ATLANTA--The new Internet registry of National Provider
Identification numbers contains a potential landmine, warned Chris
Rice, founder of provider forum competingbid.com, last week.
Activated Sept. 4 after months of preparation, the National Plan
and Provider Enumeration System database allows health care
providers to locate their referral sources' NPI numbers, necessary
for submitting compliant claims to Medicare.
But Rice said the online registry, which discloses information
obtainable through the Freedom of Information Act, also reveals
providers' National Supplier Clearinghouse numbers. Displaying an
NSC number to the public is akin to knowing someone's Social
Security number, he said.
"You can call into any one of the [DME] MACS and enter that NSC
number and you have access to all kinds of information," said
Rice.
For example, he said, people who know those NSC numbers could
find out how much Medicare paid a specific provider. "A provider
can easily listen to automated recordings of checks written to
their competitors," he said. "Further, patient information can also
be obtained (assuming they have the patient's HIC number)."
Once he became aware of the issue, Rice posted a warning on his
site that elicited more than 130 e-mails from providers, he
said.
"One concern I have--other than payment/check-write information
and patient/claim-specific information being readily available if
someone has your NSC ID--is that someone with the information on
the NPI site could potentially make changes to your NSC provider
file without your knowledge or consent," wrote one of the Web site
respondents.
The possible ramifications are of such concern that Rice and
several providers on the forum said they had tried to contact the
NSC about the issue, but with little success. "I spoke with the
NSC, the MAC and the NPI folks ... Each referred me to the other,"
Rice said. "Finally, they sent me to a CMS phone number. It
referred me to the NSC."
One agency suggested deleting the information, but Rice and
other forum writers were leery of doing that. "If you go and delete
your NSC numbers, [other sources] say it will confuse the system
and it won't cross-link, and then you won't get paid," Rice said.
"We don't know if that is true or not yet, but that's what they are
telling us."
According to a recent CMS communication sent to providers, Part
B carriers and DME MACS have begun to turn on edits to validate the
NPI/legacy number pairs submitted on claims. "If the pair is not
found on the Medicare NPI crosswalk, the claim will reject," CMS
said. (See HomeCare
Monday, Sept. 10.)
Rice questioned the need for all the information listed on the
registry. "You can understand names, addresses, phone numbers and
the NPI number, but why it needs to go beyond that, I don't get
it," he said.
"The easiest fix," he noted on his Web site, "would be for the
NPPES to just not show those [extra] fields."
The solution for preventing unscrupulous people from using other
NSC numbers is also easy, he said: "The MACs should require a PIN
to access their automated systems." Rice said that physicians'
provider numbers are also shown in the registry, but a separate PIN
is required to access their proprietary information. "That's what
HME needs," he said.
The NSC could not be reached Friday for comment.
Access the
NPI registry.
