Department of Health and Human Services 
OFFICE OF 
  
INSPECTOR GENERAL 
 
 
 
 
I N
M PROVEMENTS  EEDED TO 
 
E P
  NSURE  ROVIDER 
 
E M
NUMERATION AND  EDICARE 
 
 
E D
NROLLMENT  ATA ARE 
 
 
A , C ,
CCURATE   OMPLETE  AND 
C
ONSISTENT 
 
 
Daniel R. Levinson   
Inspector General  
 
May 2013 
OEI-07-09-00440   
EXECUTIVE SUMMARY:  IMPROVEMENTS  NEEDED TO ENSURE PROVIDER 
ENUMERATION AND MEDICARE ENROLLMENT DATA ARE ACCURATE,  
COMPLETE, AND CONSISTENT 
OEI-07-09-00440 
 
WHY WE DID THIS STUDY 
 
Health care provider information, including providers unique National Provider Identifiers 
(NPIs), is maintained in the National Plan and Provider Enumeration System (NPPES).  To 
enroll in Medicare, providers must supply their NPIs and other information to the Centers for 
Medicare & Medicaid Services (CMS) to be entered into the Provider Enrollment, Chain and 
Ownership System (PECOS).  Accurate, complete, and consistent provider data in NPPES and 
PECOS help to ensure the integrity of all health care programs.  Previous Office of Inspector 
General work has revealed ongoing problems with CMSs oversight of provider data, sometimes 
resulting in improper Medicare payments to fraudulently enrolled providers.  
 
HOW WE DID THIS STUDY    
 
We surveyed a random sample of individual Medicare providers to determine the accuracy of the 
provider information stored in NPPES and PECOS.  We reviewed individual provider data in 
both NPPES and PECOS to determine whether these data were complete and consistent between 
the two databases. Additionally, we interviewed CMS staff to gather information about 
oversight of provider data in NPPES and PECOS.   
 
WHAT WE FOUND 
 
Medicare provider data in NPPES and PECOS were often inaccurate and occasionally  
incomplete, and were generally inconsistent between the two databases.  In NPPES, provider 
data were inaccurate in 48 percent of records, and complete for nearly all required variables but 
incomplete for conditionally required variables in 9 percent of records.  In PECOS, provider data 
were inaccurate in 58 percent of records and incomplete in almost 4 percent.  Additionally, 
provider data were inconsistent between NPPES and PECOS for 97 percent of records.  
Addresses, which are essential for contacting providers and identifying trends in fraud, waste, 
and abuse, were the source of most inaccuracies and inconsistencies.  Finally, CMS did not 
verify most provider information in NPPES or PECOS.   
 
WHAT WE RECOMMEND  
 
Inaccurate, incomplete, and inconsistent provider data coupled with insufficient oversight place 
the integrity of the Medicare program at risk and present vulnerabilities in all health care 
programs.  CMS should require Medicare Administrative Contractors to implement program  
integrity safeguards for Medicare provider enrollment as established in the Program Integrity 
Manual. Additionally, CMS should require more verification of NPPES enumeration and 
PECOS enrollment data.  Finally, CMS should detect and correct inaccurate and incomplete 
provider enumeration and enrollment data for new and established records.  CMS concurred with 
all three of our recommendations. 
   
 
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology..............................................................................................10 

Findings......................................................................................................17 

In NPPES, 48 percent of records contained inaccurate data; 

almost all required data were complete .........................................17 

In PECOS, 58 percent of records contained inaccurate data  

and almost 4 percent were incomplete ...........................................18 

Provider data were inconsistent between NPPES and PECOS  

for 97 percent of records ................................................................21 

CMS did not verify most provider information in NPPES or 

PECOS ...........................................................................................22 

Conclusion and Recommendations ............................................................28 

Agency Comments and Office of Inspector General Response .....30 

Appendixes ................................................................................................31 

A: Detailed Methodology .............................................................31 

B: Point Estimates and Confidence Intervals Based on  

Provider Survey .............................................................................33 

C: Safeguards That Medicare Administrative Contractors  

Report Using To  Verify Provider Enrollment Data ........................35 

D: Agency Comments  ...................................................................37 

Acknowledgments......................................................................................41 

 
   
   
OBJECTIVES 
To assess: 
1. 	  provider enumeration data (i.e., from providers applications for 
National Provider Identifiers (NPIs)) and Medicare provider 
enrollment data maintained by the Centers for Medicare & Medicaid 
Services (CMS) for accuracy, completeness, and consistency; and  
2.	   CMS oversight processes for ensuring the accuracy, completeness, and 
consistency of provider enumeration data and Medicare provider 
enrollment data. 
BACKGROUND 
CMS has two databases with basic provider-related dataone from which 
providers obtain NPIs and one through which providers enroll in 
Medicare. Before enrolling in Medicare, a health care provider must 
apply through the National Plan and Provider Enumeration System  
(NPPES) to obtain an NPI.1  CMS assigns NPIs to providers via a process 
called enumeration, and these NPI assignments are maintained in the 
NPPES database. A health care provider wishing to establish and maintain 
Medicare billing privileges must enroll in Medicare and periodically 
reenroll with accurate and verifiable information via an approved CMS 
application process.2  Currently, Medicare provider enrollment 
applications are processed through the Provider Enrollment, Chain and 
Ownership System (PECOS).  Providers are required to submit identifying 
information to each application system, such as individuals names, dates 
of birth (DOBs), State professional license numbers, and practice 
locations. CMS oversees both NPPES and PECOS and uses contractors to 
process and maintain provider data. 
As described in the Office of Inspector Generals (OIG) 2012 
Compendium of Unimplemented Recommendations, the Department of 
Health and Human Services (HHS) and OIG 
rely heavily on the availability and completeness of data to ensure 
that ... departmental programs are operating as intended and help 
identify instances of fraud, waste, and abuse....  When these data are 
 
1 42 CFR   424.506(b); CMS, Medicare Program Integrity  Manual (PIM) (Internet-only  
manual), Pub. No. 100-08, ch. 10,  4.2.1, and ch. 15,   15.3.  (At the time of  our  review, 
information relating to provider enrollment was found in ch. 10  of the PIM; CMS has 
since moved some of this information to ch. 15.)  
2 42 CFR    424.505 and 424.515.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   1 
   
   
unavailable, are incomplete, or contain inaccuracies, program 
oversight and monitoring activities are hindered.3    
OIG identifies the integrity and security of health information systems and 
data as a Top Management Challenge for HHS.4    
Provider Enumeration in NPPES 
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) 
required the Secretary of HHS to (1) establish a standard unique health 
care system identifier for each provider and (2) specify the purposes for 
which the identifier may be used.5   The resulting identifier, the NPI, is 
intended for use by all individuals and entities that  meet the definition of a 
health care provider and/or a health care organization under HIPAA.6    
On January 23, 2004, CMS promulgated a final rule in the Federal 
Register adopting the NPI as the standard unique health identifier for 
health care providers.7   Each health care provider satisfying HIPAAs 
definition of covered entities8 was required to obtain and use an NPI for 
HIPAA transactions9 no later than May 23, 2007.10   Therefore, current 
health care providers must use NPIs to submit electronic bills to insurers 
for payment.  
The NPI replaced the legacy identification numbers (e.g., the Unique 
Physician Identification Number (UPIN) for Medicare) that health insurers 
used to identify their enrolled health care providers claiming 
reimbursement for services.11  Prior to the use of the NPI, a provider would 
have used multiple identification numbers to submit claims for 
 
3 OIG,  Compendium  of Unimplemented Recommendations, December 2012 Edition, 
p. 131.  Accessed at http://oig.hhs.gov  on January 3, 2013.   
4 OIG,  2012 Top Management  & Performance Challenges, Management  
Issue 9:  Availability and  Quality of Data for Effective Program Oversight, 
November 9, 2012.  Accessed at http://oig.hhs.gov on  January 3, 2013. 
5  HIPAA (P.L. 104-191), enacted  on August 21, 1996.  Title II, Subpart F,   262(a) added 
a new pt. C to  Title XI of the Social Security Act, Administrative Simplification.  
Currently, pt. C consists of  1171  and 1180. 
6 69 Fed. Reg. 3434, 3440 (Jan. 23, 2004). 
7 Ibid. at 3434.   
8 Ibid. at 3434.  A covered entity means (1) a health  plan, (2) a health care clearinghouse, 
or (3) a health care provider that transmits health information in electronic form in 
connection with a transaction covered by  HIPAA.  
9 The HIPAA transactions are claims and encounter information,  payment and remittance  
advice, claims  status, eligibility, enrollment and disenrollment, referrals and 
authorizations, and premium payment.  
10 45 CFR   162.404(b)(2).  Small health  plans were required  to use the NPI  in standard  
transactions  no later than May 23, 2008. 
11 CMS, NPI Fact Sheet. Accessed at http://www.cms.gov on  May 12, 2009.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   2 
   
   
reimbursement, with a different number for each participating health 
insurance plan. In contrast, the NPI is used by all health insurance plans, 
which enables the public and private sectors to consistently track providers 
nationwide. 
In the final rule establishing the NPI, CMS listed several examples of  
permissible uses of the NPI, including the following: 
	   The NPI may be used as a cross-reference in files on provider fraud 
and abuse and other program integrity files. 
	   The NPI may be used to identify providers for debt collection under 
the Debt Collection Improvement Act of 1996.  
	   Health plans may use the NPI in their internal files for providers to 
process transactions and in communications with providers. 
	   Health plans may communicate the NPI to other health plans for 
coordination of benefits. 
	   The NPI may be used to identify providers in patient medical records.12  
Providers may apply for an NPI using a Web-based or a paper 
application.13  The Web-based NPI application requires the following data 
for individuals: first and last names; Social Security number (SSN); DOB 
and place of birth; gender; mailing address; practice location address and 
telephone number; medical specialty (e.g., cardiology); State license 
information; and a contact persons name, email address, and telephone 
number.14   Although the individuals SSN and a contact persons email 
address are required on Web-based applications, they are not required for 
paper applications.15  Providers must communicate any changes in required 
data elements to NPPES within 30 days of the change.16 As of June 30, 
2012, approximately 2.8 million health care providers (e.g., physicians) 
 
