Federal Register / Vol. 72, No. 103 / Wednesday, May 30, 2007 / Notices 30011 

the provisions of 5 U.S.C. 552a(c)(3), (d), 

(e)(1), (e)(4)(G), (H), and (I), and (f). 

Exemption is appropriate to avoid 

compromise of ongoing investigations, 

disclosure of the identity of confidential 

sources and unwarranted invasions of 

personal privacy of third parties. 

By the Commission. 

Bryant L. VanBrakle, 

Secretary. 

[FR Doc. E7–10381 Filed 5–29–07; 8:45 am] 

BILLING CODE 6730–01–P 

FEDERAL RESERVE SYSTEM 

Formations of, Acquisitions by, and 

Mergers of Bank Holding Companies 

The companies listed in this notice 

have applied to the Board for approval, 

pursuant to the Bank Holding Company 

Act of 1956 (12 U.S.C. 1841 et seq.) 

(BHC Act), Regulation Y (12 CFR Part 

225), and all other applicable statutes 

and regulations to become a bank 

holding company and/or to acquire the 

assets or the ownership of, control of, or 

the power to vote shares of a bank or 

bank holding company and all of the 

banks and nonbanking companies 

owned by the bank holding company, 

including the companies listed below. 

The applications listed below, as well 

as other related filings required by the 

Board, are available for immediate 

inspection at the Federal Reserve Bank 

indicated. The application also will be 

available for inspection at the offices of 

the Board of Governors. Interested 

persons may express their views in 

writing on the standards enumerated in 

the BHC Act (12 U.S.C. 1842(c)). If the 

proposal also involves the acquisition of 

a nonbanking company, the review also 

includes whether the acquisition of the 

nonbanking company complies with the 

standards in section 4 of the BHC Act 

(12 U.S.C. 1843). Unless otherwise 

noted, nonbanking activities will be 

conducted throughout the United States. 

Additional information on all bank 

holding companies may be obtained 

from the National Information Center 

website at www.ffiec.gov/nic/. 

Unless otherwise noted, comments 

regarding each of these applications 

must be received at the Reserve Bank 

indicated or the offices of the Board of 

Governors not later than June 14, 2007. 

A. Federal Reserve Bank of New 

York (Anne MacEwen, Bank 

Applications Officer) 33 Liberty Street, 

New York, New York 10045-0001: 

1. Doral Holdings Delaware, LLC, 

Doral Holdings, LP, and Doral GP Ltd., 

all of New York, New York; to become 

bank holding companies by acquiring 

up to 100 percent of the voting shares 

of Doral Financial Corporation, and 

Doral Bank, both of San Juan, Puerto 

Rico. 

In connection with this application, 

Applicant also has applied to acquire 

Doral Bank, FSB, New York, New York, 

and thereby engage in operating a 

savings association, pursuant to section 

225.28(b)(4)(ii) of Regulation Y. 

Board of Governors of the Federal Reserve 

System, May 24, 2007. 

Jennifer J. Johnson, 

Secretary of the Board. 

[FR Doc. E7–10319 Filed 5–29–07; 8:45 am] 

BILLING CODE 6210–01–S 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

[CMS–6060–N] 

RIN 0938–AN71 

HIPAA Administrative Simplification: 

National Plan and Provider 

Enumeration System Data 

Dissemination 

AGENCY: Centers for Medicare & 

Medicaid Services (CMS), HHS. 

ACTION: Notice. 

SUMMARY: This notice establishes the 

data that are available from the National 

Plan and Provider Enumeration System 

(NPPES). In addition, this notice 

addresses who may have access to the 

data or may receive data from the 

system, the processes for requesting and 

receiving data, and the conditions under 

which data may be disclosed. 

FOR FURTHER INFORMATION CONTACT: 

Patricia Peyton, (410) 786–1812. 

