25
February
0
Comments
Sticky
Navigating NPI and PTAN: A Simple Guide for Providers
in Blog
What is the difference between NPI and PTAN?
The National Provider Identifier (NPI) and the Provider Transaction Access Number (PTAN) are both used in the healthcare industry to identify providers through the use of identification numbers. The National Provider Identifier is assigned to every medical facility and physician throughout the United States through a national standard laid out by HIPAA when performing industry and administrative tasks such as submitting billing services to insurance companies, keeping patient and medical records, and auditing. In comparison, the Provider Transaction Access Number is more limited in its application as it pertains only to Medicare related claims and transactions. Despite both being used to identify personnel and medical facilities within the realm of healthcare, the NPI and PTAN are distinct in application. A provider will only have one NPI to comply with the national standard, however, they may be linked with multiple PTAN IDs depending on if the provider is associated with multiple medical practices.
National Provider Identifier
The NPI is a universal ID uniquely assigned to each covered health care provider and facility. It is used as a personal identifier in administrative and financial HIPAA standard transactions for that provider or facility. It’s formatted as a 10 digit number that is issued by the National Plan and Provider Enumeration System and is assigned to a provider for their entire career, even if they change location.
Provider Transaction Access Number
PTAN is more narrow as it only relates in the realm of the government program Medicare. It is a six digit ID issued by the Medicare Administrative Contractors (MACs) when the provider registers and is approved as a Medicare provider. These providers who have enrolled with Medicare receive these numbers that are used as identification when submitting Medicare claims or checking on Medicare payments. This is in contrast to NPI’s which are universally granted and adhere to all health plans and health care clearinghouses when submitting transactions. The first two digits of the PTAN ID are unique to the state of the enrollee. For instance, covered Florida providers would have PTAN identification codes that start with “10”. The remaining four digits are specific to the type of healthcare entity the identification number is linked to.
HIPAA Compliance
The NPI was introduced as a provision in 2004 to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in an effort to standardize a way to identify providers and to boost billing efficiency. This identification number promotes HIPAA compliance to reduce fraud and error within the billing process such as catching activity that falls within the walls of the False Claim Act, such as upcoding. The PTAN is assigned as part of the Medicare enrollment process and also does its part to reduce fraud by ensuring only legitimate Medicare claims are being processed and billed. NPIs are also published on a public forum via public directory through the NPI Registry website.
Avoiding NPI fraud
As NPIs are public record and because of the unique and personalized quality of NPIs, this makes them vulnerable to fraudulent activity such as cyber attacks or even employee mishandling. There have been cases such as United States v. Michael which illustrates how NPIs can lead to fraudulent activity by even the misuse of healthcare employees. A pharmacist used several other health professionals’ NPIs to fraudulently fill prescriptions and bill unwarranted claims. Fraudulent activity such as this could have a detrimental impact on the associated healthcare entity as there have been cases where CMS has stopped payments amidst an investigation, which could impact the financial stability or even reputation of that entity. In order to prevent fraud with these identification numbers, it is important to take a few precautions. Although NPIs are public record, it is still important to safeguard this personalized ID. In order to do this, avoid sharing your ID unless for a legitimate reason or you are explicitly authorized to do so. Performing record upkeep by allocating time in your schedule to monitor claims and payments to ensure the activity is correct and matches the monetary value actually coming in is an essential task to ensure nothing appears out of the ordinary. When fraudulent activity is caught, having a response plan in place can help reduce and mitigate damages.
***************************************************
It should be noted that I am not your lawyer (unless you have presently retained my services through a retainer agreement). This post is not intended as legal advice; it is purely educational and informational, and no attorney-client relationship shall result after reading it. Please consult your own attorney for legal advice. If you do not have one and would like to retain my legal services, please get in touch with me using the contact information listed above.
All information and references to laws, rules, regulations, and advisory opinions were accurate as of this time, but laws are constantly evolving. Please get in touch with me to ensure that the law governing your business is up to date. Thank you.
Sticky
My DEA Number Was Stolen by an Employee and Used to Self-Prescribe Controlled Substances
in Blog
Most doctors have various licenses that provide them with unique identification numbers. If any of these identification numbers find their way into the wrong hands it can be detrimental to the healthcare provider’s practice, their patients, and the public. Doctors hire support staff to run their practice efficiently by perform tasks that they don’t have time to do or don’t have the training to perform. This employer-employee relationship requires a certain level of trust from both parties because a bad act by either party can have a negative impact on the other party’s license, privileges, or reimbursement for services. Some of the support staff working in a doctor’s office may have access to HIPAA-protected information and a doctor’s unique identification numbers, such as his NPI and DEA numbers. What should you do if one of your employees steals your DEA number and uses it to self-prescribe controlled substance through e-prescribing or traditional prescription pads? What if they use your DEA number to order controlled substances for the practice without your knowledge or consent? Doctors should also be concerned with their potential liability for the unauthorized use of their DEA number.
