Department of Health and Human Services 

 OFFICE OF 

INSPECTOR GENERAL 

MPROVEMENTS EEDED TO 

ENSURE PROVIDER 

ENUMERATION AND MEDICARE 

ENROLLMENT DATA ARE 

ACCURATE, COMPLETE, AND 

ONSISTENT 

Daniel R. Levinson 

Inspector General 

May 2013 

OEI-07-09-00440 

I N

C
 

EXECUTIVE SUMMARY: IMPROVEMENTS NEEDED TO ENSURE PROVIDER 

ENUMERATION AND MEDICARE ENROLLMENT DATA ARE ACCURATE, 

COMPLETE, AND CONSISTENT 

OEI-07-09-00440 

WHY WE DID THIS STUDY 

Health care provider information, including providers’ unique National Provider Identifiers 

(NPIs), is maintained in the National Plan and Provider Enumeration System (NPPES). To 

enroll in Medicare, providers must supply their NPIs and other information to the Centers for 

Medicare & Medicaid Services (CMS) to be entered into the Provider Enrollment, Chain and 

Ownership System (PECOS). Accurate, complete, and consistent provider data in NPPES and 

PECOS help to ensure the integrity of all health care programs. Previous Office of Inspector 

General work has revealed ongoing problems with CMS’s oversight of provider data, sometimes 

resulting in improper Medicare payments to fraudulently enrolled providers. 

HOW WE DID THIS STUDY 

We surveyed a random sample of individual Medicare providers to determine the accuracy of the 

provider information stored in NPPES and PECOS. We reviewed individual provider data in 

both NPPES and PECOS to determine whether these data were complete and consistent between 

the two databases. Additionally, we interviewed CMS staff to gather information about 

oversight of provider data in NPPES and PECOS. 

WHAT WE FOUND 

Medicare provider data in NPPES and PECOS were often inaccurate and occasionally 

incomplete, and were generally inconsistent between the two databases. In NPPES, provider 

data were inaccurate in 48 percent of records, and complete for nearly all required variables but 

incomplete for conditionally required variables in 9 percent of records. In PECOS, provider data 

were inaccurate in 58 percent of records and incomplete in almost 4 percent. Additionally, 

provider data were inconsistent between NPPES and PECOS for 97 percent of records. 

Addresses, which are essential for contacting providers and identifying trends in fraud, waste, 

and abuse, were the source of most inaccuracies and inconsistencies. Finally, CMS did not 

verify most provider information in NPPES or PECOS. 

WHAT WE RECOMMEND 

Inaccurate, incomplete, and inconsistent provider data coupled with insufficient oversight place 

the integrity of the Medicare program at risk and present vulnerabilities in all health care 

programs. CMS should require Medicare Administrative Contractors to implement program 

integrity safeguards for Medicare provider enrollment as established in the Program Integrity 

Manual. Additionally, CMS should require more verification of NPPES enumeration and 

PECOS enrollment data. Finally, CMS should detect and correct inaccurate and incomplete 

provider enumeration and enrollment data for new and established records. CMS concurred with 

all three of our recommendations. 
TABLE OF CONTENTS 

Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology..............................................................................................10 

Findings......................................................................................................17 

In NPPES, 48 percent of records contained inaccurate data; 

almost all required data were complete .........................................17 

In PECOS, 58 percent of records contained inaccurate data 

and almost 4 percent were incomplete ...........................................18 

Provider data were inconsistent between NPPES and PECOS 

for 97 percent of records ................................................................21 

CMS did not verify most provider information in NPPES or 

PECOS ...........................................................................................22 

Conclusion and Recommendations ............................................................28 

Agency Comments and Office of Inspector General Response .....30 

Appendixes ................................................................................................31 

A: Detailed Methodology .............................................................31 

B: Point Estimates and Confidence Intervals Based on 

Provider Survey .............................................................................33 

C: Safeguards That Medicare Administrative Contractors 

Report Using To Verify Provider Enrollment Data ........................35 

D: Agency Comments ...................................................................37 

Acknowledgments......................................................................................41 
 

 

 

OBJECTIVES 

To assess: 

1.	 provider enumeration data (i.e., from providers’ applications for 

National Provider Identifiers (NPIs)) and Medicare provider 

enrollment data maintained by the Centers for Medicare & Medicaid 

Services (CMS) for accuracy, completeness, and consistency; and 

2.	 CMS oversight processes for ensuring the accuracy, completeness, and 

consistency of provider enumeration data and Medicare provider 

enrollment data. 

BACKGROUND 

CMS has two databases with basic provider-related data—one from which 

providers obtain NPIs and one through which providers enroll in 

Medicare. Before enrolling in Medicare, a health care provider must 

apply through the National Plan and Provider Enumeration System 

(NPPES) to obtain an NPI.1 CMS assigns NPIs to providers via a process 

called enumeration, and these NPI assignments are maintained in the 

NPPES database. A health care provider wishing to establish and maintain 

Medicare billing privileges must enroll in Medicare and periodically 

reenroll with accurate and verifiable information via an approved CMS 

application process.2 Currently, Medicare provider enrollment 

applications are processed through the Provider Enrollment, Chain and 

Ownership System (PECOS). Providers are required to submit identifying 

information to each application system, such as individuals’ names, dates 

of birth (DOBs), State professional license numbers, and practice 

locations. CMS oversees both NPPES and PECOS and uses contractors to 

process and maintain provider data. 

As described in the Office of Inspector General’s (OIG) 2012 

Compendium of Unimplemented Recommendations, the Department of 

Health and Human Services (HHS) and OIG 

rely heavily on the availability and completeness of data to ensure 

that ... departmental programs are operating as intended and help 

identify instances of fraud, waste, and abuse.... When these data are 

1

 42 CFR § 424.506(b); CMS, Medicare Program Integrity Manual (PIM) (Internet-only 

manual), Pub. No. 100-08, ch. 10, § 4.2.1, and ch. 15, § 15.3. (At the time of our review, 

information relating to provider enrollment was found in ch. 10 of the PIM; CMS has 

since moved some of this information to ch. 15.) 

2

 42 CFR §§ 424.505 and 424.515. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 1 
 

 

 

 

 

 

 

 

 

unavailable, are incomplete, or contain inaccuracies, program 

oversight and monitoring activities are hindered.3 

OIG identifies the integrity and security of health information systems and 

data as a Top Management Challenge for HHS.4 

Provider Enumeration in NPPES 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) 

required the Secretary of HHS to (1) establish a standard unique health 

care system identifier for each provider and (2) specify the purposes for 

which the identifier may be used.5 The resulting identifier, the NPI, is 

intended for use by all individuals and entities that meet the definition of a 

health care provider and/or a health care organization under HIPAA.6 

On January 23, 2004, CMS promulgated a final rule in the Federal 

Register adopting the NPI as the standard unique health identifier for 

health care providers.7 Each health care provider satisfying HIPAA’s 

definition of covered entities8 was required to obtain and use an NPI for 

HIPAA transactions9 no later than May 23, 2007.10 Therefore, current 

health care providers must use NPIs to submit electronic bills to insurers 

for payment. 

The NPI replaced the legacy identification numbers (e.g., the Unique 

Physician Identification Number (UPIN) for Medicare) that health insurers 

used to identify their enrolled health care providers claiming 

reimbursement for services.11 Prior to the use of the NPI, a provider would 

have used multiple identification numbers to submit claims for 

3

 OIG, Compendium of Unimplemented Recommendations, December 2012 Edition, 

p. 131. Accessed at http://oig.hhs.gov on January 3, 2013. 

4

 OIG, 2012 Top Management & Performance Challenges, Management 

Issue 9: Availability and Quality of Data for Effective Program Oversight, 

November 9, 2012. Accessed at http://oig.hhs.gov on January 3, 2013. 

5 HIPAA (P.L. 104-191), enacted on August 21, 1996. Title II, Subpart F, § 262(a) added 

a new pt. C to Title XI of the Social Security Act, “Administrative Simplification.” 

Currently, pt. C consists of §§ 1171 and 1180. 

6

 69 Fed. Reg. 3434, 3440 (Jan. 23, 2004). 

7

 Ibid. at 3434. 

8

 Ibid. at 3434. A covered entity means (1) a health plan, (2) a health care clearinghouse, 

or (3) a health care provider that transmits health information in electronic form in 

connection with a transaction covered by HIPAA. 

9

 The HIPAA transactions are claims and encounter information, payment and remittance 

advice, claims status, eligibility, enrollment and disenrollment, referrals and 

authorizations, and premium payment. 

10 45 CFR § 162.404(b)(2). Small health plans were required to use the NPI in standard 

transactions no later than May 23, 2008. 

11 CMS, NPI Fact Sheet. Accessed at http://www.cms.gov on May 12, 2009. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 2 
 

 

 

 

reimbursement, with a different number for each participating health 

insurance plan. In contrast, the NPI is used by all health insurance plans, 

which enables the public and private sectors to consistently track providers 

nationwide. 

In the final rule establishing the NPI, CMS listed several examples of 

permissible uses of the NPI, including the following: 

	 The NPI may be used as a cross-reference in files on provider fraud 

and abuse and other program integrity files. 

	 The NPI may be used to identify providers for debt collection under 

the Debt Collection Improvement Act of 1996. 

	 Health plans may use the NPI in their internal files for providers to 

process transactions and in communications with providers. 

	 Health plans may communicate the NPI to other health plans for 

coordination of benefits. 