12 69 Fed. Reg. 3434, 3449 (Jan. 23, 2004). 
13 Providers may also apply online via Electronic File Interchange (EFI).  EFI  
applications are submitted by CMS-approved organizations  on behalf of health  care 
providers.   
14 CMS, NPPES Data Dictionary, ch. 19.1, pp. 13,  2010.  
15 Ibid., p.  2.   A provider must submit two  proofs of identity if he  or  she does not furnish  
an SSN. CMS, National Provider Identifier (NPI) Application/Update Form  
CMS-10114, 2012.  Acceptable forms of identification include  a valid passport, birth 
certificate, photocopy of  U.S. drivers license, or State-issued identification. 
16  45  CFR  162.410(a)(4).    
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   3 
   
   
and 913,000 health care organizations (e.g., hospitals) had been assigned 
NPIs.17    
Provider Enrollment Data Maintained in PECOS 
Medicare Administrative Contractors (MACs) enroll providers in 
Medicare using PECOS. In 2002, CMS implemented PECOS as a 
national data repository for Medicare enrollment information about 
physicians, nonphysician practitioners, and provider and supplier 
organizations.18  It is intended to contribute to CMSs information-based 
strategy on fraud and abuse.19    
The purpose of PECOS is to centralize Medicare provider enrollment.20   
PECOS is used to implement standard enrollment policies and procedures 
throughout the Medicare program.21  Each provider must obtain an NPI 
prior to applying for Medicare enrollment.22 Required provider data for 
initial enrollment in PECOS generally include an individuals first and last 
names; NPI number; Tax Identification Number (TIN), which may be an 
SSN or Employer Identification Number (EIN); DOB; mailing address 
and practice location address(es); State license information and/or 
certification information (if applicable); provider type; medical specialty; 
medical or professional school/training institution and graduation year; 
adverse legal history; and payment information.23  The providers 
telephone number is recommended but not required for enrollment.24  After 
providers are enrolled, they must report any changes to their information 
within 90 calendar days of the changes.25   
Each MAC processes enrollment data for its jurisdiction through PECOS.  
Data extracts from PECOS are then used to populate the Multi-Carrier 
System, which MACs use to process and pay Medicare claims.  Many 
 
17 CMS, NPI Enumeration  Statistics by State/Entity Type As of:  5/23/2005  through 
6/30/2012. Accessed at http://www.cms.gov on July 24, 2012. 
18 66 Fed. Reg. 51961  (Oct. 11, 2001).  Providers  of durable medical equipment, 
prosthetics, orthotics, and supplies were not  included in PECOS until 2010. 
19 Ibid.  
20 Ibid. at 51962. 

21 Ibid. 

22  42  CFR  242.506(b); CMS, PIM, Pub.  No. 100-08, ch. 15,  15.3 (previously found  in  

ch. 10,  4.21).  
23 CGI Federal, PECOS 6.0.0 Required Fields, Doc ID:  PECOS-6.0.0-REQ-67792-
v0.10, April 2009.   

24 Ibid. 

25 42 CFR   424.520(b). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   4 
   
   
other CMS business functions rely on PECOS data.  For example, PECOS 
may be used to: 
 	  capture information from the Medicare enrollment forms and record 
the associations between the applicant and those that have an 
ownership or control interest in the entity; 
 	  make informed enrollment decisions based on a providers history and 
any reported exclusions, sanctions, or felonious behavior at the 
providers locations or in multiple contractor jurisdictions; 
   ensure that correct payments are being made under Medicare; 
   assist other Federal or State agencies and their contractors; 
   assist individual or organizational research, evaluation, or 
epidemiological projects; 
   support litigation involving CMS; and 
   combat fraud, waste, and abuse in certain health care programs.26  
As of December 2012, PECOS contained records for approximately 
1.2 million individual Medicare providers and 328,488 organizational 
Medicare providers.27  PECOS may not contain records for providers 
enrolled in Medicare prior to 2003 if no enrollment updates (e.g., changes 
of address) have been made. Information for these providers is maintained  
by individual MACs. 
Provider Identification Data Common to the NPPES and 
PECOS Databases 
Although no Federal mandate requires that information in NPPES and 
PECOS be consistent, the databases contain specific fields that collect the  
same information.  Data fields that can be used to identify unique 
providers common to both databases include the following: 
   first and last names, 

   NPI number, 

   SSN (conditionally required in NPPES28), 

   Gender (not required in PECOS29), 

   DOB, 
 
 
26  71  Fed.  Reg. 60536, 60539 (Oct. 13, 2006). 
  
27 OIG, analysis of PECOS data, 2013. 

28 SSN is conditionally required in  NPPES.  It must be included  on  Web-based  

applications, but not  on paper applications. 
  
29 The gender variable is optional rather than  required in  PECOS. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   5 
   
   
 	  mailing address and practice location address(es) and corresponding 
telephone numbers (telephone numbers are not required in PECOS), 
 	  professional license number and issuing State (conditionally required 
in NPPES and PECOS30), and 
 	  provider specialty.    
CMS Oversight of Provider Data 
In 2008, an OIG official testified to Congress that CMS could be more 
effective and efficient if it were to prevent the enrollment of unqualified 
and fraudulent providers rather than attempting to recover payments or 
redress fraud or abuse after it occurs.31  However, CMS has faced 
challenges in ensuring the integrity of Medicare provider enrollment.  
Many health care fraud schemes involving misuse of provider information 
have been committed by criminals who masquerade as Medicare 
providers ... who do not provide legitimate services or products.32 Such 
criminals have used providers stolen identities to bill directly for services 
in the providers names or to authorize payment for beneficiary health care 
services. 
CMS Oversight of NPPES Enumeration Data. CMS uses two contractors 
to conduct provider enumeration.33  One contractor maintains NPPES and 
establishes electronic edits (i.e., internal system processes) to ensure that 
the NPI data conform to database requirements at the time a provider 
applies for an NPI. This contractor manages an Internet-based registry 
that makes NPPES data available to the public in accordance with the 
Freedom of Information Act.34   The other contractor enters data from paper 
applications into NPPES and operates  a call center for providers who have 
questions or problems. 
CMS Oversight of PECOS Enrollment Data.   CMS has developed 
safeguards for processing provider enrollments in PECOS to ensure that 
 
30 License/certification information is conditionally required in  NPPES and PECOS for 
specific types  of providers, as applicable by the State in  which they practice.  For 
example, several States require dietitians to  be licensed, others require certification, and a 
few do  not require licensure or certification. 
31  Medicare Payments for Claims with  Identification Numbers of  Dead Doctors, 
110th Cong. 12 (2008)  (testimony  of Robert  A.  Vito, Regional Inspector  General for  
Evaluation and Inspections). 
32  New Tools for Curbing Waste and Fraud in Medicare and Medicaid, 
112th Cong. 3 (2011) (testimony of  Daniel R. Levinson, Inspector  General). 
33 See 45 CFR pt. 162.408, subpart D, detailing the provider enumeration  process. 
34 72 Fed. Reg. 30011, 30013  (May 30, 2007).   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   6 
   
   
the applicants are eligible to participate in Medicare.35  When providers 
enroll, change ownership, or update information, the PIM requires MACs 
to ensure that they are not on the OIG List of Excluded 
Individuals/Entities or the General Services Administrations Excluded 
Parties List System.36  The PIM also requires MACs to validate all data 
submitted on applications37 and lists some examples of possible 
verification methods.38  For example, the PIM suggests that MACs check 
the Yellow Pages or conduct a site visit to verify a providers practice 
location.39    
In addition, CMS issues a variety of memorandums intended to provide 
supplementary program integrity guidance to MACs.  These documents 
include joint signature memorandums (JSM) and technical direction 
letters (TDL). For example, one JSM directed MACs to conduct site visits 
for providers and suppliers that listed UPS stores as their practice 
locations to ensure that providers were not using those locations as 
Medicare practice locations.40  
CMS has undertaken ongoing efforts to update provider information.   
In 2010, CMS implemented efforts to establish records in PECOS for all 
Medicare-enrolled providers.41  More recently, CMS instructed all 
providers and suppliers enrolled prior to March 25, 2011, to revalidate 
their enrollment data.  These revalidation applications are subject to new 
screening provisions set forth in section 6401 of the Patient Protection and 
Affordable Care Act (ACA) that require classification of providers as  
 
