[Federal Register Volume 89, Number 43 (Monday, March 4, 2024)]
[Notices]
[Pages 15581-15584]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-04517]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

[CMS-0059-N]
RIN 0938-ZB82


National Plan and Provider Enumeration System (NPPES) Data 
Changes

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS).

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: This notice provides information on changes to data elements 
that providers are required to submit to the National Plan and Provider 
Enumeration System (NPPES) to obtain and maintain a National Provider 
Identifier (NPI). The changes to the required data elements affect the 
data that is made available to the public from NPPES in downloadable 
files and in a query-only database on the internet.

DATES: This notice is applicable on April 3, 2024.

FOR FURTHER INFORMATION CONTACT: Christopher S. Wilson, (410) 786-3178 
or Beth A. Karpiak, (312) 353-1351.

SUPPLEMENTARY INFORMATION:

I. Background

A. Legislative and Regulatory Background

    Through subtitle F of title II of the Health Insurance Portability 
and Accountability Act of 1996 (HIPAA), Congress added Part C, 
``Administrative Simplification'' to title XI of the Social Security 
Act (the Act). (Pub. L. 104-191). Part C of title XI consists of 
sections 1171 through 1179 of the Act. These sections define various 
terms and impose requirements on the Secretary of the Department of 
Health and Human Services (HHS) (hereinafter referred to as the 
Secretary), health plans, health care clearinghouses, and certain 
health care providers concerning the adoption of standards and 
implementation specifications relating to health information. The 
Secretary delegated authority for administering and enforcing HIPAA 
Administrative Simplification provisions related to transactions, code 
sets, unique identifiers, and operating rules, implemented in 45 CFR 
parts 160 and 162, to the Centers for Medicare & Medicaid Services 
(CMS) (see 68 FR 60694).
    Section 1173(b) of the Act requires the Secretary to adopt a 
standard unique health identifier for each individual, employer, health 
plan, and health care provider for use in the health care system and to 
specify the purposes for which the identifiers may be used. On May 7, 
1998 (63 FR 25320), HHS proposed a standard unique health identifier 
for health care providers and requirements concerning its 
implementation (hereinafter referred to as the National Provider 
Identifier (NPI) proposed rule). On January 23, 2004 (69 FR 3434), HHS 
published a final rule that adopted the NPI as the standard unique 
health identifier for health care providers (hereinafter referred to as 
the NPI final rule). The NPI final rule established that HIPAA covered 
entities must use NPIs to identify health care providers in electronic 
transactions for which the Secretary has adopted a standard. Covered 
entities include health plans, health care clearinghouses, and health 
care providers who transmit any health information in electronic form 
in connection with a transaction for which the Secretary has adopted a 
standard.

B. Operational and System Background

    The NPI final rule established that NPIs are assigned to health 
care providers through the National Provider System (NPS). The preamble 
to the NPI final rule included an ``NPS Data Elements Table'' (69 FR 
3457) that listed the data elements HHS expected to collect about a 
health care provider and include in the NPS. The NPS, now called the 
National Plan and Provider Enumeration System (NPPES),\1\ uniquely 
identifies health care providers through an application process and 
assigns NPIs. NPPES creates a record for each health care provider to 
whom it assigns an NPI. The records are updated when health care 
providers furnish updates to NPPES.
---------------------------------------------------------------------------

    \1\ https://nppes.cms.hhs.gov/#/.
---------------------------------------------------------------------------

    Health care providers are categorized by NPPES into two types: 
Individuals, such as physicians; and organizations, such as hospitals. 
A health care provider may apply for an NPI in one of three ways, by: 
(1) completing form CMS-10114 (NPI Application/Update Form) and mailing 
it to NPPES; (2) applying online at https://NPPES.cms.hhs.gov/; or (3) 
having an approved Electronic File Interchange Organization (EFIO) 
submit its NPI application data to NPPES in an electronic format 
defined by HHS.<SUP>2 3</SUP> Health care providers who apply online 
have electronic access to the information in their own NPPES records by 
using user identifiers and passwords they select. This access allows 
those health care providers to submit updates to their NPPES data 
electronically via the internet.
---------------------------------------------------------------------------

    \2\ The information collection request is currently approved 
under OMB control number 0938-0931. (https://www.reginfo.gov/public/do/DownloadNOA?requestID=311118).
    \3\ The Electronic File Interchange (EFI), also referred to as 
``bulk enumeration,'' is a process by which a provider or group of 
providers can have an EFIO apply for NPIs on their behalf. EFIOs are 
approved by CMS through a certification process and submit 
information in a format designated by CMS; https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/efi.
---------------------------------------------------------------------------