SUPPLEMENTARY INFORMATION: 

I. Background 

A. Legislative and Regulatory 

Background 

The Administrative Simplification 

provisions of the Health Insurance 

Portability and Accountability Act of 

1996 (HIPAA) required the Secretary of 

Health and Human Services (HHS) to 

adopt a standard unique health 

identifier for health care providers. On 

January 23, 2004, HHS published a final 

rule in the Federal Register that 

adopted the National Provider Identifier 

(NPI) as the standard unique health 

identifier for health care providers (69 

FR 3434). The NPI final rule established 

the National Provider System (NPS) and 

requires, among other things, that the 

NPS disseminate data in response to 

approved requests. The NPI final rule 

stated that we would publish a notice in 

the Federal Register describing our data 

dissemination strategy and the process 

by which we would carry it out (69 FR 

3456). Therefore, we are publishing this 

notice. 

B. Operational and System Background 

On July 28, 1998, in accordance with 

the Privacy Act of 1974, we published, 

in the Federal Register, a System of 

Records (SOR) notice for the National 

Provider System (NPS) (63 FR 40297). 

The NPS is the system, as described in 

the NPI final rule, that will be used to 

enumerate health care providers and 

house the information provided on 

health care providers’ applications for 

NPIs. The NPS is now contained within 

the National Plan and Provider 

Enumeration System (NPPES). We are in 

the process of revising the Privacy Act 

SOR notice and will soon publish an 

updated SOR notice. The updated SOR 

notice will reflect the change from NPS 

to NPPES and will incorporate other 

changes necessitated by organizational 

and name changes and information 

contained in the NPI final rule. The 

updated SOR notice will also contain 

language that will clarify its consistency 

with the data dissemination policy 

described in this notice. (The existing 

SOR notice, although it is being revised, 

supports the data dissemination policy 

described in this notice.) The NPPES 

enumerates health care providers and 

houses their NPIs and information from 

their NPI applications/updates. The 

NPPES also would be capable of 

enumerating health plans and housing 

their standard unique health identifiers 

and information from their health plan 

identifier applications/updates once a 

standard unique health identifier for 

health plans has been adopted. 

Covered entities under HIPAA are 

required to use NPIs to identify health 

care providers in standard transactions 

beginning no later than May 23, 2007 

(small health plans have until May 23, 

2008). (See the Standards for Electronic 

Transactions and Code Sets final rule 

published on August 17, 2000 (65 FR 

50312), the Modifications to the 

Electronic Transaction and Code Sets 

final rule published on February 20, 

2003 (68 FR 8381), and the NPI final 

rule published on January 23, 2004 (69 

FR 3434)). Covered entities include 

health plans, health care clearinghouses, 

and those health care providers who 

transmit any health information in 

electronic form in connection with a 

transaction for which the Secretary has 

adopted a standard. 

The NPPES uniquely identifies health 

care providers by the use of an 


sroberts on PROD1PC70 with NOTICES
30012 Federal Register / Vol. 72, No. 103 / Wednesday, May 30, 2007 / Notices 

application process and assigns them 

their NPIs. The NPPES creates a record 

for each health care provider to whom 

it assigns an NPI. The records are 

updated when health care providers 

furnish updates to the NPPES. 

Health care providers are categorized 

by the NPPES as two types: Individuals, 

such as physicians; and organizations, 

such as hospitals. 

A health care provider may apply for 

an NPI in one of three ways: (1) By 

completing form CMS–10114 (NPI 

Application/Update Form) and mailing 

it to the NPI Enumerator; (2) by 

applying online at https:// 

NPPES.cms.hhs.gov/; or (3) by having an 

approved organization submit its NPI 

application data, along with the NPI 

application data of many other health 

care providers, to the NPPES in an 

electronic format defined by HHS. (The 

NPI Application/Update Form, CMS–

10114, is approved under the Paperwork 

Reduction Act as OMB No. 0938–0931 

with an expiration date of February 29, 

2008.) 

Health care providers who apply 

online have electronic access to the 

information in their own NPPES records 

by using user identifiers and passwords 

they select. This access allows those 

health care providers to submit updates 

to their NPPES data electronically via 

the Web. 

Health care providers who apply on 

the paper form may update their NPPES 

data electronically by using user 

identifiers and passwords they select. 

However, health care providers who are 

individuals and who submit paper 

applications but did not furnish SSNs in 

their applications must update their 

NPPES data by using the paper NPI 

Application/Update Form. 

