, another Federal
plan, or a Medicaid State agency would receive their NPIs from the NPS
via one of those programs and would be required to use their NPIs on
all the specified electronic transactions. Each plan would establish
its own schedule for adopting the NPI, within the time period specified
by the law. Whether a given plan would automatically issue the NPIs or
require the health care providers to apply for them would be up to the
plan. (For example, the Medicare program would issue NPIs automatically
to its currently enrolled Medicare providers and suppliers; data on its
future health care providers and suppliers would be collected on the
Medicare enrollment application.) The Federal or State plan may impose
requirements other than those stated in the regulations.
The health care providers would be required to update any data
collected from them by submitting changes to the plan within 60 days of
the change. Health care providers that transact business with multiple
plans could report changes to any one of them. (Selection of option 1
would mean that the health care provider would obtain the NPI from, and
report changes to, the Federally-directed registry.)
b. Health care providers that conduct electronic transactions but
do not do so with Federal health plans or Medicaid would receive their
NPIs from the NPS via the Federally-directed registry and would be
required to use their NPIs on all the specified electronic
transactions. Each health plan would establish its own schedule for
adopting the NPI, within the time period specified by the law. The
health care providers would be required to update any data originally
collected from them by submitting changes within 60 days of the date of
the change to the Federally-directed registry.
c. Health care providers that are not covered by the above
categories would not be required to obtain an NPI. (These health care
providers are the non-HIPAA-transaction health care providers as
described in section 4.c. of section B. Enumerators earlier in this
preamble.) They may be enumerated if they wish, depending on
availability of funds, but they would not be issued NPIs until those
health care providers that currently conduct electronic transactions
have received their NPIs. As stated earlier, the timetable and method
by which the non-HIPAA-transaction health care providers would be
enumerated must be determined. After the non-HIPAA-transaction health
care providers are enumerated, they would be required to update any
data originally collected from them by submitting changes within 60
days of the date of the change. Those providers would report their
changes to the registry or to a Federal plan or Medicaid State agency
with which they transact business at the time of the change.
2. Health plans.
a. Medicare, other Federal health plans, and Medicaid would be
responsible for obtaining NPIs from the NPS and issuing them to their
health care providers. They would be responsible for updating the data
base with data supplied by their health care providers. (Selection of
option 1 would mean that Medicare, other Federal health plans, and
Medicaid would not enumerate health care providers or update their
data.)
These government health plans would establish their own schedule
for adopting the NPI, within the time period specified by the law. They
would be able to impose requirements on their health care providers in
addition to, but not inconsistent with, those in our regulations.
b. Each remaining health plan would be required to use the NPI to
identify health care providers in electronic transactions as provided
by the statute. Each health plan would establish its own schedule for
adopting the NPI, within the time period specified by the law. They
would be able to impose requirements on their health care providers in
addition to, but not inconsistent with, those in our regulations.
[[Page 25335]]
3. Health care clearinghouses.
Health care clearinghouses would be required to use a health care
provider's NPI on electronic standard transactions requiring an NPI
that are submitted on the health care provider's behalf.
IV. Data
[Please label written and e-mailed comments about this section with
the subject: DATA.]
A. Data Elements
The NPS would collect and store in the NPF a variety of information
about a health care provider, as shown in the table below. We believe
the majority of this information is used to uniquely identify a health
care provider; other information is used for administrative purposes. A
few of the data elements are collected at the request of potential
users that have been working with HCFA in designing the database prior
to the passage of HIPAA. All of these data elements represent only a
fraction of the information that would comprise a provider enrollment
file. The data elements in the table, plus cease/effective/termination
dates, switches (yes/no), indicators, and history, are being considered
as those that would form the NPF. We have included comments, as
appropriate. The table does not display systems maintenance or similar
fields, or health care provider cease/effective/termination dates.
National Provider File Data Elements
------------------------------------------------------------------------
Data elements Comments Purpose
------------------------------------------------------------------------
National Provider Identifier 8-position alpha- I
(NPI). numeric NPI assigned
by the NPS.
Provider's current name......... For Individuals only. I
Includes first,
middle, and last names.
Provider's other name........... For Individuals only. I
Includes first,
middle, and last
names. Other names
might include maiden
and professional names.
Provider's legal business name.. For Groups and I
Organizations only.
Provider's name suffix.......... For Individuals only. I
Includes Jr., Sr., II,
III, IV, and V.
Provider's credential For Individuals only. I
designation. Examples are MD, DDS,
CSW, CNA, AA, NP, RNA,
PSY.
Provider's Social Security For Individuals only... I
Number (SSN).
Provider's Employer Employer Identification I
Identification Number (EIN). Number.
Provider's birth date........... For Individuals only... I
Provider's birth State code..... For Individuals only... I
Provider's birth county name.... For Individuals only... I
Provider's birth country name... For Individuals only... I
Provider's sex.................. For Individuals only... I
Provider's race................. For Individuals only... U
Provider's date of death........ For Individuals only... I
Provider's mailing address...... Includes 2 lines of A
street address, plus
city, State, county,
country, 5- or 9-
position ZIP code.
Provider's mailing address ....................... A
telephone number.
Provider's mailing address fax ....................... A
number.
Provider's mailing address e- ....................... A
mail address.
Resident/Intern code............ For certain Individuals U
only.
Provider enumerate date......... Date provider was A
enumerated (assigned
an NPI). Assigned by
the NPS.
Provider update date............ Last date provider data A
was updated. Assigned
by the NPS.
Establishing enumerator/agent Identification number A
number. of the establishing
enumerator.
Provider practice location 2-position alpha- I
identifier (location code). numeric code (location
code) assigned by the
NPS.
Provider practice location name. Title (e.g., ``doing I
business as'' name) of
practice location.
Provider practice location Includes 2 lines of I
address. street address, plus
city, State, county,
country, 5- or 9-
position ZIP code.
Provider's practice location ....................... A
telephone number.
Provider's practice location fax ....................... A
number.
Provider's practice location e- ....................... A
mail address.
Provider classification......... From Accredited I
Standards Committee
X12N taxonomy.
Includes type(s),
classification(s),
area(s) of
specialization.
Provider certification code..... For certain Individuals U
only.
Provider certification For certain Individuals U
(certificate) number. only.
Provider license number......... For certain Individuals I
only.
Provider license State.......... For certain Individuals I
only.
School code..................... For certain Individuals I
only.
School name..................... For certain Individuals I
only.
School city, State, country..... For certain Individuals U
only.
School graduation year.......... For certain Individuals I
only.
Other provider number type...... Type of provider I
identification number
also/formerly used by
provider: UPIN, NSC,
OSCAR, DEA, Medicaid
State, PIN, Payer ID.
Other provider number........... Other provider I
identification number
also/formerly used by
provider.
Group member name............... For Groups only. Name I
of Individual member
of group. Includes
first, middle, and
last names.
Group member name suffix........ For Groups only. This I
is the Individual
member's name suffix.
Includes Jr., Sr., II,
III, IV, and V.
[[Page 25336]]
Organization type control code.. For certain U
Organizations only.
Includes Government--
Federal (Military),
Government--Federal
(Veterans),
Government--Federal
(Other), Government--
State/County,
Government--Local,
Government--Combined
Control, Non-
Government--Non-
profit, Non-
Government--For
Profit, and Non-
Government--Not for
Profit.
------------------------------------------------------------------------
Key:
I--Used for the unique identification of a provider.
A--Used for administrative purposes.
U--Included at the request of potential users (optional).
We need to consider the benefits of retaining all of the data
elements shown in the table versus lowering the cost of maintaining the
database by keeping only the minimum number of data elements needed for
unique provider identification. We solicit input on the composition of
the minimum set of data elements needed to uniquely identify each type
of provider. In order to consider the inclusion or exclusion of data
elements, we need to assess their purpose and use.
The data elements with a purpose of ``I'' are needed to identify a
health care provider, either in the search process (which is
electronic) or in the investigation of health care providers designated
as possible matches by the search process. These data elements are
critical because unique identification is the keystone of the NPS.
The data elements with a purpose of ``A'' are not essential to the
identification processes mentioned above, but nonetheless are valuable.
Certain ``A'' data elements can be used to contact a health care
provider for clarification of information or resolution of issues
encountered in the enumeration process and for sending written
communications; other ``A'' data elements (e.g., Provider Enumerate
Date, Provider Update Date, Establishing Enumerator/Agent Number) are
used to organize and manage the data.
Data elements with a purpose of ``U'' are collected at the request
of potential users of the information in the system. While not used by
the system's search process to uniquely identify a health care
provider, Race is nevertheless valuable in the investigation of health
care providers designated as possible matches as a result of that
process. In addition, Race is important to the utility of the NPS as a
statistical sampling frame. We solicit comments on the statistical
validity of Race data. Race is collected ``as reported''; that is, it
is not validated. It is not maintained, only stored. The cost of
keeping this data element is virtually nil. Other data elements
(Resident/Intern Code, Provider Certification Code and Number, and
Organization Type Control Code) with a purpose of ``U'', while not used
for enumeration of a health care provider, have been requested to be
included by some members of the health care industry for reports and
statistics. These data elements are optional and do not require
validation; many remain constant by their nature; and the cost to store
them is negligible.
The data elements that we judge will be expensive to either
validate or maintain (or both) are the license information, provider
practice location addresses, and membership in groups. We solicit
comments on whether these data elements are necessary for the unique
enumeration of health care providers and whether validation or
maintenance is required for that purpose.
Licenses may be critical in determining uniqueness of a health care
provider (particularly in resolving identities involving compound
surnames) and are, therefore, considered to be essential by some.
License information is expensive to validate initially, but not
expensive to maintain because it does not change frequently.
The practice location addresses can be used to aid in investigating
possible provider matches, in converting existing provider numbers to
NPIs, and in research involving fraud or epidemiology. Location codes,
which are discussed in detail in section B. Practice Addresses and
Group/Organization Options below, could be assigned by the NPS to point
to and identify practice locations of individuals and groups. Some
potential users felt that practice addresses changed too frequently to
be maintained efficiently at the national level. The average Medicare
physician has two to three addresses at which he/she practices. Group
providers may have many more practice locations. We estimate that 5
percent of health care providers require updates annually, and that
addresses are one of the most frequently changing attributes. As a
result, maintaining more than one practice address for an individual
provider on a national scale could be burdensome and time consuming.
Many potential users believe that practice addresses could more
adequately be maintained at local, health-plan specific levels.
Some potential users felt that membership in groups was useful in
identifying health care providers. Many others, however, felt that
these data are highly volatile and costly to maintain. These users felt
it was unlikely that membership in groups could be satisfactorily
maintained at the national level.
We welcome your comments on the data elements proposed for the NPF
and input as to the potential usefulness and tradeoffs for these
elements such as those discussed above.
We specifically invite comments and suggestions on how the
enumeration process might be improved to prevent issuance of multiple
NPIs to a health care provider.
B. Practice Addresses and Group/Organization Options
We have had extensive consultations with health care providers,
health plans, and members of health data standards organizations on the
requirements for provider practice addresses and on the group and
organization data in the NPS. (It is important to note that the NPS is
designed to capture a health care provider's mailing address. The
mailing address is a data element separate from the practice address,
and, as such, is not the subject of the discussion below.) Following
are the major questions relating to these issues:
Should the NPS capture practice addresses of health care
providers?
For: Practice addresses could aid in non-electronic matching of
health care providers and in conversion of existing provider number
systems to NPIs. They could be useful for research specific to practice
location; for example, involving fraud or epidemiology.
Against: Practice addresses would be of limited use in the
electronic identification and matching of health care providers. The
large number of practice locations of some group
[[Page 25337]]
providers, the frequent relocation of provider offices, and the
temporary situations under which a health care provider may practice at
a particular location would make maintenance of practice addresses
burdensome and expensive.
Should the NPS assign a location code to each practice
address in a health care provider's record? The location code would be
a 2-position alphanumeric data element. It would be a data element in
the NPS but would not be part of the NPI. It would point to a certain
practice address in the health care provider's record and would be
usable only in conjunction with that health care provider's NPI. It
would not stand alone as a unique identifier for the address.
For: The location code could be used to designate a specific
practice address for the health care provider, eliminating the need to
perform an address match each time the address is retrieved. The
location code might be usable, in conjunction with a health care
provider's NPI, as a designation for service location in electronic
health transactions.
Against: Location codes should not be created and assigned
nationally unless required to support standard electronic health
transactions; this requirement has not been demonstrated. The format of
the location code would allow for a lifetime maximum of 900 location
codes per health care provider; this number may not be adequate for
groups with many locations. The location code would not uniquely
identify an address; different health care providers practicing at the
same address would have different location codes for that address,
causing confusion for business offices that maintain data for large
numbers of health care providers.
Should the NPS link the NPI of a group provider to the
NPIs of the individual providers who are members of the group?
For: Linkage of the group NPI to individual members' NPIs would
provide a connection from the group provider, which is possibly not
licensed or certified, to the individual members who are licensed,
certified or otherwise authorized to provide health care services.
Against: The large number of members of some groups and the
frequent moves of individuals among groups would make national
maintenance of group membership burdensome and expensive. Organizations
that need to know group membership prefer to maintain this information
locally, so that they can ensure its accuracy for their purposes.
Should the NPS collect the same data for organization and
group providers? There would be no distinction between organization and
group providers. Each health care provider would be categorized in the
NPS either as an individual or as an organization. Each separate
physical location or subpart of an organization that needed to be
identified would receive its own NPI. The NPS would not link the NPI of
an organization provider to the NPI of any other health care provider,
although all organizations with the same employer identification number
(EIN) or same name would be retrievable via a query on that EIN or
name.
For: The categorization of health care providers as individuals or
organizations would provide flexibility for enumeration of integrated
provider organizations. Eliminating the separate category of group
providers would eliminate an artificial distinction between groups and
organizations. It would eliminate the possibility that the same entity
would be enumerated as both a group and an organization. It would
eliminate any need for location codes for groups. It would allow
enumeration at the lowest level that needs to be identified, offering
flexibility for enumerators, health plans or other users of NPS data to
link organization NPIs as they require in their own systems.
Against: A single business entity could have multiple NPIs,
corresponding to its physical locations or subparts.