	 The NPI may be used to identify providers in patient medical records.12 

Providers may apply for an NPI using a Web-based or a paper 

application.13 The Web-based NPI application requires the following data 

for individuals: first and last names; Social Security number (SSN); DOB 

and place of birth; gender; mailing address; practice location address and 

telephone number; medical specialty (e.g., cardiology); State license 

information; and a contact person’s name, email address, and telephone 

number.14 Although the individual’s SSN and a contact person’s email 

address are required on Web-based applications, they are not required for 

paper applications.15 Providers must communicate any changes in required 

data elements to NPPES within 30 days of the change.16 As of June 30, 

2012, approximately 2.8 million health care providers (e.g., physicians) 

12 69 Fed. Reg. 3434, 3449 (Jan. 23, 2004). 

13 Providers may also apply online via Electronic File Interchange (EFI). EFI 

applications are submitted by CMS-approved organizations on behalf of health care 

providers. 

14 CMS, NPPES Data Dictionary, ch. 19.1, pp. 1–3, 2010. 

15 Ibid., p. 2. A provider must submit two proofs of identity if he or she does not furnish 

an SSN. CMS, National Provider Identifier (NPI) Application/Update Form 

CMS-10114, 2012. Acceptable forms of identification include a valid passport, birth 

certificate, photocopy of U.S. driver’s license, or State-issued identification. 

16 45 CFR § 162.410(a)(4). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 3 
 

 

 

 

and 913,000 health care organizations (e.g., hospitals) had been assigned 

NPIs.17 

Provider Enrollment Data Maintained in PECOS 

Medicare Administrative Contractors (MACs) enroll providers in 

Medicare using PECOS. In 2002, CMS implemented PECOS as a 

national data repository for Medicare enrollment information about 

physicians, nonphysician practitioners, and provider and supplier 

organizations.18 It is intended to contribute to CMS’s information-based 

strategy on fraud and abuse.19 

The purpose of PECOS is to centralize Medicare provider enrollment.20 

PECOS is used to implement standard enrollment policies and procedures 

throughout the Medicare program.21 Each provider must obtain an NPI 

prior to applying for Medicare enrollment.22 Required provider data for 

initial enrollment in PECOS generally include an individual’s first and last 

names; NPI number; Tax Identification Number (TIN), which may be an 

SSN or Employer Identification Number (EIN); DOB; mailing address 

and practice location address(es); State license information and/or 

certification information (if applicable); provider type; medical specialty; 

medical or professional school/training institution and graduation year; 

adverse legal history; and payment information.23 The provider’s 

telephone number is recommended but not required for enrollment.24 After 

providers are enrolled, they must report any changes to their information 

within 90 calendar days of the changes.25 

Each MAC processes enrollment data for its jurisdiction through PECOS. 

Data extracts from PECOS are then used to populate the Multi-Carrier 

System, which MACs use to process and pay Medicare claims. Many 

17 CMS, NPI Enumeration Statistics by State/Entity Type As of: 5/23/2005 through 

6/30/2012. Accessed at http://www.cms.gov on July 24, 2012. 

18 66 Fed. Reg. 51961 (Oct. 11, 2001). Providers of durable medical equipment, 

prosthetics, orthotics, and supplies were not included in PECOS until 2010. 

19 Ibid. 

20 Ibid. at 51962. 

21 Ibid. 

22 42 CFR § 242.506(b); CMS, PIM, Pub. No. 100-08, ch. 15, § 15.3 (previously found in 

ch. 10, § 4.21). 

23 CGI Federal, PECOS 6.0.0 Required Fields, Doc ID: PECOS-6.0.0-REQ-67792-

v0.10, April 2009. 

24 Ibid. 

25 42 CFR § 424.520(b). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 4 
 

 

 

 

 

other CMS business functions rely on PECOS data. For example, PECOS 

may be used to: 

	 capture information from the Medicare enrollment forms and record 

the associations between the applicant and those that have an 

ownership or control interest in the entity; 

	 make informed enrollment decisions based on a provider’s history and 

any reported exclusions, sanctions, or felonious behavior at the 

provider’s locations or in multiple contractor jurisdictions; 

 ensure that correct payments are being made under Medicare; 

 assist other Federal or State agencies and their contractors; 

 assist individual or organizational research, evaluation, or 

epidemiological projects; 

 support litigation involving CMS; and 

 combat fraud, waste, and abuse in certain health care programs.26 

As of December 2012, PECOS contained records for approximately 

1.2 million individual Medicare providers and 328,488 organizational 

Medicare providers.27 PECOS may not contain records for providers 

enrolled in Medicare prior to 2003 if no enrollment updates (e.g., changes 

of address) have been made. Information for these providers is maintained 

by individual MACs. 

Provider Identification Data Common to the NPPES and 

PECOS Databases 

Although no Federal mandate requires that information in NPPES and 

PECOS be consistent, the databases contain specific fields that collect the 

same information. Data fields that can be used to identify unique 

providers common to both databases include the following: 

 first and last names, 

 NPI number, 

 SSN (conditionally required in NPPES28), 

 Gender (not required in PECOS29), 

 DOB,
 

26 71 Fed. Reg. 60536, 60539 (Oct. 13, 2006). 

27 OIG, analysis of PECOS data, 2013. 

28 SSN is conditionally required in NPPES. It must be included on Web-based
 

applications, but not on paper applications.
 

29 The gender variable is optional rather than required in PECOS. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 5 
 

 

 

 

	 mailing address and practice location address(es) and corresponding 

telephone numbers (telephone numbers are not required in PECOS), 

	 professional license number and issuing State (conditionally required 

in NPPES and PECOS30), and 

	 provider specialty. 

CMS Oversight of Provider Data 

In 2008, an OIG official testified to Congress that CMS could be more 

effective and efficient if it were to prevent the enrollment of unqualified 

and fraudulent providers rather than attempting to recover payments or 

redress fraud or abuse after it occurs.31 However, CMS has faced 

challenges in ensuring the integrity of Medicare provider enrollment. 

Many health care fraud schemes involving misuse of provider information 

have been “committed by criminals who masquerade as Medicare 

providers ... who do not provide legitimate services or products.”32 Such 

criminals have used providers’ stolen identities to bill directly for services 

in the providers’ names or to authorize payment for beneficiary health care 

services. 

CMS Oversight of NPPES Enumeration Data. CMS uses two contractors 

to conduct provider enumeration.33 One contractor maintains NPPES and 

establishes electronic edits (i.e., internal system processes) to ensure that 

the NPI data conform to database requirements at the time a provider 

applies for an NPI. This contractor manages an Internet-based registry 

that makes NPPES data available to the public in accordance with the 

Freedom of Information Act.34 The other contractor enters data from paper 

applications into NPPES and operates a call center for providers who have 

questions or problems. 

CMS Oversight of PECOS Enrollment Data. CMS has developed 

safeguards for processing provider enrollments in PECOS to ensure that 

30 License/certification information is conditionally required in NPPES and PECOS for 

specific types of providers, as applicable by the State in which they practice. For 

example, several States require dietitians to be licensed, others require certification, and a 

few do not require licensure or certification. 

31 Medicare Payments for Claims with Identification Numbers of Dead Doctors, 

110th Cong. 12 (2008) (testimony of Robert A. Vito, Regional Inspector General for 

Evaluation and Inspections). 

32 New Tools for Curbing Waste and Fraud in Medicare and Medicaid, 

112th Cong. 3 (2011) (testimony of Daniel R. Levinson, Inspector General). 

33 See 45 CFR pt. 162.408, subpart D, detailing the provider enumeration process. 

34 72 Fed. Reg. 30011, 30013 (May 30, 2007). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 6 
 

 

 

 

the applicants are eligible to participate in Medicare.35 When providers 

enroll, change ownership, or update information, the PIM requires MACs 

to ensure that they are not on the OIG List of Excluded 

Individuals/Entities or the General Services Administration’s Excluded 

Parties List System.36 The PIM also requires MACs to validate all data 

submitted on applications37 and lists some examples of possible 

verification methods.38 For example, the PIM suggests that MACs check 

the Yellow Pages or conduct a site visit to verify a provider’s practice 

location.39 

In addition, CMS issues a variety of memorandums intended to provide 

supplementary program integrity guidance to MACs. These documents 

include joint signature memorandums (JSM) and technical direction 

letters (TDL). For example, one JSM directed MACs to conduct site visits 

for providers and suppliers that listed UPS stores as their practice 

locations to ensure that providers were not using those locations as 

Medicare practice locations.40 

CMS has undertaken ongoing efforts to update provider information. 

In 2010, CMS implemented efforts to establish records in PECOS for all 

Medicare-enrolled providers.41 More recently, CMS instructed all 

providers and suppliers enrolled prior to March 25, 2011, to revalidate 

their enrollment data. These revalidation applications are subject to new 

screening provisions set forth in section 6401 of the Patient Protection and 

Affordable Care Act (ACA) that require classification of providers as 

35 Chapter 10 of the PIM contained policies and procedures for processing enrollment 

applications during the time of our review. This information was recently moved to 

ch. 15. 

36 CMS, PIM, Pub. No. 100-08, ch. 10, § 1.3. The General Services Administration’s 

Excluded Parties List System migrated to the System for Award Management in 

July 2012. 

37 CMS, PIM, Pub. No. 100-08, ch. 10, § 1.3. 

38 CMS, PIM, Pub. No. 100-08, ch. 10, § 5.2. 

39 CMS, PIM, Pub. No. 100-08, ch. 10, § 5.2.B. 

40 CMS, Transmittal 331, Change Request 6822. Onsite Verifications for 

Providers/Suppliers Located at a UPS Store (CONFIDENTIAL), March 26, 2010. Some 

memorandums are issued confidentially and are not available to the public online. 

