TEAMWORK MAKES THE SCHEME WORK: STATE LICENSURE VERIFICATION FOR NATIONAL PROVIDER IDENTIFIER APPLICANTS ANTHONY SINGER* I. INTRODUCTION David Williams has exposed a weakness in the American health insurance system. On October 12, 2017, a Texas man, David Williams, was arrested on a charge of felony health care fraud, punishable by up to ten years in prison and a $250,000 fine.1 Seven months later, he was convicted after a two-day trial, and the charges had quadrupled. Over the course of four years, Williams had applied for and acquired at least twenty National Provider Identifiers (“NPIs”) from the Centers for Medicare and Medicaid Services (“CMS”).2 The NPI is a unique, ten- digit identification number that health care providers and health plans “must use . . . in the administrative and financial transactions adopted under HIPAA.”3 To apply for an NPI, providers must submit personal details such as their Social Security Number, personal and business addresses, and licensure information.4 David Williams, who held a Ph.D. in kinesiology and operated a personal training business, but is neither a physician nor licensed to practice any of the professions eligible to receive an NPI, falsely certified on his applications that he was a licensed physician who practiced sports medicine.5 Williams’ deception, however, was not as difficult as one might imagine. A federal prosecutor noted that CMS “relies on the honesty of [NPI] applicants”6 * J.D. & M.P.H. Candidate, 2021, Indiana University Robert H. McKinney School of Law & Richard M. Fairbanks School of Public Health; B.A., 2017, Indiana University. Many thanks to Professor Dan Orenstein for his advice and support throughout the development of this Note. 1. Ryan Osborne, Fort Worth Trainer ‘Dr. Dave’ Accused of $25 Million Health Care Fraud, FORT WORTH STAR-TELEGRAM (Oct. 13, 2017), https://www.star-telegram.com/news/ local/fort-worth/article178779236.html [https://perma.cc/6LN8-RSBR]. 2. Marshall Allen, Senators Call for Closing “Loopholes” That Make Health Care Fraud Easy, PROPUBLICA (Aug. 14, 2019), https://www.propublica.org/article/senators-call-for-closing- loopholes-that-make-health-care-fraud-easy [https://perma.cc/7GTL-ERKZ] [hereinafter Allen, Loopholes]. 3. National Provider Identifier Standard (NPI), CTR. FOR MEDICARE & MEDICAID SERV., h t tps:/ /www.cms.gov/Regulat ions-and-Guidance/Administrat ive-Simplif icat ion / NationalProvIdentStand/ [https://perma.cc/76SH-8M83] (last updated May 15, 2018). 4. National Provider Identifier (NPI) Application/Update Form, CTR. FOR MEDICARE & MEDICAID SERV., https://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/Downloads/CMS 10114.pdf [https://perma.cc/EGJ3-22ZG] (last visited Feb. 21, 2021). 5. Marshall Allen, Health Insurers Make It Easy for Scammers to Steal Millions. Who Pays? You., PROPUBLICA (July 19, 2019), https://www.propublica.org/article/health-insurers-make-it- easy-for-scammers-to-steal-millions-who-pays-you [https://perma.cc/U5E2-4PES] [hereinafter Allen, Scammers]. 6. Id. 418 INDIANA HEALTH LAW REVIEW [Vol. 18:417 and does not verify the submitted information,7 and CMS only verifies the credentials of those who enroll to provide care to Medicare and Medicaid patients.8 Using his NPIs, Williams was able to bill insurers Aetna, Cigna, and United HealthCare to the tune of $25 million for providing personal training services, posing as an out-of-network provider and hoping that the insurers would not bother to investigate.9 Upon his conviction, in addition to a sentence of approximately nine years in federal prison, the judge ordered that Williams pay the entire sum that he received from the insurers in restitution, a total of nearly $4 million.10 David Williams is not the only person to obtain NPIs under false pretenses and use them to fraudulently bill insurers; there have been other cases investigated recently in which non-licensed clinic administrators acquired NPIs using false information and used them to bill millions in claims.11 The cost of this kind of health insurance fraud tends to be passed along to consumers through increased premiums, copays, and deductibles or reductions in benefits, which reduces the stakes of fraud for insurers and disincentivizes the development of sound preventative or investigative measures.12 CMS acknowledged that it did not verify certain information submitted as part of an NPI application, including whether an applicant is licensed to practice medicine, and the agency claimed that it needed “explicit authority” from the Department of Health and Human Services (“HHS”) in order to verify such information.13 In August 2019, Marshall Allen’s initial article on David Williams and his fraud14 prompted six U.S. senators to write a letter to the HHS Secretary, Alex Azar, and the Administrator of CMS, Seema Verma, to request information 7. There are some exceptions to this. See HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3434 (Jan. 23, 2004) (“As health care provider data are entered into the NPS from the application, the NPS will check the data for consistency, standardize addresses, and validate the Social Security Number (SSN) if the individual applying for an NPI provides it; the NPS will validate the date of birth only if the SSN is validated . . . . If problems [with the applicant’s information] are not encountered, the NPS will then search its database to determine whether the health care provider already has an NPI. If a health care provider has already been issued an NPI, an appropriate message will be communicated. If not, an NPI will be assigned.”). 8. Allen, Scammers, supra note 5. 9. Press Release, U.S Attorney’s Office for the N. Dist. of Tex., Fort Worth Man Convicted of Health Care Fraud Scheme (May 24, 2018), https://www.justice.gov/usao-ndtx/pr/fort-worth- man-convicted-health-care-fraud-scheme [https://perma.cc/KX55-EN5Z]; see also id. 10. Allen, Scammers, supra note 5. 11. Id. 12. Marshall Allen, We Asked Prosecutors If Health Insurance Companies Care About Fraud. They Laughed at Us., PROPUBLICA (Sept. 10, 2019), https://www.propublica.org/article/we- asked-prosecutors-if-health-insurance-companies-care-about-fraud-they-laughed-at-us [https://perma.cc/AZ3H-27FD] [hereinafter Allen, Prosecutors]. 13. Allen, Scammers, supra note 5. 