June 30, 1998

Health Care Financing Administration
Department of Health and Human Services
Attention: HCFA-0045-P
P.O. Box 26585
Baltimore, MD 21207-0519

Re: PROPOSED RULE HCFA-0045-P

To Whom It May Concern:

The Association of American Physicians and Surgeons ("AAPS") hereby submits its comments to proposed rule HCFA-0045-P ("Proposed Rule").

AAPS is a not-for-profit membership organization that represents thousands of physicians in all practices and specialties. It was established in 1943 to preserve the practice of private medicine, and has remained dedicated to the Oath of Hippocrates and protecting the sanctity of the patient-physician relationship. It is incorporated in the State of Indiana and is tax-exempt under Section 501(c)(6) of the Internal Revenue Code.

AAPS objects to several aspects of the Proposed Rule, including its adoption of a particular national provider identifier ("NPI"). First, AAPS objects to the "Provisions" (Section II.A), which extend far beyond the statutory mandate in an arbitrary and capricious manner. Second, AAPS objects to the "NPI Standard" (Section II.D) as arbitrary and capricious; it also lacks disclosures required for meaningful notice and comment. Third, AAPS objects to the "Revisions" (Section VI) based on the Administrative Procedure Act ("APA") and the due process rights of physicians. Fourth, AAPS comments on the "Implementation" (Section III) by recommending "Option 2" for enumeration of the NPI rather than "Option 1." Fifth, AAPS objects to the omission from the Proposed Rules of necessary security measures to protect the privacy of patient data, as expressly required by the statute. Sixth, AAPS objects to the "Data" (Section IV) for arbitrarily including irrelevant demographic information upon which discrimination by health plans will likely be perpetrated against physicians. Finally, AAPS objects to the unjustified burden imposed by the Proposed Rule upon private practitioners in violation of the Paperwork Reduction Act ("PRA") and Regulatory Flexibility Act ("RFA"), and AAPS thereby comments on the "Collection of Information Requirements" (Section VII). AAPS respectfully urges the Health Care Financing Administration ("HCFA") to reconsider its Proposed Rule in light of these comments.

A. THE "PROVISIONS" (SECTION II.A).

The Provisions of the Proposed Rule would impede numerous types of common electronic transactions, ranging from routine e-mail with patients or colleagues to data transfers between specialists analyzing an unusual medical condition. Section II.A (F.R. at 25324). The Proposed Rule broadly defines governed "transactions" to include "[f]irst report of injury," "[c]oordination of benefits," "[h]ealth care payment and remittance advice," and "[h]ealth claims or equivalent encounter information." Proposed Sec. 142.103. The Proposed Rule expressly applies to "[a] health care provider when transmitting an electronic transaction as defined in Sec. 142.103," and that "[e]ach health care provider must accept and transmit national provider identifiers wherever required on all transactions it accepts or transmits electronically." Sec. 142.102(a)(3) & 142.408(b). Accordingly, the Proposed Rule prohibits a physician from communicating electronically much patient information unless he or she complies with the proposed format. The Proposed Rule simply failed to consider its overly broad impact.

The resultant regulation is far broader than mandated by the statute. In 1998 and beyond, physicians in small practices increasingly communicate with their patients by electronic mail ("e- mail"), and many of those communications include financial or administrative issues included in the foregoing definitions. It is arbitrary and capricious for the Proposed Rule to regulate the electronic communications between a physician and his or her patient (or guardian or friend), and such communications must be excluded from the Proposed Rule. Restrictions on such communications are as unconstitutional here as they would be for attorney-client communications.

Likewise, many other types of electronic communications by physicians in private practice must be exempted from the Proposed Rule. E-mail or data transfers between medical colleagues about a patient must be exempt, or else an unjustified chilling effect will result with respect to physician collaboration. Moreover, the physician must be able to communicate freely by e-mail and otherwise with a private individual or MSA program that is making payment for services rendered. These payments often involve negotiations, and communications are often efficiently handled through use of e-mail. It is arbitrary and capricious for the Proposed Rule to dictate the format of electronic communications between a private physician and an MSA or individual payer, and such communications must be exempt.

Furthermore, physicians sometimes must arrange for the electronic transfer of data files concerning patients from one office to another. Such files may include monitoring data, and may include information relating to administrative aspects of the treatment. The Proposed Rule would require the electronic modification of these data files to include additional provider information, which will necessarily delay and impede the transfer of urgent data. It is often difficult to add electronic information to a data file without corrupting the file, and assistance from computer programmers may be required in an emergency situation. The Proposed Rule should exempt electronic transfers related to medical treatment or advice.