41 CMS, Transmittal 712, Change Request 6842. Medicare Claims Processing Manual, 

Pub. No. 100-20, “One-Time Mailing of Solicitation Letter To All Physicians and 

Non-Physician Practitioners Who Are Currently Enrolled in Medicare But Who Do Not 

Have An Enrollment Record In the Provider Enrollment, Chain and Ownership System 

(PECOS).” 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 7 
 

 

 

limited risk, moderate risk, or high risk.42 During the first phase of the 

revalidation effort, 89,000 providers and suppliers that were actively 

enrolled in Medicare but not enrolled in PECOS were asked to revalidate 

their enrollment data.43 If providers do not revalidate their data within 

60 days of a request, CMS may deactivate their billing privileges.44 

Importance of Accuracy, Completeness, and Consistency of 

Provider Identification Data 

The accuracy and completeness of NPPES data are important for 

identifying the locations of providers across all health insurance programs. 

Public and private insurers need reliable information to identify 

geographic trends in provider fraud, waste, and abuse and to efficiently 

locate individual providers. Public health officials also need reliable 

provider information to locate providers during natural disasters or other 

emergencies. Finally, the health care industry relies on NPPES registry 

data to link legacy provider identifiers with NPIs, and health care 

providers rely on NPPES registry data to find the NPIs of other health care 

providers to submit certain health care claims.45 

The accuracy and completeness of PECOS data are important for many 

critical CMS business functions, including the ability to make informed 

provider enrollment decisions; pay claims accurately; and combat fraud, 

waste, and abuse in Medicare and other health care programs. For 

example, CMS may use an edit to automatically check provider specialties 

listed in PECOS to determine whether providers were eligible to order 

beneficiary supplies and services. 

Federal requirements do not mandate that information in NPPES and 

PECOS be consistent. However, inconsistencies in provider data can 

complicate efforts to locate providers. Inconsistencies in data may also 

hinder joint efforts among Federal, State, local, and nongovernmental 

entities to fight health care fraud, waste, and abuse. 

Previous OIG Work 

Prior to the creation of NPPES and the implementation of PECOS, we 

issued many reports highlighting problems with CMS’s oversight of 

42 Patient Protection and Affordable Care Act, P.L. 111-148 § 6401, Social Security Act, 

§ 1866(j), 42 U.S.C. § 1395cc(j); 76 Fed. Reg. 5862 (Feb. 2, 2011). The new risk-based 

screening provisions and the success of the revalidation efforts are outside the scope of 

this report. 

43 CMS, Revalidation of Medicare Provider Enrollment National Provider Call, 

transcript, October 27, 2011. Accessed at www.cms.gov on October 2, 2012. 

44 42 CFR § 424.515(a)(2). CMS, PIM, Pub. No. 100-08, ch. 15, § 15.29; Sample 

Revalidation Letter. Accessed at www.cms.gov on October 2, 2012. 

45 72 Fed. Reg. 30011, 30013 (May 30, 2007). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 8 
 

 

 

 

 

 

 

UPINs, a type of legacy identifier for providers. Our studies reported 

inaccuracies and inconsistencies in UPIN data maintained by CMS.46, 47, 48 

We also reported questionable and fraudulent Medicare claims associated 

with the use of invalid and inactive UPINs, the use of UPINs that 

belonged to deceased physicians, the improper use of surrogate UPINs, 

and the use of legitimate UPINs that were associated with an unusually 

large number of claims.49, 50, 51 In congressional testimony provided in 

2008, CMS stated that conversion from the use of UPINs to NPIs had 

strengthened CMS’s ability to combat fraud and abuse schemes that rely 

on invalid provider identifiers.52 However, the Inspector General 

cautioned Congress in 2009 that the vulnerabilities that had affected 

UPINs may affect the integrity of the NPI system, then recently 

launched.53 

Although CMS described PECOS as an important national tracking 

mechanism to identify illegal Medicare activities, we identified problems 

early in its implementation.54 Our first examination of PECOS revealed 

that contractor staff responsible for processing Medicare applications 

misunderstood policy and had problems accessing the system.55 In a 

2009 study of the accuracy of Medicare provider remuneration 

information, OIG staff were unable to reach many sampled providers 

using the contact information listed in PECOS, determined that the contact 

information listed in NPPES often differed from that in PECOS, and found 

46 OIG, Accuracy of Unique Physician Identification Number Data (OEI-07-98-00410), 

October 1999. 

47 OIG, Inaccuracies in the Unique Physician Identification Number Registry: Incorrect 

Addresses for Mental Health Service Providers (OEI-03-99-00131), May 2002. 

48 OIG, Accuracy of Unique Physician/Practitioner Identification Number Registry Data 

(OEI-03-01-00380), July 2003. 

49 OIG, Medical Equipment and Supply Claims With Invalid or Inactive Physician 

Numbers (OEI-03-01-00110), November 2001. 

50 OIG, Durable Medical Equipment Ordered With Surrogate Physician Identification 

Numbers (OEI-03-01-00270), September 2002. 

51 OIG, Invalid Prescriber Identifiers on Medicare Part D Drug Claims 

(OEI-03-09-00140), June 2010. 

52 Medicare Payments for Claims with Identification Numbers of Dead Doctors, 

110th Cong. 12 (2008) (testimony of Herb B. Kuhn, CMS Deputy Administrator). 

53 Combating Fraud, Waste, and Abuse in Medicare and Medicaid, 111th Cong. 5 (2009) 

(testimony of Daniel R. Levinson, Inspector General). 

54 66 Fed. Reg. 51961 (Oct. 11, 2001). 

55 OIG, Provider Enrollment, Chain and Ownership System: Early Implementation 

Challenges (OEI-07-05-00100), April 2007. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 9 
 

 

 

 

 

that about 20 percent of sampled providers could not be reached with the 

contact information from either database.56 

METHODOLOGY 

Scope 

This study assessed the records of individual health care providers in 

NPPES and PECOS but did not assess records for organization health care 

providers or suppliers. In January 2010, NPPES contained 

2,313,183 records for individual providers, and in August 2010, PECOS 

contained 1,211,520,57 with 987,266 records appearing in both databases.58 

We reviewed records for individuals listed in both NPPES and PECOS. 

(Our review did not include individuals who had both enrolled in 

Medicare prior to November 2003 and had not updated their enrollment 

records using PECOS by the time of our review.) Provisions for provider 

data integrity that went into effect after our review, such as CMS’s 

implementation of the ACA requirement for risk-based screening of 

providers,59 were excluded from our analysis. Additionally, this study did 

not examine the accuracy of Medicare claims coding, data processing, or 

payments. 

Data Collection and Analysis 

We obtained from CMS all records of the most recent updates of NPPES 

and PECOS at the time of our review. NPPES contained data from 

January 2010, and PECOS contained data from August 2010.60 We 

analyzed the following selected variables for individual providers in both 

databases: 

 NPI, 

 SSN (conditionally required in NPPES),61 

56 OIG, Reassignment of Medicare Benefits (OEI-07-08-00180), October 2009. 

57 The number of individual records in PECOS is based on the presence of 

1,211,520 unique PECOS Associate Control Identifiers categorized as “individual” (not 

“organizational”) in PECOS. 

58 The number of records located in both NPPES and PECOS is based on a match of 

NPIs. 

59 76 Fed. Reg. 5862 (Feb. 2, 2011). 

60 At the time of our review, some of the variables that we requested for analysis were not 

available in the PECOS Global Extract routinely used for analysis. The contractor that 

maintained the database required a significant amount of time to create a separate 

interface to provide the requested data. 

61 In NPPES, SSN must be included on Web-based applications, but not on paper 

applications. In PECOS, the TIN field may include an SSN or EIN for each provider. 

For ease of reading, we refer to this variable as SSN. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 10 
 

 

 

	 first name, 

	 last name, 

	 gender (not required in PECOS), 

	 DOB, 

	 provider specialty/credential,62 

	 State of professional licensure and license number (conditionally 

required in NPPES and PECOS), 

	 telephone number (not required in PECOS), 

	 mailing address ZIP Code, and 

	 practice address ZIP Code. 

Not all of the variables we analyzed are required in order for providers to 

obtain an NPI or to enroll in Medicare. The SSN variable is conditionally 

required in NPPES; it is required for Web-based applications but not for 

paper applications. Provider license information is conditionally required 

in both NPPES and PECOS for specific types of providers.63 Gender and 

telephone number are not required variables in PECOS. We considered 

this when presenting information about the completeness and consistency 

of data in the “Findings” section of this report. 

Accuracy of the Data in NPPES and PECOS. We selected a simple 

random sample of 170 providers from those 987,266 individual providers 

with records in both NPPES and PECOS. We created an online survey 

that listed the NPPES and PECOS data for the selected variables for each 

provider. The survey asked providers to verify whether the data for each 

variable were accurate. The data included provider variables to identify 

individuals (i.e., name, SSN, DOB, place of birth, and license and 

credential information) and address information for mailing and practice 

62 A variable called “physician specialty code” denotes 77 physician and nonphysician 

specialties in PECOS, while a variable called “taxonomy code” indicates 644 individual 

provider specialties in NPPES. An optional text field in each database called “credential” 

allows providers to indicate a more general provider type, such as M.D. for medical 

doctor. We used the required specialty type fields in each database for our analysis of 

completeness. We used the optional credential text field in each database for our analysis 

of accuracy and consistency, as the two databases had very different coding schemes for 

specialty type. 

63 Neither NPPES nor PECOS indicate which types of providers are required to submit 

license information. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 11 
 

 

 

 

location(s).64 If the data were inaccurate, the survey asked the provider 

whether these data were: 

	 partially inaccurate (e.g., included a misspelling or transposed 

numbers); 

	 correct at one time, but no longer current; or 

	 never correct.65 

Data that providers indicated were not correct for a particular variable 

were reported as “inaccurate” in the findings. 

