What's New

June 5, 2008

The National Provider Identifier (NPI) compliance date for all HIPAA-covered entities except small health plans was May 23, 2007. Small health plans had until May 23, 2008 to comply. However on April 2, 2007, the Centers for Medicare & Medicaid Services (CMS) announced that through May 23, 2008, it would not impose penalties on covered entities that implement contingency plans to facilitate the compliance of their trading partners.

When CMS lifts its policy of enforcement leniency, complaints of non-compliance will be investigated. Penalties will be a legitimate resolution if the entity does not demonstrate compliance or corrective action. CMS will continue to employ a complaint-driven approach to enforcement. For example, if a complaint is received alleging a failure to comply with the NPI requirements, CMS will contact the entity to secure evidence of compliance and the contingency plan that had been in place. If violations are identified, enforcement actions will result.

All covered entities are expected to be using the NPI in a compliant manner, and all contingency plans should have been lifted no later than May 24, 2008.