The Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification required healthcare providers to adopt a standard unique health identifier.
The NPI Final Rule, published on January 23, 2004, established the NPI as this unique identifier.
Covered healthcare providers, health plans, and clearinghouses must use NPIs in administrative and financial transactions.
The Centers for Medicare & Medicaid Services (CMS) developed the National Plan and Provider Enumeration System (NPPES) to assign these unique identifiers.
For more information on how to apply for an NPI, visit https://nppes.cms.hhs.gov/NPPES/Welcome.do.
What Is an NPI?
An NPI, or National Provider Identifier, is a unique 10-digit number the Centers for Medicare & Medicaid Services (CMS) assigns to health care providers in the United States through the NPPES system.
An NPI does not replace a state license, DEA number, or tax ID. The same NPI follows the provider across job changes and locations.
HIPAA requires it for all standard electronic health care transactions, from insurance claims to referral authorizations.
The number is permanent: it stays with a provider for life, regardless of job changes, relocation, or specialty changes. It carries no embedded information about the provider and does not encode a state, specialty, or license number.
Do I need an NPI to enroll in Medicare and participate in Medicaid?
Yes, you must have an NPI to apply for Medicare enrollment, and you must provide it on your enrollment application. Medicare will reject an enrollment application without an NPI. You cannot bill for and be reimbursed for Medicaid services without an NPI number.
Who can get an NPI number?
Any healthcare provider can get an NPI number. That includes individuals and organizations that furnish, bill, or are paid for health care in business.
- a provider of services as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u),
- a provider of medical or health services as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s), and
- any other person or organization that furnishes, bills, or is paid for health care in the normal course of business.
Who must get an NPI number?
Only HIPAA-covered providers must get one.
All HIPAA-covered healthcare providers, whether individuals or organizations, must obtain an NPI.
A HIPAA-covered entity is a:
- Healthcare provider that conducts certain transactions in electronic form
- A Healthcare clearinghouse
- A Health plan (including commercial plans, Medicare, and Medicaid) with a HIPAA standard transaction, even if you use a business associate to do so.
The table below shows which provider types count as covered entities. Healthcare providers and organizations that conduct HIPAA transactions are covered entities. Health plans and healthcare clearinghouses are also covered entities, but they are non-provider entities.
| Individuals | Organizations |
|---|---|
| Physicians | Ambulance Companies |
| Physical Therapists | Clinics |
| Pharmacists | Group Practices |
| Nurses | Health Maintenance Organizations (HMOs) |
| Dentists | Home Health Agencies (HHAs) |
| Chiropractors | Hospitals |
| Laboratories | |
| Nursing Homes | |
| Pharmacies | |
| Residential Treatment Centers | |
| Suppliers of Durable Medical | |
| Equipment (DME) |
You can use our free covered entity questionnaire to help you determine whether you are a covered entity. For more information, refer to https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html.
What are the two NPI Entity Types?
For NPI enumeration purposes, there are two types of healthcare providers: Entity Type 1 (Individual) and Entity Type 2 (Organization).
Entity Type 1: Individual Health Care Providers, Including Sole Proprietors
Individual health care providers may receive NPIs as Entity Type 1. As a sole proprietor, you must apply for the NPI using your Social Security Number (SSN), not an Employer Identification Number (EIN), even if you have an EIN.
As a sole proprietor, you may receive only one NPI, like any other individual. For example, if a physician is a sole proprietor, the physician may receive only one NPI (the individual’s NPI).
The following factors affect whether a sole proprietor is an Entity Type 1:
- Number of different office locations
- Whether you have employees
- Whether the Internal Revenue Service (IRS) issued an EIN to you so your employees’ W-2 forms can reflect the
employees’ Taxpayer Identification Number (which is your SSN)
NOTE: A sole proprietor is not an incorporated individual because they did not form a corporation. If you are a sole practitioner or solo practitioner, you may not be a sole proprietor, and vice versa.
Entity Type 2: Organization Health Care Providers
Group health care providers are eligible for NPIs as Entity Type 2, and both solo clinicians and organizations can apply.
CMS defines this to include a provider of services as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u), a provider of medical or health services as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s), and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business.
They may have one employee or thousands. For example, an incorporated individual may be the only health care provider employed by that organization (the corporation that they formed).
Some organizations’ health care providers function independently from their “parent” organization. These components may furnish different types of health care or have separate physical locations where health care is furnished.
These components and their physical locations are not legal entities; they are part of the organization’s health care provider (the organization’s legal entity). The NPI Final Rule refers to the components and locations as subparts.
An organization’s health care provider organization’s subparts’ NPIs. If a subpart conducts standard transactions (that is, separately from its parent), it must obtain its own NPI.
Subpart determination ensures that entities within a covered organization are uniquely identified in HIPAA standard transactions with Medicare and other covered entities.
For example, a hospital offers acute care, laboratory, pharmacy, and rehabilitation services. Each subpart may require its own NPI because each one sends its standard transactions to one or more health plans.
NOTE: Subpart delegation does not affect Entity Type 1 health care providers. As individuals, these healthcare providers cannot designate subparts and cannot be considered subparts.
What if I’m an Individual Incorporated Health Care Provider?
If you are an individual who is a healthcare provider and who is incorporated, you may need to obtain an NPI for yourself (Entity Type 1) and an NPI for your corporation or LLC (Entity Type 2).
Can I keep my NPI Number private?
No, an NPI number cannot be private. It is public by design.
Public Registry: All NPI numbers and associated basic practice information are completely public and searchable through the government-managed NPPES NPI Registry.
Disclosable Information: Under Freedom of Information Act (FOIA) guidelines, data elements such as the provider’s legal name, NPI number, practice address, phone number, and taxonomy (specialty) code are a matter of public record.
What Remains Confidential: Sensitive personal data, such as your Social Security Number (SSN), Individual Taxpayer Identification Number (ITIN), and date of birth, are not made public or released on the registry.