35 Chapter 10 of  the PIM contained policies and procedures for processing enrollment  
applications  during the time of  our review.  This information was recently moved to   
ch. 15. 
36  CMS, PIM, Pub. No. 100-08,  ch. 10,  1.3.  The  General Services Administrations 
Excluded Parties List System  migrated to the System for Award Management in  
July 2012. 
37  CMS, PIM, Pub. No. 100-08, ch. 10,  1.3.   
38  CMS, PIM, Pub. No. 100-08, ch. 10,  5.2.  
39  CMS, PIM, Pub. No. 100-08, ch. 10,  5.2.B. 
40 CMS, Transmittal 331, Change Request 6822.  Onsite Verifications for 
Providers/Suppliers Located at a UPS Store (CONFIDENTIAL), March 26, 2010.  Some  
memorandums are issued confidentially and  are not available to the public online.   
41 CMS, Transmittal 712, Change Request 6842.  Medicare Claims Processing Manual, 
Pub.  No. 100-20, One-Time Mailing of Solicitation Letter To  All Physicians and  
Non-Physician Practitioners Who  Are Currently Enrolled in Medicare But Who  Do Not 
Have An  Enrollment Record In the Provider  Enrollment, Chain and Ownership System  
(PECOS).  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   7 
   
   
limited risk, moderate risk, or high risk.42 During the first phase of the 
revalidation effort, 89,000 providers and suppliers that were actively 
enrolled in Medicare but not enrolled in PECOS were asked to revalidate 
their enrollment data.43  If providers do not revalidate their data within 
60 days of a request, CMS may deactivate their billing privileges.44  
Importance of Accuracy, Completeness, and Consistency of 
Provider Identification Data  
The accuracy and completeness of NPPES data are important for 
identifying the locations of providers across all health insurance programs.  
Public and private insurers need reliable information to identify  
geographic trends in provider fraud, waste, and abuse and to efficiently 
locate individual providers. Public health officials also need reliable 
provider information to locate providers during natural disasters or other 
emergencies.  Finally, the health care industry relies on NPPES registry 
data to link legacy provider identifiers with NPIs, and health care 
providers rely on NPPES registry data to find the NPIs of other health care 
providers to submit certain health care claims.45    
The accuracy and completeness of PECOS data are important for many 
critical CMS business functions, including the ability to make informed 
provider enrollment decisions; pay claims accurately; and combat fraud, 
waste, and abuse in Medicare and other health care programs.  For 
example, CMS may use an edit to automatically check provider specialties 
listed in PECOS to determine whether providers were eligible to order 
beneficiary supplies and services. 
Federal requirements do not mandate that information in NPPES and 
PECOS be consistent.  However, inconsistencies in provider data can 
complicate efforts to locate providers.  Inconsistencies in data may also 
hinder joint efforts among Federal, State, local, and nongovernmental 
entities to fight health care fraud, waste, and abuse. 
Previous OIG Work  
Prior to the creation of NPPES and the implementation of PECOS, we 
issued many reports highlighting problems with CMSs oversight of 
 
42 Patient Protection and Affordable Care Act,  P.L. 111-148   6401, Social Security Act, 
 1866(j), 42 U.S.C.  1395cc(j);  76 Fed. Reg. 5862 (Feb. 2, 2011).  The new risk-based 
screening provisions and the success of the revalidation efforts are outside the scope of  
this report. 
43 CMS, Revalidation of  Medicare Provider Enrollment National Provider Call, 
transcript, October 27, 2011.   Accessed at  www.cms.gov on October 2, 2012. 
44 42 CFR   424.515(a)(2).  CMS, PIM, Pub.  No. 100-08, ch. 15,  15.29;  Sample  
Revalidation Letter. Accessed at www.cms.gov on October 2, 2012. 
45 72 Fed. Reg. 30011, 30013  (May 30, 2007).   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   8 
   
   
UPINs, a type of legacy identifier for providers.  Our studies reported 
inaccuracies and inconsistencies in UPIN data maintained by CMS.46, 47, 48   
We also reported questionable and fraudulent Medicare claims associated 
with the use of invalid and inactive UPINs, the use of UPINs that 
belonged to deceased physicians, the improper use of surrogate UPINs, 
and the use of legitimate UPINs that were associated with an unusually 
large number of claims.49, 50, 51 In congressional testimony provided in 
2008, CMS stated that conversion from  the use of UPINs to NPIs had 
strengthened CMSs ability to combat fraud and abuse schemes that rely 
on invalid provider identifiers.52  However, the Inspector General 
cautioned Congress in 2009 that the vulnerabilities that had affected 
UPINs may affect the integrity of the NPI system, then recently 
launched.53    
Although CMS described PECOS as  an important national tracking 
mechanism to identify illegal Medicare activities, we identified problems 
early in its implementation.54  Our first examination of PECOS revealed 
that contractor staff responsible for processing Medicare applications 
misunderstood policy and had problems accessing the system.55 In a 
2009 study of the accuracy of Medicare provider remuneration 
information, OIG staff were unable to reach many sampled providers 
using the contact information listed in PECOS, determined that the contact 
information listed in NPPES often differed from that in PECOS, and found 
 
46 OIG,  Accuracy of  Unique Physician  Identification Number Data (OEI-07-98-00410), 
October 1999. 
47 OIG,  Inaccuracies in the Unique Physician  Identification  Number Registry:  Incorrect 
Addresses for Mental Health Service Providers  (OEI-03-99-00131), May 2002.   
48 OIG,  Accuracy of  Unique Physician/Practitioner Identification Number Registry Data  
(OEI-03-01-00380), July 2003.   
49 OIG,  Medical Equipment and Supply Claims With Invalid  or Inactive Physician  
Numbers (OEI-03-01-00110),  November 2001.   
50 OIG,  Durable Medical  Equipment Ordered With  Surrogate Physician Identification  
Numbers (OEI-03-01-00270), September 2002.   
51 OIG,  Invalid  Prescriber Identifiers on Medicare Part D Drug Claims 
(OEI-03-09-00140), June  2010. 
52  Medicare Payments for Claims with  Identification Numbers of  Dead Doctors, 
110th Cong. 12 (2008)  (testimony  of Herb B. Kuhn, CMS Deputy Administrator). 
53  Combating Fraud, Waste, and Abuse in Medicare and Medicaid, 111th Cong. 5 (2009)  
(testimony of  Daniel R. Levinson, Inspector General).  
54 66 Fed. Reg. 51961  (Oct. 11, 2001). 
55 OIG,  Provider Enrollment, Chain and Ownership System:   Early Implementation 
Challenges  (OEI-07-05-00100), April 2007. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   9 
   
   
that about 20 percent of sampled providers could not be reached with the 
contact information from either database.56   
METHODOLOGY 
Scope 
This study assessed the records of individual health care providers in 
NPPES and PECOS but did not assess records for organization health care 
providers or suppliers. In January 2010, NPPES contained 
2,313,183 records for individual providers, and in August 2010, PECOS 
contained 1,211,520,57 with 987,266 records appearing in both databases.58   
We reviewed records for individuals listed in both NPPES and PECOS.  
(Our review did not include individuals who had both enrolled in 
Medicare prior to November 2003 and had not updated their enrollment 
records using PECOS by the time of our review.)  Provisions for provider 
data integrity that went into effect after our review, such as CMSs 
implementation of the ACA requirement for risk-based screening of 
providers,59  were excluded from our analysis.  Additionally, this study did 
not examine the accuracy of Medicare claims coding, data processing, or  
payments.   
Data Collection and Analysis 
We obtained from CMS all records of the most recent updates of NPPES 
and PECOS at the time of our review.  NPPES contained data from  
January 2010, and PECOS contained data from  August 2010.60  We  
analyzed the following selected variables for individual providers in both 
databases: 
   NPI, 
   SSN (conditionally required in NPPES),61  
 
56 OIG,  Reassignment of Medicare Benefits (OEI-07-08-00180), October  2009. 
57 The number of individual  records in PECOS is based on the presence of  
1,211,520 unique PECOS Associate Control  Identifiers categorized as individual  (not  
organizational) in  PECOS. 
58 The number of records located in both NPPES and PECOS is based on a match of  
NPIs.  
59 76 Fed. Reg. 5862  (Feb. 2, 2011).  
60 At the time of our review, some of the variables that we requested for analysis were not 
available in the PECOS Global Extract routinely used for analysis.  The contractor that 
maintained the database required a significant amount  of time to create a separate  
interface to  provide the requested data.   
61 In NPPES, SSN must be included on  Web-based applications, but not  on paper  
applications.  In PECOS, the TIN field may include an SSN or EIN for each provider.  
For ease of reading, we refer to this variable as SSN.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   10  
   
   
 	  first name, 
 	  last name, 
 	  gender (not required in PECOS), 
 	  DOB,  
 	  provider specialty/credential,62  
 	  State of professional licensure and license number (conditionally 
required in NPPES and PECOS),  
 	  telephone number (not required in PECOS), 
 	  mailing address ZIP Code, and 
 	  practice address ZIP Code. 
Not all of the variables we analyzed  are required in order for providers to 
obtain an NPI or to enroll in Medicare. The SSN variable is conditionally 
required in NPPES; it is required for Web-based applications but not for 
paper applications. Provider license information is conditionally required 
in both NPPES and PECOS for specific types of providers.63 Gender and 
telephone number are not required variables in PECOS.  We considered 
this when presenting information about the completeness and consistency 
of data in the Findings section of this report. 
Accuracy of the Data in NPPES and PECOS.  We selected a simple 
random sample of 170 providers from those 987,266 individual providers 
with records in both NPPES and PECOS.  We created an online survey 
that listed the NPPES and PECOS data for the selected variables for each 
provider. The survey asked providers to verify whether the data for each 
variable were accurate.  The data included provider variables to identify 
individuals (i.e., name, SSN, DOB, place of birth, and license and 
credential information) and address information for mailing and practice 
 