Possible Approaches:
We present two alternatives to illustrate how answers to the
questions posed above would affect enumeration and health care provider
data in the NPS. Since the results would depend upon whether the health
care provider is an individual, organization, or group, we refer the
reader to section II.B.3., Definitions, of this preamble.
Alternative 1:
The NPS would capture practice addresses. It would assign a
location code for each practice address of an individual or group
provider. Organization and group providers would be distinguished and
would have different associated data in the NPS. Organization providers
could have only one location per NPI and could not have individuals
listed as members. Group providers could have multiple locations with
location codes per NPI and would have individuals listed as members.
For individual providers, the NPS would capture each practice
address and assign a corresponding location code. The NPS would link
the NPIs of individuals who are listed as members of a group with the
NPI of their group.
For organization providers, the NPS would capture the single active
practice address. It would not assign a corresponding location code.
For group providers, the NPS would capture each practice address
and assign a corresponding location code. The NPS would link the NPI of
a group with the NPIs of all individuals who are listed as members of
the group. A group location would have a different location code in the
members' individual records and the group record.
Alternative 2:
The NPS would capture only one practice address for an individual
or organization provider. It would not assign location codes. The NPS
would not link the NPI of a group provider to the NPIs of individuals
who are members of the group. Organization and group providers would
not be distinguished from each other in the NPS. Each health care
provider would be categorized as either an individual or an
organization.
For individual providers, the NPS would capture a single practice
address. It would not assign a corresponding location code.
For organization providers, each separate physical location or
subpart that needed to be identified would receive its own NPI. The NPS
would capture the single active practice address of the organization.
It would not assign a corresponding location code.
Recent consultations with health care providers, health plans, and
members of health data standards organizations have indicated a growing
consensus for Alternative 2 discussed above. Representatives of these
organizations feel that Alternative 2 will provide the data needed to
identify the health care provider at the national level, while reducing
burdensome data maintenance associated with provider practice location
addresses and group membership. We welcome comments on these and other
alternatives for collection of practice location addresses and
assignment of location codes, and on the group and organization
provider data within the NPS.
V. Data Dissemination
[Please label written and e-mailed comments about this section with
the subject: Dissemination.]
We are making information from the NPS available so that the
administrative simplification provisions of the law can be implemented
smoothly and efficiently. In addition to the health care provider's
name and NPI, it is important to make available other information
[[Page 25338]]
about the health care provider so that people with existing health care
provider files can associate their health care providers with the
appropriate NPIs. The data elements we are proposing to disseminate are
the ones that our research has shown will be most beneficial in this
matching process. The information needs to be disseminated to the
widest possible audience because the NPIs would be used in a vast
number of applications throughout the health care industry.
We propose to charge fees for the dissemination of such items as
data files and directories, but the fees would not exceed the costs of
the dissemination.
We would establish two levels of users of the data in the NPS for
purposes of disseminating information. Some of the data that would be
collected in order to assign NPIs would be confidential and not be
disclosed to those without a legitimate right of access to the
confidential data.
Level I--Enumerators
Access to the NPS would be limited to approved enumerators for the
system that would be specifically listed in 45 CFR part 142. We would
publish ``routine uses'' for the data concerning individuals in a
Privacy Act systems of records notice. The notice is being developed
and will be available during the comment period for this proposed rule.
Enumerators would have access to all data elements for all health
care providers in order to accurately resolve potential duplicate
situations (that is, the health care provider may already have been
enumerated). Enumerators would be required to protect the privacy of
the data in accordance with the Privacy Act.
Enumerators would have access to the on-line NPS and would also
receive periodic batch update files from HCFA.
Level II--The Public
The public (which includes individuals, health care providers,
software vendors, health plans that are not enumerators, and health
care clearinghouses) would have access to selected data elements.
The table below lists the data comprising the NPF, as described in
section IV. A. Data Elements, and indicates the dissemination level
(Level I or Level II).
Dissemination of Information From the National Provider File
------------------------------------------------------------------------
Dissemination
Data elements level Comments
------------------------------------------------------------------------
National Provider Identifier I and II.......... 8-position alpha-
(NPI). numeric NPI assigned
by the NPS.
Provider's current name...... I and II.......... For Individuals only.
Includes first,
middle, and last
names.
Provider's other name........ I and II.......... For Individuals only.
Includes first,
middle, and last
names. Other names
might include maiden
and professional
names.
Provider's legal business I and II.......... For Groups and
name. Organizations only.
Provider's name suffix....... I and II.......... For Individuals only.
Includes Jr., Sr.,
II, III, IV, and V.
Provider's credential I and II.......... For Individuals only.
designation. Examples are MD,
DDS, CSW, CNA, AA,
NP, RNA, PSY.
Provider's Social Security I only............ For Individuals only.
Number (SSN).
Provider's Employer I only............ Employer
Identification Number (EIN). Identification
Number.
Provider's birth date........ I only............ For Individuals only.
Provider's birth State code.. I only............ For Individuals only.
Provider's birth county name. I only............ For Individuals only.
Provider's birth country name I only............ For Individuals only.
Provider's sex............... I only............ For Individuals only.
Provider's race.............. I only............ For Individuals only.
Provider's date of death..... I only............ For Individuals only.
Provider's mailing address... I and II.......... Includes 2 lines of
street address, plus
city, State, county,
country, 5- or 9-
position ZIP code.
Provider's mailing address I only. .....................
telephone number.
Provider's mailing address I only. .....................
fax number.
Provider's mailing address e- I only. .....................
mail address.
Resident/Intern code......... I and II.......... For certain
Individuals only.
Provider enumerate date...... I and II.......... Date provider was
enumerated (assigned
an NPI). Assigned by
the NPS.
Provider update date......... I and II.......... Last date provider
data was updated.
Assigned by the NPS.
Establishing enumerator/agent I only............ Identification number
number. of the establishing
enumerator.
Provider practice location I and II.......... 2-position alpha-
identifier (location code). numeric code
(location code)
assigned by the NPS.
Provider practice location I and II.......... Title (e.g., ``doing
name. business as'' name)
of practice
location.
Provider practice location I and II.......... Includes 2 lines of
address. street address, plus
city, State, county,
country, 5- or 9-
position ZIP code.
Provider's practice location I only. .....................
telephone number.
Provider's practice location I only. .....................
fax number.
Provider's practice location I only. .....................
e-mail address.
Provider classification...... I and II.......... From Accredited
Standards Committee
X12N taxonomy.
Includes type(s),
classification(s),
area(s) of
specialization.
Provider certification code.. I only............ For certain
Individuals only.
Provider certification I only............ For certain
(certificate) number. Individuals only.
Provider license number...... I only............ For certain
Individuals only.
Provider license State....... I only............ For certain
Individuals only.
School code.................. I only............ For certain
Individuals only.
School name.................. I only............ For certain
Individuals only.
School city, State, country.. I only............ For certain
Individuals only.
School graduation year....... I only............ For certain
Individuals only.
[[Page 25339]]
Other provider number type... I and II.......... Type of provider
identification
number also/formerly
used by provider:
UPIN, NSC, OSCAR,
DEA, Medicaid State,
PIN, Payer ID.
Other provider number........ I and II.......... Other provider
identification
number also/formerly
used by provider.
Group member name............ I and II.......... For Groups only. Name
of Individual member
of group. Includes
first, middle, and
last names.
Group member name suffix..... I and II.......... For Groups only. This
is the Individual
member's name
suffix. Includes
Jr., Sr., II, III,
IV, and V.
Organization type control I and II.......... For certain
code. Organizations only.
Includes Government--
Federal (Military),
Government--Federal
(Veterans),
Government--Federal
(Other), Government--
State/County,
Government--Local,
Government--Combined
Control, Non-
Government--Non-
profit, Non-
Government--For
Profit, and Non-
Government--Not for
Profit.
------------------------------------------------------------------------
Clearly, the access to the public data would have to be electronic
in order to support the more frequent users. We are asking for comments
on exactly what should be available in hardcopy, what types of
electronic formats are necessary (for example, diskette, CD ROM, tape,
cartridge, and via Internet), and frequency of update. We anticipate
making these data as widely available as feasible. We note that the
UPIN Directory (currently available to the public) would be
discontinued and replaced with a similar document or electronic file
once the NPS is in place.
We initially envisioned limiting access to the second level to
health plans and other entities involved in electronic transactions and
adding a third level of access, which would make a more abbreviated
data set available to the general public. This was in keeping with the
past policy of not disclosing physicians' practice addresses. Recent
court decisions and our broader goal of beneficiary education caused us
to choose a broader data dissemination strategy. We welcome comments on
this point.
VI. New and Revised Standards
[Please label written and e-mailed comments about this section with
the subject: Revisions.]
To encourage innovation and promote development, we intend to
develop a process that would allow an organization to request a
revision or replacement to any adopted standard or standards.
An organization could request a revision or replacement to an
adopted standard by requesting a waiver from the Secretary of Health
and Human Services to test a revised or new standard. The organization
must, at a minimum, demonstrate that the revised or new standard offers
an improvement over the adopted standard. If the organization presents
sufficient documentation that supports testing of a revised or new
standard, we want to be able to grant the organization a temporary
waiver to test while remaining in compliance with the law. The waiver
would be applicable to standards that could change over time; for
example, transaction standards. We do not intend to establish a process
that would allow an organization to avoid using any adopted standard.
We would welcome comments on the following: (1) How we should
establish this process, (2) the length of time a proposed standard
should be tested before we decide whether to adopt it, (3) whether we
should solicit public comments before implementing a change in a
standard, and (4) other issues and recommendations we should consider
in developing this process.
Following is one possible process:
Any organization that wishes to revise or replace an
adopted standard must submit its waiver request to an HHS evaluation
committee (not currently established or defined). The organization must
do the following for each standard it wishes to revise or replace:
+ Provide a detailed explanation, no more than 10 pages in length,
of how the revision or replacement would be a clear improvement over
the current standard in terms of the principles listed in section I.D.,
Process for developing national standards, of this preamble.
+ Provide specifications and technical capabilities on the revised
or new standard, including any additional system requirements.
+ An explanation, no more than 5 pages in length, of how the
organization intends to test the standard.
The committee's evaluation would, at a minimum, be based
on the following:
+ A cost-benefit analysis.
+ An assessment of whether the proposed revision or replacement
demonstrates a clear improvement to an existing standard.
+ The extent and length of time of the waiver.
The evaluation committee would inform the organization
requesting the waiver within 30 working days of the committee's
decision on the waiver request. If the committee decides to grant a
waiver, the notification may include the following:
+ Committee comments such as the following:
--The length of time for which the waiver applies if it differs from
the waiver request.
--The sites the committee believes are appropriate for testing if they
differ from the waiver request.
--Any pertinent information regarding the conditions of an approved
waiver.
Any organization that receives a waiver would be required
to submit a report containing the results of the study, no later than 3
months after the study is completed.
The committee would evaluate the report and determine
whether the benefits of the proposed revision or new standard
significantly outweigh the disadvantages of implementing it and make a
recommendation to the Secretary.
VII. Collection of Information Requirements
Under the Paperwork Reduction Act of 1995, we are required to
provide 60-day notice in the Federal Register and solicit public
comment before a collection of information requirement is submitted to
the Office of Management and Budget (OMB) for review and approval. In
order to fairly evaluate whether an information collection should be
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act
of 1995 requires that we solicit comment on the following issues:
[[Page 25340]]
The need for the information collection and its usefulness
in carrying out the proper functions of our agency.
The accuracy of our estimate of the information collection
burden.
The quality, utility, and clarity of the information to be
collected.
Recommendations to minimize the information collection
burden on the affected public, including automated collection
techniques.
Section 142.408(a), (c) Requirements: Health Care Providers
In summary, each health care provider would be required to obtain,
by application if necessary, a national provider identifier and
communicate any changes to the data elements in its file in the
national provider system to an enumerator of national provider
identifiers within 60 days of the change.
Discussion:
We are especially interested in receiving comments on the possible
methods of managing the provider enumeration process. Given the
multitude of possible methods associated with managing the enumeration
process, we are unable to provide an accurate burden estimate at this
time. Below is the repeated provider identifier enumeration discussion,
from section II., Provisions of Proposed Regulations, E. Requirements,
3. Health care providers, of this preamble.
The process by which health care providers will apply for and
obtain NPIs has not yet been established. This proposed rule (in
section III., Implementation of the NPI) presents implementation
options by which health care providers would apply for and obtain NPIs.
We are seeking comments on the options and welcome other options for
consideration.
In one of the options we are presenting, we anticipate that the
initial enumeration of health care providers that are already enrolled
in Medicare, other Federal programs named as health plans, and Medicaid
would be done by those health plans. Those health care providers would
not have to apply for NPIs but would instead have their NPIs issued
automatically. Non-Federal and non-Medicaid providers would need to
apply for NPIs to a Federally-directed registry for initial
enumeration. The information that would be needed in order to issue an
NPI to a health care provider is discussed in this preamble in section
IV., Data. Depending on the implementation option selected, Federal and
Medicaid health care providers may not need to provide this information
because it would already be available to the entities that would be
enumerating them. In one of the options, health care providers would be
assigned their NPIs in the course of enrolling in the Federal health
plan or in Medicaid. Both options may require, to some degree, the
development of an application to be used in applying for an NPI.
We would require each health care provider that has an NPI to
forward updates to the data in the database to an NPI enumerator within
60 days of the date the change occurs. We are soliciting comments on
whether these updates should be applicable to all the data elements
proposed to be included in the NPF or only to those data elements that
are critical for enumeration. For example, we would like to know
whether the addition of a credential should be required to be reported
within the 60-day period or whether such updates should be limited to
name or address changes or other data elements that are required to
enumerate a health care provider.
Given the multitude of possible methods of implementing the
enumeration process we are soliciting public comment on each of the
following issues, before we submit a copy of this document to the
Office of Management and Budget (OMB) for its review of these
information collection requirements.
Sections 142.404 and 142.408(b) Requirements: Health Plans and
Requirements: Health Care Providers
In summary, each health plan would be required to accept and
transmit, either directly or via a health care clearinghouse, the NPI
of any health care provider required in any standard transaction. Also,
each health care provider must use NPIs wherever required on all
standard transactions it accepts or transmits directly.