Finally, physicians who have opted out of the government medical programs, including those who opted out pursuant to Section 4507 of the Budget Reconciliation Act of 1997, should be exempt from the definition of health care provider in Section 142.103 of the Proposed Rule. This group of physicians will not receive assignment of an NPI from the government in the foreseeable future, and perhaps never if funding is lacking. Thus these physicians will have no means or justification for conforming their electronic transmissions to the government standard. Yet the Proposed Rule prevents these physicians from communicating electronically with health plans, patients, or even colleagues without an NPI. It is arbitrary and counterproductive to deny these physicians the use of their computer simply because they are outside of the government health care programs. Imposing the Proposed Rule on this group of physicians will discourage efficient arrangements between them and health plans, including MSA-based programs. Such physicians could not electronically transmit claim information without an NPI, but would not have an NPI assigned to them by virtue of their opting out of Medicare. It is unconstitutional to prohibit, temporarily or permanently, certain electronic transactions by a physician who eschews government health care payments.

It is ironic that the Proposed Rule allows comments by e-mail, and yet impedes most of the routine e-mail currently circulated among physicians, their patients, and private payers. It would be disruptive and burdensome to require a physician to include regulatory information in e-mail and data transfers among patients, colleagues, and MSA-based payers, and such electronic communications must be exempted from the Proposed Rule.

B. THE "NPI STANDARD" (SECTION II.D).

The Proposed Rule defines an "8-position alphanumeric format" as the NPI, where the 8th position is a numeric check digit determined by the other 7 positions. Section II.D (F.R. at 25329). HCFA's rationale for using an alphanumeric format is to limit the length of NPI to 8 positions. The Proposed Rule asserts that this format allows the creation of approximately 20 billion unique identifiers. The Proposed Rule does not explain how the alphanumeric characters will be selected, or how it arrived at its total of 20 billion unique identifiers.

This proposed NPI has substantive and procedural defects. Substantively, the selection of an alphanumeric format rather than a purely numeric format (as used for Social Security Numbers) imposes costly and unnecessary burdens. For starters, use of an alphanumeric format prevents use of the telephone keypad for entering the NPI, because characters and numbers overlap on that keypad (for example, the characters "A", "B" and "C" are indistinguishable from the number "2" on a telephone keypad). Thus it will be virtually impossible for a physician or patient to inquire about the status of a claim through use of an automated telephone response system. In contrast, the numeric system used for Social Security Numbers permits easy access by telephone, as for investment or tax information. The Proposed Rule fails to address the unnecessary costs imposed by an alphanumeric format, which will have the effect of hindering access to the system by physicians and patients. The purported justification for the alphanumeric format - to reduce the number of positions in the NPI - is arbitrary and capricious. A reduction in the number of positions is only meaningful for manual use - which is precisely the use that is precluded by adoption of an alphanumeric format.

Moreover, the proposed adoption of an alphanumeric format adds unnecessary costs to the processing of the NPI. The "check digit" in the 8th position of the NPI is derived from the characters in the other 7 positions to ensure the integrity of the transmission, but can only be calculated from all-numeric base number. The Proposed Rule recognizes this complication, F.R. at 25328-29, and notes that "any alpha characters that may be part of the NPI are translated to specific numerics before the calculation of the check digit." F.R. at 25329. Even if this translation utilizes the ASCII equivalents - an important detail that HCFA failed to disclose in its proposal -- such translation adds complications for automated response systems in direct contravention of the statutory purpose of simplicity. Such complication also adds unnecessary costs to physician offices in adapting to the new system. A purely numeric identifier would avoid these arbitrary costs.

The Proposed Rule does state, in consideration of difficulties caused by alphanumeric identifiers, that the initial assigned numbers will be numeric-only. But this approach does not address the fundamental problem. Office programs for handling the NPI must still anticipate and accommodate the use of alphabetic characters. No automated telephone systems will be developed given the planned use of alphabetic characters in the NPI, nor will cheap software become available given this planned complication of alphabetic characters. Moreover, this proposal to add alphabetic characters at later stage will impose the resultant burden on individual physicians, many of whom will receive assignment of their NPIs at a later stage. These physicians are likely to encounter serious obstacles in using alphabetic characters in their NPIs, when the prior NPIs were purely numeric. This planned use of alphabetic characters is arbitrary and capricious, and would impose unjustified costs.