62 A variable called physician specialty code  denotes 77 physician and nonphysician 
specialties in PECOS, while a variable called taxonomy code indicates 644 individual 
provider specialties in NPPES.  An optional text field in each  database called credential 
allows providers to indicate a more general provider type, such as M.D. for medical 
doctor.   We used the required specialty type fields in each database for our analysis of  
completeness.  We used the optional credential text field in each database for our analysis 
of accuracy and consistency, as the two databases had very different coding schemes for 
specialty type.   
63 Neither  NPPES nor PECOS indicate which types of  providers are required to submit 
license information.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   11  
   
   
location(s).64   If the data were inaccurate, the survey asked the provider 
whether these data were: 
 	  partially inaccurate (e.g., included a misspelling or transposed 
numbers);  
 	  correct at one time, but no longer current; or 
 	  never correct.65  
Data that providers indicated were not correct for a particular variable 
were reported as inaccurate in the findings.   
Appendix A provides details regarding our attempts to contact providers to 
participate in the survey.  After 4 months, 126 of 170 providers completed 
the surveya response rate of 74 percent.  We produced population 
estimates based solely on responses from these 126 providers without 
adjusting for nonresponse. Therefore, all estimates based on the provider 
survey project to an estimated total of only 731,738 provider records 
rather than 987,266. Appendix B provides point estimates and 95-percent 
confidence intervals for all survey estimates presented in the report.   
Completeness of the Data in NPPES and PECOS.   We analyzed each 
database to determine the extent to which selected provider variables were 
populated. We reviewed all 2,313,183 individual records in NPPES and 
the 1,021,652 individual records in PECOS indicating that the enrollee 
was a health care practitioner.66  NPPES contained one record per 
provider, listing all variables. However, PECOS is substantially more 
complicated; records for a given provider appear across multiple 
relational tables, each with different variables and different numbers of 
records per table.  (For more detail on how PECOS is structured, see 
Appendix A.) Therefore, we identified two types of incomplete records 
for PECOS: records that were missing from the relevant table and records 
that were present in the relevant table but did not contain values for a 
particular variable. The relational tables featuring practice location 
 
64 Our survey did not ask providers to  verify telephone numbers or gender,  which are not  
required  variables in PECOS.  The survey did ask providers to  verify conditionally  
required  variables, such as professional license information.  
65 We sought to determine the accuracy of provider data, but not to correct inaccurate 
information.   Within the survey, we notified  providers that they are responsible for 
updating inaccurate data, and  we listed the instructions  for doing so.   
66 Of the 1,211,520 individual PECOS records, 1,021,652  were associated with health 
care practitioners.  The remaining individuals were authorized  or delegated officials of 
provider and supplier organizations or worked on behalf of providers or suppliers.  Such  
individuals are not providers  and are not required to have an  NPI; therefore, we excluded  
them from our  analysis of the completeness of PECOS data.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   12  
   
   
information did not contain all records for individual providers; some  
individual provider data were stored in group enrollment records. 
For this analysis, we generally excluded variables that were not required, 
and attempted to include variables that were conditionally required.  We  
excluded gender and telephone number from the PECOS analysis because 
they are not required on the Medicare enrollment application.  We  
included SSN in the NPPES analysis because it is required for Web-based 
applications.  We included State license information in our analyses of 
both databases because it is required for certain provider specialty types.  
However, we found no indication NPPES of whether applications were 
submitted via Web or paper, and no indication in either database of which 
provider specialty types were required to submit license information.  As 
such, we were unable to determine whether null values were appropriate 
for SSNs in NPPES or license information in either database. Therefore, 
the totals for incomplete records in the findings include only missing 
provider records and those records that did not contain values for a 
particular variable when undoubtedly required.   
Consistency of the Data in NPPES and PECOS.  We compared the 
selected data fields in each database to determine whether the data were 
consistent in both. This matching process used variables that were 
required across both databases as well as variables that were conditionally 
required and/or not required but were populated across both databases 
(e.g., text field for provider credentials, if populated in both).  Where there 
were multiple values for variables in either database, we searched for at 
least one match between the two databases.  For example, NPPES 
contained up to 15 licenses per provider and PECOS contained up to 
19 licenses per provider; we looked for any match and considered the 
record consistent if we found one.  In determining whether there was a 
data match, we considered only the content of data fields, not their 
formatting.  For example, we standardized the text for the credentials 
variable so that capitalization, spacing, and punctuation did not influence 
the match (e.g., R.N. and r n would match).67  Rather than attempt to 
standardize street addresses in their entirety, we used only the ZIP Code 
portion to match addresses to reduce the detection of false mismatches.  
The exclusive use of ZIP Codes can underestimate the precise number of 
 
67  We  standardized only the most common credentials, including clinical social worker  
(CSW, LCSW, LICSW, MSW, LMSW); doctor  of chiropractic (DC); doctor of dental 
science (DDS);  doctor of optometry  (OD); doctor of osteopathy  (DO);  doctor of  
philosophy  (PhD); doctor  of podiatric medicine (DPM); doctor of  psychiatry  (PsyD);  
licensed  dietician  (LD); medical doctor (MD); nurse practitioner (NP, APN, APRN, 
WHNP, ARNP, FNP, CFNP); occupational therapist (OT,  OTR, OTRL); physical 
therapist (MSPT, RPT, PT, MPT, DPT); and physicians assistant (PA, PA-C).  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   13  
   
   
mismatches.  Appendix A includes more information regarding the 
process of matching addresses between NPPES and PECOS.   
We reported fields that did not contain the same information for a 
particular variable across both databases as inconsistent in the findings.  
It is possible that a provider could have updated the information in NPPES 
prior to our collection of PECOS data, resulting in a mismatch between 
the two databases.  To estimate this effect, we reviewed the PECOS record 
history to determine how many records with mismatches could be 
explained by record updates between January and August 2010.  
CMS Oversight of NPPES and PECOS. CMS uses contractors to ensure 
the integrity of provider data. We obtained and reviewed guidance 
documents that CMS provided to contractors in processing the NPPES and 
PECOS data.  We collected and reviewed information regarding CMSs 
oversight of contractors; current program integrity requirements; and 
safeguards used to implement those requirements (e.g., electronic system  
edits and other methods to ensure the accuracy, completeness, and 
consistency of the NPPES and PECOS data).  We compared documented 
requirements with the program integrity safeguards that contractors used 
to protect the integrity of provider data.   
We interviewed CMS contractor staff with oversight responsibilities for 
NPPES and PECOS at the time of our review.  One contractor managed 
both databases,68  and a separate contractor processed NPI enumeration.  
The interviews enabled the study team to gather indepth information about 
contractor operations following staff responses to more general questions 
regarding data accuracy, completeness, and consistency.   We identified 
interview responses that described vulnerabilities for the integrity of 
provider data. 
To assess the program integrity safeguards in place with regard to the 
accuracy and completeness of the PECOS data, we conducted structured 
interviews with staff from 11  organizations (generally MACs)69  that 
managed Medicare provider enrollment at the time of our review.  These 
interviews focused on the oversight and maintenance of the PECOS data.  
We analyzed interview responses to determine whether the contractors 
verified provider enrollment data in accordance with the PIM and 
 
68 After we interviewed the contractors in  2010, CMS awarded the contract  for managing  
the NPPES system to a different entity. 
69 At the time of our review, legacy carriers  in six Part A/Part B MAC jurisdictions were  
still processing provider enrollment because  the MAC contract awards were under protest  
and had not been finalized.  For the purposes of this report, the contractors responsible 
for enrolling providers into PECOS will be  referred to as MACs. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   14  
   
   
supplementary guidance.  See List 1 for CMSs suggested verification 
methods for PECOS data. 
List 1: Suggested Verification Methods for PECOS Data   
Adverse Legal History   Practice Location  
Check court records 
 Compare address to Internet sources 
Check records of the Internal Revenue Service (IRS) 
 Contact the city  or county  for professional/business  
    license, certification, and/or registration 
Credentials  
Perform a site visit  
Check information/Web sites of State boards or 
 credentialing organizations  Professional License  
Require supporting documentation of license from each 
Exclusion Status  
    State where provider practices 
Check the OIG List of Excluded Providers and Entities 
Check the General Services Administration (GSA)   SSN  
Excluded Parties List System   Confirm provider tax identification number with an  
    approved IRS form  
Legitimacy of Business  
Compare telephone number to telephone listing(s)   Telephone Numbers  
Contact the city  or county  for professional/business   Call the number to verify connection or ownership  
    license, certification, and/or registration  Compare telephone number to Internet sources  
Compare telephone number to telephone listing(s) 
Mailing Address  
Confirm that it is not a billing agency   Request for Data Change  
Call telephone number to confirm applicant is reached  Compare signature for request to change a special 
Confirm that it is not a management service organization      payments address 
Confirm that it is not a chains corporate office   Compare signature for request to change a 
Confirm that it is not an applicants representative       providers electronic funds transfer authorization 
    agreement  
NPI  
Compare signature for request to change practice 
Require supporting documentation from NPPES  
    location address 
Compare signature for request for reactivation or  
 
revalidation 
Compare signature for requests to change mailing 
address  
Source:  OIG analysis of CMS, PIM, Pub. No. 100-08, ch. 10.   
 
Finally, we interviewed CMS staff knowledgeable about NPPES and 
PECOS regarding safeguards pertaining to data verification.  Staff 
discussed program integrity activities related to provider data in NPPES 
and PECOS, as well as vulnerabilities and potential improvements for 
each. 
Limitations 
Although we collected information about program integrity safeguards for 
provider data from CMS and contractor staff, we did not determine the 
extent to which each safeguard worked to prevent or correct inaccurate, 
incomplete, and/or inconsistent data.  The sampling scheme for our 
provider survey did not enable us to determine the extent to which 
individual MACs or the application submission method (paper or 
electronic) influenced the accuracy, completeness, or consistency of 
provider data. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   15  
   
   
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   16  
   
   
FINDINGS 
In NPPES, 48 percent of records contained inaccurate 
data; almost all required data were complete 
Most currently practicing health care providers have records in NPPES.  
However, the provider information in NPPES was inaccurate for almost 
half of providers and while 91 percent of records contained values for all 
variables, 9 percent of records did not.  We were unable to determine if 
most null values were appropriate, because they were associated with 
conditionally required variables and NPPES did not indicate whether 
applicable conditions were met.   
Forty-eight percent of NPPES records were inaccurate, 
generally because address data were inaccurate 
Forty-eight percent of NPPES records for Medicare-enrolled providers 
were inaccurate. Table 1 summarizes the inaccuracies identified by the 
provider survey.  Appendix B provides confidence intervals for each of the 
point estimates.   
Table 1: Inaccurate Provider Data in NPPES 
NPPES Inaccurate Records  
Provider Variable   (Percentage)  
N=731,738  
Mailing address  34.1%  
Practice address  33.3%  
License (primary)*  4.0%  
Credentials**  1.6%  
Date of birth   1.6%  
License (secondary)*  1.6%  
First name   0.0%  
Last name   0.0%  
NPI  0.0%  
SSN (last 4 digits)*  0.0% 
 Gross   76.2% 
   (Overlapping)   (27.8%)  
     Any  variable   48.4%  
Note: The  survey did not ask providers to verify telephone  number or gender. 
* Provider license and SSN variables are conditionally required in NPPES. 