Appendix A provides details regarding our attempts to contact providers to 

participate in the survey. After 4 months, 126 of 170 providers completed 

the survey—a response rate of 74 percent. We produced population 

estimates based solely on responses from these 126 providers without 

adjusting for nonresponse. Therefore, all estimates based on the provider 

survey project to an estimated total of only 731,738 provider records 

rather than 987,266. Appendix B provides point estimates and 95-percent 

confidence intervals for all survey estimates presented in the report. 

Completeness of the Data in NPPES and PECOS. We analyzed each 

database to determine the extent to which selected provider variables were 

populated. We reviewed all 2,313,183 individual records in NPPES and 

the 1,021,652 individual records in PECOS indicating that the enrollee 

was a health care practitioner.66 NPPES contained one record per 

provider, listing all variables. However, PECOS is substantially more 

complicated; records for a given provider appear across multiple 

“relational tables,” each with different variables and different numbers of 

records per table. (For more detail on how PECOS is structured, see 

Appendix A.) Therefore, we identified two types of incomplete records 

for PECOS: records that were missing from the relevant table and records 

that were present in the relevant table but did not contain values for a 

particular variable. The relational tables featuring practice location 

64 Our survey did not ask providers to verify telephone numbers or gender, which are not 

required variables in PECOS. The survey did ask providers to verify conditionally 

required variables, such as professional license information. 

65 We sought to determine the accuracy of provider data, but not to correct inaccurate 

information. Within the survey, we notified providers that they are responsible for 

updating inaccurate data, and we listed the instructions for doing so. 

66 Of the 1,211,520 individual PECOS records, 1,021,652 were associated with health 

care practitioners. The remaining individuals were authorized or delegated officials of 

provider and supplier organizations or worked on behalf of providers or suppliers. Such 

individuals are not providers and are not required to have an NPI; therefore, we excluded 

them from our analysis of the completeness of PECOS data. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 12 
 

 

 

 

 

information did not contain all records for individual providers; some 

individual provider data were stored in group enrollment records. 

For this analysis, we generally excluded variables that were not required, 

and attempted to include variables that were conditionally required. We 

excluded gender and telephone number from the PECOS analysis because 

they are not required on the Medicare enrollment application. We 

included SSN in the NPPES analysis because it is required for Web-based 

applications. We included State license information in our analyses of 

both databases because it is required for certain provider specialty types. 

However, we found no indication NPPES of whether applications were 

submitted via Web or paper, and no indication in either database of which 

provider specialty types were required to submit license information. As 

such, we were unable to determine whether null values were appropriate 

for SSNs in NPPES or license information in either database. Therefore, 

the totals for “incomplete” records in the findings include only missing 

provider records and those records that did not contain values for a 

particular variable when undoubtedly required. 

Consistency of the Data in NPPES and PECOS. We compared the 

selected data fields in each database to determine whether the data were 

consistent in both. This matching process used variables that were 

required across both databases as well as variables that were conditionally 

required and/or not required but were populated across both databases 

(e.g., text field for provider credentials, if populated in both). Where there 

were multiple values for variables in either database, we searched for at 

least one match between the two databases. For example, NPPES 

contained up to 15 licenses per provider and PECOS contained up to 

19 licenses per provider; we looked for any match and considered the 

record consistent if we found one. In determining whether there was a 

data match, we considered only the content of data fields, not their 

formatting. For example, we standardized the text for the credentials 

variable so that capitalization, spacing, and punctuation did not influence 

the match (e.g., “R.N.” and “r n” would match).67 Rather than attempt to 

standardize street addresses in their entirety, we used only the ZIP Code 

portion to match addresses to reduce the detection of false mismatches. 

The exclusive use of ZIP Codes can underestimate the precise number of 

67 We standardized only the most common credentials, including clinical social worker 

(CSW, LCSW, LICSW, MSW, LMSW); doctor of chiropractic (DC); doctor of dental 

science (DDS); doctor of optometry (OD); doctor of osteopathy (DO); doctor of 

philosophy (PhD); doctor of podiatric medicine (DPM); doctor of psychiatry (PsyD); 

licensed dietician (LD); medical doctor (MD); nurse practitioner (NP, APN, APRN, 

WHNP, ARNP, FNP, CFNP); occupational therapist (OT, OTR, OTRL); physical 

therapist (MSPT, RPT, PT, MPT, DPT); and physician’s assistant (PA, PA-C). 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 13 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 14 

 

mismatches. Appendix A includes more information regarding the 

process of matching addresses between NPPES and PECOS. 

We reported fields that did not contain the same information for a 

particular variable across both databases as “inconsistent” in the findings. 

It is possible that a provider could have updated the information in NPPES 

prior to our collection of PECOS data, resulting in a mismatch between 

the two databases. To estimate this effect, we reviewed the PECOS record 

history to determine how many records with mismatches could be 

explained by record updates between January and August 2010. 

CMS Oversight of NPPES and PECOS. CMS uses contractors to ensure 

the integrity of provider data. We obtained and reviewed guidance 

documents that CMS provided to contractors in processing the NPPES and 

PECOS data. We collected and reviewed information regarding CMS’s 

oversight of contractors; current program integrity requirements; and 

safeguards used to implement those requirements (e.g., electronic system 

edits and other methods to ensure the accuracy, completeness, and 

consistency of the NPPES and PECOS data). We compared documented 

requirements with the program integrity safeguards that contractors used 

to protect the integrity of provider data. 

We interviewed CMS contractor staff with oversight responsibilities for 

NPPES and PECOS at the time of our review. One contractor managed 

both databases,68 and a separate contractor processed NPI enumeration. 

The interviews enabled the study team to gather indepth information about 

contractor operations following staff responses to more general questions 

regarding data accuracy, completeness, and consistency. We identified 

interview responses that described vulnerabilities for the integrity of 

provider data. 

To assess the program integrity safeguards in place with regard to the 

accuracy and completeness of the PECOS data, we conducted structured 

interviews with staff from 11 organizations (generally MACs)69 that 

managed Medicare provider enrollment at the time of our review. These 

interviews focused on the oversight and maintenance of the PECOS data. 

We analyzed interview responses to determine whether the contractors 

verified provider enrollment data in accordance with the PIM and 

68 After we interviewed the contractors in 2010, CMS awarded the contract for managing 

the NPPES system to a different entity. 

69 At the time of our review, legacy carriers in six Part A/Part B MAC jurisdictions were 

still processing provider enrollment because the MAC contract awards were under protest 

and had not been finalized. For the purposes of this report, the contractors responsible 

for enrolling providers into PECOS will be referred to as MACs. 
 

supplementary guidance. See List 1 for CMS’s suggested verification 

methods for PECOS data. 

List 1: Suggested Verification Methods for PECOS Data 

Adverse Legal History Practice Location 

Check court records Compare address to Internet sources 

Check records of the Internal Revenue Service (IRS) Contact the city or county for professional/business 

 license, certification, and/or registration Credentials Perform a site visit 

Check information/Web sites of State boards or

 credentialing organizations Professional License 

Require supporting documentation of license from each 

Exclusion Status State where provider practices Check the OIG List of Excluded Providers and Entities 

Check the General Services Administration (GSA) SSN 

Excluded Parties List System Confirm provider tax identification number with an 

 approved IRS form Legitimacy of Business 

Compare telephone number to telephone listing(s) Telephone Numbers 

Contact the city or county for professional/business Call the number to verify connection or ownership 

 license, certification, and/or registration Compare telephone number to Internet sources 

Compare telephone number to telephone listing(s) Mailing Address 

Confirm that it is not a billing agency Request for Data Change 

Call telephone number to confirm applicant is reached Compare signature for request to change a special 

Confirm that it is not a management service organization payments address 

Confirm that it is not a chain’s corporate office Compare signature for request to change a

Confirm that it is not an applicant’s representative provider’s electronic funds transfer authorization 

 agreement NPI Compare signature for request to change practice Require supporting documentation from NPPES location address 

Compare signature for request for reactivation or 

revalidation 

Compare signature for requests to change mailing 

address 

Source: OIG analysis of CMS, PIM, Pub. No. 100-08, ch. 10. 

Finally, we interviewed CMS staff knowledgeable about NPPES and 

PECOS regarding safeguards pertaining to data verification. Staff 

discussed program integrity activities related to provider data in NPPES 

and PECOS, as well as vulnerabilities and potential improvements for 

each. 

Limitations 

Although we collected information about program integrity safeguards for 

provider data from CMS and contractor staff, we did not determine the 

extent to which each safeguard worked to prevent or correct inaccurate, 

incomplete, and/or inconsistent data. The sampling scheme for our 

provider survey did not enable us to determine the extent to which 

individual MACs or the application submission method (paper or 

electronic) influenced the accuracy, completeness, or consistency of 

provider data. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 15 
 

Standards 

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 16 
 

 

FINDINGS 

In NPPES, 48 percent of records contained inaccurate 

data; almost all required data were complete 

Most currently practicing health care providers have records in NPPES. 

However, the provider information in NPPES was inaccurate for almost 

half of providers and while 91 percent of records contained values for all 

variables, 9 percent of records did not. We were unable to determine if 

most null values were appropriate, because they were associated with 

conditionally required variables and NPPES did not indicate whether 

applicable conditions were met. 

Forty-eight percent of NPPES records were inaccurate, 

generally because address data were inaccurate 

Forty-eight percent of NPPES records for Medicare-enrolled providers 

were inaccurate. Table 1 summarizes the inaccuracies identified by the 

provider survey. Appendix B provides confidence intervals for each of the 

point estimates. 

