Your NPI Is Easy to Steal; Here's How to Prevent That

James F. Sweeney


September 10, 2019

That "need to know" policy should apply within the practice as well, she said. NPIs should be shared only with those who need them to do their jobs, such as coders and billers.

And because physicians and practices have separate NPIs, doctors should be sure the practice is using the appropriate identifiers during transactions. Doctors can't loan their NPIs to others.

Doctors who leave a practice should make sure that their former employer is not still using their number, whether out of habit or deliberately.

NPIs follow physicians throughout their career, regardless of where they practice. Doctors who leave a practice should make sure that their former employer is not still using their number, whether out of habit or deliberately. Physicians who stop practicing can notify CMS so that their NPIs are flagged as no longer valid for future transactions.

Practices should have policies in place to detect fraud and misuse. The most important of these is routinely checking Medicare and Medicaid statements for errors or suspicious activity and following up on discrepancies.

Physicians also should make sure a criminal has not used an NPI to set up a separate mailing address. And keep meticulous billing records that are backed up in the cloud, said attorney Bivens, who added that small practices tend not to have these safeguards.

"They don't have compliance at the outset, and they don't have anyone afterward checking to make sure things are on the up and up," she said.

Practices also should ask patients to notify them of any erroneous or suspicious billing statements, Seale said.

Having these policies in place might not prevent misuse, but they are helpful in tracking down where and how it occurred and are a valuable part of a practice's defense against any charges of fraud, she said.

What to Do if Your NPI Is Misused

Experts say that although some NPI-related fraud is committed by outsiders and organized crime, it's most often done by someone within a practice or someone with whom the practice does business, such as a vendor or lab. Seale suggested stipulating in employment contracts that employees will be liable if they misuse NPIs.

Physicians can become aware of NPI misuse in different ways. The lucky ones discover it themselves.

The unlucky ones don't become aware of it until they're contacted by the FBI or HHS Office of Investigations. And sometimes, that "contact" comes in the form of a raid, complete with seized computers and records, criminal charges, and bad publicity. That can destroy a practice, even if it's ultimately determined that the physicians were innocent of fraud.

For example, during a formal fraud investigation, Medicare and Medicaid payments to a practice are stopped, which can cripple finances and force affected patients to go elsewhere.

"Like all identity theft, medical identity theft is not something easily dealt with," said Texas attorney Nanette Beaird, who recommended that practices who have identified potential misuse on their own do some preliminary investigating and contact any outside organization that might be involved, such as a vendor. Insist that all parties cooperate in examining records and documents to pin down the source of the problem, she said.

It's not only CMS that investigates fraud. Private payers do as well. Insurance companies use data analytics to detect abnormalities in claims and investigate those further, said Cathryn Donaldson, spokeswoman for America's Health Insurance Plans (AHIP), an industry group.

Insurers will try to resolve discrepancies with providers, but will contact law enforcement if they find criminal activity, she said. AHIP is part of the Healthcare Fraud Prevention Partnership, a public-private organization fighting healthcare fraud.


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.