Discussion:
The emerging and increasing use of health care EDI standards and
transactions raises the issue of the applicability of the PRA. The
question arises whether a regulation that adopts an EDI standard used
to exchange certain information constitutes an information collection
subject to the PRA. However, for the purpose of soliciting useful
public comment we provide the following burden estimates.
In particular, the initial burden on the estimated 4 million health
plans and 1.2 million health care providers to modify their current
computer systems software would be 2 hours/$60 per entity, for a total
burden of 10.4 million hours/$312 million. While this burden estimate
may appear low, on average, we believe it to be accurate. This is based
on the assumption that these and the other burden calculations
associated with HIPAA administrative simplification systems
modifications may overlap. This average also takes into consideration
that (1) this standard may not be used by several of the entities
included in the estimate, (2) this standard may already be in use by
several of the entities included in the estimate, (3) modifications may
be performed in an aggregate manner during the course of routine
business and/or, (4) modifications may be made by contractors, such as
practice management vendors, in a single effort for a multitude of
affected entities.
We invite public comment on the issues discussed above. If you
comment on these information collection and recordkeeping requirements,
please e-mail comments to JB[email protected] (Attn:HCFA-0045) or mail
copies directly to the following:
Health Care Financing Administration, Office of Information Services,
Information Technology Investment Management Group, Division of HCFA
Enterprise Standards, Room C2-26-17, 7500 Security Boulevard,
Baltimore, MD 21244-1850. Attn: John Burke HCFA-0045.
and,
Office of Information and Regulatory Affairs, Office of Management and
Budget, Room 10235, New Executive Office Building, Washington, DC
20503, Attn: Allison Herron Eydt, HCFA Desk Officer.
VIII. Response to Comments
Because of the large number of items of correspondence we normally
receive on Federal Register documents published for comment, we are not
able to acknowledge or respond to them individually. We will consider
all comments we receive by the date and time specified in the DATES
section of this preamble, and, if we proceed with a subsequent
document, we will respond to the comments in the preamble to that
document.
IX. Impact Analysis
A. Executive Summary
The costs of implementing the standards specified in the statute
are primarily one-time or short-term costs related to conversion. These
costs include system conversion/upgrade costs, start-up costs of
automation, training costs, and costs associated with implementation
problems. These costs will be incurred during the first three years of
implementation. The benefits of EDI include reduction in manual data
entry, elimination of postal service delays, elimination of the costs
[[Page 25341]]
associated with the use of paper forms, and the enhanced ability of
participants in the market to interact with each other.
In our analysis, we have used the most conservative figures
available and have taken into account the effects of the existing trend
toward electronic health care transactions. Based on this analysis, we
have determined that the benefits attributable to the implementation of
administrative simplification will accrue almost immediately but will
not exceed costs for health care providers and health plans until after
the third year of implementation. After the third year, the benefits
will continue to accrue into fourth year and beyond. The total net
savings for the period 1998-2002 will be $1.5 billion (a net savings of
$1.7 billion for health plans, and a net cost of $.2 billion for health
care providers). The single year net savings for the year 2002 will be
$3.1 billion ($1.6 billion for plans and $1.5 billion for providers).
B. Introduction
We assessed several strategies for determining the impact of the
various standards that the Secretary will designate under the statute.
We could attempt to analyze the costs and savings of each individual
standard independently or we could analyze the costs and savings of all
the standards in the aggregate. We chose to base our analysis on the
aggregate impact of all the standards. Assessing the cost of
implementing each standard independently would yield inflated costs.
The statute gives health care providers and health plans 24 months (36
months for small health plans) to implement each standard after it is
designated. This will give the industry flexibility in determining the
most cost-effective way of implementing the standards. A health plan
may decide to implement more than one standard at a time or to combine
implementation of a standard with other system changes dictated by its
own business needs. As a result, overall estimates will be more
accurate than individual estimates.
Assessing the benefits of implementing each standard independently
would also be inaccurate. While each individual standard is beneficial,
the standards as a whole have a synergistic effect on savings. For
example, the combination of the standard health plan identifier and
standard claim format would improve the coordination of benefits
process to a much greater extent than either standard individually.
Clearly, the costs and benefits described in this impact analysis are
dependent upon all of the rules being published at roughly the same
time.
It is difficult to assess the costs and benefits of such a sweeping
change with no historical experience. Moreover, we do not yet know
enough about the issues and options related to the standards that are
still being developed to be able to discuss them here. Our analysis, as
a result, will be primarily qualitative and somewhat general. In order
to address that shortcoming, we have added a section discussing
specific issues related to the provider identifier standard. In each
subsequent regulation, we will, if appropriate, include a section
discussing the specifics of the standard or standards being designated
in the regulation. In addition, we will update this analysis to reflect
any additional cost/benefit information that we receive from the public
during the comment period for the proposed rule. We solicit comments on
this approach and on our assumptions and conclusions.
C. Overall Cost/Benefit Analysis
In order to assess the impact of the HIPAA administrative
simplification provisions, it is important to understand current
industry practices. A 1993 study by Lewin-VHI (1, p. 4) estimated that
administrative costs comprised 17 percent of total health expenditures.
Paperwork inefficiencies are a component of those costs, as are the
inefficiencies caused by the more than 400 different data transmission
formats currently in use. Industry groups such as ANSI ASC X12N have
developed standards for EDI transactions, which are used by some health
plans and health care providers. However, migration to these recognized
standards has been hampered by the inability to develop a concerted
approach, and even ``standard'' formats such as the Uniform Bill (UB-
92), the standard Medicare hospital claim form (which is used by most
hospitals, skilled nursing facilities, and home health agencies for
inpatient and outpatient claims) are customized by plans and health
care providers.
Several reports have made estimates of the costs and/or benefits of
implementing electronic data interchange (EDI) standards. In assessing
the impact of the HIPAA administrative simplification provisions, the
Congressional Budget Office reported that:
``The direct cost of the mandates in Title II of the bill would
be negligible. Health plans (and those providers who choose to
submit claims electronically) would be required to modify their
computer software to incorporate new standards as they are adopted
or modified. . . . Uniform standards would generate offsetting
savings for plans and providers by simplifying the claims process
and coordination of benefits.'' (page 4 of the Estimate of Costs of
Private Sector Mandates)
The most extensive industry analysis of the effects of EDI
standards was developed by WEDI in 1993, which built upon a similar
1992 report. The WEDI report used an extensive amount of information
and analysis to develop its estimates, including data from a number of
EDI pilot projects. The report included a number of electronic
transactions that are not covered by HIPAA, such as materials
management. The report projected implementation costs ranging between
$5.3 billion and $17.3 billion (3, p. 9-4) and annual savings for the
transactions covered by HIPAA ranging from $8.9 billion and $20.5
billion (3, pp. 9-5 and 9-6). Lewin estimated that the data standards
proposed in the Healthcare Simplification and Uniformity Act of 1993
would save from 2.0 to 3.9 percent of administrative costs annually
($2.6 to $5.2 billion based on 1991 costs) (1, p. 12). A 1995 study
commissioned by the New Jersey Legislature estimated yearly savings of
$760 million in New Jersey alone, related to EDI claims processing,
reducing claims rejection, performing eligibility checks, decreasing
accounts receivable, and other potential EDI applications (4, p. 316)
We have drawn heavily on the WEDI report for many of our estimates.
However, our conclusions differ, especially in the area of savings, for
a number of reasons. The WEDI report was intended to assess the savings
from a totally EDI environment, which HIPAA does not mandate. Health
care providers may still choose to conduct HIPAA transactions on paper.
In addition, a significant amount of movement toward EDI has been made
(especially in the claims area) since 1993, and it is reasonable to
assume that EDI would have continued to grow at some rate even without
HIPAA. In order to assess the true impact of the legislation and these
regulations, we cannot claim that all subsequent benefits are
attributable to HIPAA.
D. Implementation Costs
The costs of implementing the standards specified in the statute
are primarily one-time or short-term costs related to conversion. They
can be characterized as follows:
1. System Conversion/Upgrade--Health care providers and health
plans will incur costs to convert existing software to utilize the
standards. Health plans and large health care providers generally have
their own information systems, which they maintain with in-
[[Page 25342]]
house or contract support. Small health care providers are more likely
to use off-the-shelf software developed and maintained by a vendor.
Examples of software changes include the ability to generate and accept
transactions using the standard (for example, claims, remittance
advices) and converting or crosswalking current provider files and
medical code sets to chosen standards. However, health care providers
have considerable flexibility in determining how and when to accomplish
these changes. One alternative to a complete system redesign would be
to purchase a translator that reformats existing system outputs into
standard transaction formats. A health plan or health care provider
could also decide to implement two or more related standards at once or
to implement one or more standards during a software upgrade. We expect
that each health care provider's and health plan's situation will
differ and that each will select a cost-effective implementation
scheme. Many health care providers use billing agents or claims
clearinghouses to facilitate EDI. (Although we discuss billing agents
and claims clearinghouses as separate entities in this impact analysis,
billing agents are considered to be the same as clearinghouses for
purposes of administrative simplification.) Those entities would also
have to reprogram to accommodate standards. We would expect these costs
to be passed on to health care providers in the form of fee increases
or to be absorbed as a cost of doing business.
2. Start-up Cost of Automation--The legislation does not require
health care providers to conduct transactions electronically. Those who
do not currently have electronic capabilities would have to purchase
and implement hardware and software and train staff to use it in order
to benefit from EDI. However, this is likely to be less costly once
standards are in place, because there will be more vendors supporting
the standard.
3. Training--Health care provider and health plan personnel will
require training on use of the various standard identifiers, formats,
and code sets. For the most part this will be directed toward
administrative personnel, but training in new code sets would be
required for clinical staff as well.
4. Implementation problems--The implementation of any industry-wide
standards will inevitably introduce additional complexity as health
plans and health care providers struggle to re-establish communication
and process transactions using the new formats, identifiers, and code
sets. This is likely to result in a temporary increase in rejected
transactions, manual exception processing, payment delays, and requests
for additional information.
While the majority of costs are one-time costs related to
implementation, there are also on-going costs associated with
administrative simplification. Health care providers and health plans
may incur on-going costs to subscribe to or purchase documentation and
implementation guides related to code sets and standard formats as well
as health plan and provider identifier directories or data files. These
entities may already be incurring some of these costs, and the costs
under HIPAA would be incremental. We will be pursuing low-cost
distribution options to keep these costs as low as possible.
In addition, EDI could affect cash flow throughout the health
insurance industry. Electronic claims reach the health plan faster and
can be processed faster. This has the potential to improve health care
providers' cash flow situations while decreasing health plans' earnings
on cash reserves.
The only known impact on individuals and employers (other than
those that function as health plans) is the need to obtain an
identifier.
E. Benefits of Increased Use of EDI for Health Care Transactions
Some of the benefits attributable to increased EDI can be readily
quantified, while others are more intangible. For example, it is easy
to compute the savings in postage from EDI claims, but attributing a
dollar value to processing efficiencies is difficult. In fact, the
latter may not result in lower costs to health care providers or health
plans but may be categorized as cost avoidance, rather than savings.
For example, a health care provider may find that its billing office
staff can be reduced from four clerks to three after standards are
implemented. The health care provider could decide to reduce the staff
size, to reduce the billing office staff and hire additional clinical
personnel, or to retain the staff and assign new duties to them. Only
the first option results in a ``savings'' (i.e., fewer total dollars
spent) for the health care provider or the health care industry.
However, all three options allow health care providers to reduce
administrative costs associated with billing. We are considering these
to be benefits for purposes of this analysis because it is consistent
with the way the industry views them.
The benefits of EDI to industry in general are well documented in
the literature. One of the most significant benefits of EDI is the
reduction in manual data entry. The paper processing of business
transactions requires manual data entry at the point in which the data
are received and entered into a system. For example, the data on a
paper health care transaction from a health care provider to a health
plan have to be manually entered into the health plan's business
system. If the patient has more than one health plan, the second health
plan would also have to manually enter the data into its system if it
cannot receive the information electronically. The potential for
repeated keying of information transmitted via paper results in
increased labor as well as significant opportunities for keying errors.
EDI allows for direct data transmission between computer systems, which
reduces the need to rekey data.
Another problem with paper-based transactions is that these
documents are mostly mailed. Normal delivery times of mailings can vary
anywhere from one to several days for normal first class mail. To ship
paper documents more quickly can be expensive. While bulk mailings can
reduce some costs, paper mailings remain costly. Using postal services
can also lead to some uncertainty as to whether the transaction was
received, unless more expensive certified mail options are pursued. A
benefit of EDI is that the capability exists for the sender of the
transaction to receive an electronic acknowledgment once the data is
opened by the recipient. Also, because EDI involves direct computer to
computer data transmission, the associated delays with postal services
are eliminated. With EDI, communication service providers such as value
added networks function as electronic post offices and provide 24-hour
service. Value added networks deliver data instantaneously to the
receiver's electronic mailbox.
In addition to mailing time delays, there are other significant
costs in using paper forms. These include the costs of maintaining an
inventory of forms, typing data onto forms, addressing envelopes, and
the cost of postage. The use of paper also requires significant staff
resources to receive and store the paper during normal processing. The
paper must be organized to permit easy retrieval if necessary.
F. The Role of Standards in Increasing the Efficiency of EDI
There has been a steady increase in use of EDI in the health care
market since 1993, and we predict that there would be some continued
growth, even without national standards. However, we believe the upward
trend in EDI health care transactions will be enhanced by having
national standards
[[Page 25343]]
in place. Because national standards are not in place today, there
continues to be a proliferation of proprietary formats in the health
care industry. Proprietary formats are those that are unique to an
individual business. Due to proprietary formats, business partners that
wish to exchange information via EDI must agree on which formats to
use. Since most health care providers do business with a number of
plans, they must produce EDI transactions in many different formats.
For small health care providers, this is a significant disincentive for
converting to EDI.
National standards would allow for common formats and translations
of electronic information that would be understandable to both the
sender and receiver. If national standards were in place, there would
be no need to determine what format a trading partner was using.
Standards also reduce software development and maintenance costs that
are required for converting proprietary formats. The basic costs of
maintaining unique formats are the human resources spent converting
data or in personally contacting entities to gather the data because of
incompatible formats. These costs are reflected in increased office
overhead, and a reliance on paper and third party vendors as well as
communication delays and general administrative hassle. Health care
transaction standards will improve the efficiency of the EDI market and
will help further persuade reluctant industry partners to choose EDI
over traditional mail services.