14. Id. 2021] TEAMWORK MAKES THE SCHEME WORK 419 on CMS’s efforts to improve the agency’s ability to prevent and investigate fraud.15 As of March 2020, there had been no response from the administration. David Williams exposed a gap in the American health insurance system, and due to its ripeness for fraudulent action, that gap needs to be addressed, and the appropriate adjustment is licensure verification for NPI applicants by CMS. Section II of this Note explores the federal government’s efforts to improve the efficiency of health care in the face of technological change and the NPI’s place in those efforts. Section III examines the regulatory standard that HHS must meet in order to assign NPIs, argues that the HHS interpretation of these regulations does not deserve deference, illustrates the standard in a recognizable manner, and determines that HHS is not meeting the standard. Section IV describes the practicality of adjusting the NPS application process to meet the regulatory standard. Section V surveys the federal policymaking landscape to determine the likelihood of meaningful action on this issue in the immediate future. II. HIPAA, ADMINISTRATIVE SIMPLIFICATION, AND THE NPI The NPI’s purpose was to simplify the administration of health care and improve the efficiency of health information transmission. Individual health plans, be they administered by government or by private entities, are used to assign identification numbers to providers and suppliers in their networks, and these identification numbers often were not standardized within plans nor were they standardized across health plans, resulting in confusion and complication when claims were submitted and processed.16 As this chaos was unfolding, the growing adoption of computers in the workplace meant that businesses were able to store ever-larger amounts of data, thereby compounding the potential for mistakes. The use of computers for recordkeeping purposes proliferated throughout many institutions of American life—especially government17—during the latter half of the 20th century, but the health care industry lagged behind. As 15. Letter from Catherine Cortez Masto, U.S. Sen., Nev.; Sheldon Whitehouse, U.S. Sen., R.I.; Margaret Wood Hassan, U.S. Sen., N.H.; Tammy Duckworth, U.S. Sen., Ill.; Michael F. Bennet, U.S. Sen., Colo.; & Robert Menendez, U.S. Sen., N.J., to Alex Azar, Secretary, U.S. Dep’t of Health & Human Servs., & Seema Verma, Admin., Ctrs. for Medicare & Medicaid Servs. (Aug. 12, 2019), https://www.cortezmasto.senate.gov/imo/media/doc/20190812cms%20medicare% 20fraud.pdf [https://perma.cc/9APH-5UK9]. 16. National Standard Health Care Provider Identifier, 63 Fed. Reg. 25320, 25321 (May 7, 1998). 17. In 1975, a federal government survey of personal data systems subject to the Privacy Act of 1974 showed that approximately twenty-seven percent of systems were at least partially computerized. By 1985, the proportion of at least partially computerized personal data systems had risen to sixty percent; among large data systems, the figure was nearly eighty percent. OFFICE OF TECH. ASSESSMENT, U.S. CONGRESS, FEDERAL GOVERNMENT INFORMATION TECHNOLOGY: ELECTRONIC RECORD SYSTEMS AND INDIVIDUAL PRIVACY 22 (1986), https://www.princeton.edu/ ~ota/disk2/1986/8606/8606.PDF [https://perma.cc/L8QQ-4AWE]. 420 INDIANA HEALTH LAW REVIEW [Vol. 18:417 physicians bemoaned the “inadequacies” of paper records,18 the Institute of Medicine (“IoM”), while acknowledging some strengths of paper records,19 advocated for the adoption of computerized recordkeeping: first as a supplement to paper records in order to ease the transition and then, eventually, as an outright replacement.20 However, this endorsement of technological advancement, welcome though it was, did not arrive until 1997. A few years earlier, the government—surprisingly or unsurprisingly, depending on one’s view—had already taken steps to prepare the health care industry for the era of computerized recordkeeping. In 1991, aiming to improve efficiency in health care and hoping to capitalize on advances in technology, then-HHS Secretary Louis Sullivan brought together leaders from across the industry to discuss potential solutions to administrative waste.21 A number of groups were born as a result of this summit, including the Work Group on Administrative Costs and Benefits, the Task Force on Patient Information, and the Work Group for Electronic Data Interchange (“WEDI”).22 In 1993, CMS,23 in collaboration with WEDI and other representatives from the public and private sectors,24 began the development of an identifier, initially, for health care providers who participated in Medicare, though the actual implementation of the identifier—the NPI—and its accompanying system—the 18. Steven M. Ornstein et al., The Computer-Based Medical Record: Current Status, 35 J. FAM. PRAC. 556, 556-58 (1992). 19. The IoM’s report cited, as reasons for paper’s staying power as the standard medium for recordkeeping in many health care settings, paper records’ familiarity, portability (a moot consideration given modern technology), accessibility, and flexibility. COMM. ON IMPROVING THE PATIENT RECORD, INST. OF MED., THE COMPUTER-BASED PATIENT RECORD: AN ESSENTIAL TECHNOLOGY FOR HEALTH CARE 58 (1997). 20. Id. at 178-79. 21. Denise C. Andresen, The Computerization of Health Care: Can Patient Privacy Survive?, 26 J. HEALTH & HOSP. L. 1, 1 (1993). 22. Id. 23. At the time, the agency was known as the Health Care Financing Administration (“HCFA”). The name changed to the Centers for Medicare and Medicaid Services in June 2001 to accompany major reforms to the agency’s structure in order to better align with the services it was charged with administering. See Sheila Burke & Elaine C. Kamarck, The Crisis in Management at the Centers for Medicare and Medicaid Services (Part I): Capacity, BROOKINGS (Mar. 2016), https://www.brookings.edu/wp-content/uploads/2016/07/CMS-Crisis-in-Management-Part-I.pdf [https://perma.cc/QNC6-977Y]; Press Release, Dep’t of Health & Human Servs., The New Centers for Medicare and Medicaid Services (June 14, 2001), http://cdn.ca9.uscourts.gov/datastore/ library/2013/02/26/Providence_pressrelease.pdf [https://perma.cc/KF8C-TF4W]; Tommy G. Thompson, Sec’y, Dep’t of Health & Human Servs., Remarks at Press Conference Announcing Reforming Medicare and Medicaid Agency (June 14, 2001), https://wayback.archive-it.org/3926/ 20131029133134/http://archive.hhs.gov/news/press/2001pres/20010614b.html [https://perma.cc/ 4NTX-G8MK]. 