Table 1: Inaccurate Provider Data in NPPES 

Provider Variable 

NPPES Inaccurate Records 

(Percentage) 

N=731,738 

Mailing address 34.1% 

Practice address 33.3% 

License (primary)* 4.0% 

Credentials** 1.6% 

Date of birth 1.6% 

License (secondary)* 1.6% 

First name 0.0% 

Last name 0.0% 

NPI 0.0% 

SSN (last 4 digits)* 0.0%

 Gross 76.2%

 (Overlapping) (27.8%) 

Any variable 48.4% 

Note: The survey did not ask providers to verify telephone number or gender. 

* Provider license and SSN variables are conditionally required in NPPES. 

** The credential text variable is not required in NPPES. 

Source: OIG analysis of provider survey data, 2011. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 17 
 

 

 

Responses from providers indicated that address information was the most 

common inaccuracy. When we asked providers about the accuracy of 

mailing addresses and practice address information, 44 percent identified 

at least one inaccurate NPPES address. Within the 126 survey responses, 

providers identified 96 data elements (i.e., provider variables shown in 

Table 1) as inaccurate; 51 (53 percent) were outdated, 18 (19 percent) 

were partially inaccurate (e.g., contained typographical errors), and 

27 (28 percent) had never been correct. 

Virtually all required variables in NPPES records were 

complete 

Although 2,098,784 provider records in NPPES contained all necessary 

data, we found that 214,399 provider records contained null values for one 

or more variables that are essential for provider identification. 

Specifically, four records did not contain required provider specialty data 

and two records did not contain the required telephone number. However, 

all remaining null values were associated with two conditionally required 

variables: license number and SSN. A license number is required only for 

certain provider specialties; however, NPPES does not indicate which 

records should include license numbers. Similarly, an SSN is required 

only for web-based applications, but NPPES does not indicate which 

records were from web-based applications. We were unable to determine 

the appropriateness of most null values because NPPES lacks indicators 

regarding which records required license number and SSN data. 

In PECOS, 58 percent of records contained inaccurate 

data and almost 4 percent were incomplete 

CMS relies on the verification of PECOS data to ensure Medicare 

provider integrity. However, the provider information in PECOS was 

often inaccurate and, at times, incomplete. 

Fifty-eight percent of PECOS records were inaccurate, 

generally because address data were inaccurate 

Fifty-eight percent of PECOS records for Medicare-enrolled providers 

were inaccurate. Table 2 summarizes the inaccuracies identified by the 

provider survey. Appendix B provides confidence intervals for each of the 

point estimates. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 18 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 19 

 

 

Table 2: Inaccurate Provider Data in PECOS 

Provider Variable 

PECOS Inaccurate Records 

(Percentage) 

N=731,738 

Mailing address (primary) 46.8% 

Practice address (primary) 8.7% 

Mailing address (secondary) 7.9% 

License (primary)* 7.1% 

Credentials** 4.8% 

License (secondary)* 3.2% 

Last name 2.4% 

Practice address (secondary) 2.4% 

DOB 0.8% 

First name 0.0% 

NPI 0.0% 

SSN (last 4 digits) 0.0%

 Gross 84.1%

 (Overlapping) (26.2%) 

Any variable 57.9% 

Note: The survey did not ask providers to verify telephone number or gender. 

* The provider license variable is conditionally required in PECOS. 

**The credential text variable is not required in PECOS. 

Source: OIG analysis of provider survey data, 2011. 

Responses from providers indicated that address information was often 

inaccurate. When we asked providers about the accuracy of mailing 

addresses and practice address information, 52 percent identified at least 

one inaccurate PECOS address. Within the 126 survey responses, 

providers identified 106 data elements (i.e., provider variables shown in 

Table 3) as inaccurate; 60 (57 percent) were outdated, 25 (24 percent) 

were partially inaccurate (e.g., contained typographical errors), and 

21 (20 percent) had never been correct.70 

Almost 4 percent of PECOS records were missing required 

data 

We found that 3.7 percent provider records in PECOS were missing values 

in one or more required variables that are important for provider 

identification. Most of the incomplete data can be attributed to the fact 

that records were missing from the relevant relational tables in PECOS 

70 Percentages have been rounded. 
 

 

 

 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 20 

 

(i.e., the expected record did not exist) rather than to null values (i.e., the 

data fields contained no values). The information most often incomplete 

in PECOS was NPI (3 percent). Almost all of the records that were 

missing NPIs were “active” and therefore should have contained an NPI.71 

We could not determine how many records contained incomplete practice 

location addresses because the PECOS table that lists such information 

associates the practice location addresses with the entities to which 

providers reassigned their benefits. As a result, practice location addresses 

are rarely associated with individual providers. As in NPPES, license 

number is required only for certain provider types; however, PECOS does 

not indicate which records should include license numbers. Therefore, we 

excluded the 1.2 percent of records missing license number data from our 

calculation of the total percentage of incomplete records. The gender 

variable was incomplete for approximately 11 percent of records, and the 

telephone number variable was incomplete for approximately 4 percent. 

However, those variables are not required to be populated in PECOS and 

were therefore excluded from our calculation of the total percentage of 

incomplete records. Table 3 describes the extent to which individual 

provider variables were incomplete in PECOS. 

71 Providers who had enrolled through PECOS before NPIs were required would not have 

an NPI on record; CMS should have deactivated these providers’ records if they had not 

submitted claims in more than a year. We found that less than 1 percent of the records 

that were missing NPIs (30 of 32,759) had been deactivated. 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 21 

 

 

 

 

 

 

Table 3: Incomplete Provider Data in PECOS 

Provider Variable Records in 

Database 

Missing 

Records 

Null 

Data Field 

Incomplete 

Records 

N=1,021,652 

(Number) 

Incomplete Records 

N=1,021,652 

(Percentage) 

NPI 988,893 32,759 0 32,759 3.2% 

Mailing address 1,016,075 5,577 37 5,614 0.5% 

Provider specialty 1,016,843 4,809 0 4,809 0.5% 

SSN 1,021,427 225 0 225 0.0% 

DOB 1,021,652 0 0 0 0.0% 

Full name 1,021,652 0 0 0 0.0% 

License number* 1,009,470 12,182 0 * * 

Gender** 1,021,652 0 111,546   

Telephone number**  1,016,075 5,577 38,875 ** ** 

Practice address*** 203,637 818,015 17 *** ***

 Gross 43,407 4.2%

 (Overlapping) 5,964 0.6% 

Any variable 37,443 3.7% 

*We excluded license number from our calculation of the total because it is conditionally required and PECOS data did not indicate which 

provider types were required to submit licensure information. 

**We excluded gender and telephone number from our calculation of the total because they are not required fields in PECOS. 

***The provider identification number used to link the other variables was not used to link practice address; we excluded practice address from 

our calculation of the total to avoid misrepresenting the number of missing records. See Appendix A for more information. 

Source: OIG analysis of NPPES and PECOS data, 2011. 

Provider data were inconsistent between NPPES and 

PECOS for 97 percent of records 

Of the 987,266 records for providers listed in both NPPES and PECOS, 

961,634 contained at least 1 variable that did not match. Only 

11,682 records (1.2 percent of the mismatches) could potentially be 

attributed to the timelag between updates of the databases.72 Only 

3 percent of records contained information that matched across all selected 

provider variables. More than half of the records were inconsistent 

between the databases for provider contact information, such as practice 

location address (89 percent), telephone number (59 percent), and mailing 

address (51 percent). Address matches are based only on ZIP Codes; this 

methodology may overestimate the consistency between addresses in 

NPPES and PECOS. For required variables, such as practice location 

72 Information updates were submitted in PECOS between January and August 2010 for 

1.2 percent of the records with inconsistent data. We did not determine whether the 

information that was entered as updates was the inconsistent information. 
 

 

 

 

address, some of the inconsistencies are attributable to missing or null 

values in one database or the other. For nonrequired variables, such as 

telephone number, inconsistencies are attributable only to populated 

values in both databases. Table 4 lists the extent to which variables were 

inconsistent between the databases. 

Table 4: Inconsistent Data Between NPPES and PECOS 

Provider Variable 

Mismatched Data 

Records 

(Number) 

N=987,266 

Mismatched Data 

Records 

(Percentage) 

N=987,266 

Practice location address* 874,401 88.6% 

Telephone number 582,147 59.0% 

Mailing address* 500,865 50.7% 

License number 415,799 42.1% 

Credential 91,851 9.3% 

Full name 50,921 5.2% 

DOB 21,199 2.2% 

Gender 12,256 1.2% 

SSN 376 0% 

NPI 0 0%

 Gross 2,549,815 258.2%**

 (Overlapping) (1,588,181) (160.8)% 

Any variable 961,634 97.4% 

Note: Values that were null in both NPPES and PECOS for each variable are considered matches for this 

analysis. Variables that were optional in one database or the other (telephone number, credential, and 

gender) or conditionally required (license) were included in this analysis only if populated in both 

databases. 

*Matches for practice location and mailing addresses are for ZIP Codes only. See Appendix A for detailed 

methodology regarding the analysis of addresses. 

** Figures do not sum to the total because of rounding. 

Source: OIG analysis of NPPES and PECOS data, 2011. 