The statute directs the Secretary to establish standards and sets
out the timetable for doing so. The Secretary must designate a standard
for each of the specified transactions and identifiers but does have
the discretion to designate alternate standards (for example, both a
flat file and X12N format for a particular transaction). We have chosen
to designate a single standard for each identifier and transaction. On
the surface, allowing alternate standards would seem to be a more
flexible approach, permitting health care providers and health plans to
choose which standard best fits their business needs. In reality,
health plans and health care providers generally conduct EDI with
multiple partners. Since the choice of a standard transaction format is
a bilateral decision between the sender and receiver, most health plans
and health care providers would need to support all of the designated
standards for the transaction in order to meet the needs of all of
their trading partners. Single standards will maximize net benefits and
minimize ongoing confusion.
Health care providers and health plans have a great deal of
flexibility in how and when they will implement standards. The statute
specifies dates by which health plans will have adopted standards, but
within that time period health plans can determine when and in which
order they will implement standards. Health care providers have the
flexibility to determine when it is cost-effective for them to convert
to EDI. Health plans and health care providers have a wide range of
vendors and technologies from which to choose in implementing standards
and can choose to utilize a health care clearinghouse to produce
standard transactions. Implementation options for transactions will be
the subject of more detailed analysis in a subsequent regulation.
G. Cost/Benefit Tables
The tables below illustrate the costs for health plans and health
care providers to implement the standards and the savings that will
occur over time as a result of the HIPAA administrative simplification
provisions. All estimates are stated in 1998 dollars--no adjustment has
been made for present value.
The tables are extracted from a report prepared by our actuaries,
who analyzed the impact of the HIPAA administrative simplification
provisions. Using standard actuarial principles, they utilized data
from a wide range of industry sources as a base for their estimates but
revised them as needed to precisely reflect the impact of the
legislation. For example, the number of health care providers and
percentage of EDI transactions were adjusted to reflect expected 1998
levels. Where data were not available (for example, the percentage of
EDI billing for hospices), estimates were developed based on
assumptions. Where data from multiple sources were in conflict, the
various sources were considered in developing an independent estimate.
These processes are complex and are described in detail in the
actuaries' report, both in narrative form and in footnotes to tables.
The report is too voluminous to publish here, and it is not feasible to
describe the processes used to arrive at each and every number. We are
presenting here the data that are most critical to assessing the impact
of HIPAA administrative simplification provisions and a general
description of the processes used to develop those data. The full
actuarial report is available for inspection at the HCFA document room
and at the following web site: http://aspe.os.dhhs.gov/admnsimp/.
The costs are based on estimates for the cost of a moderately
complex set of software upgrades. The range of costs that health plans
and health care providers will incur is quite large and is based on
such factors as the size and complexity of the existing systems,
ability to implement using existing low-cost translator software, and
reliance on health care clearinghouses to create standard transactions.
The cost of a moderately complex upgrade represents a reasonable
midpoint in this range. In addition, we assume that health plans and
health care providers with existing EDI systems will incur
implementation costs related to manual operations to make those
processes compatible with the EDI systems. For example, manual
processes may be converted to recognize standard identifiers or to
produce paper remittance advices that contain the same data elements as
the EDI standard transaction. We have estimated those costs to equal 50
percent of the upgrade cost. Health care providers that do not have
existing EDI systems will also incur some costs due to HIPAA, even if
they choose not to implement EDI for all of the HIPAA transactions. For
example, a health care provider may have to change accounting practices
in order to process the revised paper remittance advice discussed
above. Health plans must accept HIPAA transactions via EDI, but not all
health plans will be called upon to accept all HIPAA transactions. For
example, some health plans process only dental claims, while others
process claims for institutional and noninstitutional services. We have
assumed the average cost for non-EDI health care providers and health
plans to be half that of already-automated health care providers and
health plans.
Savings are based on the estimated increase in EDI attributable to
the HIPAA administrative simplification provisions, multiplied by a per
transaction savings for each type of transaction. Our estimates are
much lower than those included in the WEDI report, primarily because we
only recognize savings that would not have occurred without the
legislation. While some industry estimates of gross savings (not net of
costs) have been as high as $32.8 billion over five years, we believed
it was important to utilize the most conservative assumptions possible.
It is important to view these estimates as an attempt to furnish a
realistic context rather than as precise budgetary predictions. Our
estimates also do not include any benefits attributable to qualitative
aspects of Administrative simplification, because of the lack of
reliable data. (For example, we do not
[[Page 25344]]
attempt to put a dollar value on improved public health practices that
will result from implementation of standard identifiers.) We strongly
encourage comments on how to quantitatively and qualitatively measure
the efficiencies realized as a result of the HIPAA administrative
simplification standards.
More detailed information regarding data sources and assumptions is
provided in the explanations for the specific tables.
Table 1 below shows estimated costs and savings for health plans.
The number of entities is based on the WEDI report, Department of Labor
data, and various trade publications trended forward to 1998. The cost
per health plan for software upgrades is based on the WEDI report,
which estimated a range of costs required to implement a fully capable
EDI environment. The high-end estimates ranged from two to ten times
higher than the low-end estimates. We have used the lower end of the
estimates in most cases because, as explained above, HIPAA does not
require as extensive changes as envisioned by WEDI. The estimated
percentages of health plans that accept electronic billing are based on
reports in the 1997 edition of Faulkner & Gray's Health Data Directory
(5). The total cost for each type of health plan is the sum of the cost
for EDI and non-EDI plans. Cost for EDI plans is computed as follows:
Total Entities x EDI % x Average Upgrade Cost x 1.5
(Note: As described above, the cost of changing manual processes is
estimated to be half the cost of system changes.)
Cost for non-EDI plans is computed as follows:
Total entities x (1 x EDI %) x Average Upgrade Cost x .5
(Note: As described above, cost to non-EDI health care providers is
assumed to be half the cost of systems changes.)
The $3.9 billion in savings is derived from Table 4, and represents
savings to health plans for the first five years of implementation. The
assumptions related to these savings are contained in the explanation
to Table 4. The savings have been apportioned to each type of health
plan based on the ratio of that health plan type's cost to the cost to
all health plans. For example, a plan type that incurs ten percent of
the costs would be assigned ten percent of the savings. We acknowledge
that this is an imprecise method for allocating savings. We have not
been able to identify a reliable method for allocating savings to
specific types of health plans but nonetheless believed that it was
important to present costs and savings together in order to provide a
sense of how the HIPAA administrative simplification provisions would
affect various entities.
Table 1.--Health Plan Implementation Costs and Savings
[in Millions--1998-2002]
----------------------------------------------------------------------------------------------------------------
Number of Percent Total cost (in Savings (in
Type of plan plans Average cost EDI millions) millions)
----------------------------------------------------------------------------------------------------------------
Large commercials.................... 250 $1,000,000 .90 $350 $620
Smaller commercials.................. 400 500,000 .50 200 354
Blue Cross/Blue Shield............... 75 1,000,000 .90 106 188
Third-party administered............. 750 500,000 .50 375 665
HMO/PPO.............................. 1,500 250,000 .50 375 665
Self-administered.................... 16,000 50,000 .25 600 1,063
Other employer plans................. 3,900,000 100 .00 195 345
Total............................ .............. .............. ......... $2,201 $3,900
----------------------------------------------------------------------------------------------------------------
Table 2 illustrates the costs and savings attributable to various
types of health care providers.
The number of entities (practices, not individual health care
providers) is based on the 1992 Census of Services, the 1996
Statistical Abstract of the United States, and the American Medical
Association survey of group practices trended forward to 1998.
Estimated percentages of EDI billing are based on the 1997 edition of
Faulkner & Gray's Health Data Directory or are actuarial estimates.
The cost of software upgrades for personal computers (PCS) is based
on reports on the cost of software upgrades to translate and
communicate standardized claims forms. The low end is used for smaller
practices and the high end for larger practices with PCS. The estimate
for mainframe upgrade packages is twice the upper end for PCS. The cost
per upgrade for facilities is ours after considering estimates by WEDI
and estimates of the cost of new software packages in the literature.
The estimates fall within the range of the WEDI estimates, but that
range is quite large. For example, WEDI estimates the cost for a large
hospital upgrade would be from $50,000 to $500,000. For an explanation
of the method for computing Total Cost, see the explanation for Table
1.
The $3.4 billion in savings is derived from Table 4 and represents
savings to health care providers for the first five years of
implementation. We have included them here to provide a sense of how
the HIPAA administrative simplification provisions would affect various
entities. As in Table 1, the savings have been apportioned to each type
of health care provider based on the ratio of that health care provider
type's cost to the cost to all health care providers.
Table 2.--Health Care Provider Implementation Costs and Savings
[In millions--1998-2002]
----------------------------------------------------------------------------------------------------------------
Number of Percent Total cost (in Savings (in
Type of provider providers Average cost EDI millions) millions)
----------------------------------------------------------------------------------------------------------------
Hospitals <100 beds.................. 2,850 $100,000 .86 $388 $369
Hospitals 100+ beds.................. 3,150 250,000 .86 1,071 1,019
Nursing facility <100 beds........... 27,351 10,000 .50 274 260
Nursing facility 100+ beds........... 8,369 20,000 .50 167 159
[[Page 25345]]
Home health agency................... 10,608 10,000 .75 133 126
Hospice.............................. 1,191 10,000 .10 7 7
Dialysis facility.................... 1,211 10,000 .75 15 14
Specialty outpatient................. 7,175 10,000 .75 90 85
Pharmacy............................. 70,100 4,000 .85 379 360
Medical labs......................... 9,000 4,000 .85 49 46
Dental labs.......................... 8,000 1,500 .50 12 11
DME.................................. 116,800 1,500 .50 175 167
Physicians solo and groups <3........ 337,000 1,500 .20 354 337
Physicians groups 3+ with mainframe.. 17,000 8,000 .75 170 162
Physicians groups 3+ with PCS........ 15,000 4,000 .40 54 51
Physicians groups 3+ no automation... 2,000 0 .00 0 0
Osteopaths........................... 35,600 1,500 .10 32 30
Dentists............................. 147,000 1,500 .14 141 134
Podiatrists.......................... 8,400 1,500 .05 7 6
Chiropractors........................ 29,000 1,500 .05 24 23
Optometrists......................... 18,200 1,500 .05 14 14
Other professionals.................. 23,600 1,500 .05 20 19
--------------------------------------------------------------------------
Total............................ .............. .............. ......... 3,574 3,400
----------------------------------------------------------------------------------------------------------------
Table 3 shows the estimates we used to determine the portion of EDI
increase attributable to the HIPAA administrative simplification
provisions. The proportion of claims that would be processed
electronically even without HIPAA is assumed to grow at the same rate
from 1998 through 2002 as it did from 1992 to 1996, except that the
rate for hospitals, which is already high, is assumed to grow at one
percent annually instead of the two percent that was observed from
1992-1996. The proportion of ``other'' provider claims is high because
it includes pharmacies that generate large volumes of claims and have a
high rate of electronic billing.
The increase attributable to HIPAA is highly uncertain and is
critical to the savings estimate. Our actuary arrived at these
estimates based on an analysis of the current EDI environment. Because
the rate of growth in electronic billing is already high, there is not
much room for added growth. On the other hand, much of the increase
that has already occurred is attributable to Medicare and Medicaid;
private insurers and third party administrators still have fairly low
rates of electronic billing and may benefit significantly from
standardization.
Table 3.--Percent Growth in EDI Claims Attributable to HIPAA as Provisions
[Cumulative]
----------------------------------------------------------------------------------------------------------------
1998 1999 2000 2001 2002
Type of Provider (percent) (percent) (percent) (percent) (percent)
----------------------------------------------------------------------------------------------------------------
Physician:
Percent before HIPAA....................... 45 50 55 60 65
Percent after HIPAA........................ 45 52 59 66 73
----------------------------------------------------------------
Difference................................. ........... 2 4 6 8
----------------------------------------------------------------
Hospital:
Percent before HIPAA....................... 86 87 88 89 90
Percent after HIPAA........................ 86 88 89 91 92
----------------------------------------------------------------
Difference................................. ........... 1 1 2 2
----------------------------------------------------------------
Other:
Percent before HIPAA....................... 75 76 77 78 79
Percent after HIPAA........................ 75 78 81 84 87
Difference................................. ........... 2 4 6 8
----------------------------------------------------------------------------------------------------------------
Table 4 shows the annual costs, savings, and net savings over a
five-year implementation period. We assume that the costs will be
incurred within the first three years, since the statute requires
health plans other than small health plans to implement within 24
months and small health plans to implement within 36 months. As each
health plan implements a standard, health care providers that conduct
electronic transactions with that health plan would also implement the
standard. We assume that no savings would accrue in the first year,
because not enough health plans and health care providers would have
implemented the standards. Savings would increase as more health plans
and health care providers implement, exceeding costs in the fourth
year. At that point, the majority of health plans and health care
providers will have implemented the
[[Page 25346]]
standards, and costs will decrease and benefits will increase as a
result.
The savings per claim processed electronically instead of manually
is based on the lower end of the range estimated by WEDI. We have used
$1 per claim for health plans and physicians, and $.75 per claim for
hospitals and other health care providers. These estimates are based on
surveys of health care providers and health plans. Savings per EDI
claim are computed by multiplying the per claim savings times the
number of EDI claims attributed to HIPAA. The total number of EDI
claims is used in computing the savings to health plans, while the
savings for specific health care provider groups is computed using only
the number of EDI claims generated by that group (for example, savings
to physicians is computed using only physician EDI claims).
WEDI also estimated savings resulting from other HIPAA
transactions. The savings per transaction was higher than the savings
from electronic billing, but the number of transactions was much
smaller. Our estimates for transactions other than claims were derived
by assuming a number of transactions and a savings per transaction
relative to those assumed for the savings for electronic billing (see
table 4a). In general our assumptions are close to those used by WEDI.
One major difference is that we derived the number of enrollment/
disenrollment transactions from Department of Labor statistics. We used
their estimate of the number of events requiring a certificate to be
issued, which includes such actions as starting or leaving a firm,
children ``aging out'' of coverage and death of policyholder. That
estimate is about 45 million events. We used WEDI's estimate that the
savings per transaction is about half that of billing transactions.