24. For the list in full, see National Standard Health Care Provider Identifier, 63 Fed. Reg. 25320, 25321 (May 7, 1998). 2021] TEAMWORK MAKES THE SCHEME WORK 421 National Provider System (“NPS”)—ultimately expanded to encompass providers not enrolled in Medicare.25 These efforts all occurred prior to the enactment of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), which required that the HHS Secretary “adopt standards providing for a standard unique health identifier for each individual, employer, health plan, and health care provider for use in the health care system,” taking into account “multiple uses for identifiers and multiple locations and specialty classifications for health care providers.”26 HIPAA’s “standard unique health identifier” requirement was one part of a broader goal of “administrative simplification,” wherein the law “encourage[d] the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.”27 To fulfill the requirements laid out in HIPAA, CMS proposed in 1998 the implementation of the NPI, an eight-position alphanumeric identifier that carried no “intelligence”—in other words, nothing about the eight individual symbols that made up the NPI nor the order in which those symbols were arranged conveyed information about the provider to whom it was assigned—and reserved the eighth position as a check digit, allowing for approximately twenty billion possible NPIs.28 In order for the NPI to achieve designation as a HIPAA standard, CMS used ten principles, specified within HIPAA and comporting with the standards set by the Paperwork Reduction Act of 199529 and Executive Order 12866,30 to guide the development and implementation of the NPI—principles such as efficiency, consistency, and flexibility.31 Using these criteria,32 CMS explored the possibility of using other identifiers—some specific to the health care industry33 or others 25. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3434 (Jan. 23, 2004). 26. Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 1173(b)(1), 110 Stat. 1936, 2025. 27. Id. at 2021. 28. National Standard Health Care Provider Identifier, 63 Fed. Reg. at 25322. 29. Paperwork Reduction Act of 1995, Pub. L. No. 104-13, § 2, 109 Stat. 163, 163-64. The Act is intended to "strengthen the partnership between the Federal Government and State, local, and tribal governments by minimizing the burden and maximizing the utility of information created, collected, maintained, used, disseminated, and retained by or for the Federal Government," as well as “minimize the cost to the Federal Government of the creation, collection, maintenance, use, dissemination, and disposition of information.” 44 U.S.C. § 3501 (2021). 30. Exec. Order No. 12866, 58 Fed. Reg. 51735, 51735-36 (Oct. 4, 1993). The Executive Order requires that agencies submit significant regulatory actions to the Office of Information and Regulatory Affairs for review. 31. National Standard Health Care Provider Identifier, 63 Fed. Reg. at 25323-24. 32. For a full list with explanations for each criterion, see id. at 25329. 33. Examples include the unique physician identification number (CMS/HCFA); the health industry number (Health Industry Business Communications Council); the National Association of Boards of Pharmacy number; Drug Enforcement Administration number; and the national 422 INDIANA HEALTH LAW REVIEW [Vol. 18:417 with less of a tie to the field34—and ultimately eschewed their use in favor of the NPI due to its satisfaction of the selected criteria. The NPI’s proposed use was to universally identify, without confusion or complication, all types of health care providers who transmit certain health care information electronically,35 and while this did include means likely considered rather low-tech today36—or even at the time CMS had included them—the agency seemed to have one eye trained on the future and the immense possibilities available there as the Internet grew and developed.37 As CMS continued to develop the NPI and NPS from 1998 to 2004, the NPI grew to a ten-position numeric identifier,38 ultimately deciding against the use of alpha characters due to concerns over accessibility and accuracy, thus reducing the number of issuable NPIs from twenty billion to two hundred million—enough to last approximately two hundred years, according to CMS projections.39 Therefore, the NPI facilitates universal identification of health care providers and improves the efficiency of health information transmission, thus simplifying the administration of health care. The NPI not only simplifies the administration of health care but also supplier clearinghouse number (Medicare). 34. Social Security Number (Social Security Administration) and the employer identification number (Internal Revenue Service). 35. For a full list of the appropriate uses of the NPI originally proposed by CMS, see National Standard Health Care Provider Identifier, 63 Fed. Reg. at 25334. 36. Id. (“Electronic transmissions would include transmissions using all media, even when the transmission is physically moved from one location to another using magnetic tape, disk, or CD media. Transmissions over the Internet (wide-open), Extranet (using Internet technology to link a business with information only accessible to collaborating parties), leased lines, dial-up lines, and private networks are all included.”). 37. Compare Susannah Fox, The Internet Circa 1998, PEW RES. CTR. (June 21, 2007), https://www.pewinternet.org/2007/06/21/the-internet-circa-1998/ [https://perma.cc/4W42-DR7L], and Cheri Paquet, Report Counts 147 Million Global Net Users, CNN (Feb. 12, 1999), http://edition.cnn.com/TECH/computing/9902/12/globalnet.idg/index.html [https://perma.cc/3ALG- K2NA], with Internet/Broadband Fact Sheet, PEW RES. CTR. (June 12, 2019), https://www. pewinternet.org/fact-sheet/internet-broadband/ [https://perma.cc/H569-HNR7]. See also E-Rate - Schools & Libraries USF Program, U.S. FED. COMM. COMMISSION, https://www.fcc.gov/general/e- rate-schools-libraries-usf-program [https://perma.cc/36NZ-DU2W] (last visited Oct. 5, 2019) (describing federal efforts to improve internet access); Tim Berners-Lee, Web Access Is a 'Basic Human Right,' HUFFINGTON POST, https://www.huffingtonpost.co.uk/2014/12/12/web-human- right_n_6313688.