Reporting Requirement
According to Florida Statute §893.07(5)(b), if your DEA number has been stolen and used to divert controlled substances you must file a police report with the local sheriff of that county within 24 hours after discovery. A person who fails to report a theft or significant loss of a controlled substance commits a misdemeanor of the second degree. It is not required that you press charges against the perpetrator of the theft, but I always recommend that my clients do so for several reasons. First, it shows authorities that you were not complicit in the theft. Second, it becomes part of the employee’s record and prospective future employers will be able to see this information on their criminal history during background checks. Third, as punishment for the emotional despair you will endure, negative impact on your practice, and the cost to hire an attorney to represent you in this matter.
You must also notify the Drug Enforcement Agency (“DEA”) within one business day upon discovery of a theft or significant loss of controlled substances. “Upon discovery” means that a report should be filed once the doctor has made a good-faith effort to determine whether a theft has in fact occurred. To determine whether a loss is significant the DEA provided the following factors in 21 C.F.R. § 1301.74(c):
1) The actual quantity of controlled substances lost in relation to the type of business;
2) The specific controlled substances lost;
3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances;
4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,
5) Whether the specific controlled substances are likely candidates for diversion; and
6) Local trends and other indicators of the diversion potential of the missing controlled substance.
The six factors mentioned above are not exhaustive and should be taken into account with other factors where appropriate.
According to 21 C.F.R. § 1301.76(b), the DEA’s implementing regulations for the Controlled Substance Act, all DEA registrants must complete DEA Form 106 and submit it to the DEA electronically or by mail. Once submitted, the DEA will begin the investigatory process and contact you to obtain additional information.
Additionally, you should contact the board or association that grants you your license to practice (i.e. Florida Board of Osteopathic Medicine) to see what reporting requirements they may have. For example, although I could not find a clearly defined rule requiring so, the Florida Board of Osteopathic Medicine (“FDOM”) strongly suggests that the doctor file a complaint with the Florida Department of Health (“DOH”) against the perpetrator of the crime so that they may conduct their own investigation into the matter. The complaint should be sent to the Consumer Services Section of the DOH. You will typically receive a response from the DOH within ten business days at which point in time they may schedule a phone call or an in person meeting as part of their ongoing investigation. This investigation may include interviewing parties in your practice about the perpetrator or the crime and facts and events that gave rise to the incident.
During all stages of the investigation, whether talking to the DEA, local police authorities, or the DOH you must be candid with the investigating authorities so that there isn’t any indication of impropriety on your part.
Steps To Prevent A Theft From Occurring Again
To limit the occurrence of future thefts or significant loss, providers should do the following:
- Conduct employee background checks for all employees, including those employees with access to controlled substances. This background check should be performed in any local, state jurisdiction where the employee has worked and resided. Federal background checks should also be performed.
- Schedule I and II drugs must be stored separately from other drugs in an approved safe. Schedule III and IV drugs must also be kept under lock and key but the security measures are more relaxed than their counterparts.
- Utilize tracking software that records specific employee’s removal of controlled substances from locked cabinets together with an associated patient identifier. The software is designed to flag and alert the doctor of suspicious or unusual employee activity.
- Providers should also conduct periodic internal audits to ensure that the inventory of controlled substances is accurate.
- Providers may also want to consider a adopting a policy into their practice which requires employees to be periodically drug tested and suspicion-based drug testing. Drug testing should be performed prior to employment; the offer of employment should be conditional on a clean drug test.
- Sparingly share you DEA number and e-prescribing log-in information only with trusted employees.
- Make sure that your prescription pads are locked up in a secure area. Utilize watermarks on your prescription pads because it makes it more difficult to replicate.
- Monitor remittance advice, claims and reimbursements to verify billed services match your income.
- Observe and takes notes of erratic or unusual behavior by an employee (i.e. lying and mood swings) and physical abnormalities, such as “track marks”, excessive sweating, pale skin, red face with red eyes, etc.
- Implement a training program to educate staff on controlled substance diversion.
Conclusion
If you are unable to determine whether a theft of controlled substances did in fact occur within one business day, you should err on the side of caution and file a report with the DEA and other appropriate authorities. It may also be necessary to notify the Center for Medicare and Medicaid Services If you fail to timely report a theft or significant loss you may face penalties and fines or any other remedial actions that the authorities deem are necessary. If any patients were affected by the theft you must determine how to appropriately notify your patients. Make sure to gather any documents or evidence that can be useful for authorities during their investigation. Any theft of prescribing pads should be reported to the Board of Pharmacy.
****
This post was authored by Jamaal R. Jones, Esquire of Jones Health Law, P.A. for more information contact me at (305) 877-5054; email us at JRJ@JonesHealthLaw.com, or visit our website at www.JonesHealthLaw.com.
It should be noted that I am not your lawyer (unless you have presently retained my services through a retainer agreement). This post is not intended as legal advice, it is purely educational and informational, and no attorney-client relationship shall result after reading it. Please consult your own attorney for legal advice. If you do not have one and would like to retain my legal services please contact me using the information listed above.
All of the information and references made to laws, regulations, and advisory opinions were accurate based on the law as it existed at this time, but laws are constantly evolving. Please contact me to be sure that the law which will govern your business is current. Thank you.