We also assumed that savings could be expected from simplifications
in manual claims. The basic assumption is that the savings are ten
percent (per transaction) of those that are projected for conversion to
electronic billing. However, it is also assumed that the standards only
gradually allow health care providers and health plans to abandon old
forms and identifiers because of the many relationships that have been
established with other entities that will require a period of overlap.
Table 4.--Five-Year Net Savings
[in billions of dollars]
----------------------------------------------------------------------------------------------------------------
Costs and savings 1998 1999 2000 2001 2002 Total
----------------------------------------------------------------------------------------------------------------
Costs:
Provider.............................. 1.3 1.3 1.1 0.0 0.0 3.6
Plan.................................. 0.8 0.8 0.7 0.0 0.0 2.2
---------------------------------------------------------------------
Total............................. 2.0 2.0 1.7 0.0 0.0 5.8
=====================================================================
Savings From Claims Processing:
Provider.............................. 0.0 0.1 0.3 0.4 0.6 1.4
Plan.................................. 0.0 0.1 0.2 0.4 0.5 1.2
---------------------------------------------------------------------
Total............................. 0.0 0.2 0.5 0.8 1.1 2.6
=====================================================================
Savings from Other Transactions:
Provider.............................. 0.0 0.2 0.4 0.7 1.1 2.4
Plan.................................. 0.0 0.2 0.4 0.6 0.8 2.0
---------------------------------------------------------------------
Total............................. 0.0 0.3 0.8 1.2 1.8 4.1
=====================================================================
Savings From Manual Transactions:
Provider.............................. 0.0 0.0 0.1 0.1 0.1 0.3
Plan.................................. 0.0 0.0 0.1 0.1 0.1 0.3
---------------------------------------------------------------------
Total............................. 0.0 0.1 0.1 0.2 0.2 0.6
=====================================================================
Total Savings:
Provider.............................. (1.3) (1.0) (0.5) 1.0 1.5 (0.2)
Plan.................................. (0.8) (0.5) 0.0 1.2 1.6 1.7
---------------------------------------------------------------------
Total............................. (2.0) (1.4) (0.3) 2.2 3.1 1.5
----------------------------------------------------------------------------------------------------------------
Note: Figures do not total due to rounding.
Table 4a shows the savings per nonclaim transaction as a multiple
of claims savings per transaction and the ratio of transactions to
number of claims. These values were used to determine the savings for
nonclaims transactions.
Table 4a.--Relative Savings and Volume of Other Transactions
------------------------------------------------------------------------
Transaction Savings Volume
------------------------------------------------------------------------
Claim............................................ 1.0 1.0
Claims inquiry................................... 4.0 0.5
Remittance advice................................ 1.5 0.10
Coordination of benefits......................... 0.5 0.10
Eligibility inquiry.............................. 0.5 0.05
Enrollment/disenrollment......................... 0.5 0.01
Referral......................................... 0.1 0.10
------------------------------------------------------------------------
H. Qualitative Impacts of Administrative Simplification
Administration simplification produces more than hard-dollar
savings. There are also qualitative benefits that
[[Page 25347]]
are less tangible, but nevertheless important. These changes become
possible when data can be more easily integrated across entities. WEDI
suggests in its 1993 report that there will be a ``ripple-effect'' of
implementing an EDI infrastructure on the whole health care delivery
system in that there would be a reduction in duplicate medical
procedures and processes as a patient is handled by a continuum of
health care providers during an episode of care. WEDI also suggests
that there will be a reduction in the exposure to health care fraud as
security controls on electronic transactions will prevent unauthorized
access to financial data.
We also believe that having standards in place would reduce
administrative burden and improve job satisfaction. For example, fewer
administrative staff would be required to translate procedural codes,
since a common set of codes would be used. All codes used in these
transactions will be standardized, eliminating different values for
data elements (for example, place of service).
Administrative simplification would promote the accuracy,
reliability and usefulness of the information shared. For example,
today there are any number of claims formats and identifiers in use. We
estimate that there are over 400 variations of electronic formats for
claims transactions alone. As we noted earlier, these variations make
it difficult for parties to exchange information electronically. At a
minimum, it requires data to be translated from the sender's own format
to the different formats specified by each intended receiver. Also,
since industry has taken different approaches to uniquely identifying
patients, health care providers and health plans (based on their
individual business needs and preferences), it has become difficult to
develop methods to compare services across health care providers and
health plans. This mixed approach to enumeration has made it extremely
difficult for health care researchers to do comparative analysis across
settings and over time, and complicates identification of individuals
for public health and epidemiologic purposes.
Administrative simplification greatly enhances the sharing of data
both within entities and across entities. It facilitates the
coordination of benefit information by having in place a standardized
set of data that is known to all parties, along with standardized name
and address information that tells where to route transactions. Today,
health care providers are reluctant to file claims to multiple health
plans on the behalf of the patient because information about a
patient's eligibility in a health plan is difficult to verify.
Additionally, identifying information about health plans is not
standardized or centralized for easy access. Most claims filed by
patients today are submitted in hardcopy. We anticipate that more
health care providers will file claims and coordinate benefits on the
patient's behalf once standard identifiers are adopted and this
information is made available electronically.
I. Regulatory Flexibility Analysis
The Regulatory Flexibility Act (RFA) of 1980, Public Law 96-354,
requires us to prepare a regulatory flexibility analysis if the
Secretary certifies that a proposed regulation would have a significant
economic impact on a substantial number of small entities. In the
health care sector, a small entity is one with less than $5 million in
annual revenues. Nonprofit organizations are considered small entities;
however, individuals and States are not included in the definition of a
small entity. We have attempted to estimate the number of small
entities and provide a general discussion of the effects of the
statute. We request comments and additional information about our
estimates and discussion.
All nonprofit Blue Cross-Blue Shield Plans are considered small
entities. Two percent of the approximately 3.9 million employer health
plans are considered small businesses. All doctors of osteopathy,
dentists, podiatrists, chiropractors, and solo and group physicians'
offices with fewer than three physicians are considered small entities.
Forty percent of group practices with 3 or more physicians and 90
percent of optometrist practices are considered small entities.
Seventy-five percent of all pharmacies, medical laboratories, dental
laboratories and durable medical equipment suppliers are assumed to be
small entities.
We found the best source for information about the health data
information industry to be Faulkner & Gray's Health Data Dictionary.
This publication is the most comprehensive we found of its kind. The
information in this directory is gathered by Faulkner & Gray editors
and researchers who called all of the more than 3,000 organizations
that are listed in the book to elicit information about their
operations. It is important to note that some businesses are listed as
more than one type of business entity. That is because in reporting the
information, companies could list themselves as up to three different
types of entities. For example, some businesses listed themselves as
both practice management vendors as well as claims software vendors
because their practice management software was ``EDI enabled.''
All the statistics referencing Faulkner & Gray's come from the 1996
edition of its Health Data Dictionary. It lists 100 third party claims
processors, which includes health care clearinghouses (5-33). Faulkner
& Gray define third party claims processors as entities under contract
that take electronic and paper health care claims data from health care
providers and billing companies that prepare bills on a health care
provider's behalf. The third party claims processor acts as a conduit
to health plans; it batches claims and routes transactions to the
appropriate health plan in a form that expedites payment.
Of the 100 third party processors/clearinghouses listed in this
publication, seven processed more that 20 million electronic
transactions per month. Another 14 handled 2 million or more
transactions per month and another 29 handled over a million electronic
transactions per month. The remaining 50 entities listed processed less
than a million electronic transactions per month. We believe that
almost all of these entities have annual revenues of under $5 million
and would therefore be considered small entities by our definition.
Another entity that is involved in the electronic transmission of
health care transactions is the value added network. Value added
networks are involved in the electronic transmission of data over
telecommunication lines. We include value added networks in the
definition of a health care clearinghouse. Faulkner & Gray list 23
value added networks that handle health care transactions (5, p. 544).
After further discussion, the editors clarified that only 8 of the 23
would be considered ``pure'' value added networks. We believe that all
of these companies have annual revenues of over $5 million.
A billing company is another entity involved in the electronic
routing of health care transactions. It works primarily with physicians
either in office or hospital-based settings. Billing companies, in
effect, take over the office administrative functions for a physician;
they take information such as copies of medical notes and records and
prepare claim forms that are then forwarded to an insurer for payment.
Billing companies may also handle the receipt of payments, including
posting payment to the patient's record on behalf of the health care
provider. They can be located within or outside of the physician's
practice setting.
The International Billing Association is a trade association
representing
[[Page 25348]]
billing companies. The International Billing Association estimated that
there are approximately 4500 billing companies currently in business in
the United States. The International Billing Association's estimates
are based on the name and address of actual billing companies that it
compiled in developing its mailing list. We believe all of the 4500
billing companies known to be in business have revenues under $5
million annually.
Software system vendors provide computer software applications
support to health care clearinghouses, billing companies, and health
care providers. They particularly work with health care providers'
practice management and health information systems. These businesses
provide integrated software applications for such services as accounts
receivable management, electronic claims submission (patient billing),
record keeping, patient charting, practice analysis and patient
scheduling. Some software vendors are also involved in providing
applications for translating paper and nonstandard computer documents
into standardized formats that are acceptable to health plans.
Faulkner & Gray list 104 physician practice management vendors and
suppliers (5, p. 520), 105 hospital information systems vendors and
suppliers (5, p. 444), 134 software vendors and suppliers for claims-
related transactions (5, p. 486), and 28 translation vendors (5, p.
534). We were unable to determine the number of these entities with
revenues over $5 million, but we assume most of these businesses would
be considered small entities under our definition.
As discussed earlier in this analysis, the cost of implementing the
standards specified in the statute are primarily one-time or short-term
costs related to conversion. They were characterized as follows:
software conversion, cost of automation, training, implementation
problems, and cost of documentation and implementation guides. Rather
than repeat that information here, we refer you to the beginning of
this impact analysis.
1. Health care Providers and Health Plans
As a result of standard data format and content, health care
providers and health plans that wish to do business electronically
could do so knowing that whatever capital outlays they make are
worthwhile, with some certainty of return on investment. This is
because entities that exchange electronic health care transactions
would be required to receive and send transactions in the same standard
formats using the same health care provider and health plan
identifiers. We believe this will be an incentive to small physicians'
offices to convert from paper to EDI. In a 1996 Office of the Inspector
General study entitled ``Encouraging Physicians to Use Paperless
Claims,'' the Office of the Inspector General and HCFA agreed that over
$36 million in annual Medicare claims processing savings could be
achieved if all health care providers submitting 50 or more Medicare
claims per month submitted them electronically. Establishment of EDI
standards will make it financially beneficial for many small health
care providers to convert to electronic claim submissions, because all
health plans would accept the same formats.
Additionally, we believe that those health care providers that
currently use health care clearinghouses and billing agencies will see
costs stabilize and potentially some cost reduction. This would result
from the increased efficiency that health care clearinghouses and
billing companies will realize from being able to more easily link with
health care industry business partners.
2. Third Party Vendors
Third party vendors include third party processors/clearinghouses
(including value added networks), billing companies, and software
system vendors. While the market for third party vendors will change as
a result of standardization, these changes will be positive to the
industry and its customers over the long term. However, the short term/
one time costs discussed above will apply to the third party vendor
community.
a. Clearinghouses and Billing Companies
As noted above, health care clearinghouses are entities that take
health care transactions, convert them into standardized formats
acceptable to the receiver, and forward them on to the insurer. Billing
companies take on the administrative functions of a physician's office.
The market for clearinghouse and billing company services will
definitely be affected by the HIPAA administrative simplification
provisions; however there appears to be some debate on how the market
for these services will be affected.
It is likely that competition among health care clearinghouses and
billing companies will increase over time. This is because standards
would reduce some of the technical limitations that currently inhibit
health care providers from conducting their own EDI. For example, by
eliminating the requirement to maintain several different claims
standards for different trading partners, health care providers will be
able to more easily link themselves directly to health plans. This
could negatively affect the market for health care clearinghouses and
system vendors that do translation services; however, standards should
increase the efficiency in which health care clearinghouses operate by
allowing them to more easily link to multiple health plans. The
increased efficiency in operations resulting from standards could, in
effect, lower their overhead costs as well as attract new health care
clearinghouse customers to offset any loss in market share that they
might experience.
Another potential area of change is that brought about through
standardized code sets. Standards would lower costs and break down
logistical barriers that discouraged some health care providers from
doing their own coding and billing. As a result, some health care
providers may choose an in-house transaction system rather than using a
billing company as a means of exercising more control over information.
Conversely, health care clearinghouses may acquire some short-term
increase in business from those health care providers that are
automated but do not use the selected standards. These health care
providers would hire health care clearinghouses to take data from the
nonstandard formats they are using and convert them into the
appropriate standards. Generally, we would also expect health care
clearinghouses to identify opportunities to add value to transaction
processing and to find new business opportunities, either in marketing
promotional materials or in training health care providers on the new
transaction sets. Standards would increase the efficiency of health
care clearinghouses, which could in turn drive costs for these services
down. Health care clearinghouses may be able to operate more
efficiently or at a lower cost based on their ability to gain market
share. Some small billing companies may be consumed by health care
clearinghouses that may begin offering billing services to augment
their health care clearinghouse activities. However, most health care
providers that use billing companies would probably continue to do so
because of the comprehensive and personalized services these companies
offer.
Value added networks do not manipulate data but rather transmit
data in its native form over telecommunication lines. We anticipate
[[Page 25349]]
that the demand for value added network services would increase as
additional health care providers and health plans move to electronic
data exchange. Standards would eliminate the need for data to be
reformatted, which would allow health care providers to purchase value
added network services individually rather than as a component of the
full range of clearinghouse services.
b. Software Vendors
As noted above, software vendors provide computer software
applications support to health care clearinghouses and health care
providers. They particularly work with health care providers' practice
management and health information systems. We believe these entities
would be affected positively, at least in the short term. The
implementation of administrative simplification would enhance their
business opportunities as they would be involved in developing
computerized software solutions that would allow for health care
providers and other entities that exchange health care data to
integrate the new transaction set into their existing systems. They may
also be involved in developing software solutions to manage the
crosswalk of existing health care provider and health plan identifiers
to the national provider identifier and health plan identifier
(PAYERID) until such time as all entities have implemented the
identifiers.