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS 8&guce_referrer_sig=AQAAAE4-9-i4sg7sR8PpQRVdRKgcYBDkmQDKi7yjQz45s EjfcVQycXHzLTJXnlNRnoAxW58aihmwiPBb5QSUrJ7HQ4FMz3nfNMHOrehfoxLFGb98sT _ZfRArOiVhmK6n-FGd8toKm5I6fbIecyUwQIn4Ky-sGiIup2TYbAQJoYCDXmQF [https://perma.cc/5BN9-MVL2] (last updated Dec. 12, 2014). 38. 45 C.F.R. § 162.406 (2021). 39. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3442 (Jan. 23, 2004). 2021] TEAMWORK MAKES THE SCHEME WORK 423 represents the simplest means of accessing health insurers’ coffers. When ProPublica reporter Marshall Allen described the NPI as the “key that unlocks access to health care dollars,” CMS disputed this characterization as a blunt exaggeration.40 Recall, though, that “[c]overed health care providers and all health plans and health care clearinghouses must use the NPIs in the administrative and financial transactions adopted under HIPAA.”41 Even though CMS and many private insurers verify a provider’s credentials before granting admission to their networks, out-of-network providers42 can still tap into those private insurance dollars since insurers will pay them for submitted claims without verifying the credentials of the provider billing them,43 thus creating a comfortable space within which bad actors can operate by taking advantage of CMS’s reliance on honesty and private insurers’ indifference to fraud and waste. From 2010 to 2016, the percentage of patients with private insurance admitted to emergency departments at hospitals within their network and who received bills from out-of- network providers increased from 32.3 percent to 42.8 percent; for in-patient admissions, the increase was sharper—from 26.3 percent to 42.0 percent. These increases meant that the average potential liability for these patients grew by 185 percent and 153 percent, respectively, over that period.44 As out-of-network billing becomes more commonplace, insurers and consumers may end up overlooking fraudulent charges, thus emboldening future fraudsters. Therefore, the NPI allows bad actors to enter a zone in which access to private health insurers’ funds is under-policed. III. SECTION 162.408 NATIONAL PROVIDER SYSTEM A. NPS Regulations and Agency Interpretation The language used in HIPAA and the resulting regulations defining the 40. Allen, Loopholes, supra note 2. 41. National Provider Identifier Standard (NPI), supra note 3 (emphasis added). 42. For a primer on the differences between in-network and out-of-network providers, see In-Network vs. Out-of-Network Providers, CIGNA, https://www.cigna.com/individuals-families/ understanding-insurance/in-network-vs-out-of-network [https://perma.cc/C4BC-VTYF] (last visited July 25, 2020). For a primer on how billing by out-of-network providers (“balance billing” or “surprise billing”) impacts costs and what can be done to limit or prevent it, see Issue Brief: Balance Billing, AMA (2016), https://www.ama-assn.org/media/14691/download [https://perma. cc/RA8H-W4VQ]. For an example of a state-level proposal to limit the impact of surprise billing on patients, see S.B. 3, 121st Gen. Assemb., 1st Reg Sess. (Ind. 2020). For an example of how surprise billing became part of the health care policy discourse in the run-up to the 2020 presidential campaign, see Dan Merica & Tami Luhby, Buttigieg Outlines Middle-of-the-Road Approach to Health Care in New Plan, CNN (Sept. 19, 2019), https://www.cnn.com/2019/09/19/ politics/pete-buttigieg-health-care-plan/index.html [https://perma.cc/E8FJ-T4C6]. 43. Allen, Loopholes, supra note 2. 44. See generally Eric C. Sun et al., Assessment of Out-of-Network Billing for Privately Insured Patients Receiving Care in In-Network Hospitals, 179 JAMA INTERNAL MED. 1543 (2019). 424 INDIANA HEALTH LAW REVIEW [Vol. 18:417 multifarious purposes of the NPS, the system that assigns NPIs to providers, suggests an opening for the possibility of licensure verification for NPI applicants. Recall that HIPAA requires that the HHS Secretary “adopt standards providing for a standard unique health identifier for each individual, employer, health plan, and health care provider for use in the health care system.”45 A plain- meaning, commonsense reading of the language in the statute would indicate that the Secretary must devise standards for a system that assigns one unique identifier to each provider that applies for the identifier. Based on the regulations that HHS promulgated in order to carry out the duties that Congress assigned through HIPAA, that plain-meaning, commonsense reading appears to be the one that the agency adopted. HHS has declared that the NPS is responsible for “assign[ing] a single, unique NPI to a health care provider.”46 With the addition of “single,” it is evident from this language that HHS intended for the NPS to assign only one—and only one—NPI to each provider who uses the NPS to apply. It should be the case, then, that one could track a single provider by their assigned NPI because each NPI is unique and that one could track a single NPI by the provider to which it has been assigned because each provider should only be assigned one NPI. It should work both ways. In fact, in the announcement of its final rule for the NPI and NPS, CMS specifically emphasized that the identifier’s utility as a tracking tool was a consequence of—and arguably conditional upon—the assignment of just one unique identifier to each provider.47 However, like David Williams, the aforementioned Texan trainer and inveterate fraudster, demonstrated, it is not only possible for an individual to acquire more than one NPI, but it also easy for an individual to acquire more than one NPI, thereby frustrating the intended purpose of the NPS. For a system that relies on the honesty of its applicants48 to be charged with the crucial task of giving only one identifier to each applicant is difficult to understand, especially since the system does not have to leave itself open to such manipulation. In fact, NPS regulations appear to give HHS and CMS the means to protect the NPS from bad actors: the NPS “shall . . . assign a single, unique NPI to a health care provider, provided that . . . the [HHS] Secretary has sufficient information to permit the assignment to be made.”49 Furthermore, in its final rule establishing the NPI and NPS, CMS stated that the NPS “must collect information sufficient to uniquely identify a health care provider.”50 Taken 45. Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 1173(b)(1), 110 Stat. 1936, 2025 (emphasis added). 46. 45 C.F.R. § 162.408(a) (2021) (emphasis added). 47. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3452 (Jan. 23, 2004) (“utilization review and other payment safeguard activities will be facilitated, since health care providers would use only one identifier and could be easily tracked over time and across geographic areas”). 48. Allen, Scammers, supra note 5. 49. 45 C.F.R. § 162.408(a)(2) (2021) (emphasis added). 50. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. at 3452. 2021] TEAMWORK MAKES THE SCHEME WORK 425 together, this language suggests that CMS has a mandate from its own rules and regulations to establish a more rigorous system for assigning NPIs than the one that currently exists. Even a reading that is more charitable to the current administration’s preference for minimal government involvement in health care would allow CMS plenty of cover to improve the NPS application process. The NPS serves as the primary tool for collecting information from health care providers and assigning NPIs. Therefore, it is reasonable to consider the operation of the NPS as representative of HHS’s interpretation of the regulations providing that the agency must collect sufficient information to uniquely identify a health care provider in order to assign a single, unique NPI to that provider. The case of David Williams illustrates the insufficiency of the agency’s approach and, in so doing, calls into question the agency’s interpretation of its own regulations. Just as the judicial branch will generally defer to an administrative agency’s interpretation of the statute it administers,51 so too will it tend to defer to an agency’s interpretation of its own regulations. The United States Supreme Court adopted the latter doctrine of deference in 1945 when it ruled for an agency administrator who sought to enjoin a manufacturer from violating the agency’s regulations, deciding that “the ultimate criterion [for interpreting administrative regulations] is the administrative interpretation, which becomes of controlling weight unless it is plainly erroneous or inconsistent with the regulation.”52 The Court reaffirmed this deference in 1997 in its decision favoring the Secretary of Labor’s interpretation of regulations promulgated under the Fair Labor Standards Act.53 More recently, the Court tightened the range of circumstances in which agencies would receive such deference; delivering the opinion of the Court, Justice Kagan wrote that “the possibility of deference can arise only if a regulation is genuinely ambiguous . . . even after a court has resorted to all the standard tools of interpretation.”54 Here, a court should not defer to HHS’s interpretation of the aforementioned regulations. First, the regulations are not genuinely ambiguous. The regulations require that the NPS shall assign a single, unique NPI to a provider; that the agency overseeing NPI assignment must have sufficient information to permit the assignment; and that the assignment system must collect sufficient information to uniquely identify a provider. In other words, once the system has information that allows it to prove the identity55 of a provider and distinguish each provider from other providers,56 the system has what it needs to assign a single, unique NPI to that provider. A plain-meaning reading of the regulations brings about an unambiguous result—or, at the very least, it allows observers to conclude with relative ease when those conditions have not been met in a particular scenario. 51. See generally Chevron, U.S.A., Inc. v. NRDC, Inc., 467 U.S. 837 (1984). 52. Bowles v. Seminole Rock & Sand Co., 325 U.S. 410, 414 (1945). 53. Auer v. Robbins, 519 U.S. 452, 461 (1997). 54. Kisor v. Wilkie, 139 S. Ct. 2400, 2414 (2019). 55. See Identify, BLACK’S LAW DICTIONARY (8th ed. 2004). 56. See Unique, MERRIAM-WEBSTER, https://www.merriam-webster.com/dictionary/unique [https://perma.cc/8YQ3-V95V] (last visited July 25, 2020). 426 INDIANA HEALTH LAW REVIEW [Vol. 18:417 Second, even if the regulations were genuinely ambiguous, thereby triggering the possibility of deference, the HHS interpretation is inconsistent with the regulation because it does not meet the conditions required therein. Therefore, HHS’s interpretation of these regulations does not merit deference. It is important, then, to devise an interpretation of the word “sufficient” that is suitable in this context. A condition that is sufficient for the occurrence of an event is a condition or set of conditions that will produce the event. Sufficient conditions are different from necessary conditions, which must be present but do not bring about the occurrence of the event unless sufficient conditions are present.57 For example, it is sufficient that a number being divisible by four would make the number even, but it is not necessary. It is necessary that an animal be a mammal in order to be a human, but it is not sufficient. In the case of the NPS application process, David Williams, who acquired over twenty NPIs through the NPS, showed that while the system collects information58 that is necessary for the assignment of a single NPI to each provider, the system did not collect information that is sufficient for that assignment. What, then, does sufficiency mean in the instant context? Since the matter has not been litigated or otherwise adjudicated, looking to another, more developed, and more contentious context for guidance may prove useful. B. Interpreting “Sufficiency” Through the Lens of Civil Pleading The realm of pleading in civil actions has seen a substantial evolution over the last two centuries, and this evolution can illustrate and make sense of the meaning of sufficiency. When bringing a civil action, a plaintiff files a complaint that alleges the facts that entitle the plaintiff to relief, and the defendant can then respond with a variety of answers. In the early days of American common law, what typically followed was a “complex dance” of responses between the parties.59 By the first half of the nineteenth century, this process, known as common-law pleading, tended to get messy due to the high volume of pleadings that each side filed.60 There was, indeed, a method to the madness: all that pleading had the effect of narrowing the scope of the case so that the issue at hand was relatively simple to understand and would allow the resulting trial to be a straightforward affair.61 It is not difficult to imagine, however, that this system 57. See Dept. of Philosophy, Confusion of Necessary with a Sufficient Condition, TEX. ST. U., https://www.txstate.edu/philosophy/resources/fallacy-definitions/Confusion-of-Necessary.html [https://perma.cc/UH2K-RN6G] (last visited July 25, 2020) (illustrating the ease with which one can confuse necessary and sufficient conditions). 58. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3457-60 (Jan. 23, 2004). 59. Ray W. Campbell, Getting a Clue: Two Stage Complaint Pleading as a Solution to the Conley-Iqbal Dilemma, 114 PENN ST. L. REV. 1191, 1198 (2010). 60. See CHARLES ALAN WRIGHT & MARY KAY KANE, LAW OF FEDERAL COURTS 471 (6th ed. 2002) (describing common-law pleading "wonderfully slow, expensive, and unworkable"). 61. Charles E. Clark, History, Systems and Functions of Pleading, 11 VA. L. REV. 517, 526 2021] TEAMWORK MAKES THE SCHEME WORK 427 made life difficult for newcomers to a given case, such as newly appointed judges or newly hired counsel, because they would then have to trace the dispute through a mountain of pleadings in order to determine what was at issue between the two parties. Perhaps as a consequence of the process’s iterative nature, “sufficiency” was not as firm a barrier to the continuation of proceedings within this regime as it would eventually become; common-law pleading nevertheless accomplished the goal of tightening the focus of the matter at hand and simplifying the trial. While the common-law pleading paradigm may have been an effective way to narrow and simplify the issues to be litigated during trial, an unending back- and-forth between parties is not an NPS application model that would appeal to CMS or to the providers who use the system. It is possible that the paradigm was sufficient, but it does not fit the needs of modern health care providers or the government agencies that regulate the industry. Throughout the development of the NPI and NPS, CMS has stressed the importance of efficiency for users and for regulators.62 Therefore, an incredibly thorough, iterative process, though likely sufficient for the overall purpose of collecting information essential to the application, would fail to satisfy other goals of the NPS and renders it unfeasible. The pleading regime that followed—code pleading—had its own challenges. Midway through the nineteenth century, New York lawmakers, recognizing the difficulties associated with the drawn-out dance that pleading had become, sought to encourage the opposing parties to offer the facts salient to the matter at the outset of the process. The requirement that they established, which was then adopted in similar forms by more than half the country during the next half- century,63 was that the initial pleading must include a “plain and concise statement of the facts constituting a cause of action without unnecessary repetition.”64 In theory, this appears to be an effective way to condense the pleading process into fewer exchanges between the parties as they hash out the relevant details, thereby instilling some modicum of discipline in the proceedings.65 In practice, however, code pleading had become rather similar to the expensive, lumbering ordeal it had hoped to replace, except that its difficulties lied not in the duration of the process but in the initiation of the action. Because the statement of facts constituting the action had to be plain and concise, and the (1925). 62. See, e.g., Health Insurance Reform: Standards for Electronic Transactions, 63 Fed. Reg. 25272, 25293 (May 7, 1998); Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82462, 82541 (Dec. 28, 2000); Health Insurance Reform: Modifications to Electronic Data Transaction Standards and Code Sets, 68 Fed. Reg. 8381, 8381 (Feb. 20, 2003); HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. at 3434. 63. Clark, supra note 61, at 534. 64. Act to Amend the Code of Procedure, ch. 479, § 142, 1851 N.Y. Laws 887. This version was broadly similar to the original code, which had been established three years earlier. For the original version, see Act to Simplify and Abridge the Practice, Pleadings, and Proceedings of the Courts of the State, ch. 379, § 120(2), 1848 N.Y. Laws 521. 65. Campbell, supra note 59, at 1201. 428 INDIANA HEALTH LAW REVIEW [Vol. 18:417 distinctions between facts, evidence, and conclusions of law were often difficult to parse,66 there was an inexorable tension between producing a technically proper pleading of one’s case67 and carving out enough room in the pleading for oneself to maneuver over the course of the action, leading to the dismissal of many otherwise meritorious claims.68 A sufficient statement of facts delivered at the outset of pleading was essential to the survival and success of a claim under this pleading regime, and it presented would-be plaintiffs with a high, albeit ill- defined, bar to clear. Placing such a substantial burden on providers at the outset of the NPS application does not comport with CMS’s goals for the system. The agency has stressed in a number of instances that it wants the acquisition of an identifier to be easy for providers69 and that generally seems to be the case.70 As such, incorporating stumbling blocks into the application process, such as the submission of difficult-to-obtain documentation or the assessment of a fee, clash with both the intentions of the agency and the demands of the users. The next innovation in pleading laid the foundation for the modern standard. Nearly a century after New York adopted code pleading, the Federal Rules of Civil Procedure (“FRCP”) came into effect and established a new pleading paradigm: notice pleading.71 Rule 8 of the FRCP requires that the complaint 66. See, e.g., Edson R. Sunderland, Some Difficulties of Code Pleading, 8 MICH. L. REV. 400, 400-01 (1910); Charles E. Clark, The Complaint in Code Pleading, 35 YALE L.J. 259, 259-60 (1926). 