A health care provider may have its 

NPI application data submitted by a 

HHS-approved organization if the 

organization offers this service and the 

health care provider gives permission 

for the NPI application data to be 

submitted by the organization. An 

organization, once it is approved to do 

so, submits to the NPPES the health care 

provider’s NPI application data, along 

with the NPI application data of many 

other health care providers who have 

also agreed to this service. The NPI 

application data are submitted to the 

NPPES for enumeration electronically in 

a format defined by HHS. The NPPES 

processes the NPI application data and 

makes available to the organization the 

NPIs that were assigned to the health 

care providers. If NPIs were not 

assigned to all of the health care 

providers, HHS indicates to the 

organization why NPIs were not 

assigned. This process is known as 

electronic file interchange (EFI) for bulk 

enumeration. Information about EFI can 

be found at http://www.cms.hhs.gov/ 

NationalProvIdentStand/. Health care 

providers who are assigned NPIs via this 

process may update their own NPPES 

data electronically via the Web using 

user identifiers and passwords they 

select. The approved organizations may 

offer to submit updates to the health 

care providers’ NPPES data on behalf of 

the health care providers, and may do 

so if the health care providers agree. The 

updates are sent to the NPPES in an 

electronic format defined by HHS. 

Information on the format of EFI files is 

available at https://NPPES.cms.hhs.gov. 

The EFI process became available on 

May 1, 2006. 

II. How to Obtain NPI(s) and Other 

NPPES Data of Enumerated Health Care 

Providers 

A. Request the NPIs From the Health 

Care Providers 

Entities wishing to obtain the NPI of 

a health care provider for use in a 

standard transaction(s) may contact that 

health care provider directly and 

request the NPI. Health care providers 

who are covered entities under HIPAA 

(known as ‘‘covered health care 

providers’’) are required by the NPI final 

rule to disclose their NPIs to any entity 

that needs them for use in standard 

transactions (45 CFR 162.410(a)(3)). 

Covered organization health care 

providers that have subparts that have 

been assigned NPIs must ensure that 

those subparts disclose their NPIs as 

well (45 CFR 162.410(a)(6)). Because the 

NPI was adopted for use in standard 

transactions, enumerated health care 

providers who are not covered health 

care providers are expected, but not 

required, to disclose their NPIs, upon 

request, to any entity that needs them 

for use in standard transactions. 

B. Request the NPIs and Other NPPES 

Health Care Provider Data From HHS 

In accordance with the Freedom of 

Information Act (FOIA), the Privacy Act, 

and the CMS FOIA and Privacy Act 

procedures, HHS has reviewed the 

health care provider data elements 

contained in the NPPES, which are 

listed in the NPI final rule (69 FR 3457 

through 3460). As a result of this 

review, HHS believes that Social 

Security Numbers (SSNs), Internal 

Revenue Service Individual Taxpayer 

Identification Numbers (IRS ITINs), and 

dates of birth (DOB) are not disclosable 

under FOIA and, therefore, HHS will 

not release these three data elements to 

the public, which includes HIPAA 

covered entities. This decision supports 

HHS and CMS efforts to prevent or 

minimize fraud and abuse in the 

Medicare and Medicaid programs and in 

the health care industry in general. HHS 

has determined that the remaining 

health care provider data elements 

contained in the NPPES, which are 

listed in the table below, are required to 

be disclosed under the FOIA. HHS 

believes that the data elements in the 

table below are sufficient to enable 

HIPAA covered entities to match health 

care provider records in NPPES with the 

health care providers for whom they 

have data. 

Anyone may request NPIs and other 

NPPES health care provider data from 

HHS under the FOIA. 

The NPPES data elements that HHS 

has determined are required to be 

disclosed under the FOIA are listed 

below. They are defined in the NPI final 

rule. 

NPPES HEALTH CARE PROVIDER DATA THAT MAY BE DISCLOSED UNDER FOIA 

For health care providers who are individuals For health care providers who are 

organizations 

NPI (This is the provider’s NPI. If the provider has had an NPI replaced, this will be the same NPI as the Replacement NPI.).NPI (This is the provider’s NPI. If the provider has had an NPI replaced, this will be the same NPI as the Replacement NPI.) 

