Get It (Now), Use It and Share It (Soon): CMS Grants Some Leeway on NPI Implementation

One of the goals of HIPAA was to impose consistent standards for the form and content of information exchanges by healthcare industry participants in electronic commerce.  That resulted in the establishment of standard forms for billing, payment inquiries, and similar standard healthcare business transactions.  To further the goal of standardization, in 2004 the Department of Health and Human Services also issued the National Provider Identifier rule, which required all HIPAA-covered providers to obtain and start using and sharing a new provider number, known as the NPI.  The NPI is designed to replace almost all other forms of provider identifier numbers, including “legacy” provider numbers such as UPINs and individual plan provider IDs.

Under the NPI rule, all providers are required to apply for their new NPI and will begin using it in all electronic transactions by May 23, 2007.  For most of the last year, CMS has attempted to nudge providers into migrating to the NPI, particularly by requiring all applicants for a new Medicare provider number to obtain an NPI.  However, it now appears that some providers and payors may simply not be ready to fully implement the NPI by the May 2007 deadline. 

Back in October 2003, when the deadline for all HIPAA transactions being in HIPAA-compliant standard formats was bearing down on the industry, HHS announced a “contingency plan.”  Providers and plans that weren’t ready to be fully switched to the new plan would not necessarily be thrown into “HIPAA jail” for noncompliance as long as they had a plan in place to get into compliance within the next year and were working to implement that plan.  Now that the NPI is bearing down on the industry, HHS has thrown out another bone: in Guidance published today, acting CMS administrator Leslie Norwalk states, “Covered entities that have been making a good faith effort to comply with the NPI provisions may, for up to 12 months, implement contingency plans that could include accepting legacy provider numbers on HIPAA transactions in order to maintain operations and cash flows.”

As with the original “contingency plan” for HIPAA-compliant transaction forms, covered entities ignore the May deadline at their peril.  If you have a good reason why you can’t switch over to full-time use of the NPI and must continue to use legacy numbers, you will not be penalized by CMS if you (1) have a plan to implement NPI numbers exclusively by May 2008 and (2) diligently pursue that plan.  However, it is hard to think of a good reason why a provider would not have at least obtained an NPI and be using it wherever possible.  In fact, the Guidance includes as an example of “good faith” efforts the fact that a covered provider has obtained an NPI and is ready and able to use it.

The CMS Guidance, including examples of what might be considered good faith efforts at compliance, can be viewed by clicking http://www.cms.hhs.gov/NationalProvIdentStand/Downloads/NPI_Contingency.pdf.