CMS did not verify most provider information in

NPPES or PECOS 

CMS had processes in place to verify the accuracy of provider data in 

NPPES and PECOS; however, the manner in which CMS implemented 

these processes impeded efforts to ensure that the databases contained 

accurate information. Contractor staff reported that CMS required 

verification for only one provider variable in NPPES. CMS instructed 

MACs to verify only four provider data variables in PECOS (SSN, NPI, 

State licensure, and exclusion status) and has not issued detailed guidance 

for verifying all provider data. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 22 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 23 

CMS required little verification of NPPES enumeration data 

The SSN was the only provider data element verified within NPPES, a 

possible explanation for why SSNs were the most complete and consistent 

variable in both databases. However, no verification occurred for any of 

the other provider data elements. According to NPPES contractor staff, 

each online applicant’s SSN was verified through a CMS data-sharing 

agreement with the Social Security Administration. Staff stated that if a 

provider submitted a paper application and chose not to provide an SSN, 

they required two other forms of identification, one of which had to be 

government issued. Staff also noted that although the NPPES software 

standardized the street names in the system to those used by the U.S. 

Postal Service, the software did not verify that the provider maintained a 

practice at the location. 

CMS staff reported concentrating its program integrity efforts solely on 

PECOS because NPPES is not used exclusively for Federal health care 

programs. However, most individual providers that are registered in 

NPPES also enroll in Medicare.73 CMS staff reported that NPPES data, 

including NPI, first and last name, SSN, and DOB, were cross-referenced 

with PECOS data during the Medicare enrollment process, serving as a 

verification check for NPPES. CMS staff required providers to correct 

any inaccurate information in NPPES that resulted in inconsistencies with 

PECOS before they could proceed with Medicare enrollment. In response 

to questions about the implications of missing or inaccurate information in 

NPPES, CMS staff indicated that the onus is on providers to keep their 

NPPES data correct and up to date. However, CMS is ultimately 

responsible for ensuring the accuracy of the database. 

73 Although no precise measure exists, the percentage of providers who choose not to 

participate in Medicare may be less than 1 percent. William Buczko, “Provider Opt-Out 

Under Medicare Private Contracting,” Health Care Financing Review, 

Winter 2004–2005, vol. 26, no. 2. OEI, Lack of Data Regarding Physicians Opting Out 

of Medicare (OEI 07-11-00340), January 26, 2012. 
 

 

 

 

 

CMS directed MACs to suspend many of the verifications 

required by the PIM for Medicare provider enrollment in 

PECOS 

To expedite the provider enrollment process, CMS sent a series of 

memorandums74 to instruct MACs to verify only the following information 

during the initial or revalidation PECOS application process: 

	 the provider’s SSN and NPI, 

	 the applicable State licensure or educational requirements for the 

provider, and 

	 the provider’s status of not being excluded from participation in the 

program. 

This supplementary guidance effectively waived the PIM requirement to 

verify all application information, such as telephone numbers and 

addresses. During this time, CMS was actively encouraging “legacy 

providers”—providers that had enrolled in Medicare before PECOS was 

put into place—to reenroll through PECOS.75 As a result, CMS’s 

instructions to waive the PIM requirement affected not only new 

enrollments but also reenrollments. 

CMS guidance lacks specificity regarding mechanisms of 

verification for PECOS enrollment data 

The PIM directs MACs to verify enrollment data using the most 

cost-effective method available and suggests some options.76 The broad 

guidance provides flexibility in choosing how to verify enrollment 

application information. However, MACs’ use of inconsistent 

mechanisms of verification can contribute to inaccurate, incomplete, and 

inconsistent data. Appendix C lists the safeguards that MACs reported 

74 CMS, Expedited Processing of Physician and Non-Physician Practitioner Initial 

Enrollment Applications (CONFIDENTIAL), JSM/TDL-10157, February 24, 2010; 

extended by CMS, Extension of Joint Signature Memorandums/Technical Direction 

Letters (JSM/TDLs) Which Expires December 31, 2010 – Confidential, JSM/TDL 11087, 

December 17, 2010, and CMS, Extension of Joint Signature Memorandums/Technical 

Direction Letters (JSM/TDL) 09184, 10175, 08191, and 0822, TDL 12171, January 18, 

2012. The JSM instruction remained in effect at the time of report publication, although 

we use past tense for ease of reading the report. Also for ease of reading, we refer to 

these collective memorandums as “supplemental guidance.” The memorandums are not 

available online to the public because they were issued confidentially. We were unaware 

of the existence of these memorandums until the contractor made them available to us. 

75 CMS, Transmittal 712, Change Request 6842. Medicare Claims Processing Manual, 

Pub. No. 100-20, “One-Time Mailing of Solicitation Letter To All Physicians and 

Non-Physician Practitioners Who Are Currently Enrolled in Medicare But Who Do Not 

Have An Enrollment Record In the Provider Enrollment, Chain and Ownership System 

(PECOS).” 

76 CMS, PIM, Pub. No. 100-08, ch. 10, § 5.2. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 24 
 

 

 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 25 

using during the provider enrollment process at the time of our review and 

distinguishes verifications required by the PIM and reiterated in 

supplemental guidance from those required by the PIM but waived by 

supplemental guidance. 

MACs generally reported performing the activities suggested by CMS to 

verify the variables required by the PIM and reiterated in supplemental 

guidance. However, 4 of the 11 MACs did not require applicants to 

submit documentation from NPPES to verify providers’ NPIs, 2 did not 

require applicants to submit approved IRS forms to confirm their Tax 

Identification Numbers/SSNs, and 3 did not require applicants to submit 

documentation of professional licensure. 

MACs reportedly verified some of the information required by the PIM 

but waived by supplemental guidance; however, their methods suggested 

vulnerabilities in the enrollment process. For example, all of the MACs 

reported verifying that when an application listed a billing agency, the 

provider’s mailing address did not match the billing agency address. 

However, four MACs did not verify that the mailing address was not that 

of a management services organization, a chain’s corporate office, or the 

applicant’s representative, as required by the PIM. Seven MACs did not 

verify that practice locations were legitimate businesses, and four did not 

call telephone numbers to confirm that they were legitimate. Additionally, 

when a provider’s signature on a request for change (e.g., change of 

contact or payment information) did not match the signature from the 

original enrollment application, eight MACs required a driver’s license or 

passport to verify the signature on the request for change. However, one 

MAC required only an attestation on the enrolled provider’s letterhead as 

proof of identity.77 

Ineffective safeguards can contribute to inaccurate, 

incomplete, and inconsistent NPPES and PECOS data 

The lack of sophisticated electronic edits may explain why almost half of 

inaccurate NPPES data and 43 percent78 of inaccurate PECOS data were 

never accurate or only partially accurate. The staff from the electronic 

database contractor for NPPES and PECOS reported that a variety of 

external databases exist to verify the identity of new applicants, check for 

previously deactivated or excluded providers, and check for adverse legal 

77 CMS, PIM, Pub. 100-08, ch. 10 § 5.7(A)(1). In cases in which a provider requests to 

change its practice location address, the MAC compares the signature on the change 

request to the same person’s signature on file to ensure that the signatures match. If there 

is a discrepancy, the MAC must request additional information, such as a photocopy of a 

current passport or driver’s license. 

78 Total has been rounded. 
 

 

 

 

 

 

 

 

 

 

actions. However, they stated that NPPES and PECOS were not 

technologically integrated with many of these sources. CMS staff 

reported that they are implementing a new automated provider-screening 

tool for PECOS that references certain provider information against 

third-party sources such as State licensing boards and identity 

management databases.79 

Other oversight issues may explain why more than half of inaccurate 

NPPES data were outdated. Contractor staff reported that NPPES uses an 

algorithm to flag newly submitted applications that contain some level of 

provider information already in the database80 and stated that when such 

applications are flagged, a contractor staff member telephones the 

applicant to reach a resolution. However, staff reported difficulties when 

trying to reach providers and reported that they do not deactivate a 

provider’s NPI because of outdated contact information. 

NPPES contractor staff also reported difficulties when they processed 

monthly updates from the Social Security Administration’s Death Master 

Record File to deactivate NPIs belonging to deceased providers. NPPES 

staff reported sending letters to the providers’ NPPES mailing addresses to 

confirm that providers were deceased and called providers who sent no 

response to the letter within 20 days. If they received no response after 

30 days, staff deactivated the NPIs. However, if providers responded, 

stating that a mistake had occurred, their NPIs remained active. 

Consequently, if a fraudulent provider had stolen a deceased provider’s 

identity and indicated to NPPES staff that a mistake had occurred, the 

fraudulent provider would be able to continue billing as the deceased 

provider. 

Another explanation for errors is that, according to MAC staff, 

approximately 80 percent of enrollment applications were still processed 

on paper and transcribed into the PECOS Web interface.81 When staff 

transcribe the data from paper forms into PECOS, a risk of transcription 

errors arises. CMS estimated that fewer than 5 percent of NPPES 

applications are submitted via paper; however, there is a risk of 

transcription errors for those records as well. 

79 CMS originally expected that the automated provider-screening tool would be fully 

implemented in mid-2012. CMS, “Information on the Centers for Medicare & Medicaid 

Services (CMS) Fraud Prevention: Automated Provider Screening and National Site 

Visit Initiatives,” MLN Matters Number SE1211, effective July 1, 2012. As of 

January 2013, CMS expected to fully implement the tool by the end of 2013. 

80 A duplicate record may indicate an error or an attempt to fraudulently obtain an NPI. 

81 The responses from MACs indicated that an average of 81 percent of applications were 

submitted in paper form, with a range between 66 and 97 percent. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 26 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 27 

Finally, although regulations require providers to update their NPPES and 

PECOS data soon after changes occur,82 CMS reportedly enforces this 

requirement only for PECOS through revalidation efforts generally 

scheduled every 5 years. CMS staff reported that they prompt providers to 

update NPPES data only if a mismatch occurs with the provider’s NPI, 

first or last name, SSN, or DOB in NPPES data during provider 

enrollment or reenrollment in PECOS. 