Entity Type Code: Entity Type Code: 

1=Individual ....................................................................................... 2=Organization 

Replacement NPI (This is the provider’s NPI if the provider has been 

assigned a Replacement NPI. If the provider has never been assigned a Replacement NPI, this data element will be blank.).

Replacement NPI (This is the provider’s NPI if the provider has been 

assigned a Replacement NPI. If the provider has never been assigned a Replacement NPI, this data element will be blank.) 

Employer Identification Number (EIN). 

Provider Last Name (Legal Name) .......................................................... Provider Organization Name (Legal Business Name). 

Provider First Name 


sroberts on PROD1PC70 with NOTICES
Federal Register / Vol. 72, No. 103 / Wednesday, May 30, 2007 / Notices 30013 

NPPES HEALTH CARE PROVIDER DATA THAT MAY BE DISCLOSED UNDER FOIA—Continued 

For health care providers who are individuals For health care providers who are 

organizations 

Provider Middle Name 

Provider Other Last Name ....................................................................... Provider Other Organization Name. 

Provider Other Last Name Type Code: Provider Other Organization Name Type Code: 

1=Former Name ................................................................................ 3=Doing Business As Name. 

2=Professional name ......................................................................... 4=Former Legal Business Name. 

5=Other .............................................................................................. 5=Other. 

Provider Other First Name 

Provider Other Middle Name 

Provider Name Prefix Text 

Provider Name Suffix Text 

Provider Credential Text 

Provider First Line Business Mailing Address ......................................... Provider First Line Business Mailing Address. 

Provider Second Line Business Mailing Address .................................... Provider Second Line Business Mailing Address.

Provider Business Mailing Address City Name ....................................... Provider Business Mailing Address City Name. 

Provider Business Mailing Address State Name ..................................... Provider Business Mailing Address State Name. 

Provider Business Mailing Address Postal Code ..................................... Provider Business Mailing Address Postal Code. 

Provider Business Mailing Address Country Code (If outside U.S.) ....... Provider Business Mailing Address Country Code (If outside U.S.). 

Provider Business Mailing Address Telephone Number ......................... Provider Business Mailing Address Telephone Number. 

Provider Business Mailing Address Fax Number .................................... Provider Business Mailing Address Fax Number. 

Provider First Line Business Location Address ....................................... Provider First Line Business Location Address. 

Provider Second Line Business Location Address .................................. Provider Second Line Business Location Address.

Provider Business Location Address City Name ..................................... Provider Business Location Address City Name. 

Provider Business Location Address State Name ................................... Provider Business Location Address State Name. 

Provider Business Location Address Postal Code .................................. Provider Business Location Address Postal Code.

Provider Business Location Address Country Code (If outside U.S.) ..... Provider Business Location Address Country Code (If outside U.S.). 

Provider Business Location Address Telephone Number ....................... Provider Business Location Address Telephone Number. 

Provider Business Location Address Fax Number .................................. Provider Business Location Address Fax Number. 

Healthcare Provider Taxonomy Code (Primary Taxonomy required; up 

to 15 may be reported).

Healthcare Provider Taxonomy Code (Primary Taxonomy required; up 

to 15 may be reported). 

Other Provider Identifier ........................................................................... Other Provider Identifier. 

Other Provider Identifier Type Code ........................................................ Other Provider Identifier Type Code.

Provider Enumeration Date ...................................................................... Provider Enumeration Date. 

Last Update Date ..................................................................................... Last Update Date. 

NPI Deactivation Reason Code ............................................................... NPI Deactivation Reason Code. 

NPI Deactivation Date .............................................................................. NPI Deactivation Date. 

NPI Reactivation Date .............................................................................. NPI Reactivation Date. 

Provider Gender Code 

Provider License Number 

Provider License Number State Code 

Authorized Official Last Name. 

Authorized Official First Name. 

Authorized Official Middle Name. 

Authorized Official Title or Position. 

Authorized Official Telephone Number. 