J. Unfunded Mandates
We have identified costs to the private sector to implement these
standards. Although these costs are unfunded, we expect that they will
be offset by subsequent savings as detailed in this impact analysis.
Most costs will occur in the first 3 years following the adoption
of the HIPAA standards, with savings to health care providers and
health plans exceeding costs in the fourth year. Five-year costs of
implementing the HIPAA standards are estimated at $ 5.8 billion for
health care providers and health plans combined. Savings to these
entities over the same period in electronic claims processing, other
electronic transactions (e.g., enrollments and disenrollments), and
manual transactions are estimated at $ 7.3 billion, for a net savings
of $ 1.5 billion in 5 years.
The costs to State and local governments and tribal organizations
are also unfunded, but we do not have sufficient information to provide
estimates of the impact of these standards on those entities. Several
State Medicaid agencies have estimated that it would cost $1 million
per state to implement all the HIPAA standards. However, the
Congressional Budget Office analysis stated that ``States are already
in the forefront in administering the Medicaid program electronically;
the only costs--which should not be significant--would involve bringing
the software and computer systems for the Medicaid programs into
compliance with the new standards.'' The report went on to point out
that Medicaid State agencies have the option to compensate by reducing
other expenditures and that other State and local government agencies
are likely to incur less in the way of costs since most of them will
have fewer enrollees. Moreover, the Federal government pays a portion
of the cost of converting State Medicaid Management Information Systems
(MMIS) as Federal Financial Participation--75 percent for system
maintenance changes and 90 percent for new software (if approved). Many
States are in the process of changing systems as they convert many of
the current functions in the move to enroll Medicaid beneficiaries in
managed care.
K. Specific Impact of Provider Identifier
This is the portion of the impact analysis that relates
specifically to the standard that is the subject of this regulation--
the health care provider identifier. This section describes specific
impacts that relate to the provider identifiers. However, as we
indicated in the introduction to this impact analysis, we do not intend
to associate costs and savings to specific standards. In addition, this
section assesses the relative cost impact of the various identifier
options and implementation options set out in the regulation.
Although we cannot determine the specific economic impact of the
standard being proposed in this rule (and individually each standard
may not have a significant impact), the overall impact analysis makes
clear that, collectively, all the standards will have a significant
impact of over $100 million on the economy. Also, while each standard
may not have a significant impact on a substantial number of small
entities, the combined effects of all the proposed standards may have a
significant effect on a substantial number of small entities.
Therefore, the following impact analysis should be read in conjunction
with the overall impact analysis.
In accordance with the provisions of Executive Order 12866, this
proposed rule was reviewed by the Office of Management and Budget.
1. Affected entities.
a. Health care providers.
Health care providers that conduct electronic transactions with
health plans would have to begin to use the NPI in those transactions.
Health care providers that are indirectly involved in electronic
transactions (for example, by submitting a paper claim that the health
plan transmits electronically to a secondary payer) may also use the
NPI. Any negative impact on these health care providers generally would
be related to the initial implementation period. They would incur
implementation costs for converting systems, especially those that
generate electronic claims, from current provider identifiers to the
NPI. Some health care providers would incur those costs directly and
others would incur them in the form of fee increases from billing
agents and health care clearinghouses.
Health care providers not only would have to include their own NPI
on claims, but they would also have to obtain and use NPIs of other
health care providers (for example, for referring and ordering). This
would be a more significant implementation workload for larger
institutional health care providers, such as hospitals, that would have
to obtain the NPIs for each physician practicing in the hospital.
However, these health care providers are accustomed to maintaining
these types of data. There would also be a potential for disruption of
claims processes and timely payments during a particular health plan's
transition to the NPI. Some health care providers that do not do
business with government programs may be resistant to obtaining an NPI
and providing data about themselves that would be stored in a national
database.
Health care providers would also have to obtain an NPI and report
changes in pertinent data. Under one of the enumeration options
presented in this preamble, current Medicare providers will receive
their NPIs automatically, and other health care providers may be
enumerated in this manner to the extent that appropriate valid data
files are available. New health care providers would have to apply for
an NPI. This does not impose a new burden on health care providers. The
vast majority of health plans issue identifiers to the health care
providers with whom they transact business in order to facilitate the
electronic processing of claims and other transactions. The information
that health care providers must supply in order to receive an NPI is
significantly less than the information most health plans require to
enroll a health care provider. There would be no new cost
[[Page 25350]]
burden; the statute does not support our charging health care providers
to receive an NPI.
After implementation, health care providers would no longer have to
keep track of and use different identifiers for different insurers.
This would simplify provider billing systems and processes and reduce
administrative expenses. A standard identifier would facilitate and
simplify coordination of benefits, resulting in faster, more accurate
payments. Under option 2 of the enumeration options, (see section
IX.K.2.d. of this preamble, on enumerators), many health care providers
(all those doing business with Medicare) would receive their NPIs
automatically and would be able to report changes in the data contained
in the NPS to a single place and have the changes made available to
many health plans.
b. Health plans.
Health plans that engage in electronic commerce would have to
modify their systems to use the NPI. This conversion would have a one-
time cost impact on Federal, State, and private health plans alike and
is likely to be more costly for health plans with complex systems that
rely on intelligent provider numbers. Disruption of claims processing
and payment delays could result. However, health plans would be able to
schedule their implementation of the NPI and other standards in a
manner that best fits their needs, as long as they meet the deadlines
specified in the legislation.
Once the NPI has been implemented, health plans' coordination of
benefits activities would be greatly simplified because all health
plans would use the same health care provider identifier. In addition,
utilization review and other payment safeguard activities would be
facilitated, since health care providers would not be able to use
multiple identifiers and could be easily tracked over time and across
geographic areas. Health plans currently assign their own
identification numbers to health care providers as part of their
enrollment procedures, and this would no longer be necessary. Existing
enumeration systems maintained by Federal health programs would be
phased out, and savings would result.
c. Health care clearinghouses.
Health care clearinghouses would face impacts (both positive and
negative) similar to those experienced by health plans. However,
implementation would likely be more complex, because health care
clearinghouses deal with many health care providers and health plans
and would have to accommodate both old and new health care provider
identifiers until all health plans with which they deal have converted.
2. Effects of Various Options.
a. Guiding Principles for Standard Selection.
The implementation teams charged with designating standards under
the statute have defined, with significant input from the health care
industry, a set of common criteria for evaluating potential standards.
These criteria are based on direct specifications in the HIPAA, the
purpose of the law, and principles that support the regulatory
philosophy set forth in Executive Order 12866 of September 30, 1993,
and the Paperwork Reduction Act of 1995. These criteria also support
and are consistent with the principles of the Paperwork Reduction Act
of 1995. In order to be designated as a standard, a proposed standard
should:
Improve the efficiency and effectiveness of the health
care system by leading to cost reductions for or improvements in
benefits from electronic HIPAA health care transactions. This principle
supports the regulatory goals of cost-effectiveness and avoidance of
burden.
Meet the needs of the health data standards user
community, particularly health care providers, health plans, and health
care clearinghouses. This principle supports the regulatory goal of
cost-effectiveness.
Be consistent and uniform with the other HIPAA standards--
their data element definitions and codes and their privacy and security
requirements--and, secondarily, with other private and public sector
health data standards. This principle supports the regulatory goals of
consistency and avoidance of incompatibility, and it establishes a
performance objective for the standard.
Have low additional development and implementation costs
relative to the benefits of using the standard. This principle supports
the regulatory goals of cost-effectiveness and avoidance of burden.
Be supported by an ANSI-accredited standards developing
organization or other private or public organization that will ensure
continuity and efficient updating of the standard over time. This
principle supports the regulatory goal of predictability.
Have timely development, testing, implementation, and
updating procedures to achieve administrative simplification benefits
faster. This principle establishes a performance objective for the
standard.
Be technologically independent of the computer platforms
and transmission protocols used in HIPAA health transactions, except
when they are explicitly part of the standard. This principle
establishes a performance objective for the standard and supports the
regulatory goal of flexibility.
Be precise and unambiguous, but as simple as possible.
This principle supports the regulatory goals of predictability and
simplicity.
Keep data collection and paperwork burdens on users as low
as is feasible. This principle supports the regulatory goals of cost-
effectiveness and avoidance of duplication and burden.
Incorporate flexibility to adapt more easily to changes in
the health care infrastructure (such as new services, organizations,
and provider types) and information technology. This principle supports
the regulatory goals of flexibility and encouragement of innovation.
We assessed the various candidates for a provider identifier
against the principles listed above, with the overall goal of achieving
the maximum benefit for the least cost. We found that the NPI met all
the principles, but no other candidate identifier met all the
principles, or even those principles supporting the regulatory goal of
cost-effectiveness. We are assessing the costs and benefits of the NPI,
but we did not assess the costs and benefits of other identifier
candidates, because they did not meet the guiding principles. We invite
your comments on the costs and benefits of the alternative candidate
NPI options for the various market segments.
b. Need To Convert
Because there is no standard provider identifier in widespread use
throughout the industry, adopting any of the candidate identifiers
would require most health care providers, health plans and health care
clearinghouses to convert to the new standard. In the case of the NPI,
all health care providers would have to convert because this identifier
is not in use presently. As we pointed out in our analysis of the
candidates, even the identifiers that are in use are not used for all
purposes or for all provider types. The selection of the NPI does not
impose a greater burden on the industry than the nonselected
candidates, and presents significant advantages in terms of cost-
effectiveness, universality, uniqueness and flexibility.
c. Complexity of Conversion
Some existing provider identifier systems assign multiple
identifiers to a single health care provider in order to distinguish
the multiple identities the health care provider has in the system. For
example, in these systems, the health care provider may have a
[[Page 25351]]
different identifier to represent each ``pay-to'' identity, contract or
provider agreement, practice location, and specialty or provider type.
Since the NPI is a unique identifier for each health care provider, it
would not distinguish these multiple identities. Systems that need to
distinguish these identities would need to use data other than the NPI
to do so. The change to use other data would add complexity to the
conversion to the NPI or to any other standard provider identifier, but
it is necessary in order to achieve the goal of unique identification
of the health care provider.
The complexity of the conversion would also be significantly
affected by the degree to which health plans' processing systems
currently rely on intelligent identifiers. For example, a health plan
may route claims to different processing routines based on the type of
health care provider by keying on a provider type code included in the
identifier. Converting from one unintelligent identifier to another is
less complex than modifying software logic to obtain needed information
from other data elements. However, the use of an unintelligent
identifier is required in order to meet the guiding principle of
assuring flexibility.
Specific technology limitations of existing systems could affect
the complexity of conversion. For example, some existing provider data
systems use a telephone keypad to enter data. Data entry of alpha
characters is inconvenient in these systems. In order to mitigate this
inconvenience, we would implement the NPI by initially assigning
numeric NPIs. After all numeric possibilities have been exhausted, we
would introduce alpha characters in one position at a time. This
implementation strategy would allow additional time for systems with
technology limitations to overcome conversion difficulties.
In general, the shorter the identifier, the easier it is to
implement. It is more likely that a shorter identifier, such as the
NPI, would fit into existing data formats.
The selection of the NPI does not impose a greater burden on the
industry than the nonselected candidates.
d. Enumerators
Based on the analysis discussed earlier in the preamble, we assess
the two most viable combinations of choices for the entities that would
enumerate health care providers. We do not assess choices that permit
large numbers of enumerators (for example, all health plans,
educational institutions, professional associations) because these
choices do not satisfy the critical programmatic requirements of
maintaining a high degree of data quality and consistency and
minimizing confusion for health care providers.
No matter which of the two enumeration options is chosen, certain
costs and impacts would not vary.
We assume that the NPS would be used in both options to
generate NPIs and serve as the central enumeration system and database.
We began to develop the NPS for Medicare use, and this effort, which
was funded by HCFA, is now nearing completion. As the NPS becomes
national in scope, we estimate that the cost of maintaining the NPS
software, hardware, and telecommunications, and operating a Help Desk
to deal with user questions, would cost approximately $10.4 million
over the first three years of operation and approximately $2.9 million
per year thereafter. Roughly half of these costs are attributable to
telecommunications expenses. This analysis presumes the availability of
Federal funds to support the development and operations of the NPS.
However, we are seeking comments on how the NPS could be funded once it
becomes national.
We further assume that, in both options, the same
implementation strategy of loading the NPS database using health plans'
existing prevalidated files will be utilized to the extent possible.
This would reduce costs by not repeating the process of soliciting,
receiving, controlling, validating and keying applications from health
care providers that have already been enumerated by a trusted source.
For example, we would use existing Medicare provider files to initially
load the NPS database. The majority of work to reformat and edit these
files has already been completed.
We estimate that approximately 1.2 million current health care
providers and 30,000 new health care providers annually would require
NPIs because they conduct HIPAA transactions.
An additional 3 million health care providers (120,000 new health
care providers annually) do not conduct HIPAA transactions, but they
may choose to be enumerated at some future time. We refer to these
health care providers as ``non-HIPAA-transaction health care
providers'' (see section 4. Enumeration Phases of this preamble). These
health care providers would be primarily individual practitioners such
as registered nurses and pharmacists who perform services in
institutions and whose services are not billed by the institution. More
research is required on the time frame and process for enumerating
these health care providers.
Based on Medicare carriers' costs, we have estimated that the
average cost to enumerate a health care provider should not exceed $50.
Enumeration activities would include assisting health care providers
and answering questions, accepting the application for an NPI;
validating as many of the data elements as possible at the point of
application to assure the submitted data are accurate and the
application is authentic; entering the data into the NPS to obtain an
NPI for the health care provider; researching cases where there is a
possible match to a health care provider already enumerated; notifying
the health care provider of the assigned NPI; and entering updated data
into the NPS when notified by the health care provider. The cost of
processing a data update is not known, and for purposes of this
analysis we are assuming an average cost of $10 per update transaction,
and that 5 percent per year of these health care providers on file
would have updated data. However, we estimate that approximately 15
percent of health care providers that do not conduct business with
Federal health plans or Medicaid would require updates each year. These
health care providers may be unfamiliar with the terminology for some
of the information they need to provide in order to be enumerated;
thus, they may need to correct errors they could have made in
completing the applications for NPIs or may have a need to change some
of that information for other reasons. The per transaction cost would
be lower if practice location addresses and membership in groups were
not collected (see section IV., Data, and section IX.E., Maintenance of
the Database, of this preamble) and if enumerators were already
validating data as part of their own enrollment processes. The number
of updates would also be affected by the practice location and group
membership issues because these data are more volatile than demographic
data (see IV., Data, and IX.E., Maintenance of the Database, of this
preamble).
