ATLANTA--The new Internet registry of National Provider Identification numbers contains a potential landmine, warned Chris Rice, founder of provider forum competingbid.com, last week.
Activated Sept. 4 after months of preparation, the National Plan and Provider Enumeration System database allows health care providers to locate their referral sources' NPI numbers, necessary for submitting compliant claims to Medicare.
But Rice said the online registry, which discloses information obtainable through the Freedom of Information Act, also reveals providers' National Supplier Clearinghouse numbers. Displaying an NSC number to the public is akin to knowing someone's Social Security number, he said.
"You can call into any one of the [DME] MACS and enter that NSC number and you have access to all kinds of information," said Rice.
For example, he said, people who know those NSC numbers could find out how much Medicare paid a specific provider. "A provider can easily listen to automated recordings of checks written to their competitors," he said. "Further, patient information can also be obtained (assuming they have the patient's HIC number)."
Once he became aware of the issue, Rice posted a warning on his site that elicited more than 130 e-mails from providers, he said.
"One concern I have--other than payment/check-write information and patient/claim-specific information being readily available if someone has your NSC ID--is that someone with the information on the NPI site could potentially make changes to your NSC provider file without your knowledge or consent," wrote one of the Web site respondents.
The possible ramifications are of such concern that Rice and several providers on the forum said they had tried to contact the NSC about the issue, but with little success. "I spoke with the NSC, the MAC and the NPI folks ... Each referred me to the other," Rice said. "Finally, they sent me to a CMS phone number. It referred me to the NSC."
One agency suggested deleting the information, but Rice and other forum writers were leery of doing that. "If you go and delete your NSC numbers, [other sources] say it will confuse the system and it won't cross-link, and then you won't get paid," Rice said. "We don't know if that is true or not yet, but that's what they are telling us."
According to a recent CMS communication sent to providers, Part B carriers and DME MACS have begun to turn on edits to validate the NPI/legacy number pairs submitted on claims. "If the pair is not found on the Medicare NPI crosswalk, the claim will reject," CMS said. (See HomeCare Monday, Sept. 10.)
Rice questioned the need for all the information listed on the registry. "You can understand names, addresses, phone numbers and the NPI number, but why it needs to go beyond that, I don't get it," he said.
"The easiest fix," he noted on his Web site, "would be for the NPPES to just not show those [extra] fields."
The solution for preventing unscrupulous people from using other NSC numbers is also easy, he said: "The MACs should require a PIN to access their automated systems." Rice said that physicians' provider numbers are also shown in the registry, but a separate PIN is required to access their proprietary information. "That's what HME needs," he said.
The NSC could not be reached Friday for comment.
Access the NPI registry.