We anticipate an extraordinary 

demand from the health care industry 

for FOIA-disclosable NPPES health care 

provider data. Because the health care 

industry needs these data in order to 

develop linkages between legacy 

identifiers and NPIs that will be 

necessary in order to implement the NPI 

as required by regulation, and because 

health care providers need to know the 

NPIs of other health care providers in 

order to submit HIPAA-compliant 

health care claims transactions, there is 

an extreme urgency for HHS to make 

these data available. In order to 

efficiently respond, HHS will make 

NPPES health care provider data 

available on the Internet. Internet 

availability eliminates the need for 

entities to submit initial and ongoing 

requests for data to HHS and for HHS 

to process and respond to each of those 

requests. We believe that making these 

data available on the Internet is the most 

efficient and effective means of 

dissemination. 

HHS will make the FOIA-disclosable 

NPPES health care provider data 

available in downloadable files and in a 

query-only database, as described below 

in items 1 and 2, respectively. Upon 

publication of this notice, HHS will 

announce the Internet locations of the 

downloadable files and the query-only 

database on the CMS NPI Web page 

(http://www.cms.hhs.gov/ 

NationalProvIdentStand/). At the same 

time, CMS will communicate that 

information in its provider listservs and 

to its business partners and other health 

care industry associations with whom 

CMS works on issues related to NPI 

implementation. 

The initial downloadable file and the 

query-only database will be available 30 

days after the publication date of this 

notice. 

We remind health care providers who 

are covered entities under HIPAA that 

they are required by the NPI final rule 

to update their NPPES data within 30 

days of the changes, and we encourage 

other health care providers who have 

been assigned NPIs to do the same. 

Further, prior to CMS’’ disclosure of 

NPPES health care provider data, we 

encourage health care providers who 

have been assigned NPIs to check the 

information in their NPPES records to 

ensure it is current. Some health care 

providers may wish to delete optional 

NPPES data that they furnished when 

applying for their NPIs since the 


sroberts on PROD1PC70 with NOTICES
30014 Federal Register / Vol. 72, No. 103 / Wednesday, May 30, 2007 / Notices 

information provided in these optional 

fields is not required. For example, the 

data contained in the ‘‘Other Names’’

and ‘‘Other Provider Identifiers’’ data 

fields are optional. Further, a primary 

‘‘Healthcare Provider Taxonomy Code’’

is required to be furnished when 

applying for an NPI; however, the 

reporting of additional ‘‘Healthcare 

Provider Taxonomy Codes’’ (a total of 

15 may be reported) is optional. 

The HHS NPPES data dissemination 

policy is as follows: 

1. NPPES health care provider data 

that are required to be disclosed under 

the FOIA will be available as a 

downloadable file on a Web site. 

Section 552(a)(2)(D) of the FOIA 

requires agencies to make available by 

electronic means copies of records 

which have been released to any person 

under the FOIA and which, because of 

the nature of their subject matter, the 

agency determines have become or are 

likely to become the subject of 

subsequent requests for substantially the 

same records. We believe that the 

demand for NPPES health care provider 

data will be such that it will justify our 

making NPPES health care provider data 

that are required to be disclosed under 

the FOIA available for download by the 

public from an Internet Web site. The 

location of the downloadable file will be 

announced on the CMS NPI Web page 

(http://www.cms.hhs.gov/ 

NationalProvIdentStand/) prior to its 

availability. Each month, an update file 

will also be available for download from 

the same Web site. The update file will 

not replace the initial file: The update 

file will contain only (1) data that are 

required to be disclosed under FOIA for 

health care providers who obtained 

NPIs within the prior month, and (2) 

updates and changes to the data that are 

required to be disclosed under the FOIA 

for enumerated health care providers 

that were made within the prior month. 

The first update file will be available for 

downloading 30 days after the 

availability of the initial file, and a new 

update file will be available for 

downloading each month thereafter. 

There will be no charge to download 

the files. 

We may decide to discontinue making 

these files available if we determine that 

the query-only database described in (2) 

below is an adequate replacement. 

The NPPES data elements that HHS 

has determined are required to be 

disclosed under FOIA and will be 

contained in the downloadable files are 

listed in the table above. 

2. NPPES health care provider data 

that HHS has determined are required 

to be disclosed under FOIA will be 

available in a query-only database on an 

Internet Web site. 

Section 552(a)(2)(D) of the FOIA 

requires agencies to make available by 

electronic means copies of records 

which have been released to any person 

under the FOIA and which, because of 

the nature of their subject matter, the 

agency determines have become or are 

likely to become the subject of 

subsequent requests for substantially the 

same records. 