For a similarly sized commercial numbering system that uniquely
identifies corporations and assigns unique identifiers, we have
received independent estimates from Dun & Bradstreet (D&B) of $7 per
enumeration and $3 per update. The D&B estimates are based on the cost
of assigning and maintaining the Data Universal Numbering System (D-U-
N-S) number. The D-U-N-S number is a nine-digit, non-indicative number
assigned to each record in D&B's file. It uses a modulus
[[Page 25352]]
10 check digit in the ninth position. Over 47 million D-U-N-S numbers
have been assigned, worldwide, with 22 million attributed to locations
in the United States. D&B uses the D-U-N-S number to enumerate
businesses, including commercial sites, sole proprietorships, cottage
industries, educational institutions, not-for-profits, and government
entities, but does not maintain records on private individuals. D&B
estimates an average cost of $7 to add a record to its database and
assign it a unique record identifier. To establish a record and ensure
uniqueness, D&B requires the entity's legal name, any ``doing business
as'' names, physical address, telephone number, chief executive, date
started, line of business, number of employees and relationship(s) with
other business entities. D&B runs a daily computer process to audit all
records added during the day and extracts any that may be duplicates
for research by an analyst. Updates to each record are estimated at
approximately $3 but can run as high as $30 per year for very robust
database entries, some of which contain 1500 different data elements.
The D&B estimates may be understated for our purposes because the
four to six data elements used to uniquely identify the enumerated
corporations do not require verification. We welcome comments on which
data elements are required to uniquely identify health care providers
(individuals, groups, and organizations), on whether verification of
the data is necessary for purposes of enumeration, and on estimates of
the cost to enumerate and update that minimum data set. We understand
that the cost would be lower if the number and complexity of the data
elements were reduced, but this cost must be balanced against the level
of confidence that can be placed in the uniqueness of the health care
providers identified. Specific consideration of these tradeoffs in
submitted comments will be very helpful.
The $50 estimated average cost to enumerate a health care provider
is an upper limit. The cost would decrease significantly if the second
data alternative is selected (see section IV.B., Practice Addresses and
Group/Organization Options, of this preamble). Under this alternative,
the NPS would capture only one practice address for an individual or
organization provider. It would not assign location codes. The NPS
would not link the NPI of a group provider to the NPIs of individuals
who are members of the group. Costs would decrease because we would
collect significantly less data at the time of enumeration, and the
data that would be collected would not need to be updated very
frequently. Recent consultations with the industry reveal a growing
consensus for this alternative.
Table 5 below provides estimates as to the cost of each enumeration
option for start-up and outyear, with Federal, State, and private
costs, for HIPAA-transaction and non-HIPAA-transaction health care
providers, and the Federal costs of the NPS. We define ``start-up'' as
the first 3 years during which the NPS becomes operational nationally
and the bulk of the health care providers requiring NPIs are
enumerated. ``Outyear'' would be each subsequent year, in which the
majority of actions would be enumerations of new health care providers
and provider updates. Assumptions follow the table.
Table 5.--Enumeration Costs: Federal, State, and Private
----------------------------------------------------------------------------------------------------------------
Enumeration Costs: Federal, State, and Private
-----------------------------------------------------------------------------------------------------------------
Start-up costs Outyear costs Start-up costs Outyear costs
HIPAA- HIPAA- non-HIPAA- non-HIPAA-
Costs to: transaction transaction transaction transaction
providers providers providers providers
----------------------------------------------------------------------------------------------------------------
OPTION 1--REGISTRY
----------------------------------------------------------------------------------------------------------------
Federal for NPS................................. 10,400,000 2,900,000 .............. ..............
Federal for non-HIPAA-transaction health care
providers...................................... .............. .............. 165,000,000 7,500,000
Federal......................................... 64,560,000 2,280,000 .............. ..............
State........................................... 0 0 .............. ..............
Private......................................... 0 0 .............. ..............
---------------------------------------------------------------
Total....................................... 74,960,000 5,180,000 .............. ..............
----------------------------------------------------------------------------------------------------------------
OPTION 2--COMBINATION OF FEDERAL HEALTH PLANS, MEDICAID STATE AGENCIES, AND FEDERALLY-DIRECTED REGISTRY
----------------------------------------------------------------------------------------------------------------
Federal for NPS................................. 10,400,000 2,900,000 .............. ..............
Federal for non-HIPAA-transaction health care
providers...................................... .............. .............. 165,000,000 7,500,000
Federal (if all Medicaid State agencies
participate)................................... 9,990,000 495,000 .............. ..............
Federal (if 5% of Medicaid State agencies
decline to participate)........................ 10,310,000 505,000 .............. ..............
State (if all Medicaid State agencies
participate)................................... 0 0 .............. ..............
State (if 5% of Medicaid State agencies decline
to participate)................................ 0 0 .............. ..............
Private......................................... 0 0 .............. ..............
---------------------------------------------------------------
Total (if all Medicaid State agencies
participate)............................... 20,390,000 3,395,000 .............. ..............
===============================================================
Total (if 5% of Medicaid State agencies
decline to participate).................... 20,710,000 3,405,000 .............. ..............
----------------------------------------------------------------------------------------------------------------
Assumptions
1. Definitions
a. ``HIPAA-transaction health care provider'' means a health care
provider that we would require to have an NPI; that is, a health care
provider that must be identified in the transactions specified in
HIPAA.
b. ``Non-HIPAA-transaction health care provider'' means a health
care provider that we would not require to have an NPI.
c. ``Start-up'' means the first 3 years in which the NPS becomes
operational nationally and the bulk of the health care providers
requiring NPIs are enumerated. It is the sum of the cost of enumerating
existing health care providers in the first year plus the
[[Page 25353]]
annual cost of enumerating new and updating existing health care
providers for the 2 subsequent years.
d. ``Outyear'' means each subsequent year in which the majority of
actions would be enumerating new health care providers and updating
existing ones. It is the sum of the cost of enumerating new health care
providers plus the cost of updating existing health care providers.
2. The cost to enumerate a health care provider that is not
enrolled or enrolling in a Federal health plan (e.g., Medicare,
CHAMPUS) or Medicaid is estimated to be $50. (See Assumption 4.)
3. The cost to update information on a health care provider that is
not enrolled or enrolling in a Federal health plan (e.g., Medicare,
CHAMPUS) or Medicaid is estimated to be $10. (See Assumption 4.)
4. The cost to Federal health plans (e.g., Medicare, CHAMPUS) and
Medicaid to enumerate or update their own health care providers is
relatively small as these health plans must collect the same
information to enroll or update the health care providers in their own
programs. Possible up-front costs to these health plans and Medicaid
would be offset by simpler, more efficient coordination of benefits,
elimination of the need to maintain multiple enumeration systems, and
elimination of the need to maintain other provider numbers. The Federal
Government pays 75 percent of Medicaid State agencies' costs to
enumerate and update health care providers. Because all of these costs
are relatively small and would be offset by savings, they are
considered to be $0 (zero).
5. This analysis presumes the availability of Federal funds to
support the registry.
6. It is estimated that 5 percent of existing HIPAA-transaction
health care providers that conduct business with Federal health plans
or Medicaid require updates annually; 15 percent of the remaining
HIPAA-transaction health care providers require updates annually.
7. It is estimated that 5 percent of Medicaid State agencies may
decline to participate in enumerating/updating their health care
providers. The registry would enumerate/update that 5 percent.
8. Non-HIPAA-transaction health care providers would not be
enumerated in the initial phases of enumeration. These costs are
estimated to be $165,000,000 for start-up and $7,500,000 for outyear.
The registry would enumerate/update these health care providers only if
funds are available.
Option 1 calls for all 1.2 million HIPAA-transaction health care
providers to be enumerated by a Federally-directed registry. The one-
time cost for the registry to assign NPIs to existing HIPAA-transaction
health care providers would depend on the extent to which existing
files could be used. The cost could be as high as $60 million (1.2
million health care providers x $50) or as low as $9 million (see
option 2). The low estimate assumes that prevalidated provider files
are available for 100 percent of all Federal and Medicaid providers.
The annual outyear cost would be $2.1 million (30,000 new health care
providers x $50 plus 60,000 updates x $10). The Federal health
plans and Medicaid State agencies would no longer have to assign their
own identifiers, which would result in some savings, but they would
still incur costs related to provider enrollment activities that would
duplicate Federally-directed registry functions (for example, duplicate
collection and verification of some information).
Option 2 calls for enumeration of HIPAA-transaction health care
providers to be performed by a combination of Federal programs named as
health plans, Medicaid State agencies, and a Federally-directed
registry. This registry would enumerate non-Federal, non-Medicaid
providers. All enumerators would receive, validate, and enter
application data into the NPS and would communicate with health care
providers. Data files would be available from a central source. The
registry would utilize the NPS and would be operated under Federal
oversight but could, if appropriate, be contracted out.
Medicare, Medicaid, CHAMPUS, and the Department of Veterans Affairs
already assign identifiers to health care providers with whom they
conduct business. They would simply begin to use the NPS to issue NPIs
instead of using their own systems to assign the identifiers they now
use. Initially, these Federal health plans and Medicaid may incur up-
front costs in issuing NPIs; however, these additional costs would be
offset by savings from the fact that each health care provider would
only have to be enumerated once; multiple enumeration systems would not
have to be maintained; other provider numbers would not have to be
maintained; and coordination of benefits would be simpler and more
efficient. We estimate that approximately 5 percent of Medicaid State
agencies may decline to participate (that is, they would not enumerate
and update their health care providers). These health care providers
would need to be enumerated and updated by the Federally-directed
registry; however, that cost would be offset by savings realized by the
discontinuance of UPIN assignment and maintenance of the UPIN registry.
We estimate that approximately 85 percent of the health care providers
that conduct HIPAA transactions would be enumerated in this manner (75
percent by Federal health plans, 10 percent by Medicaid). Additional
costs, if any, to enumerate these health care providers or update their
data would be insignificant.
The remaining 15 percent of health care providers that conduct
HIPAA transactions (180,000) would be enumerated by a Federally-
directed registry. The one-time cost of enumerating these health care
providers would be $9 million (180,000 health care providers x $50).
The cost of enumerating 4,500 new health care providers would be
$225,000 per year, and the cost to process 27,000 updates would be
$270,000, for a total registry cost of $495,000 per outyear.
Based on the cost estimates in this analysis, option 1 is
considerably more expensive than option 2. We believe option 2 to be
preferable to option 1 in that Federal programs and Medicaid State
agencies would enumerate and update their own health care providers.
The enumeration functions of the 5 percent of Medicaid State agencies
that may decline to enumerate and update their own health care
providers would fall to the Federally-directed registry.
The initial and ongoing cost of developing, implementing and
operating the NPS would be borne by the Federal government, depending
on the availability of funds; some of this cost could be offset by
ceasing current enumeration systems like Medicare's UPIN registry.
The previous analysis relates only to health care providers that
are required to have an NPI to perform HIPAA transactions. The
remaining health care providers would not be required to obtain an NPI
but could do so if they wished to have one for other reasons. We
indicated in the Implementation section of this preamble that we would
not issue NPIs to these health care providers until the health care
providers that needed NPIs to conduct any of the electronic
transactions specified in HIPAA had been enumerated. The cost of
enumerating the approximately 3 million non-HIPAA-transaction health
care providers could be as high as $150 million (3 million health care
providers x $50). We are soliciting comments on sources of
information on non-HIPAA-transaction health care providers. We cannot
provide a realistic estimate of the cost of enumerating these health
care providers without this additional input.
[[Page 25354]]
e. Maintenance of the Database
Another cost implication is the maintenance of the database being
developed by the NPS. (We discuss this cost implication in more detail
in section IV. Data but believe the general discussion should be
repeated here in the impact analysis as well.) That database, known as
the National Provider File (NPF), is currently being designed to
contain the data elements shown in the table entitled, ``National
Provider File Data Elements'' in section IV. Data, A. Data Elements,
earlier in this preamble. The majority of the information is used to
uniquely identify a health care provider; other information is used for
administrative purposes. A few of the data elements are collected at
the request of potential users that have been working with HCFA in
designing the database prior to the passage of HIPAA. All of these data
elements represent only a fraction of the information that would
comprise a provider enrollment file. The data elements shown in the
``National Provider File Data Elements'' table earlier in the preamble,
plus cease/effective/termination dates, switches (yes/no), indicators,
and history, are being considered as those that would form the NPF. The
table includes appropriate comments. The table does not display systems
maintenance or similar fields, or health care provider cease/effective/
termination dates.
We need to consider the benefits of retaining all of the data
elements shown in the table versus lowering the cost of maintaining the
database by keeping only the minimum number of data elements needed for
unique provider identification. We solicit input on the composition of
the minimum set of data elements needed to uniquely identify each type
of health care provider. In order to consider the inclusion or
exclusion of data elements, we need to assess their purpose and use.
The data elements in the table with a purpose of ``I'' are being
proposed to identify a health care provider, either in the search
process (which is electronic) or in the investigation of health care
providers designated as possible matches by the search process. These
data elements are critical because unique identification is the
keystone of the NPS.
The data elements in the table with a purpose of ``A'' are not
essential to the identification processes mentioned above, but they
nonetheless are valuable. Certain ``A'' data elements can be used to
contact a health care provider for clarification of information or
resolution of issues encountered in the enumeration process and for
sending written communications; other ``A'' data elements (e.g.,
Provider Enumerate Date, Provider Update Date, Establishing Enumerator/
Agent Number) are used to organize and manage the data.
The data elements in the table with a purpose of ``U'' are
collected at the request of potential users of the information in the
system. While not used by the system's search process to uniquely
identify a health care provider, Race (with a purpose of ``U'') is
nevertheless valuable in the investigation of health care providers
designated as possible matches as a result of that process. In
addition, Race is important to the utility of the NPS as a statistical
sampling frame. Race is collected ``as reported''; that is, it is not
validated. It is not maintained, only stored. The cost of keeping this
data element is virtually nil. Other data elements (Resident/Intern
Code, Provider Certification Code and Number, and Organization Type
Control Code) with a purpose of ``U'', while not used for enumeration
of a health care provider, have been requested to be included by some
members of the health care industry for reports and statistics. These
data elements are optional and do not require validation; many remain
constant by their nature; and the cost to store them is negligible.
