Navigating NPI and PTAN: A Simple Guide for Providers

What is the difference between NPI and PTAN?

The National Provider Identifier (NPI) and the Provider Transaction Access Number (PTAN) are both used in the healthcare industry to identify providers through the use of identification numbers. The National Provider Identifier is assigned to every medical facility and physician throughout the United States through a national standard laid out by HIPAA when performing industry and administrative tasks such as submitting billing services to insurance companies, keeping patient and medical records, and auditing. In comparison, the Provider Transaction Access Number is more limited in its application as it pertains only to Medicare related claims and transactions. Despite both being used to identify personnel and medical facilities within the realm of healthcare, the NPI and PTAN are distinct in application. A provider will only have one NPI to comply with the national standard, however, they may be linked with multiple PTAN IDs depending on if the provider is associated with multiple medical practices.

National Provider Identifier

The NPI is a universal ID uniquely assigned to each covered health care provider and facility. It is used as a personal identifier in administrative and financial HIPAA standard transactions for that provider or facility. It’s formatted as a 10 digit number that is issued by the National Plan and Provider Enumeration System and is assigned to a provider for their entire career, even if they change location.

Provider Transaction Access Number

PTAN is more narrow as it only relates in the realm of the government program Medicare. It is a six digit ID issued by the Medicare Administrative Contractors (MACs) when the provider registers and is approved as a Medicare provider. These providers who have enrolled with Medicare receive these numbers that are used as identification when submitting Medicare claims or checking on Medicare payments. This is in contrast to NPI’s which are universally granted and adhere to all health plans and health care clearinghouses when submitting transactions. The first two digits of the PTAN ID are unique to the state of the enrollee. For instance, covered Florida providers would have PTAN identification codes that start with “10”. The remaining four digits are specific to the type of healthcare entity the identification number is linked to.

HIPAA Compliance

The NPI was introduced as a provision in 2004 to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in an effort to standardize a way to identify providers and to boost billing efficiency. This identification number promotes HIPAA compliance to reduce fraud and error within the billing process such as catching activity that falls within the walls of the False Claim Act, such as upcoding. The PTAN is assigned as part of the Medicare enrollment process and also does its part to reduce fraud by ensuring only legitimate Medicare claims are being processed and billed. NPIs are also published on a public forum via public directory through the NPI Registry website. 

Avoiding NPI fraud

As NPIs are public record and because of the unique and personalized quality of NPIs, this makes them vulnerable to fraudulent activity such as cyber attacks or even employee mishandling. There have been cases such as United States v. Michael which illustrates how NPIs can lead to fraudulent activity by even the misuse of healthcare employees. A pharmacist used several other health professionals’ NPIs to fraudulently fill prescriptions and bill unwarranted claims. Fraudulent activity such as this could have a detrimental impact on the associated healthcare entity as there have been cases where CMS has stopped payments amidst an investigation, which could impact the financial stability or even reputation of that entity. In order to prevent fraud with these identification numbers, it is important to take a few precautions. Although NPIs are public record, it is still important to safeguard this personalized ID. In order to do this, avoid sharing your ID unless for a legitimate reason or you are explicitly authorized to do so. Performing record upkeep by allocating time in your schedule to monitor claims and payments to ensure the activity is correct and matches the monetary value actually coming in is an essential task to ensure nothing appears out of the ordinary. When fraudulent activity is caught, having a response plan in place can help reduce and mitigate damages.

***************************************************

It should be noted that I am not your lawyer (unless you have presently retained my services through a retainer agreement). This post is not intended as legal advice; it is purely educational and informational, and no attorney-client relationship shall result after reading it. Please consult your own attorney for legal advice. If you do not have one and would like to retain my legal services, please get in touch with me using the contact information listed above.

All information and references to laws, rules, regulations, and advisory opinions were accurate as of this time, but laws are constantly evolving. Please get in touch with me to ensure that the law governing your business is up to date. Thank you.