82 45 CFR § 162.410(a)(4). 
 

CONCLUSION AND RECOMMENDATIONS 

The ability to identify and locate providers is fundamental to health care 

program integrity. However, the results of our analyses show that NPPES 

and PECOS data are not reliable independently or even when combined. 

More than three out of four providers identified inaccurate data in NPPES 

or PECOS, and more than one in four providers identified inaccurate data 

in both NPPES and PECOS. Although verification requirements for 

provider information are more robust in PECOS, these data are not more 

accurate than analogous data in NPPES. Required variables in NPPES 

and PECOS were largely complete, however, the databases lacked the 

information necessary to determine whether missing values for 

conditionally required variables were appropriate. Data did not match 

between NPPES and PECOS for more than 9 out of 10 provider records. 

Addresses were the source of most inaccuracies and inconsistencies. 

Because the NPI is used by private and public health insurance programs, 

the lack of safeguards for NPPES data complicates program integrity 

efforts for all health care programs. Each program must separately 

implement robust safeguards during the enrollment process to ensure that 

provider data are accurate. The suspension of provider enrollment 

verification activities at a time of increased application volume could have 

compromised the accuracy and completeness of PECOS data, increasing 

the vulnerability of the Medicare program to fraud and abuse. CMS’s new 

automated provider-screening tool has the potential to improve the 

accuracy of PECOS data. However, it does not reduce the risk of 

fraudulent NPI enumeration and will not improve NPPES data accuracy. 

CMS and OIG have long recognized that preventing fraudulent providers 

from enrolling in Federal health care programs is more efficient and 

effective than trying to recover fraudulent payments. To prevent and 

correct fraudulent enumeration and enrollment, we recommend that CMS: 

Require MACs To Implement Program Integrity Safeguards for 

Medicare Provider Enrollment as Established in the PIM 

CMS should rescind the supplemental guidance that waives verification 

requirements in order to expedite the processing of PECOS applications 

and should issue new guidance reiterating that all provider data should be 

verified. MACs should verify all provider data, including credentials, 

mailing addresses, practice locations, telephone numbers, legitimacy of 

businesses, and adverse legal histories. CMS should take appropriate 

action if the safeguards that MACs use do not meet the requirements. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 28 
 

Require More Verification of NPPES Enumeration and PECOS 

Enrollment Data 

CMS should require more verification of provider data in NPPES to 

protect Medicare and other health care programs from fraud. In addition, 

CMS could consider: 

	 using the new PECOS automated provider-screening tool to verify 

provider data in NPPES, including name, DOB, place of birth, 

licensure, credentials, mailing address, practice location, telephone 

numbers, and legitimacy of business; 

	 monitoring NPPES applications by geographic area to detect potential 

fraud; and 

	 enabling NPPES contractor staff to immediately deactivate or suspend 

the NPIs of providers who are presumed to be deceased. 

CMS should also build upon the enhancements to the provider-enrollment 

screening requirements that went into effect March 25, 2011, by 

strengthening program integrity safeguards for all initial enrollments, 

change requests, and revalidations in PECOS. For example, providers 

identified as limited risk are exempt from the site visits required for 

moderate- and high-risk providers and suppliers; CMS should determine 

whether a computerized solution may be used to verify that limited-risk 

providers’ locations are legitimate. 

Detect and Correct Inaccurate and Incomplete Provider 

Enumeration and Enrollment Data for New and Established 

Records 

CMS should consider: 

 requiring more frequent revalidation of selected variables, especially 

address information; 

 implementing an automated system edit that will require license 

information for providers with applicable specialty/taxonomy codes; 

 reducing or eliminating the option for providers to submit enumeration 

and enrollment applications via paper; and 

 offering providers incentives to keep their data accurate and current. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 29 
 

 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with all three of the report recommendations. 

Regarding the first recommendation, CMS concurred and stated that 

measures to streamline the enrollment process do not jeopardize existing 

program integrity safeguards. CMS reiterated that MACs must adhere to 

the processing guidelines established in Chapter 15 of the PIM and that 

supplemental guidance provided to the MACs does not waive those 

guidelines. The results of this study suggest that MACs may not 

understand that supplemental guidance does not waive program integrity 

safeguards established in the PIM; we encourage CMS to clarify that point 

with the MACs directly. 

Regarding the second recommendation, CMS concurred and listed 

mechanisms under development to further verify NPPES and PECOS data. 

We encourage CMS to emphasize verification of NPPES data in addition 

to PECOS data. 

Regarding the third recommendation, CMS concurred and plans to use a 

new Automated Provider Screening tool to identify changes to provider 

data in PECOS and identify specific providers to revalidate more 

frequently. CMS has also made enhancements to PECOS that may 

decrease inaccurate and incomplete provider information. CMS stated that 

ongoing revalidation efforts and provider education regarding loss of 

billing privileges for failure to update records will encourage providers to 

keep their data accurate. We note that all of these efforts are directed 

towards PECOS data and are therefore unlikely to correct the inaccurate 

and incomplete provider enumeration data stored in NPPES. Reliable 

NPPES data could enhance program integrity efforts not just for Medicare, 

but all health care programs across the Nation. 

We did not make any changes to the report based on CMS’s comments. 

For the full text of CMS’s comments, see Appendix D. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 30 
 

 

APPENDIX A 

Detailed Methodology 

Invitations for Provider Survey. We used email addresses in the National 

Plan and Provider Enumeration System (NPPES) and Provider 

Enrollment, Chain and Ownership System (PECOS) databases to notify 

providers and/or their designated contact people of our survey. If provider 

email addresses were not valid, we called providers using the telephone 

number(s) listed in NPPES and PECOS in an effort to obtain valid email 

addresses. Next, we sent invitations to complete the online survey via 

email and U.S. Postal Service (USPS) mail, using the mailing address 

listed in PECOS. The USPS invitation letters assigned each provider a 

unique user name and password that were required as a security measure 

to complete the survey. Providers who did not complete the survey after 

2 weeks were sent a second USPS mailing and reminder email. Letters 

were sent to the same mailing address listed in PECOS unless initial 

mailings were returned marked as “Return to Sender,” in which case the 

second letter was sent to the mailing address listed in NPPES. We 

attempted to telephone providers who did not complete the survey and 

sent a final invitation letter via certified mail 10 weeks after the previous 

mailing. This final attempted mailing was sent to the provider mailing 

address listed in NPPES if it was different from the mailing address in 

PECOS; if it was the same, the letter was sent to the practice location 

address listed in NPPES. 

After 4 months, 126 providers had completed the survey—a response rate 

of 74 percent. The remaining 44 providers declined to complete the 

survey, were retired from practice, or accessed the survey but did not 

submit any response. 

Completeness of Data: PECOS. Most of the variables in our analysis 

were linked across relational tables in PECOS using a variable called 

PECOS associate control ID (PAC ID). However, the PAC ID was not 

present in the table featuring practice address; instead, a variable called 

Enrollment ID was used. Email correspondence with Centers for 

Medicare & Medicaid Services (CMS) staff confirmed that a practice 

address was displayed for individual provider records in the relevant table 

only if those providers had not reassigned their benefits to a group or other 

individual provider (which is common practice for providers working in a 

group or clinic setting). In many cases, the practice addresses would be 

under groups’ enrollment identifiers rather than the individual 

practitioners’ enrollment identifiers. Data for group practices were outside 

the scope of this study, so findings on the completeness of practice address 

are absent from this report. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 31 
 

 

PECOS contained 5 schemas with 839 relational tables and 4,701 

variables and different numbers of records per table. The 10 variables we 

reviewed were located in 8 different tables within the schema that CMS 

advised us to use. See Table A-1 for information about how many records 

were listed for each variable in PECOS. 

Table A-1: Records per Variable in PECOS Schema 

Variable Table Name Variable Link Total Number 

of Records 

Number of 

Nonduplicate 

Individual 

Practitioner 

Records 

Full name PEC_INDVDL_NAME PAC ID 1,519,571 1,021,652 

Date of birth PEC_ASCT_INDVDL PAC ID 1,426,013 1,021,652 

Gender PEC_ASCT_INDVDL PAC ID 1,426,013 1,021,652 

Social Security 

number PEC_TIN PAC ID 1,751,742 1,021,427 

Specialty Code PEC_ENRLMT_PHYSN_SPCLTY + 

PEC_ENRLMT_NPHYSN_SPCLTY PAC ID 1,260,639 1,016,843 

Mailing address PEC_MLG_ADR PAC ID 1,762,669 1,016,075 

Telephone 

number PEC_MLG_ADR PAC ID 1,762,669 1,016,075 

License number PEC_STATE_LCNS Enrollment ID 1,221,584 1,009,470 

National Provider 

Identifier PEC_NPI PAC ID 1,292,182 988,893 

Practice address PEC_ENRLMT_ADR Enrollment ID 895,234 203,637 

Source: Office of Inspector General analysis of PECOS data, 2011. 

Consistency of Data: Address Match. NPPES contained one set of 

variables (i.e., street address, city, State, ZIP Code) for each provider 

mailing address and another set of variables for each provider practice 

location address. However, the relational tables in PECOS permitted two 

mailing addresses and five practice location addresses per provider.83 If 

the ZIP Code from the mailing address in NPPES matched the ZIP Code 

for either mailing address in PECOS, we considered it a match. Similarly, 

if the ZIP Code from the practice address in NPPES matched the ZIP Code 

for any of the practice addresses in PECOS, we considered it a match. 