The data elements that we judge will be expensive to either
validate or maintain (or both) are the license information, provider
practice location addresses, and membership in groups. We solicit
comments on whether these data elements are necessary for the unique
enumeration of health care providers and whether validation or
maintenance is required for that purpose.
Licenses may be critical in determining uniqueness of a health care
provider (particularly in resolving identifies involving compound
surnames) and are, therefore, considered to be essential by some.
License information is expensive to validate initially, but it is not
expensive to maintain because it does not change frequently.
The practice location addresses can be used to aid in investigating
possible provider matches, in converting existing provider numbers to
NPIs, and in research involving fraud or epidemiology. Location codes,
which are discussed in detail in section B. Practice Addresses and
Group/Organization Options of this preamble, could be assigned by the
NPS to point to and identify practice locations of individuals and
groups. Some potential users felt that practice addresses changed too
frequently to be maintained efficiently at the national level. The
average Medicare physician has two to three addresses at which he or
she practices. Group providers may have many more practice locations.
We estimate that 5 percent of health care providers require updates
annually and that addresses are one of the most frequently changing
attributes. As a result, maintaining more than one practice address for
an individual provider on a national scale could be burdensome and time
consuming. Many potential users believe that practice addresses could
more adequately be maintained at local, health-plan specific levels.
Some potential users felt that membership in groups was useful in
identifying health care providers. Many others, however, felt that
these data are highly volatile and costly to maintain. These users felt
it was unlikely that membership in groups could be satisfactorily
maintained at the national level.
We welcome comments on the data elements proposed for the NPF and
input as to the potential usefulness and tradeoffs for these elements
such as those discussed above.
References
1. Dobson, Allen, Ph.D. and Bergheiser, Matthew; ``Reducing
Administrative Costs in a Pluralistic Delivery System through
Automation;'' Lewin-VHI Report prepared for the Healthcare Financial
Management Association; 1993.
2. Congressional Budget Office; ``Federal Cost Estimate for H.R.
3070;'' 1996.
3. Workgroup for Electronic Data Interchange; ``Report,'' 1993.
4. ``Electronic Network Solution for Rising Healthcare Costs;''
New Jersey Institute of Technology and Thomas Edison State College,
1995.
5. Faulkner & Gray's Health Data Directory, 1997 Edition; Kurt
T. Peters, Publisher (also earlier editions).
List of Subjects in 45 CFR Part 142
Administrative practice and procedure, Health facilities, Health
insurance, Hospitals, Medicare, Medicaid.
Accordingly, 45 CFR subtitle A, subchapter B, would be amended by
adding Part 142 to read as follows:
Note to Reader: This proposed rule and another proposed rule
found elsewhere in this Federal Register are two of several proposed
rules that are being published to implement the administrative
simplification provisions of the Health Insurance Portability and
Accountability Act of 1996. We propose to establish a new 45 CFR
Part 142. Proposed Subpart A--General Provisions is exactly the same
in each rule unless we have added new sections or definitions to
incorporate
[[Page 25355]]
additional general information. The subparts that follow relate to
the specific provisions announced separately in each proposed rule.
When we publish the first final rule, each subsequent final rule
will revise or add to the text that is set out in the first final
rule.
PART 142--ADMINISTRATIVE REQUIREMENTS
Subpart A--General Provisions
Sec.
142.101 Statutory basis and purpose.
142.102 Applicability.
142.103 Definitions.
142.104 General requirements for health plans.
142.105 Compliance using a health care clearinghouse.
142.106 Effective date of a modification to a standard or
implementation specification.
Subparts B--C [Reserved]
Subpart D--National Provider Identifier Standard
142.402 National provider identifier standard.
142.404 Requirements: Health plans.
142.406 Requirements: Health care clearinghouses.
142.408 Requirements: Health care providers.
142.410 Effective dates of the initial implementation of the
national provider identifier standard.
Authority: Sections 1173 and 1175 of the Social Security Act (42
U.S.C. 1320d-2 and 1320d-4).
Subpart A--General Provisions
Sec. 142.101 Statutory basis and purpose.
Sections 1171 through 1179 of the Social Security Act, as added by
section 262 of the Health Insurance Portability and Accountability Act
of 1996, require HHS to adopt national standards for the electronic
exchange of health information in the health care system. The purpose
of these sections is to promote administrative simplification.
Sec. 142.102 Applicability.
(a) The standards adopted or designated under this part apply, in
whole or in part, to the following:
(1) A health plan.
(2) A health care clearinghouse when doing the following:
(i) Transmitting a standard transaction (as defined in
Sec. 142.103) to a health care provider or health plan.
(ii) Receiving a standard transaction from a health care provider
or health plan.
(iii) Transmitting and receiving the standard transactions when
interacting with another health care clearinghouse.
(3) A health care provider when transmitting an electronic
transaction as defined in Sec. 142.103.
(b) Means of compliance are stated in greater detail in
Sec. 142.105.
Sec. 142.103 Definitions.
For purposes of this part, the following definitions apply:
Code set means any set of codes used for encoding data elements,
such as tables of terms, medical concepts, medical diagnostic codes, or
medical procedure codes.
Health care clearinghouse means a public or private entity that
processes or facilitates the processing of nonstandard data elements of
health information into standard data elements. The entity receives
health care transactions from health care providers, health plans,
other entities, or other clearinghouses, translates the data from a
given format into one acceptable to the intended recipient, and
forwards the processed transaction to the appropriate recipient.
Billing services, repricing companies, community health management
information systems, community health information systems, and ``value-
added'' networks and switches that perform these functions are
considered to be health care clearinghouses for purposes of this part.
Health care provider means a provider of services as defined in
section 1861(u) of the Social Security Act, a provider of medical or
other health services as defined in section 1861(s) of the Social
Security Act, and any other person who furnishes or bills and is paid
for health care services or supplies in the normal course of business.
Health information means any information, whether oral or recorded
in any form or medium, that--
(1) Is created or received by a health care provider, health plan,
public health authority, employer, life insurer, school or university,
or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental
health or condition of an individual, the provision of health care to
an individual, or the past, present, or future payment for the
provision of health care to an individual.
Health plan means an individual or group plan that provides, or
pays the cost of, medical care. Health plan includes the following,
singly or in combination:
(1) Group health plan. A group health plan is an employee welfare
benefit plan (as currently defined in section 3(1) of the Employee
Retirement Income and Security Act of 1974, 29 U.S.C. 1002(1)),
including insured and self-insured plans, to the extent that the plan
provides medical care, including items and services paid for as medical
care, to employees or their dependents directly or through insurance,
or otherwise, and
(i) Has 50 or more participants; or
(ii) Is administered by an entity other than the employer that
established and maintains the plan.
(2) Health insurance issuer. A health insurance issuer is an
insurance company, insurance service, or insurance organization that is
licensed to engage in the business of insurance in a State and is
subject to State law that regulates insurance.
(3) Health maintenance organization. A health maintenance
organization is a Federally qualified health maintenance organization,
an organization recognized as a health maintenance organization under
State law, or a similar organization regulated for solvency under State
law in the same manner and to the same extent as such a health
maintenance organization.
(4) Part A or Part B of the Medicare program under title XVIII of
the Social Security Act.
(5) The Medicaid program under title XIX of the Social Security
Act.
(6) A Medicare supplemental policy (as defined in section
1882(g)(1) of the Social Security Act).
(7) A long-term care policy, including a nursing home fixed-
indemnity policy.
(8) An employee welfare benefit plan or any other arrangement that
is established or maintained for the purpose of offering or providing
health benefits to the employees of two or more employers.
(9) The health care program for active military personnel under
title 10 of the United States Code.
(10) The veterans health care program under 38 U.S.C., chapter 17.
(11) The Civilian Health and Medical Program of the Uniformed
Services (CHAMPUS), as defined in 10 U.S.C. 1072(4).
(12) The Indian Health Service program under the Indian Health Care
Improvement Act (25 U.S.C. 1601 et seq.).
(13) The Federal Employees Health Benefits Program under 5 U.S.C.
chapter 89.
(14) Any other individual or group health plan, or combination
thereof, that provides or pays for the cost of medical care.
Medical care means the diagnosis, cure, mitigation, treatment, or
prevention of disease, or amounts paid for the purpose of affecting any
body structure or function of the body; amounts paid for transportation
primarily for and essential to these items; and amounts paid for
insurance covering the items and the
[[Page 25356]]
transportation specified in this definition.
Participant means any employee or former employee of an employer,
or any member or former member of an employee organization, who is or
may become eligible to receive a benefit of any type from an employee
benefit plan that covers employees of that employer or members of such
an organization, or whose beneficiaries may be eligible to receive any
of these benefits. ``Employee'' includes an individual who is treated
as an employee under section 401(c)(1) of the Internal Revenue Code of
1986 (26 U.S.C. 401(c)(1)).
Small health plan means a group health plan or individual health
plan with fewer than 50 participants.
Standard means a set of rules for a set of codes, data elements,
transactions, or identifiers promulgated either by an organization
accredited by the American National Standards Institute or HHS for the
electronic transmission of health information.
Transaction means the exchange of information between two parties
to carry out financial and administrative activities related to health
care. It includes the following:
(1) Health claims or equivalent encounter information.
(2) Health care payment and remittance advice.
(3) Coordination of benefits.
(4) Health claims status.
(5) Enrollment and disenrollment in a health plan.
(6) Eligibility for a health plan.
(7) Health plan premium payments.
(8) Referral certification and authorization.
(9) First report of injury.
(10) Health claims attachments.
(11) Other transactions as the Secretary may prescribe by regulation.
Sec. 142.104 General requirements for health plans.
If a person conducts a transaction (as defined in Sec. 142.103)
with a health plan as a standard transaction, the following apply:
(a) The health plan may not refuse to conduct the transaction as a
standard transaction.
(b) The health plan may not delay the transaction or otherwise
adversely affect, or attempt to adversely affect, the person or the
transaction on the ground that the transaction is a standard
transaction.
(c) The health information transmitted and received in connection
with the transaction must be in the form of standard data elements of
health information.
(d) A health plan that conducts transactions through an agent must
assure that the agent meets all the requirements of this part that
apply to the health plan.
Sec. 142.105 Compliance using a health care clearinghouse.
(a) Any person or other entity subject to the requirements of this
part may meet the requirements to accept and transmit standard
transactions by either--
(1) Transmitting and receiving standard data elements, or
(2) Submitting nonstandard data elements to a health care
clearinghouse for processing into standard data elements and
transmission by the health care clearinghouse and receiving standard
data elements through the health care clearinghouse.
(b) The transmission, under contract, of nonstandard data elements
between a health plan or a health care provider and its agent health
care clearinghouse is not a violation of the requirements of this part.
Sec. 142.106 Effective date of a modification to a standard or
implementation specification.
HHS may modify a standard or implementation specification after the
first year in which HHS requires the standard or implementation
specification to be used, but not more frequently than once every 12
months. If HHS adopts a modification to a standard or implementation
specification, the implementation date of the modified standard or
implementation specification may be no earlier than 180 days following
the adoption of the modification. HHS determines the actual date,
taking into account the time needed to comply due to the nature and
extent of the modification. HHS may extend the time for compliance for
small health plans.
Subpart B-C--[Reserved]
Subpart D--National Provider Identifier Standard
Sec. 142.402 National provider identifier standard.
(a) The provider identifier standard that must be used under this
subpart is the national provider identifier, which is supported by the
Health Care Financing Administration. The national provider identifier
is an 8-position alphanumeric identifier, which includes as the eighth
position a check digit.
(b) The file containing identifying information for each health
care provider for its national provider identifier includes the
following information:
(1) The national provider identifier.
(2) Other identifiers, such as the social security number
(optional), employer identification number for some provider types, and
identifying numbers from other health programs, if applicable.
(3) Provider names.
(4) Addresses and associated practice location codes.
(5) Demographics (date of birth, State/country of birth, date of
death if applicable, race (optional), sex).
(6) Provider type(s), classification(s), area(s) of specialization.
(7) Education for certain provider types, State licensure for
certain provider types (optional), and board certification (optional
for some classifications).
Sec. 142.404 Requirements: Health plans.
Each health plan must accept and transmit the national provider
identifier of any health care provider that must be identified by the
national provider identifier in any standard transaction.
Sec. 142.406 Requirements: Health care clearinghouses.
Each health care clearinghouse must use the national provider
identifier of any health care provider that must be identified by the
national provider identifier in any standard transaction.
Sec. 142.408 Requirements: Health care providers.
(a) Each health care provider must obtain, by application if
necessary, a national provider identifier.
(b) Each health care provider must accept and transmit national
provider identifiers wherever required on all transactions it accepts
or transmits electronically.
(c) Each health care provider must communicate any changes to the
data elements in its file in the national provider system to an
enumerator of national provider identifiers within 60 days of the
change.
(d) Each health care provider may receive and use only one national
provider identifier. Upon dissolution of a health care provider that is
a corporation or a partnership, or upon the death of a health care
provider who is an individual, the national provider identifier is
inactivated.
Sec. 142.410 Effective dates of the initial implementation of the
national provider identifier standard.
(a) Health plans. (1) Each health plan that is not a small health
plan must comply with the requirements of Secs. 142.104 and 142.404 by
(24 months after the effective date of the final rule in the Federal
Register).
(2) Each small health plan must comply with the requirements of
[[Page 25357]]
Sec. Sec. 142.104 and 142.404 by (36 months after the effective date of
the final rule in the Federal Register).
(b) Health care clearinghouses and health care providers. Each
health care clearinghouse and health care provider must begin using the
standard specified in Sec. 142.402 by (24 months after the effective
date of the final rule in the Federal Register).
Authority: Sections 1173 and 1175 of the Social Security Act (42
U.S.C. 1320d-2 and 1320d-4).
Dated: March 27, 1998.
Donna E. Shalala,
Secretary.
[FR Doc. 98-11692 Filed 5-1-98; 9:05 am]
BILLING CODE 4120-01-P