The proposed NPI violates procedural norms as well. The Proposed Rule does not include any discussion of how an NPI will actually be selected for a given entity. HCFA has apparently already adopted a methodology for assigning certain NPIs; the Proposed Rule says that 20 billion unique identifiers will be available, when a 7-position alphanumeric identifier actually allows about 78 billion unique possibilities (53 billion possibilities if the characters "I" and "O" are omitted to avoid confusion). AAPS is concerned about - and entitled to notice for comment upon - any methodology adopted by HCFA in selecting an NPI for a given entity. Such selection must be completely random to ensure that the NPI itself will not become a basis for discriminating against small health care providers in processing claims. If, for example, HCFA has adopted a methodology that enables, intentionally or inadvertently, a claims processor to detect the size or nature of the health care provider from the NPI itself, then discrimination such as delay in payments to physicians may result. AAPS and the public are procedurally entitled to review and comment upon the actual methodology for selecting an NPI.

C. THE "REVISIONS" (SECTION VI).

The proposed procedure for allowing revisions to the electronic standard violates due process. Section VI (F.R. at 25339). The Proposed Rule contemplates waivers for an organization to bypass the adopted standard and thereby impose its own standard. Such a procedure violates the Administrative Procedure Act and the constitutional rights to due process of physicians subjected to these revised standards.

At a minimum, no revisions to the standard should be allowed unless and until they are formally adopted by HCFA pursuant to actual notice and comment. To allow waivers without procedural protections is to undermine the standard itself, and thereby subject physicians to unjustified burdens and uncertainties. Physicians will be making substantial investments in the standard adopted by HCFA, and such government-required investments cannot and should not be destroyed by procedurally invalid modifications to the standard.

D. THE "IMPLEMENTATION" (SECTION III).

The Proposed Rule presents two options for the enumeration of health care providers. Option 1 consists of establishing a large Federally-directed registry, which would probably be a private contractor retained by the government, for the enumeration of health care providers. Option 2 consists of enumeration by existing Federal and State agencies, whereby a health care provider that participates in more than one health plan could select the plan to perform the enumeration. The Proposed Rule indicates its preference for Option 2, but states that health care providers are likely to prefer Option 1.

AAPS, on behalf of thousands of physicians, comments that Option 2 is preferable to Option 1. AAPS strongly opposes the establishment of a central, Federally-directed registry to enumerate health care providers. History has shown that such centralized registries are both expensive and vulnerable to manipulation. It would be too easy for lobbyists or special interests to convert such a registry into an improper use, such as rationing care or discriminating against certain physicians. Any conversion of the limited statutory mandate to enumerate providers into an unrestricted national registry, at enormous expense, would be arbitrary and unjustified. AAPS thereby supports HCFA in preferring Option 2 for enumerating health care providers.

That said, the Proposed Rule should clarify that a health care provider need not comply with standard specified in Sec. 142.402 unless and until it has received assignment of an NPI. It is possible, even likely, that there will be unforeseen delays in supplying an NPI to particular physicians in light of the lack of funding of the actual enumeration under either Option 1 or Option 2, and compliance requirements must reflect this delay.

E. THE PROPOSED RULE VIOLATES SECTION 1173(c) BY OMITTING SECURITY PROTECTIONS.

Section 1173(c) expressly requires the following:

(d) Security standards for health information.  
   	(1) Security standards. The Secretary shall adopt 
		security standards that--
		(A) take into account--
	         	(i)	the technical capabilities of record 
				systems used to maintain health 
				information;
			(ii)	the costs of security measures;
			(iii)	the need for training persons who 
				have access to health information;
			(iv)	the value of audit trails in computerized 
				record systems; and
			(v)	the needs and capabilities of small health 
				care providers and rural health care 
				providers (as such providers are defined 
				by the Secretary); and
		(B) ensure that a health care clearinghouse, if it is 
			part of a larger organization, has policies 
			and security procedures which isolate the 
			activities of the health care clearinghouse 
			with respect to processing information in a 
			manner that prevents unauthorized access to 
			such information by such larger organization.
	(2)	Safeguards. Each person described in section 1172(a) 
		[42 USCS Sec. 1320d-1] who maintains or transmits 
		health information shall maintain reasonable and 
		appropriate administrative, technical, and 
		physical safeguards--
		(A)	to ensure the integrity and confidentiality of 
			the information;
		(B)	to protect against any reasonably anticipated--
			(i)	threats or hazards to the security or 
				integrity of the information; and
			(ii)	unauthorized uses or disclosures of the 
				information;	
	and
		(C)	otherwise to ensure compliance with this part 
			[42 USCS Sec.Sec. 1320d et seq.] by the officers 
			and employees of such person.