** The credential text variable is not required in NPPES. 

Source:  OIG analysis of provider survey data, 2011. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   17  
   
   
Responses from providers indicated that address information was the most  
common inaccuracy.  When we asked providers about the accuracy of 
mailing addresses and practice address information, 44 percent identified 
at least one inaccurate NPPES address.  Within the 126 survey responses,  
providers identified 96 data elements (i.e., provider variables shown in 
Table 1) as inaccurate; 51 (53 percent) were outdated, 18 (19 percent) 
were partially inaccurate (e.g., contained typographical errors), and  
27 (28 percent) had never been correct.    
Virtually all required variables in NPPES records were 
complete 
Although 2,098,784 provider records in NPPES contained all necessary 
data, we found that 214,399 provider records contained null values for one 
or more variables that are essential for provider identification.   
Specifically, four records did not contain required provider specialty data 
and two records did not contain the required telephone number.  However,  
all remaining null values were associated with two conditionally required 
variables: license number and SSN.  A license number is required only for 
certain provider specialties; however, NPPES does not indicate which 
records should include license numbers.  Similarly, an SSN is required 
only for web-based applications, but NPPES does not indicate which 
records were from web-based applications.  We were unable to determine 
the appropriateness of most null values because NPPES lacks indicators 
regarding which records required license number and SSN data.    
In PECOS, 58 percent of records contained inaccurate 
data and almost 4 percent were incomplete 
CMS relies on the verification of PECOS data to ensure Medicare 
provider integrity.  However, the provider information in PECOS was 
often inaccurate and, at times, incomplete.  
Fifty-eight percent of PECOS records were inaccurate, 
generally because address data were inaccurate 
Fifty-eight percent of PECOS records for Medicare-enrolled providers 
were inaccurate.  Table 2 summarizes the inaccuracies identified by the 
provider survey.  Appendix B provides confidence intervals for each of the 
point estimates.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   18  
   
   
Table 2: Inaccurate Provider Data in PECOS  
PECOS Inaccurate Records 
Provider Variable   (Percentage)  
N=731,738  
Mailing address (primary)   46.8%  
Practice address (primary)   8.7%  
Mailing address (secondary)   7.9%  
License (primary)*  7.1%  
Credentials**  4.8%  
License (secondary)*  3.2%  
Last name   2.4%  
Practice address (secondary)   2.4%  
DOB  0.8%  
First name   0.0%  
NPI  0.0%  
SSN (last 4 digits)  0.0% 
 Gross   84.1% 
   (Overlapping)   (26.2%)  
     Any  variable   57.9%  
Note: The  survey did not ask providers to verify telephone  number or gender. 
* The provider license variable is conditionally required in  PECOS. 

**The credential text variable is not required in PECOS. 

Source:  OIG analysis of provider survey data, 2011. 

Responses from providers indicated that address information was often 
inaccurate.  When we asked providers about the accuracy of mailing 
addresses and practice address information, 52 percent identified at least 
one inaccurate PECOS address.  Within the 126 survey responses, 
providers identified 106 data elements (i.e., provider variables shown in 
Table 3) as inaccurate; 60 (57 percent) were outdated, 25 (24 percent) 
were partially inaccurate (e.g., contained typographical errors), and 
21 (20 percent) had never been correct.70    
Almost 4 percent of PECOS records were missing required 
data 
We found that 3.7 percent provider records in PECOS were missing values 
in one or more required variables that are important for provider 
identification.  Most of the incomplete data can be attributed to the fact 
that records were missing from the relevant relational tables in PECOS 
 
70 Percentages have been rounded.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   19  
   
   
(i.e., the expected record  did not exist) rather than to null values (i.e., the 
data fields contained no values). The information most often incomplete 
in PECOS was NPI (3 percent). Almost all of the records that were 
missing NPIs were active and therefore should have contained an NPI.71   
We could not determine how many records contained incomplete practice 
location addresses because the PECOS table that lists such information 
associates the practice location addresses with the entities to which 
providers reassigned their benefits. As a result, practice location addresses 
are rarely associated with individual providers.  As in NPPES, license 
number is required only for certain provider types; however, PECOS does 
not indicate which records should include license numbers.  Therefore, we 
excluded the 1.2 percent of records missing license number data from our 
calculation of the total percentage of incomplete records.  The gender 
variable was incomplete for approximately 11 percent of records, and the 
telephone number variable was incomplete for approximately 4 percent.  
However, those variables are not required to be populated in PECOS and 
were therefore excluded from our calculation of the total percentage of 
incomplete records.  Table 3 describes the extent to which individual 
provider variables were incomplete in PECOS. 
   
 
71 Providers  who had enrolled through PECOS before NPIs were required  would not  have  
an NPI on record; CMS should have deactivated these providers records if they had not 
submitted claims in  more than a year.  We found that less than 1 percent of the records 
that were missing NPIs (30 of 32,759)  had been  deactivated.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   20  
   
   
Table 3: Incomplete Provider Data in PECOS 
 
Incomplete 
Incomplete Records 
Records in  Missing  Null  Records  
Provider Variable   N=1,021,652 
Database   Records   Data Field  N=1,021,652  
(Percentage)  
(Number)  
 
NPI  988,893   32,759   0  32,759   3.2%  
Mailing address  1,016,075   5,577   37  5,614   0.5%  
Provider specialty  1,016,843   4,809   0  4,809   0.5%  
SSN  1,021,427   225  0  225  0.0%  
DOB  1,021,652   0  0  0  0.0%  
Full name  1,021,652   0  0  0  0.0%  
License number*   1,009,470   12,182   0  *  * 
Gender**  1,021,652   0  111,546   **  ** 
 
Telephone number**  1,016,075   5,577   38,875   **  ** 
 
Practice address***  203,637   818,015   17  ***  ***
 Gross   43,407  4.2% 
 
   (Overlapping)   5,964  0.6%  
 
   Any variable   37,443  3.7%  
 
*We excluded license number from our calculation of  the total because it is conditionally required and  PECOS data did not indicate which  
provider types were required to submit  licensure information. 
 
**We  excluded gender and telephone number from our calculation  of  the total  because they  are not required fields  in  PECOS. 
  
***The provider identification number used to link the other variables was not used  to link practice address; we excluded practice address from 
our calculation of the total to avoid misrepresenting the number of missing records.  See Appendix A for more information.  
Source:  OIG analysis of NPPES and PECOS data, 2011. 
Provider data were inconsistent between NPPES and 
PECOS for 97 percent of records 
Of the 987,266 records for providers listed in both NPPES and PECOS, 
961,634 contained at least 1 variable that did not match.  Only  
11,682 records (1.2 percent of the mismatches) could potentially be 
attributed to the timelag between updates of the databases.72 Only 
3 percent of records contained information that matched across all selected 
provider variables. More than half of the records were inconsistent 
between the databases for provider contact information, such as practice 
location address (89 percent), telephone number (59 percent), and mailing 
address (51 percent). Address matches are based only on ZIP Codes; this 
methodology may overestimate the consistency between addresses in 
NPPES and PECOS.  For required variables, such as practice location 
 
72 Information updates were submitted in PECOS between January and August  2010  for 
1.2 percent of the records with  inconsistent data.  We did not  determine whether the  
information that was entered as updates was the inconsistent information.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   21  
   
   
address, some of the inconsistencies are attributable to missing or null 
values in one database or the other. For nonrequired variables, such as 
telephone number, inconsistencies are attributable only to populated 
values in both databases. Table 4 lists the extent to which variables were 
inconsistent between the databases.   
Table 4: Inconsistent Data Between NPPES and PECOS  
Mismatched Data   Mismatched Data  
Records  Records 
Provider Variable  
(Number)   (Percentage)  
N=987,266   N=987,266  
Practice location address*  874,401   88.6%  
Telephone number   582,147   59.0%  
Mailing address*  500,865   50.7%  
License number   415,799   42.1%  
Credential  91,851   9.3%  
Full name  50,921   5.2%  
DOB  21,199   2.2%  
Gender  12,256   1.2%  
SSN  376  0%  
NPI  0  0% 
 Gross   2,549,815  258.2%** 
   (Overlapping)   (1,588,181)  (160.8)%  
   Any  variable   961,634   97.4%  
Note: Values  that  were null in both NPPES and PECOS for each variable are considered matches for this 
analysis.  Variables that were optional in one  database or  the other (telephone number, credential, and 
gender) or conditionally required (license) were included in this analysis only if populated in both  
databases.    
*Matches  for practice location and mailing addresses are for ZIP Codes only.  See Appendix A for detailed  
methodology regarding the analysis of addresses. 
** Figures do not sum to the total because of rounding. 
Source:  OIG analysis of NPPES and PECOS data, 2011. 
CMS did not verify most provider information in 
NPPES or PECOS 
CMS had processes in place to verify the accuracy of provider data in 
NPPES and PECOS; however, the manner in which CMS implemented 
these processes impeded efforts to ensure that the databases contained 
accurate information.  Contractor staff reported that CMS required 
verification for only one provider variable in NPPES.  CMS instructed 
MACs to verify only four provider data variables in PECOS (SSN, NPI, 
State licensure, and exclusion status) and has not issued detailed guidance 
for verifying all provider data. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   22  
   
   
CMS required little verification of NPPES enumeration data 
The SSN was the only provider data element verified within NPPES, a 
possible explanation for why SSNs were the most complete and consistent 
variable in both databases. However, no verification occurred for any of 
the other provider data elements.  According to NPPES contractor staff, 
each online applicants SSN was verified through a CMS data-sharing 
agreement with the Social Security Administration.  Staff stated that if a 
provider submitted a paper application and chose not to provide an SSN, 
they required two other forms of identification, one of which had to be 
government issued.  Staff also noted that although the NPPES software 
standardized the street names in the system to those used by the U.S. 
Postal Service, the software did not verify that the provider maintained a 
practice at the location.  
CMS staff reported concentrating its program integrity efforts solely on 
PECOS because NPPES is not used exclusively for Federal health care 
programs.  However, most individual providers that are registered in 
NPPES also enroll in Medicare.73  CMS staff reported that NPPES data, 
including NPI, first and last name, SSN, and DOB, were cross-referenced 
with PECOS data during the Medicare enrollment process, serving as a 
verification check for NPPES. CMS staff required providers to correct 
any inaccurate information in NPPES that resulted in inconsistencies with 
PECOS before they could proceed with Medicare enrollment. In response 
to questions about the implications of missing or inaccurate information in  
NPPES, CMS staff indicated that the onus is on providers to keep their 
NPPES data correct and up to date.  However, CMS is ultimately 
responsible for ensuring the accuracy of the database.  
 
