We assessed a number of candidate identifiers to see if they met the four specific criteria discussed above. We first assessed the identifiers listed in the inventory of standards prepared for the Secretary by the Health Informatics Standards Board. Those standards are the unique physician identification number (UPIN), which is issued by HCFA; the health industry number (HIN), which is issued by the Health Industry Business Communications Council; the National Association of Boards of Pharmacy (NABP) number, which is issued by the National Council for Prescription Drug Programs in cooperation with the NABP; and the national provider identifier (NPI), which is being developed by HCFA.
Unique physician identification numbers are currently issued to physicians, limited license practitioners, group practices, and certain noninstitutional providers (for example, ambulance companies). These numbers are issued to health care providers through Medicare carriers, and generally only Medicare providers have them. The unique physician identification number is used to identify ordering, performing, referring, and attending health care providers in Medicare claims processing. The computer system that generates the numbers is maintained by HCFA and is able to detect duplicate health care providers. The unique physician identification number is in the public domain and could be made widely accessible to health care providers and health plans. These numbers do contain intelligence (the first position designates a provider type, e.g., physician) and are only six positions long, which would not be able to accommodate a sufficient number of future health care providers. The unique physician identification number does not meet criteria 2 and 10.
The health industry number is used for contract administration in the health industry supply chain, as a prescriber identifier for claims processing, and for market analysis. It consists of a base 7-position alpha-numeric identifier and a 2-position alpha-numeric suffix identifying the location of the prescriber. The suffix contains intelligence. Health industry numbers can enumerate individual prescribers as well as institutional providers. They are issued via a proprietary system maintained by the Health Industry Business Communications Council, which permits subscriptions to the database by data re-sellers and others. In addition, it does not collect sufficient data for thorough duplicate checking of individuals. The health industry number does not meet criteria 1, 3, and 10.
The National Association of Boards of Pharmacy number is a 7-digit numeric identifier assigned to licensed pharmacies. It is used to identify pharmacies to various payers. Its first two digits denote the State, the next four positions are assigned sequentially, and the last position is a check digit. We cannot assess data accessibility or privacy and confidentiality at this time because of the very limited applicability of the number. A 7-digit numeric identifier would not yield a sufficient quantity of identifiers, and there is intelligence in the number. This number does not meet criteria 2 and 10.
The NPI is intended to be a universal identifier, which can be used to enumerate all types of health care providers, and the supporting data structure incorporates a comprehensive list of provider types developed by an ANSI Accredited Standards Committee X12N workgroup. It is an intelligence-free 8-position alpha- numeric identifier, with the eighth position being a check digit, allowing for approximately 20 billion possible identifiers. The NPI would not be proprietary and would be widely available to the industry. The system that would enumerate health care providers would be maintained by HCFA, and data would therefore be safeguarded under the Privacy Act (5 U.S.C 552a). The system would also incorporate extensive search and duplicate checking routines into the enumeration process. The NPI meets all four of these criteria.
In addition, we examined the social security number issued by the Social Security Administration, the DEA number issued by the Drug Enforcement Administration, the employer identification number issued by the Internal Revenue Service, and the national supplier clearinghouse number issued by the Medicare program and used to identify suppliers of durable medical equipment and other suppliers. Neither the social security number nor the DEA number meets the accessibility test. The use of the social security number by Federal agencies is protected by the Privacy Act, and the DEA number must remain confidential in order to fulfill its intended function of monitoring controlled substances. The employer identification number does not meet the comprehensiveness test, because some individual health care providers do not qualify for one. The length of the national supplier clearinghouse number is 10 positions; to expand it would make it too long. Also, it is not intelligence-free, since the first portion of the identifier links health care providers together into business entities. The last four positions are reserved for subentities, leaving only the first six positions to enumerate unique health care provider entities.
Based on this analysis, we recommend the NPI be designated as the standard identifier for health care providers. It is the only candidate identifier that meets all four of the criteria above. In addition, the NPI would be supported by HCFA to assure continuity. As discussed in section VII. of this preamble, on collection of information requirements, the data collection and paperwork burdens on users would be minimal, and the NPI can be used in other standard transactions under the HIPAA. In addition, as discussed in sections III.B., Enumerators, and IX., Impact Analysis, implementation costs per health care provider and per health plan would be relatively low, and we would develop implementation procedures. The NPI would be platform and protocol independent, and the structure of the identifier has been precisely stated. The NPI is not fully operational, but it is undergoing testing at this time, and comprehensive testing will be completed before the identifier is implemented.