We believe that the demand for 

NPPES health care provider data will be 

such that it will justify our making a 

query-only database containing NPPES 

health care provider data that are 

required to be disclosed under the FOIA 

available to the public on an Internet 

Web site. Users will be able to run 

simple queries online, such as queries 

by NPI and by name of health care 

provider. 

There will be no charge to use the 

query-only database. 

The NPPES data elements that HHS 

has determined are required to be 

disclosed under FOIA and will be 

available from the query-only database 

are listed in the table above. 

3. Other requests for NPPES health 

care provider data that HHS has 

determined are required to be disclosed 

under the FOIA. 

Requests for FOIA-disclosable data in 

formats or in media that are not 

described above, or any other custom 

requests, will be considered in 

accordance with the FOIA and CMS 

FOIA procedures and charges (see 

http://www.cms.hhs.gov/AboutWebsite/ 

04_FOIA.asp). For example, these could 

be requests for FOIA-disclosable data for 

specific health care providers, or for 

health care providers in certain States or 

with certain Healthcare Provider 

Taxonomy Codes, or requests for FOIAdisclosable data on CD, diskette, or 

paper. These requests must be described 

in detail and be submitted to the 

following address: Centers for Medicare 

& Medicaid Services, Office of Strategic 

Operations and Regulatory Affairs, 

Freedom of Information Group, Room 

N2–20–16, 7500 Security Boulevard, 

Baltimore, Maryland 21244–1850. 

Requests may be sent by fax to (410) 

786–0474. We will not acknowledge, 

respond to, or honor requests that are 

made by telephone. 

III. Collection of Information 

Requirements 

This document does not impose 

information collection and 

recordkeeping requirements. 

Consequently, it need not be reviewed 

by the Office of Management and 

Budget under the authority of the 

Paperwork Reduction Act of 1995 (44 

U.S.C. 3501 et seq.). 

Authority: Sections 1171 through 1179 of 

the Social Security Act (42 U.S.C. 1320d–

1320d–8), as added by section 262 of Pub. L. 

104–191. 42 CFR 162, Subpart D. (Catalog of 

Federal Domestic Assistance Program, No. 

93.773, Medicare—Hospital Insurance 

Program; and No. 93.774, Medicare—

Supplementary Medical Insurance Program) 

Dated: August 30, 2005. 

Mark B. McClellan, 

Administrator, Centers for Medicare & 

Medicaid Services. 

Dated: February 22, 2007. 

Michael O. Leavitt 

Secretary, Department of Health and Human 

Services. 

[FR Doc. 07–2651 Filed 5–23–07; 4:12 pm] 

BILLING CODE 4120–01–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

[Docket No. 2007N–0208] 

Interim Melamine and Melamine 

Analogues Safety/Risk Assessment; 

Availability 

AGENCY: Food and Drug Administration, 

HHS 

ACTION: Notice. 

SUMMARY: The Food and Drug 

Administration (FDA) is announcing the 

availability of a document entitled, 

‘‘Interim Melamine and Melamine 

Analogues Safety/Risk Assessment.’’

The interim safety/risk assessment 

describes the risk to human health 

associated with eating pork, chicken, 

fish, and eggs from animals that were 

inadvertently fed animal feed that 

contained melamine and its analogues 

(cyanuric acid, ammelide and 

ammeline). FDA is seeking public 

comment on the interim safety/risk 

assessment to assist the agency and the 

Food Safety and Inspection Service 

(FSIS) at the U. S. Department of 

Agriculture (USDA) in the ongoing 

investigation of contaminated vegetable 

protein products imported from China 

that were mislabeled as ‘‘wheat gluten’’

and ‘‘rice protein concentrate,’’ and 

ensuring the safety of the U.S. food 

supply. 

DATES: Comments on the interim safety/ 

risk assessment must be submitted by 

June 29, 2007. 

ADDRESSES: Submit written comments 

to the Division of Dockets Management 

(HFA–305), Food and Drug 

Administration, 5630 Fishers Lane, rm. 

1061, Rockville, MD 20852. Submit 


sroberts on PROD1PC70 with NOTICES