|
The Evolution of Ethics in the New Millennium:
HIPAA Compliance and the National Provider Identifier
William F. Doverspike, Ph.D.
This article is part of a series of articles related to putting ethics into practice. The opinions expressed in this article are those of the author and do not reflect any official policy or opinion of the GPA Ethics Committee or the State Board of Examiners of Psychologists. This article is designed to be educational in nature and is not intended to provide legal advice. The reader is encouraged to contact an attorney for legal advice regarding state laws governing professional conduct.
The Health Insurance Portability and Accountability Act (HIPAA), which came into being as a result of passage of the Kassenbaum-Kennedy bill, was signed into law as PL104-191 in 1996. Whether we like it or not, HIPAA federal regulations are so broad and comprehensive that they have become the new national standard of care for privacy, record retention, and authorizations for disclosure. HIPAA regulations have also become the standard for provider credentialing and identification.
Introduction
As ethicist Ofer Zur (2003) has pointed out, HIPAA has become the standard of care by which all mental health professionals will be judged regardless of their billing practices or their technical status as "covered entities." Zur has identified three types of clinicians with respect to HIPAA: possums, ostriches, and eagles. Overwhelmed by the demands of HIPAA, some clinicians have responded by hiding their heads in the sand, whereas others have responded by rolling over and playing dead. The appropriate response to HIPAA is to be alert and vigilant. Litwak, an attorney and HIPAA expert, simplified the matter by identifying two types of practitioners: "1. those who are covered by HIPAA, and 2. those who think they aren’t but really are" (Psychotherapy Finance, 2002a, p. 9). As Zuckerman has pointed out, "Courts may view the Privacy Rule as setting the standard for protecting PHI and so, in a lawsuit or state licensing board complaint, the practitioner will be judged by HIPAA’s rules as the standards" (2003, p. 17). Like it or not, HIPAA is the standard of practice in the new millennium. Yet whether unintentionally or otherwise, many therapists negligently missed the April 14, 2003 Privacy Rule deadline and the October 15, 2003 Transaction Rule deadline. Many therapists also appear to be ready to miss the May 23, 2007 deadline for the National Provider Identifier (NPI), which implements a HIPAA requirement that must be used by most HIPAA-covered entities. According to Blue Cross Blue Shield (BCBS; 2007), "To date, less than half the providers expected to need an NPI have obtained one" (p. 3).
HIPAA required that the Secretary of Health and Human Services (HHS) adopt a standard unique health identifier for health care providers. On January 23, 2004, the Secretary published a Final Rule that adopted the National Provider Identifier (NPI) as this identifier. The purpose of the NPI is to improve electronic transactions for health care. All HIPAA-covered health care providers, whether they are individuals or organizations, must obtain an NPI to identify themselves in HIPAA standard transactions. Once enumerated, a provider’s NPI will not change. The NPI remains with the provider regardless of job or location changes. HIPAA-covered entities, such as providers completing electronic transactions, health care clearinghouses, and large health plans, must use only the NPI to identify covered health care providers in standard transactions by May 23, 2007. Small health plans must use only the NPI by May 23, 2008.
Questions and Answers
Am I required to get an NPI to practice psychology?
No. The rule states that only HIPAA-covered entities, as defined at 45 C.F.R. § 160.103, are required to obtain an NPI. You may not need an NPI if you are a non-covered entity, engage in no electronic transactions, and accept absolutely no third-party payments. For example, a non-covered entity might include organizational psychologists who provide only corporate consultations and executive coaching.
What if I file only paper claims (qualifying me as a HIPAA non-covered entity) and treat Medicare patients?
There is one exception to the HIPAA non-covered entity provision for the NPI. The rules require that any provider who files claims with Medicare, including paper claims, must use an NPI. This rule applies whether you are a participating or non-participating provider.
Is being a HIPAA non-covered entity and opting out of Medicare the only way to avoid using an NPI?
Yes. However, consider the advantages of declaring your independence. You will protect yourself from the possibility of prosecution if your compliance is imperfect, such as punishments of up to $250,000.00 fines and up to 10 years in prison. Otherwise, you could be prosecuted for failing to meet the letter of the law---some 3,000 pages---even if no client records are compromised.
What is the deadline for using the NPI?
Medicare, Medicaid, large private insurance issuers, and health care clearinghouses must accept and use NPIs in standard transactions by May 23, 2007 whereas small health plans have until May 23, 2008. Medicare has required the use of a revised Form CMS-1500 since February 1, 2007.
Can I wait until the deadline to apply and still be in compliance?
Yes, you may be able to wait to apply. The rule only requires that you “obtain” an NPI by May 23, 2007. However, you will not be able to submit any claims to large health plans, Medicare, Medicaid, or clearinghouses until your have your number.
What is the NPPES Enumerator?
NPPES refers to the National Plan and Provider Enumeration System. The Department of Health and Human Services selected Fox Systems, Inc., as the Enumerator. It will process applications, assign numbers, resolve issues related to applications, and will operate a call center and an electronic mailbox for questions about obtaining NPIs.
How do I apply for an NPI?