    The NPI final rule requires that the NPS (now NPPES) disseminate 
data in response to approved requests. Following publication of the NPI 
final rule, CMS, as the administrator of NPPES, published a notice in 
the May 30, 2007 Federal Register (72 FR 30011) describing the data 
dissemination strategy for NPI data maintained in NPPES and the process 
by which CMS would carry out the strategy (hereinafter referred to as 
the NPPES Data Dissemination notice). The NPPES Data Dissemination 
notice included a list of data elements that CMS determined are 
required to be disclosed under the Freedom of Information Act (FOIA) 
(see 72 FR 30012).
    The health care industry needs NPPES health care provider data to 
know the NPIs of health care providers to be able to submit HIPAA-
compliant health care transactions. In anticipation

[[Page 15582]]

of an extraordinary demand from the health care industry for FOIA-
disclosable NPPES health care provider data, in September 2007, CMS 
began making this information available to the public, in accordance 
with the Electronic Freedom of Information Act Amendments of 1996 (Pub. 
L. 104-231), via the internet in two forms:
    <bullet> NPI Registry: The NPI Registry is a query-only database 
that is updated daily to enable users to query NPPES (for example, 
search by NPI, provider name, etc.) and retrieve the FOIA-disclosable 
data from the search results. There is no charge to view the data.
    <bullet> NPI Downloadable File: Full Replacement Monthly NPI File, 
Weekly Incremental NPI File, and Full Replacement NPI Deactivation 
File. There is no charge to download the data.

II. Provisions of the Notice

A. Changes to NPPES Data Elements

    The NPI final rule acknowledged that the data elements and 
information presented in the data elements table were not intended to 
be used for data design purposes and that during the NPS design and 
development, the names and attributes of the data elements could be 
revised.\4\ The table was included to show the kind of information that 
CMS expected to collect about health care providers and that could be 
disseminated by the NPS (69 FR 3455).
---------------------------------------------------------------------------

    \4\ HIPAA Administrative Simplification: Standard Unique Health 
Identifier for Health Care Providers (NPI final rule) (69 FR 3455) 
https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
---------------------------------------------------------------------------

    The data elements table in the NPI final rule included the 
following health care provider data elements addressed by this notice: 
provider first line address location, provider second line address 
location, and provider gender code. Thirty days after publication of 
this notice in the Federal Register, the NPPES system, NPPES Registry, 
paper form, and associated data files will be updated to begin 
collecting and disseminating for these health care provider data 
elements: (1) amend the description of the provider first line location 
address and second line location address data elements to permit a 
provider that does not have a physical location other than their home 
address to enter a United States Postal Service (USPS) post office box 
or personal mailbox provided by private delivery services as their 
provider location address; and (2) add additional choices for provider 
gender codes. All other attributes assigned to these data elements 
remain unchanged.
    The data elements relevant to this notice are listed in Table 1. 
Description of the information contained in each column of this table 
is as follows:
    <bullet> Data Element Name: The name of the data element residing 
in the NPPES.
    <bullet> Description: The definition of the data element and 
related information.
    <bullet> Data Status: The instruction for furnishing the 
information being requested in the data element. The abbreviations used 
in this column are as follows:
    ++ Required (R): Required for NPI assignment.
    ++ NPPES-generated (NG): Generated or assigned by the NPPES.
    ++ Optional (O): Not required for NPI assignment.
    ++ Situational (S): If a certain condition exists, the data element 
is required. Otherwise, it is not required.
    ++ Repeat (RPT): Indicates that the data element is a repeating 
field. A repeating field is one that can accommodate more than one 
separate entry. Each separate entry must meet the edits, if any, 
designated for that data element.
    <bullet> Data Condition: Describes the condition(s) under which a 
``Situational'' data element must be furnished. NOTE: The abbreviation 
NA means ``not applicable.''
    <bullet> Entity Types: The ``Entity type codes'' to which the data 
element applies. Code describing the type of health care provider that 
is being assigned an NPI. Codes are as follows:
    ++ 1 = (Person): individual human being who furnishes health care.
    ++ 2 = (Non-person): entity other than an individual human being 
that furnishes health care (for example, hospital, SNF, hospital 
subunit, pharmacy, or HMO).
    <bullet> Use: The purpose for which the information is being 
collected or will be used. The abbreviations used in this column are as 
follows:
    ++ I: The data element supports the unique identification of a 
health care provider.
    ++ A: The data element supports administrative implementation 
specification.