 
73 Although no precise measure exists, the percentage of providers who  choose not to  
participate in Medicare may be less than 1 percent.  William Buczko, Provider Opt-Out 
Under Medicare Private Contracting, Health Care Financing Review, 
Winter 20042005, vol. 26, no. 2.  OEI, Lack of  Data Regarding Physicians Opting Out  
of Medicare  (OEI 07-11-00340), January 26, 2012.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   23  
   
   
CMS directed MACs to suspend many of the verifications 
required by the PIM for Medicare provider enrollment in 
PECOS 
To expedite the provider enrollment process, CMS sent a series of 
memorandums74 to instruct MACs to verify only the following information 
during the initial or revalidation PECOS application process: 
 	  the providers SSN and NPI, 
 	  the applicable State licensure or educational requirements for the 
provider, and 
 	  the providers status of not being excluded from participation in the 
program.  
This supplementary guidance effectively waived the PIM requirement to 
verify all application information, such as telephone numbers and 
addresses. During this time, CMS was actively encouraging legacy 
providersproviders that had enrolled in Medicare before PECOS was 
put into placeto reenroll through PECOS.75   As a result, CMSs 
instructions to waive the PIM requirement affected not only new 
enrollments but also reenrollments.  
CMS guidance lacks specificity regarding mechanisms of 
verification for PECOS enrollment data 
The PIM directs MACs to verify enrollment data using the most 
cost-effective method available and suggests some options.76   The broad 
guidance provides flexibility in choosing how to verify enrollment 
application information.  However, MACs use of inconsistent 
mechanisms of verification can contribute to inaccurate, incomplete, and 
inconsistent data.  Appendix C lists the safeguards that MACs reported 
 
74 CMS, Expedited Processing  of Physician  and Non-Physician  Practitioner Initial 
Enrollment Applications (CONFIDENTIAL), JSM/TDL-10157, February  24, 2010; 
extended by CMS, Extension of Joint Signature Memorandums/Technical  Direction  
Letters (JSM/TDLs) Which Expires December 31, 2010  Confidential, JSM/TDL 11087, 
December 17, 2010, and CMS, Extension of  Joint Signature Memorandums/Technical 
Direction Letters (JSM/TDL)  09184, 10175, 08191, and 0822, TDL 12171, January 18, 
2012.  The JSM instruction remained in effect at the time of report  publication, although  
we use past tense for ease of reading the report.  Also for ease of reading, we refer to  
these collective memorandums as supplemental guidance.  The memorandums are not 
available online to the public because they were issued confidentially.  We were unaware  
of the existence of these memorandums until the contractor made them available to  us. 
75 CMS, Transmittal 712, Change Request 6842.  Medicare Claims Processing Manual, 
Pub.  No. 100-20, One-Time Mailing of Solicitation Letter To  All Physicians and  
Non-Physician Practitioners Who  Are Currently Enrolled in Medicare But Who  Do Not 
Have An  Enrollment Record In the Provider  Enrollment, Chain and Ownership System  
(PECOS).  
76  CMS, PIM, Pub. No. 100-08, ch. 10,  5.2.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   24  
   
   
using during the provider enrollment process at the time of our review and 
distinguishes verifications required by the PIM and reiterated in 
supplemental guidance from those required by the PIM but waived by 
supplemental guidance.   
MACs generally reported performing the activities suggested by CMS to 
verify the variables required by the PIM and reiterated in supplemental 
guidance. However, 4 of the 11 MACs did not require applicants to 
submit documentation from NPPES to verify providers NPIs, 2 did not 
require applicants to submit approved IRS forms to confirm their Tax 
Identification Numbers/SSNs, and 3 did not require applicants to submit 
documentation of professional licensure.   
MACs reportedly verified some of the information required by the PIM 
but waived by supplemental guidance; however, their methods suggested 
vulnerabilities in the enrollment process.  For example, all of the MACs 
reported verifying that when an application listed a billing agency, the 
providers mailing address did not match the billing agency address.  
However, four MACs did not verify that the mailing address was not that 
of a management services organization, a chains corporate office, or the 
applicants representative, as required by the PIM.  Seven MACs did not 
verify that practice locations were legitimate businesses, and four did not 
call telephone numbers to confirm that they were legitimate.  Additionally, 
when a providers signature on a request for change (e.g., change of 
contact or payment information) did not match the signature from the 
original enrollment application, eight MACs required a drivers license or 
passport to verify the signature on the request for change.  However, one 
MAC required only an attestation on the enrolled providers letterhead as 
proof of identity.77    
Ineffective safeguards can contribute to inaccurate, 
incomplete, and inconsistent NPPES and PECOS data 
The lack of sophisticated electronic edits may explain why almost half of 
inaccurate NPPES data and 43 percent78 of inaccurate PECOS data were 
never accurate or only partially accurate.  The staff from the electronic 
database contractor for NPPES and PECOS reported that a variety of 
external databases exist to verify the identity of new applicants, check for 
previously deactivated or excluded providers, and check for adverse legal 
 
77 CMS, PIM,  Pub.  100-08, ch. 10   5.7(A)(1).   In cases in  which a provider requests to  
change its practice location address, the MAC compares the signature on the change 
request to the same persons signature on file to ensure that the signatures match.  If there  
is a discrepancy, the MAC must request additional information, such as a photocopy of a  
current passport or drivers license. 
78  Total has been rounded. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   25  
   
   
actions.  However, they stated that NPPES and PECOS were not 
technologically integrated with many of these sources.  CMS staff 
reported that they are implementing a new automated provider-screening 
tool for PECOS that references certain provider information against 
third-party sources such as State licensing boards and identity 
management databases.79    
Other oversight issues may explain why more than half of inaccurate 
NPPES data were outdated. Contractor staff reported that NPPES uses an 
algorithm to flag newly submitted applications that contain some level of  
provider information already in the database80 and stated that when such 
applications are flagged, a contractor staff member telephones the 
applicant to reach a resolution.  However, staff reported difficulties when 
trying to reach providers and reported that they do not deactivate a 
providers NPI because of outdated contact information.   
NPPES contractor staff also reported difficulties when they processed 
monthly updates from the Social Security Administrations Death Master 
Record File to deactivate NPIs belonging to deceased providers.  NPPES 
staff reported sending letters to the providers NPPES mailing addresses to 
confirm that providers were deceased and called providers who sent no 
response to the letter within 20 days. If they received no response after 
30 days, staff deactivated the NPIs.  However, if providers responded, 
stating that a mistake had occurred, their NPIs remained active.   
Consequently, if a fraudulent provider had stolen a deceased providers 
identity and indicated to NPPES staff that a mistake had occurred, the 
fraudulent provider would be able to continue billing as the deceased 
provider.    
Another explanation for errors is that, according to MAC staff, 
approximately 80 percent of enrollment applications were still processed 
on paper and transcribed into the PECOS Web interface.81   When staff 
transcribe the data from paper forms into PECOS, a risk of transcription 
errors arises.  CMS estimated that fewer than 5 percent of NPPES 
applications are submitted via paper; however, there is a risk of  
transcription errors for those records as well.  
 
79 CMS originally expected that the automated provider-screening tool  would  be  fully 
implemented in mid-2012.  CMS, Information on the Centers for Medicare & Medicaid  
Services (CMS) Fraud Prevention:   Automated Provider Screening and National Site  
Visit Initiatives, MLN Matters Number SE1211, effective July 1, 2012.  As of  
January 2013, CMS expected to  fully implement the tool  by the end  of 2013. 
80 A duplicate record may indicate an error or an attempt to fraudulently obtain an NPI. 
81 The responses from MACs indicated that an  average of 81  percent  of applications were 
submitted in paper form, with a range between  66 and  97  percent. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   26  
   
   
Finally, although regulations require providers to update their NPPES and 
PECOS data soon after changes occur,82 CMS reportedly enforces this 
requirement only for PECOS through revalidation efforts generally 
scheduled every 5 years. CMS staff reported that they prompt providers to 
update NPPES data only if a mismatch occurs with the providers NPI, 
first or last name, SSN, or DOB in NPPES data during provider 
enrollment or reenrollment in PECOS. 
 