Despite these express requirements, the Proposed Rule does not contain any "security standards" or "safeguards". This is a clear violation of the foregoing provisions.

Instead, the Proposed Rule mandates a standard that omits any encryption or other security features, and lacks any privacy safeguards whatsoever. The Proposed Rule expressly mandates that a "health plan may not refuse to conduct the transaction as a standard transaction" and that a "health plan may not delay the transaction or otherwise adversely affect, or attempt to adversely affect, the person or the transaction on the ground that the transaction is a standard transaction." Sec. 142.104(a)-(b). The Proposed Rule thereby requires that an unencrypted transfer of medical data be accepted as a "standard transaction," and prohibits any rejection of an electronic transfer based on lack of encryption for privacy purposes. Accordingly, the Proposed Rule makes it impossible for a recipient of electronic medical information to require encryption by the sender - all unencrypted standard transactions must be accepted. The Proposed Rule thereby ensures that unencrypted electronic transfers of medical information will become the standard for health care providers -- in direct violation of the foregoing statutory requirement.

This lack of security features in the Proposed Rule is entirely unjustified. The federal government has adopted encryption techniques in many other areas that less sensitive than personal medical information. Even users on the Internet enjoy greater security, through encryption in commercial browsers, than the Proposed Rule adopts for patients receiving private medical treatment. HCFA should revise electronic standard to include security features, and allow rejection of any electronic transaction for the reason of inadequate encryption.

F. THE "DATA" (SECTION IV).

The Proposed Rule includes in the National Provider File ("NPF") irrelevant information about age (date of birth), sex and race that will encourage discrimination against certain classes of physicians. F.R. at 25335. Thousands of incidents of discrimination based on age, sex and race arise each year in the health care industry, and there is no justification for requiring physicians in vulnerable classes to provide such information in electronic form. Of these classifications, the Proposed Rule designates the "race" classification as optional, but physicians will nevertheless feel compelled to provide such data in light of its inclusion in the NPF.

The Proposed Rule provides no plausible statutory justification in requiring this information. The Proposed Rule omits any rationale for including in the NPF the physician's age and sex, but merely states generally that information is needed "to identify a health care provider." F.R. at 25335. But given the use of the name and social security number to identify individuals, there is no need for this additional information. With respect to race, the Proposed Rule states that "Race is important to the utility of the [National Provider System] as a statistical sampling frame." Id. The Proposed Rule also states that such data "represent[s] only a fraction of the information that would comprise a provider enrollment file." Id.

It is arbitrary and capricious - and far beyond the statutory mandate - for HCFA to include the foregoing data in the NPF as a foundation for uses that extend beyond the statutory purpose - including uses that may include discrimination. The planned provision of this NPF to organizations inside and outside of the government, along with expected additions as quoted above, will subject many physicians to possible discrimination. The fields of age, sex and race should be removed from the NPF for statutory and constitutional reasons.

G. THE "COLLECTION OF INFORMATION REQUIREMENTS," THE PRA AND RFA (SECTIONS VII AND IX).

The Proposed Rule grossly underestimates its impact on physicians, in violation of the PRA. Specifically, the Proposed Rule estimates that it will only require 2 hours of time, at $30 per hour, for a physicians "to modify their current computer systems software" in compliance. F.R. at 25340. Yet the Proposed Rule does not provide any basis for this estimate.

It will require more than 2 hours simply to review and understand the data formats required by the Proposed Rule. Then many weeks of time will be required to change office practices and acquire software that complies with the new data standards. The software will be expensive, and installation will be time-consuming. AAPS believes that, based on discussions with its members, HCFA's estimates are in error by a factor of 50-100. AAPS estimates that it will require about 100 hours of time, and $5000 in costs (including office time at $30 per hour and software acquisition charges), to convert to the standards promulgated in the Proposed Rule. For the 400,000 or so physicians currently in practice, this imposes a total cost of about $2 billion. OMB should reject the Proposed Rule because it imposes costs far in excess of the benefits. This burden imposed on small entities - physicians in private practice -- also requires rejection of the Proposed Rule under the RFA.

CONCLUSION.

AAPS respectfully urges HCFA to consider and implement the above modifications with respect to HCFA-0045-P. Please contact me if I can be of further assistance.

Sincerely,