                              Table A--NPPES Data Elements at Issue in This Notice
----------------------------------------------------------------------------------------------------------------
                                                                         Data condition
       Data element name               Description        Data status     (situational     Entity types    Use
                                                                          status only)
----------------------------------------------------------------------------------------------------------------
Provider first line location     The first line location  R            NA................  1, 2........  A
 address.                         address of the
                                  provider being
                                  identified. For
                                  providers with more
                                  than one physical
                                  location, this is the
                                  primary location. This
                                  address can only
                                  include the USPS post
                                  office box location or
                                  personal mailbox
                                  offered by a private
                                  delivery service if
                                  the provider's NPI is
                                  Entity type code = 1
                                  and the provider does
                                  not have a physical
                                  location other than
                                  their home address
                                  (for example, a
                                  provider that
                                  exclusively provides
                                  telehealth services
                                  from their home).
Provider second line location    The second line          S            Required if it      1, 2........  A
 address.                         location address of                   exists.
                                  the provider being
                                  identified. For
                                  providers with more
                                  than one physical
                                  location, this is the
                                  primary location. This
                                  address can only
                                  include a USPS post
                                  office box location or
                                  personal mailbox
                                  offered by a private
                                  delivery service if
                                  the provider's NPI is
                                  Entity type code = 1
                                  and the provider does
                                  not have a physical
                                  location other than
                                  their home address
                                  (for example a
                                  provider that
                                  exclusively provides
                                  telehealth services
                                  from their home).
Provider gender code...........  The code designating     S            Required if the     1...........  I
                                  the provider's gender                 provider's NPI is
                                  if the provider is a                  Entity type code
                                  person.                               = 1.
----------------------------------------------------------------------------------------------------------------


[[Page 15583]]

1. Allowing Provider Address Location To Include Post Office Boxes
    The NPI final rule acknowledged that many comments to the NPI 
proposed rule noted that health care provider practice addresses change 
frequently, will be burdensome and expensive to maintain, and will be 
unlikely to be maintained accurately.\5\ In response to these comments, 
we concluded in the NPI final rule that, due to how frequently provider 
location addresses change, the data element is of limited use in 
electronic matching of health care providers (69 FR 3450). However, the 
rule did recognize that capturing one provider location address in 
NPPES could serve the administrative purpose of providing an address 
where a health care provider can be contacted in situations when a 
mailing address is insufficient. For example, a mailing address 
containing a USPS post office box number cannot be used for mail 
delivery by entities other than the USPS. The rule concluded that NPPES 
should collect a provider mailing address and one provider location 
address as required elements. To support this administrative purpose, 
both the provider first line location address and provider second line 
location address data element descriptions included a note indicating, 
``This address cannot include a post office box'' (69 FR 3458).
---------------------------------------------------------------------------

    \5\ HIPAA Administrative Simplification: Standard Unique Health 
Identifier for Health Care Providers (NPI final rule)(69 FR 3455) 
https://www.federalregister.gov/documents/2004/01/23/04-1149/hipaa-administrative-simplification-standard-unique-health-identifier-for-health-care-providers#p-394.
---------------------------------------------------------------------------

    Since the publication of the NPI final rule, health plans, 
Medicare, and Medicaid programs, have expanded coverage for telehealth 
services.\6\ As such, there are now a number of individual (Entity type 
code = 1) providers, such as behavioral health service providers, who 
exclusively furnish telehealth services from the providers' homes. In 
some instances, providers who exclusively furnish telehealth services 
from their own homes may not have a provider address location other 
than their home address. We understand that providers who furnish 
telehealth services exclusively from their homes often enter a post 
office box as their provider mailing address into NPPES when applying 
for an NPI. Given the prohibition on including a post office box for 
the provider location address data elements, they enter their home 
addresses into NPPES to satisfy the provider location address data 
elements and obtain an NPI.
---------------------------------------------------------------------------

    \6\ https://telehealth.hhs.gov/; https://data.cms.gov/summary-statistics-on-use-and-payments/medicare-service-type-reports/medicare-telehealth-trends; https://www.ama-assn.org/practice-management/digital/new-survey-data-shows-doctors-steadfast-commitment-telehealth.
---------------------------------------------------------------------------