67. See United States v. Uni Oil, Inc., 710 F.2d 1078, 1080-81 n.1 (5th Cir. 1983) (disparaging code pleading as a “hyper-technical reading of legal papers”). 68. David M. Roberts, Fact Pleading, Notice Pleading, and Standing, 65 CORNELL L. REV. 390, 395-96 (1980). 69. See, e.g., National Standard Health Care Provider Identifier, 63 Fed. Reg. 25320, 25329 (May 7, 1998) (“In order to be integrated into electronic transactions efficiently, standard provider identifiers must be easily accessible.”); HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3468 (Jan. 23, 2004) (“We will attempt to make the processes of obtaining NPIs and updating NPS data as easy as possible for health care providers . . . .”). 70. Compare National Provider Identifier (NPI) Numbers, AM. SPEECH-LANGUAGE-HEARING ASS’N, https://www.asha.org/practice/reimbursement/hipaa/NPI/ [https://perma.cc/KDM9-LGYT] (last visited July 25, 2020) (“It takes less than [five] minutes to apply online and the number is issued within a few minutes.”), with NPI Frequently Asked Questions, INDEP. BLUE CROSS, https://www.ibx.com/providers/claims_and_billing/npi/faq.html [https://perma.cc/A9LX-BJS7] (last visited Jan. 30, 2020) (“CMS estimates that, in general, a health care provider who submits a properly completed, electronic application could have an NPI within ten days.”), and u/rdrop, How Long Did It Take to Get Your NPI Number from Time of Application?, REDDIT (Apr. 11, 2016), https://www.reddit.com/r/medicalschool/comments/4ebu7z/how_long_did_it_take_to_ get_your_npi_number_from/ [https://perma.cc/7HLJ-SP4C] (comparing applicant wait times for an NPI, ranging from a few minutes to fifteen days). 71. See Roberts, supra note 68, at 391 n.6 (“The term ‘notice pleading’ has achieved wide currency as a convenient shorthand description of the federal approach to pleading . . . . Nowhere, 2021] TEAMWORK MAKES THE SCHEME WORK 429 contain “a short and plain statement of the claim showing that the pleader is entitled to relief” that is sufficient to put the opposing party on notice,72 and the defense may counter, under the authority of Rule 12(b)(6), that the plaintiff has failed to state a claim for which relief can be granted.73 For the complaint to survive a Rule 12(b)(6) motion to dismiss, then, it must state its claim sufficiently; only then can the action move forward. The Supreme Court took its first look at this new paradigm twenty years after the rule’s establishment.74 In Conley v. Gibson, the Supreme Court adopted a position on Rule 8 that was relatively friendly to plaintiffs. Forty-five black railroad workers, after being fired from their jobs and replaced by white railroad workers, filed suit against their union for failing to protect them to the same degree that the union had protected white union members.75 The defendants’ answer challenged the complaint on several grounds, the last of which was that the plaintiffs had failed to state a claim for which relief could be granted.76 The Court sided with the plaintiffs, holding that the test for a complaint’s sufficiency was whether “it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.”77 Because it was possible that evidence would support the allegations in the complaint, namely that the union to which the plaintiffs had belonged did not treat them in the same manner that it treated its white members, then the complaint was sufficient. Under this standard—that is, the complaint is sufficient if the allegations therein are possible—getting past the initial hurdle of the complaint and moving into the discovery phase was much easier than it had been previously because the Court set a relatively low bar for the definition of “sufficiency” for the complaints. This understanding of sufficiency as possibility appears to be the standard under which CMS and its NPS are currently operating. According to HHS regulations, CMS must collect sufficient information to ensure that it assigns a single, unique NPI to an individual. But CMS also issues NPIs to applicants without verifying the information that they submitted regarding their identity and their credentials, relying instead on the applicants’ honesty78 and making only limited inquiries about the information submitted.79 If CMS understands itself to be compliant with these regulations, then the agency seems to be taking the position that the possibility that the NPS will assign a single, unique NPI to an individual is sufficient to justify the NPI’s assignment. This, of course, is not to say that the NPS is not capable of accomplishing its objective. There is no however, do the federal rules use that term . . . .”). 72. FED. R. CIV. P. 8(a)(2). 73. FED. R. CIV. P. 12(b)(6). 74. See Conley v. Gibson, 355 U.S. 41 (1957). 75. Id. at 42-43. 76. Id. at 43-44. 77. Id. at 45-46. 78. Allen, Scammers, supra note 5. 79. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3434 (Jan. 23, 2004). 430 INDIANA HEALTH LAW REVIEW [Vol. 18:417 evidence to suggest that the assignment of multiple NPIs to an individual—as a result of fraudulent activity or otherwise—is a widespread phenomenon. It is true, however, that the NPS in its current form does not collect sufficient information to ensure that it assigns a single, unique NPI to an individual. The next evolution in pleading raised the bar for sufficiency to its current level. In 2007, the Supreme Court abandoned the position it had taken in Conley and instead embraced a new standard when it issued its decision in Bell Atlantic Corporation v. Twombly.80 In Twombly, the plaintiffs, who were subscribers to local telephone and Internet services, brought an action against local exchange carriers, alleging that the carriers engaged in parallel conduct to preclude competition in violation of the Sherman Act.81 The trial court granted the defendants’ Rule 12(b)(6) motion to dismiss, which was then reversed on appeal to the circuit court. The Supreme Court reversed the circuit court’s decision and sided with the defendants, holding that, in the context of antitrust law, “a claim requires a complaint with enough factual matter” to plausibly infer that the plaintiff is entitled to relief.82 If the plaintiff could not point to facts that showed that the defendants had indeed agreed to engage in illegal activity, then simply alleging that a