83 Values for practice location address did not exist for many provider records, as 

described in the section above regarding completeness of PECOS data. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 32 
 

 

 

APPENDIX B 

Point Estimates and Confidence Intervals Based on Provider 

Survey 

We calculated confidence intervals for key data points in the provider 

survey regarding the accuracy of provider data. The sample size, point 

estimates, and 95-percent confidence intervals are given for each of the 

following: 

Table B-1: Confidence Intervals for Provider Survey Data 

Data Element Description Sample 

Size Point Estimate 95-Percent Confidence Interval 

Number of providers who responded to the survey 126 731,738 666,080–797,395 

Percentage of providers with inaccurate NPPES mailing 

address or practice location address 126 43.7% 35.2%–52.5% 

Percentage of providers with inaccurate NPPES mailing 

address 126 34.1% 26.3%–42.9% 

Percentage of providers with inaccurate NPPES practice 

address 126 33.3% 25.6%–42.1% 

Percentage of providers with inaccurate NPPES State 

license (primary) 126 4.0% 1.6%–9.3% 

Percentage of providers with inaccurate NPPES DOB 126 1.6% 0.4%–6.2% 

Percentage of providers with inaccurate NPPES State 

license (secondary) 126 1.6% 0.4%–6.2% 

Percentage of providers with inaccurate NPPES 

credentials 126 1.6% 0.4%–6.2% 

Percentage of providers with inaccurate NPPES first name 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate NPPES last name 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate NPPES NPI 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate NPPES SSN 

(last four digits) 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate NPPES data 

(gross) 126 76.2% 60.6%–91.8% 

Percentage of providers with inaccurate NPPES data 

(overlapping) 126 27.8% 19.0%–36.6% 

Percentage of providers with inaccurate NPPES data (net) 126 48.4% 39.7%–57.2% 

Percentage of providers with inaccurate PECOS mailing 

address or practice location address 126 51.6% 42.8%–60.3% 

Percentage of providers with inaccurate PECOS mailing 

address (primary) 126 46.8% 38.2%–55.6% 

Percentage of providers with inaccurate PECOS practice 

address (primary) 126 8.7% 4.9%–15.2% 

Percentage of providers with inaccurate PECOS mailing 

address (secondary) 126 7.9% 4.3%–14.2% 

continued on next page 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 33 
 

Table B-1: Confidence Intervals for Provider Survey Data (Continued) 

Data Element Description Sample 

Size Point Estimate 95-Percent Confidence Interval 

Percentage of providers with inaccurate PECOS practice 

address (secondary) 126 2.4% 0.8%–7.2% 

Percentage of providers with inaccurate PECOS 

credentials 126 4.8% 2.1%–10.3% 

Percentage of providers with inaccurate PECOS State 

license (primary) 126 7.1% 3.7%–13.2% 

Percentage of providers with inaccurate PECOS 

state/license (secondary) 126 3.2% 1.2%–8.2% 

Percentage of providers with inaccurate PECOS last name 126 2.4% 0.8%–7.2% 

Percentage of providers with inaccurate PECOS DOB 126 0.8% 0.1%–5.5% 

Percentage of providers with inaccurate PECOS first name 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate PECOS NPI 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate PECOS SSN 

(last four digits) 126 0.0% 0.0%–2.9% 

Percentage of providers with inaccurate PECOS data 

(gross) 126 84.1% 68.0%–100.0% 

Percentage of providers with inaccurate PECOS data 

(overlapping) 126 26.2% 15.5%–36.9% 

Percentage of providers with inaccurate PECOS data (net) 126 57.9% 49.1%–66.3% 

Percentage of providers with any inaccurate NPPES or 

PECOS data 126 77.0% 68.7%–83.6% 

Percentage of providers with inaccurate NPPES and 

PECOS data 126 29.4% 22.0%–38.0% 

Abbreviations used in table: NPPES = National Plan and Provider Enumeration System; DOB = date of birth; NPI = National Provider 

Identifier; SSN = Social Security number; PECOS = Provider Enrollment, Chain and Ownership System. 

Source: Office of Inspector General analysis of provider survey data, 2011. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 34 
 

 

APPENDIX C 

Table C-1: Safeguards That Medicare Administrative Contractors Report Using To Verify 

Provider Enrollment Data 

Status Variable for 

Verification Suggested Method for Verification 

MACs Routinely 

Performing 

Activity (N=11) 

Required by the 

PIM and 

Supplemental 

Guidance 

Exclusion 

Status 

Check the OIG List of Excluded Providers & Entities 

database 11 

Check the GSA Excluded Parties List System 11 

SSN Confirm provider tax identification number with an approved 

Internal Revenue Service form 8 

Professional 

License 

Require supporting documentation of license from each 

State where provider practices 9 

NPI Require supporting documentation from NPPES 7 

Required by the 

PIM but 

Waived by 

Supplemental 

Guidance 

Credentials Check information/Web sites of State boards or 

credentialing organizations 11 

Mailing Address 

Confirm that it is not a billing agency 11 

Call telephone number to confirm that applicant is reached 8 

Confirm that it is not a management service organization 7 

Confirm that it is not a chain’s corporate office 6 

Confirm that it is not an applicant’s representative 4 

Request for 

Data Change 

Compare signatures for request to change a 

special payments address 11 

Compare signatures for request to change the provider’s 

electronic funds transfer authorization agreement 10 

Compare signatures for request to change practice 

location address 10 

Compare signatures for request for reactivation 

or revalidation 9 

Compare signature for requests to change mailing address 8 

Practice 

Location 

Compare addresses to addresses in Internet sources 10 

Contact the city or county for professional/business license, 

certification, or registration 2 

Perform a site visit 0 

continued on next page 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 35 
 

 

Table C-1: Safeguards That Medicare Administrative Contractors Report Using To Verify 

Provider Enrollment Data (Continued) 

Status Variable for 

Verification Suggested Method for Verification 

MACs Routinely 

Performing 

Activity (N=11) 

Call the number to verify connection or ownership 7 

Telephone 

Numbers Compare telephone number to Internet sources 5 

Compare telephone number to telephone listing(s) 2 

Required by the Check records of the Internal Revenue Service (EIN) 4 

PIM but Waived 

by Supplemental 

Guidance Legitimacy of 

Business 

Compare telephone number to telephone listing(s) 2 

Contact the city for professional/business license, 

certification, or registration 2 

Contact the county for professional/business license, 

certification, or registration 1 

Adverse Legal 

History Check court records of conviction 2 

Abbreviations used in table: MAC = Medicare Administrative Contractor, PIM = Program Integrity Manual, JSM = Joint Signature 

Memorandum, OIG = Office of Inspector General, GSA = General Services Administration, SSN = Social Security number, NPI = National 

Provider Identifier, NPPES = National Plan and Provider Enumeration System, and EIN = Employer Identification Number. 

Source: Office of Inspector General analysis of MAC Survey data, 2011. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 36 
APPENDIX D 

Agency Comments 

/tPVl~, 

( ~ DEPARTMENT OF HEALTH & HUMAN SERVICES Centers tor Medicare & Medicaid Services 

<~'!- Administrator 

Washington , DC 20201 

DATE: MAR 2 5 2013 

TO: 	 Daniel R. Levinson 


Inspector General 


FROM: 	 Marilyn 'h\'enner 


Acting Ad\nihistrator 


SUBJECT: 	 Office of Inspector General (OIG) Draft Report: "Inaccurate, Incomplete, and 

Inconsistent Provider Enumeration and Medicare Enrol.lment Data" 

(OEI-07 -09-00440) 

The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 

comment on the subject of the OIG draft report. The purpose of this report is to assess provider 

enumeration data (i.e., from providers' applications for National Provider Identifiers (NPI)) and 

Medicare provider enrollment data maintained by CMS for accuracy, completeness, and 

consistency; and to assess CMS oversight processes for ensuring the accuracy, completeness, and 

consistency of provider enumeration data and Medicare provider enrollment data. 

The CMS is committed to preventing fraudulent providers from enrolling in federal health care 

programs, removing fraudulent providers from the programs, and maintaining the integrity of the 

systems that house provider enumerators and enrollment information. Medicare Administrative 

Contractors (MAC) are required by the Program Integrity Manual (PIM) to use validation 

techniques such as documentation reviews, licensure verification, review of exclusion and 

debarment databases, interaction with Social Security Administration's (SSA) databases, and site 

visits to verify enrollment information. 

In addition, CMS has already begun working on developing mechanisms to further verify 

provider enumerator data and implement processes to actively deactivate NP!s when appropriate 

for potentially fraudulent providers. 

We appreciate OIG's efforts in working with CMS to help ensure that provider enumeration and 

Medicare enrollment data is accurate, complete, and consistent. Our response to each of the OIG 

recommendations follows. 

OIG Recommendation 

The OIG recommends that CMS require MACs to implement program integrity safeguards for 

Medicare provider enrollment as established in the PIM . 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEl-07-09-00440) 37 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 38 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 39 
 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 40 
 

ACKNOWLEDGMENTS 

This report was prepared under the direction of Brian Pattison, Regional 

Inspector General for Evaluation and Inspections in the Kansas City 

regional office, and Brian T. Whitley, Deputy Regional Inspector General. 

Julie Dusold Culbertson served as the team leader for this study. Other 

principal Office of Evaluation and Inspections staff from the Kansas City 

regional office who contributed to the report include Michael J. Brown 

and Jordan R. Clementi; central office staff who contributed include 

Kevin Farber, Scott Horning, Scott Manley, Christine Moritz, and 

Debra Roush. 

Improvements Needed for Provider Enumeration and Medicare Enrollment Data (OEI-07-09-00440) 41 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.