    In accordance with FOIA, NPPES address data, including provider 
mailing address and provider location address, is publicly available on 
the internet. Internet posting of provider home address information as 
a provider location may cause confusion, potentially leading patients 
and others who may access NPPES data to think that the provider can be 
accessed for treatment or administrative purposes at the listed home 
address. We have heard from providers that posting the information also 
poses privacy and potential safety concerns for themselves and their 
families.
    To address these concerns, while still maintaining the 
administrative purpose of providing a provider location address that 
can be accessed by methods other than the USPS when such a location 
exists outside of the provider's own home, NPPES will keep the provider 
location address data element status as required, but will allow for 
submission of a post office box or personal mailbox offered by a 
private delivery service when a provider's NPI is Entity type code = 1 
and the provider does not have a physical location other than their 
home address (for example, a provider that exclusively furnishes 
telehealth services from their home). This change is accomplished by 
removing the language ``This address cannot include a post office box'' 
from the data element descriptions for both the provider first line 
location address and provider second line location address and 
replacing it with ``This address can include a post office box or 
personal mailbox offered by a private delivery service only if the 
provider's NPI is Entity type code = 1 and the provider does not have a 
physical location other than their home address (for example, a 
provider that exclusively provides telehealth services from their 
home).''
    The change in the data element descriptions allows providers that 
are persons that do not currently have an NPI, and exclusively furnish 
telehealth services or other services out of their homes, to obtain an 
NPI without including their home address in NPPES. Should a provider 
with Entity type code = 1 that has as an existing NPI, and exclusively 
furnishes telehealth services or other services out of their homes, 
wish to remove their home address from NPPES and replace it with a post 
office box, they may do so by updating their NPPES records, either 
themselves or through the EFIO that submitted their NPI application 
data to NPPES. The change in the data element descriptions does not 
require providers that already have an NPI assigned through NPPES, 
including telehealth providers that do not have a physical location 
address other than their home address, from changing any existing 
information in NPPES. Should a provider who furnishes telehealth 
services or other services exclusively from their home address wish to 
maintain their home address as their provider location address within 
their NPPES record, they may do so.
2. Adding Additional Provider Gender Code Choices
    The NPI final rule identified provider gender code as a required 
data element if the provider's NPI is Entity type code = 1. While 
neither the NPI final rule nor the NPPES Data Dissemination notice 
identified the gender codes that NPPES would collect and disseminate 
when applying for an NPI, providers are given the option to click on a 
box that captures gender as either male or female. NPPES stores that 
selection as code (F) should an individual select female and (M) should 
an individual select male. The NPI Registry query-only database 
displays the descriptions ``Male'' and ``Female'' to disseminate 
provider gender and NPI downloadable files display the information 
using the codes (M) and (F).
    NPPES will permit selection of, and disseminate, gender code 
options beyond M and F to promote improved accuracy in publicly 
available data and support unique identification and enumeration of 
health care providers. The NPPES system, NPPES Registry, paper form, 
and associated data files will be updated to begin collecting and 
disseminating these new values 30 days after publication of this notice 
in the Federal Register. NPPES will provide additional guidance on the 
new codes and instructions for selecting gender codes when applying for 
an NPI and maintaining NPI data.
    Adding gender codes aligns with HHS efforts, as described in E.O. 
14075 (87 FR 37189), to advance equity and full inclusion of lesbian, 
gay, bisexual, transgender, queer, and intersex (LGBTQI+) individuals 
through inclusive federal data collection practices.
    Providers with Entity type code = 1 who previously furnished a 
provider gender code to NPPES may update or change their selection in 
NPPES, or have the EFIO that submitted their NPI application data to 
NPPES cause them to be changed in NPPES, at any time. HHS encourages 
providers who have

[[Page 15584]]

obtained NPIs to review their NPPES records to ensure that the 
information they furnished when applying for their NPIs is up-to-date 
and accurate.

B. Impact on FOIA-Releasable NPPES Data

    The NPPES Data Dissemination notice identified both the provider 
location address and provider gender code as NPPES data elements that 
must be released under FOIA. The changes to these data elements 
described in section II. of this notice do not affect HHS's assessment 
of their releasability under FOIA and the data elements will continue 
to be made available to the public through the NPI registry and the NPI 
downloadable files.

III. Collection of Information Requirements

    This document imposes new information for collection and 
recordkeeping requirements. It makes reference to an existing 
information collection request that will be revised as a result of the 
revised data elements discussed in this notice. Specifically, we will 
submit a non-substantive change request to OMB for review and approval 
of the data element revisions associated with the information 
collection request currently approved under 0938-0931.
    Chiquita Brooks-LaSure, Administrator of the Centers for Medicare & 
Medicaid Services, approved this document on February 27, 2024.

Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2024-04517 Filed 3-1-24; 8:45 am]
BILLING CODE 4120-01-P