82 45 CFR   162.410(a)(4).  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   27  
   
   
CONCLUSION AND RECOMMENDATIONS 
The ability to identify and locate providers is fundamental to health care 
program integrity.  However, the results of our analyses show that NPPES 
and PECOS data are not reliable independently or even when combined.  
More than three out of four providers identified inaccurate data in NPPES 
or PECOS, and more than one in four providers identified inaccurate data 
in both NPPES and PECOS. Although verification requirements for 
provider information are more robust in PECOS, these data are not more 
accurate than analogous data in NPPES.  Required variables in NPPES 
and PECOS were largely complete, however, the databases lacked the 
information necessary to determine whether missing values for 
conditionally required variables were appropriate.  Data did not match 
between NPPES and PECOS for more than 9 out of 10 provider records.  
Addresses were the source of most inaccuracies and inconsistencies.     
Because the NPI is used by private and public health insurance programs,  
the lack of safeguards for NPPES data complicates program integrity 
efforts for all health care programs.  Each program must separately 
implement robust safeguards during the enrollment process to ensure that 
provider data are accurate. The suspension of provider enrollment 
verification activities at a time of increased application volume could have 
compromised the accuracy and completeness of PECOS data, increasing 
the vulnerability of the Medicare program to fraud and abuse.  CMSs new 
automated provider-screening tool has the potential to improve the 
accuracy of PECOS data. However, it does not reduce the risk of 
fraudulent NPI enumeration and will not improve NPPES data accuracy.  
CMS and OIG have long recognized that preventing fraudulent providers 
from enrolling in Federal health care programs is more efficient and 
effective than trying to recover fraudulent payments.  To prevent and 
correct fraudulent enumeration and enrollment, we recommend that CMS: 
Require MACs To Implement Program Integrity Safeguards for 
Medicare Provider Enrollment as Established in the PIM 
CMS should rescind the supplemental guidance that waives verification 
requirements in order to expedite the processing of PECOS applications 
and should issue new guidance reiterating that all provider data should be 
verified. MACs should verify all provider data, including credentials, 
mailing addresses, practice locations, telephone numbers, legitimacy of 
businesses, and adverse legal histories.  CMS should take appropriate 
action if the safeguards that MACs use do not meet the requirements.   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   28  
   
   
Require More Verification of NPPES Enumeration and PECOS 
Enrollment Data 
CMS should require more verification of provider data in NPPES to 
protect Medicare and other health care programs from fraud.  In addition, 
CMS could consider: 
 	  using the new PECOS automated provider-screening tool to verify 
provider data in NPPES, including name, DOB, place of birth, 
licensure, credentials, mailing address, practice location, telephone 
numbers, and legitimacy of business; 
	   monitoring NPPES applications by geographic area to detect potential 
fraud; and 
	   enabling NPPES contractor staff to immediately deactivate or suspend 
the NPIs of providers who are presumed to be deceased.  
CMS should also build upon the enhancements to the provider-enrollment 
screening requirements that went into effect March 25, 2011, by 
strengthening program integrity safeguards for all initial enrollments, 
change requests, and revalidations in PECOS.  For example, providers 
identified as limited risk are exempt from the site visits required for 
moderate- and high-risk providers and suppliers; CMS should determine 
whether a computerized solution may be used to verify that limited-risk 
providers locations are legitimate. 
Detect and Correct Inaccurate and Incomplete Provider 
Enumeration and Enrollment Data for New and Established 
Records 
CMS should consider: 
   requiring more frequent revalidation of selected variables, especially 
address information; 
   implementing an automated system edit that will require license 
information for providers with applicable specialty/taxonomy codes; 
   reducing or eliminating the option for providers to submit enumeration 
and enrollment applications via paper; and 
   offering providers incentives to keep  their data accurate and current.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   29  
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
CMS concurred with all three of the report recommendations. 
Regarding the first recommendation, CMS concurred and stated that 
measures to streamline the enrollment process do not jeopardize existing  
program integrity safeguards.  CMS reiterated that MACs must adhere to 
the processing guidelines established in Chapter 15 of the PIM and that 
supplemental guidance provided to the MACs does not waive those 
guidelines. The results of this study suggest that MACs may not 
understand that supplemental guidance does not waive program integrity 
safeguards established in the PIM; we  encourage CMS to clarify that point  
with the MACs directly.  
Regarding the second recommendation, CMS concurred and listed 
mechanisms under development to further verify NPPES and PECOS data.  
We encourage CMS to emphasize verification of NPPES data in addition 
to PECOS data. 
Regarding the third recommendation, CMS concurred and plans to use a 
new Automated Provider Screening tool to identify changes to provider 
data in PECOS and identify specific providers to revalidate more 
frequently.  CMS has also made enhancements to PECOS that may 
decrease inaccurate and incomplete provider information.  CMS stated that 
ongoing revalidation efforts and provider education regarding loss of 
billing privileges for failure to update records will encourage providers to 
keep their data accurate.   We note that all of these efforts are directed 
towards PECOS data and are therefore unlikely to correct the inaccurate 
and incomplete provider enumeration data stored in NPPES.  Reliable 
NPPES data could enhance program integrity efforts not just for Medicare, 
but all health care programs across the Nation.  
We did not make any changes to the report based on CMSs comments.  
For the full text of CMSs comments, see Appendix D.    
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   30  
   
   
APPENDIX A 
Detailed Methodology   
Invitations for Provider Survey.  We used email addresses in the National 
Plan and Provider Enumeration System (NPPES) and Provider 
Enrollment, Chain and Ownership System (PECOS) databases to notify 
providers and/or their designated contact people of our survey.  If provider 
email addresses were not valid, we called providers using the telephone 
number(s) listed in NPPES and PECOS in an effort to obtain valid email 
addresses. Next, we sent invitations to complete the online survey via 
email and U.S. Postal Service (USPS) mail, using the mailing address 
listed in PECOS. The USPS invitation letters assigned each provider a 
unique user name and password that were required as a security measure 
to complete the survey.  Providers who did not complete the survey after 
2 weeks were sent a second USPS mailing and reminder email.  Letters 
were sent to the same  mailing address listed in PECOS unless initial 
mailings were returned marked as Return to Sender, in which case the 
second letter was sent to the mailing address listed in NPPES.  We  
attempted to telephone providers who did not complete the survey and 
sent a final invitation letter via certified mail 10 weeks after the previous 
mailing.  This final attempted mailing was sent to the provider mailing 
address listed in NPPES if it was different from the mailing address in 
PECOS; if it was the same, the letter was sent to the practice location 
address listed in NPPES. 
After 4 months, 126 providers had completed the surveya response rate 
of 74 percent. The remaining 44 providers declined to complete the 
survey, were retired from practice, or accessed the survey but did not 
submit any response.   
Completeness of Data:  PECOS. Most of the variables in our analysis 
were linked across relational tables in PECOS using a variable called 
PECOS associate control ID (PAC ID).  However, the PAC ID was not 
present in the table featuring practice address; instead, a variable called 
Enrollment ID was used.  Email correspondence with Centers for 
Medicare & Medicaid Services (CMS) staff confirmed that a practice 
address was displayed for individual provider records in the relevant table 
only if those providers had not reassigned their benefits to a group or other 
individual provider (which is common practice for providers working in a 
group or clinic setting).  In many cases, the practice addresses would be 
under groups enrollment identifiers rather than the individual 
practitioners enrollment identifiers.  Data for group practices were outside 
the scope of this study, so findings on the completeness of practice address 
are absent from this report.  
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   31  
   
   
PECOS contained 5 schemas with 839 relational tables and 4,701 
variables and different numbers of records per table.  The 10 variables we 
reviewed were located in 8 different tables within the schema that CMS 
advised us to use. See Table A-1 for information about how many records 
were listed for each variable in PECOS.       
 
Table A-1: Records per Variable in PECOS Schema  
Number of  
Nonduplicate 
Total Number  
Variable  Table Name   Variable Link   Individual 
of Records  
Practitioner 
Records  
Full name  PEC_INDVDL_NAME  PAC ID   1,519,571   1,021,652  
Date of birth   PEC_ASCT_INDVDL  PAC ID   1,426,013   1,021,652  
Gender   PEC_ASCT_INDVDL  PAC ID   1,426,013   1,021,652  
Social Security  
PEC_TIN  PAC ID   1,751,742   1,021,427  
number  
PEC_ENRLMT_PHYSN_SPCLTY + 
Specialty Code   PAC ID   1,260,639   1,016,843  
PEC_ENRLMT_NPHYSN_SPCLTY  
Mailing address  PEC_MLG_ADR   PAC ID   1,762,669   1,016,075  
Telephone 
PEC_MLG_ADR   PAC ID   1,762,669   1,016,075  
number  
License number   PEC_STATE_LCNS  Enrollment ID   1,221,584   1,009,470  
National Provider  
PEC_NPI   PAC ID   1,292,182   988,893  
Identifier 
Practice address  PEC_ENRLMT_ADR  Enrollment ID   895,234   203,637  
 
Source:  Office of  Inspector General analysis of PECOS data, 2011. 
Consistency of Data: Address Match. NPPES contained one set of 
variables (i.e., street address, city, State, ZIP Code) for each provider 
mailing address and another set of variables for each provider practice 
location address.  However, the relational tables in PECOS permitted two 
mailing addresses and five practice location addresses per provider.83 If 
the ZIP Code from the mailing address in NPPES matched the ZIP Code 
for either mailing address in PECOS, we considered it a match.  Similarly,  
if the ZIP Code from the practice address in NPPES matched the ZIP Code  
for any of the practice addresses in PECOS, we considered it a match. 
   