There are three ways to become “enumerated.” First, you may complete an online application. You may apply online at https://nppes.cms.hhs.gov/NPPES/Welcome.do. Alternatively, you may mail in a paper application. You may prepare a paper application and send it to the Enumerator. You may download the application at the URL above, call 1-800-465-3203 to request an application, or write directly to NPI Enumerator, PO Box 6059, Fargo, ND 58108-6059. Finally, you may authorize a third-party to submit an application on your behalf. With your permission, a professional organization or your employer can submit an electronic file with your information.
How long does the application process take?
Processing takes approximately 10 days but it also depends on the volume of applications, whether or not an electronic or paper application is submitted, and whether the application passes all edits.
How much does it cost to apply?
There is no charge to apply, nor is there an annual fee. As the adage goes, “Getting an NPI is free; not getting one can be costly” (BCBS, 20007, p. 5).
What is the difference between a Type 1 and Type 2 provider?
According to the Enumerator, there are two types of NPI numbers. Individuals (Type 1) are people who are providing healthcare service. One of the questions on the individual application is the Social Security number (SSN), which is required unless you do not have a SSN or unless wish to submit with the other form of identification. Organizations (Type 2) are facilities or group where the healthcare services are being provided, such as hospitals, pharmacies, clinic, or incorporated groups (even with just one provider). The Type 2 application requires the Employee Identification Number (EIN). According to NPPES, entering the SSN or EIN does not indicate that you are billing under this number; it is only for identification purposes for the NPI application. In other words, sole proprietors are unincorporated individuals, often operating under a doing-business-as (DBA) name, who would only receive a Type 1 NPI and who do not need a Type 2 NPI (Jillian S., NPI Specialist, personal communication, October 30, 2006). As stated in the NPI application itself, “Incorporated individuals may also obtain NPIs as type 2 organizations” (Centers for Medicare & Medicaid Services, 2005, p. 5). For further information, contact the NPI Enumerator at 1-800-465-3203 or customerservice@npienumerator.com.
Does it matter whether I practice as a sole proprietor or a professional corporation?
According to the Maureen Testoni, J.D., Director, Legal and Regulatory Affairs, APA Practice Directorate, individual providers need an NPI and for that the provider will use the SSN. Separately, an incorporated provider may also need an NPI for his or her corporation. Sole proprietorships are generally unincorporated, which means that they are not seen as a separate legal entity, and can use the owner’s individual NPI instead of obtaining a separate one. If, however, a provider owns an incorporated business, then that business will need its own NPI (M. Testoni, personal communication, October 19, 2006).
What is a taxonomy code?
When applying for an NPI, providers need to pick a “taxonomy code,” which refers to code numbers that corresponding to various health-care practice descriptions. Although the Centers for Medicare and Medicaid Services (CMS) indicates that psychologists will be able to select up to 15 taxonomy codes to describe their practices, the codes include two main categories for psychologists: Psychologist (103T00000X) and Clinical Neuropsychologist (103G00000X). Within the broader categories, there are codes for subcategories, such as addiction, child, youth and family, and forensic psychology. A complete listing of taxonomy codes is available at http://www.wpc-edi.com/codes/taxonomy.
What is the format of the number?
The NPI is all numeric and has 10 positions: the first 9 positions are the identifier and the last position is a check digit. The check digit helps detect invalid NPIs.
Do I have to notify the Enumerator if I move or change jobs?
Yes, covered entities must file notice of any changes to information on their application within 30 days of the change. Non-covered entities are “encouraged” to do so as well.
Will it change the way I get paid or how long it takes to get paid?
Using an NPI will not change the way you get paid, but you should expect delays in payments during the “shakedown” period. Industry experts testified to HHS that delays of 9 weeks or more can be expected.
How do I update my billing software?
It is your responsibility to contact your software vendor to get updates that will accommodate the NPI.
What happens if I don’t have an NPI?
If you submit a claim that requires an NPI after the May 23, 2007 deadline, your claim will be rejected. In other words, getting an NPI is free; not getting one can be costly.
References
Blue Cross Blue Shield of Georgia. (2007). Provider Update, Winter, 2007. Atlanta: Blue Cross Blue Shield of Georgia.
Centers for Medicare and Medicaid Services, Department of Health and Human Services. (2005). National Provider Identifier (NPI) Application/Update Form. Form CMS-10114 (02/05). Washington, DC: Centers for Medicare and Medicaid Services.
Meyers, L. (2006). Applying for a National Provider Identifier. Monitor on psychology, 37(8), 43.
Psychotherapy Finance. (2002a). October.
Zuckerman, E. (2003). HIPAA Help. Pennsylvania: Three Wishes Press.
Zur, O. (2003). Is this HIPAA Friendly: All you need to know about HIPAA’s possums, ostriches, and eagles in three pages or less. The Independent Practitioner, 23(2), 79-82.
Dr. Doverspike is a member of the GPA Ethics Committee and coordinator of the Consulting With Colleagues series of ethics workshop. He is the author of Ethical Risk Management (1999), which is currently undergoing revision for publication later this year.
|