 
83 Values for practice location address did not  exist for many provider records, as 
described in the section above regarding completeness of  PECOS data. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   32  
   
   
APPENDIX B 
Point Estimates and Confidence Intervals Based on Provider 
Survey   
We calculated confidence intervals for key data points in the provider 
survey regarding the accuracy of provider data. The sample size, point 
estimates, and 95-percent confidence intervals are given for each of the 
following: 
Table B-1: Confidence Intervals for Provider Survey Data  
 Sample   95-Percent 
 Data Element Description    Point Estimate  
Size   Confidence Interval  
Number of providers who responded to the survey   126  731,738   666,080797,395 
Percentage of providers with inaccurate NPPES mailing 
126  43.7%  35.2%52.5%  
address or practice location address 
Percentage of providers with inaccurate NPPES mailing 
126  34.1%  26.3%42.9%  
address 
Percentage of providers with inaccurate NPPES practice 
126  33.3%  25.6%42.1%  
address 
Percentage of providers with inaccurate NPPES State 
126  4.0%  1.6%9.3%  
license (primary)  
Percentage of providers with inaccurate NPPES DOB   126  1.6%  0.4%6.2%  
Percentage of providers with inaccurate NPPES State 
126  1.6%  0.4%6.2%  
license (secondary)  
Percentage of providers with inaccurate NPPES 
126  1.6%  0.4%6.2%  
credentials 
Percentage of providers with inaccurate NPPES first name  126  0.0%  0.0%2.9%  
Percentage of providers with inaccurate NPPES last name  126  0.0%  0.0%2.9%  
Percentage of providers with inaccurate NPPES NPI  126  0.0%  0.0%2.9%  
Percentage of providers with inaccurate NPPES SSN  
126  0.0%  0.0%2.9%  
(last four digits) 
Percentage of providers with inaccurate NPPES data 
126  76.2%  60.6%91.8%  
(gross)  
Percentage of providers with inaccurate NPPES data 
126  27.8%  19.0%36.6%  
(overlapping)  
Percentage of providers with inaccurate NPPES data (net)  126  48.4%  39.7%57.2%  
Percentage of providers with inaccurate PECOS mailing 
126  51.6%  42.8%60.3%  
address or practice location address 
Percentage of providers with inaccurate PECOS mailing 
126  46.8%  38.2%55.6%  
address (primary) 
Percentage of providers with inaccurate PECOS practice 
126  8.7%  4.9%15.2%  
address (primary) 
Percentage of providers with inaccurate PECOS mailing 
126  7.9%  4.3%14.2%  
address (secondary)  
continued on next page 
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   33  
   
   
Table B-1: Confidence Intervals for Provider Survey Data (Continued)  
 Sample   95-Percent 
 Data Element Description    Point Estimate  
Size   Confidence Interval  
Percentage of providers with inaccurate PECOS practice 
126  2.4%  0.8%7.2%  
address (secondary)  
Percentage of providers with inaccurate PECOS 
126  4.8%  2.1%10.3%  
credentials 
Percentage of providers with inaccurate PECOS State 
126  7.1%  3.7%13.2%  
license (primary)  
Percentage of providers with inaccurate PECOS 
126  3.2%  1.2%8.2%  
state/license (secondary)  
Percentage of providers with inaccurate PECOS last name  126  2.4%  0.8%7.2%  
Percentage of providers with inaccurate PECOS DOB   126  0.8%  0.1%5.5%  
Percentage of providers with inaccurate PECOS first name  126  0.0%  0.0%2.9%  
Percentage of providers with inaccurate PECOS NPI  126  0.0%  0.0%2.9%  
Percentage of providers with inaccurate PECOS SSN  
126  0.0%  0.0%2.9%  
(last four digits) 
Percentage of providers with inaccurate PECOS data 
126  84.1%  68.0%100.0%  
(gross)  
Percentage of providers with inaccurate PECOS data 
126  26.2%  15.5%36.9% 
(overlapping)  
Percentage of providers with inaccurate PECOS data (net)   126  57.9%   49.1%66.3%  
Percentage of providers with any inaccurate NPPES or 
126  77.0%   68.7%83.6%  
PECOS data  
Percentage of providers with inaccurate NPPES and 
126  29.4%   22.0%38.0%  
PECOS data  
Abbreviations used in table:  NPPES = National Plan and Provider Enumeration System; DOB = date of birth; NPI =  National Provider 
Identifier; SSN = Social Security number; PECOS =  Provider Enrollment, Chain and Ownership  System. 
Source:  Office of  Inspector General analysis of provider survey data, 2011. 
 
 
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   34  
   
   
APPENDIX C 
Table C-1: Safeguards That Medicare Administrative Contractors Report Using To Verify  
Provider Enrollment Data 
MACs Routinely  
Variable for 
Status   Suggested Method for Verification   Performing 
Verification  
Activity (N=11)  
Check the OIG List of Excluded Providers & Entities  
11 
Exclusion  database  
Status 
Check the GSA Excluded Parties List System   11 
Required by the 
PIM and  Confirm provider tax identification number with an approved 
SSN  8 
Supplemental  Internal Revenue Service form  
Guidance  
Professional  Require supporting documentation of license from each 
9 
License  State where provider practices 
NPI  Require supporting documentation from NPPES   7 
Check information/Web sites of State boards or  
Credentials  11 
credentialing organizations 
Confirm that it is not a billing agency   11 
Call telephone number to confirm that applicant is reached   8 
Confirm that it is not a management service organization  7 
Mailing Address 
Confirm that it is not a chains corporate office   6 
Required by the 
PIM but 
Waived by   Confirm that it is not an applicants representative   4 
Supplemental 
Guidance  
Compare signatures for request to change a  
11 
special payments address 
Compare signatures for request to change the providers 
10 
electronic funds transfer authorization agreement  
Request for 
Data Change   Compare signatures for request to change practice  
  location address  10 
 
Compare signatures for request for reactivation 
9 
or revalidation 
Compare signature for requests to change mailing address  8 
 
Compare addresses to addresses in Internet sources  10 
 
Practice  Contact the city  or county  for professional/business license, 
2 
  Location  certification, or registration 
Perform a site visit   0 
 
continued on next page 
 
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   35  
   
   
Table C-1: Safeguards That Medicare Administrative Contractors Report Using To Verify  
Provider Enrollment Data (Continued)  
MACs Routinely  
Variable for 
Status   Suggested Method for Verification   Performing 
Verification  
Activity (N=11)  
Call the number to verify connection or ownership   7 
Telephone 
Numbers   Compare telephone number to Internet sources   5 
Compare telephone number to telephone listing(s)  2 
Check records of the Internal Revenue Service (EIN)   4 
Required by the 
PIM but Waived 
Compare telephone number to telephone listing(s)  2 
by Supplemental 
Guidance   Legitimacy of  
Contact the city for professional/business license, 
Business  2 
certification, or registration 
Contact the county for professional/business license, 
1 
certification, or registration 
Adverse Legal 
Check court records of conviction   2 
History 
Abbreviations used in table:  MAC = Medicare Administrative  Contractor, PIM = Program Integrity Manual, JSM = Joint Signature  
Memorandum, OIG = Office of  Inspector General, GSA =  General Services Administration, SSN  = Social Security number, NPI = National 
Provider Identifier, NPPES = National Plan and Provider Enumeration System, and EIN = Employer Identification Number. 
   
Source:  Office of  Inspector General analysis of MAC Survey data, 2011. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   36  
  APPENDIX D 
Agency Comments 
/tPVl~, 
~ 	
(  DEPARTMENT OF HEALTH & HUMAN SERVICES  Centers tor Medicare & Medicaid Services 
<~'!-	
Administrator 
Washington , DC 20201 
DATE: 
MAR  2 5 2013 
TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	 Marilyn 'h\'enner 

Acting Ad\nihistrator 

SUBJECT: 	 Office of Inspector General (OIG) Draft Report:  "Inaccurate, Incomplete, and 
Inconsistent Provider Enumeration and Medicare Enrol.lment Data" 
(OEI-07 -09-00440) 
The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 
comment on the subject of the OIG draft report. The purpose of this report is to assess provider 
enumeration data (i.e., from providers' applications for National Provider Identifiers (NPI)) and 
Medicare provider enrollment data maintained by CMS for accuracy, completeness, and 
consistency; and to assess CMS oversight processes for ensuring the accuracy, completeness, and 
consistency of provider enumeration data and Medicare provider enrollment data. 
The CMS is committed to preventing fraudulent providers from enrolling in federal health care 
programs, removing fraudulent providers from the programs, and maintaining the integrity of the 
systems that house provider enumerators and enrollment information. Medicare Administrative 
Contractors (MAC) are required by the Program Integrity Manual (PIM) to use validation 
techniques such as documentation reviews, licensure verification, review of exclusion and 
debarment databases, interaction with Social Security Administration's (SSA) databases, and site 
visits to verify enrollment information. 
In addition, CMS has already begun working on developing mechanisms to further verify 
provider enumerator data and implement processes to actively deactivate NP!s when appropriate 
for potentially fraudulent providers. 
We appreciate OIG's efforts in working with CMS to help ensure that provider enumeration and 
Medicare enrollment data is accurate, complete, and consistent. Our response to each of the OIG 
recommendations follows. 
OIG Recommendation 
The OIG recommends that CMS require MACs to implement program integrity safeguards for 
Medicare provider enrollment as established in the PIM . 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEl-07-09-00440)  37   
   
 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   38  
   
   
 
 
 
 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   39  
   
   
 
   
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   40  
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Brian Pattison, Regional 
Inspector General for Evaluation and Inspections in the Kansas City 
regional office, and Brian T.  Whitley, Deputy Regional Inspector General.   
Julie Dusold Culbertson served as the team leader for this study. Other 
principal Office of Evaluation and Inspections staff from the Kansas City  
regional office who contributed to the report include Michael J. Brown 
and Jordan R. Clementi; central office staff who contributed include 
Kevin Farber, Scott Horning, Scott Manley, Christine Moritz, and 
Debra Roush. 
Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440)   41  
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS)  programs, as well as the health and welfare of beneficiaries  served by those 
programs.  This statutory mission  is  carried  out through  a nationwide network  of  audits, 
investigations, and inspections conducted by the  following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections  
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of  fraud and misconduct  related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs  and operations and providing all 
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and abuse cases involving HHS programs,  including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.