conspiracy existed due to the existence of parallel conduct is an insufficient statement of the claim. This ruling makes sense in the context of antitrust law because the Court was concerned that the ease of pleading under the Conley possibility standard would result in meritless cases ending in settlements for the plaintiffs.83 However, this new pleading standard did not remain exclusive to antitrust cases for long. When the Court issued its decision in Ashcroft v. Iqbal, it upheld the Twombly plausibility standard and expanded it to apply in all civil cases. The plaintiff, a Muslim-Pakistani citizen, was arrested in the wake of terrorist attacks on September 11, 2001 and allegedly deprived of constitutional protections while in custody; he filed suit against a number of federal officials, claiming that his treatment had been the result of discriminatory policies that these officials enacted.84 Both the district court and the circuit court found that the plaintiff’s complaint was sufficient, but the Supreme Court reversed, holding that the plaintiff failed to plead sufficient facts to state his claim against the defendants.85 Unable to allege facts indicating illegal and unconstitutional behavior on behalf of the defendants themselves, the plaintiff could allege only that his treatment was unconstitutional and that the defendants oversaw the agencies that carried out the treatment, and the Court found that such a nonspecific complaint would place an unfair and overwhelming burden on the defendants during the discovery process.86 Aside from its various policy implications across different areas of 80. See Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007). 81. Id. at 549-51. 82. Id. at 556. 83. Id. at 559-62. 84. Ashcroft v. Iqbal, 556 U.S. 662, 666 (2009). 85. Id. at 687. 86. See id. at 685-86. 2021] TEAMWORK MAKES THE SCHEME WORK 431 law,87 the Court’s ruling in Iqbal solidified and expanded the sufficiency-as- plausibility standard to cover all civil cases and ushered in a brave new world for would-be plaintiffs. This new, more rigorous standard for sufficiency in pleading should serve as a model for the sufficiency to which CMS should aspire in the design of its NPS application process and the information that it collects. Rather than continue operating with the apparent understanding of sufficiency as possibility, CMS should instead adopt a view of sufficiency as plausibility. This standard would require that CMS collect sufficient information to ensure that it is plausible—not just possible—that it has assigned a single, unique NPI to an individual. One of the key differences between the contexts of pleading and the NPS application, though, is that, unlike in pleading, where a higher sufficiency standard means a higher bar that plaintiffs must clear in order to survive, CMS can obtain the information that it requires in order to meet this heightened standard without shifting the burden of producing information of higher quality or greater quantity to applicants when they apply for an NPI. The regulation calling for sufficient information states only that the agency must collect it and does not specify the means or methods of that collection.88 The upshot is that CMS can collect that information and still accomplish its goals of efficiency and ease for applicants while collecting sufficient information for the assignment of a single, unique NPI to a health care provider. The NPS can take steps to ensure that individuals—rather than only applicants and those already assigned an NPI—receive a single, unique NPI. The NPS must assign a single, unique NPI to an individual,89 and if the NPS fails this task, the NPI’s utility for billing and tracking purposes is severely diminished. That individual may be a physician, a subpart of a larger health care entity, a hospital system, or a myriad of other classifications of health care providers,90 but each of those distinct providers should only have a single, unique NPI. Currently, when the NPS receives an application, it checks its database to determine whether the provider already has an NPI.91 This step is important but does not protect the system from individuals like David Williams, who attempt to present themselves as multiple providers through the use of falsified credentials. Williams was able to acquire multiple NPIs by feeding the NPS enough information to convince the 87. See, e.g., John M. Landry, Fact Pleading After Ashcroft v. Iqbal: The Implications for Section 1 Cartel Cases, ANTITRUST SOURCE 1 (Oct. 2009), https://www.sheppardmullin.com/media/ article/796_Fact%20Pleading%20After%20Ashcroft%20v%20Iqbal.pdf [https://perma.cc/4JZZ- ARZF]; Alexander A. Reinert, The Costs of Heightened Pleading, 86 IND. L.J. 119, 130 n. 53 (2010). 88. 45 C.F.R. § 162.408(a)(2) (2021). 89. 45 C.F.R. § 162.408 (2021). 90. See 42 U.S.C. § 1395x (2021); 45 C.F.R. § 162.408(g) (2021); HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. 3434, 3437 (Jan. 23, 2004). 91. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. at 3446. 432 INDIANA HEALTH LAW REVIEW [Vol. 18:417 system that he was a new applicant and therefore did not already have an NPI, and the system did not use or seek out information other than what it had received. He used the system’s passive collection of information against it. This weakness is emblematic of the insufficiency of the NPS’s information collection procedures, such as they are. Because the system passively collects information, it cannot assign NPIs with a level of certainty higher than the mere possibility that an individual will not receive more than one unique NPI. Luckily for CMS, that collection does not necessarily have to be passive; the NPS can seek out additional information to ensure that it does not assign more than one unique NPI to an individual. Verification of licensure or other credentials would be an appropriate and effective means of actively collecting sufficient information to assign a single, unique NPI to an individual. Possessing a state-issued professional license is a kind of shorthand for a high degree of institutional confidence in the license holder’s ability to carry out the duties of their profession. For example, in order to obtain a license to practice medicine in a particular state, one must earn certain degrees, pass certain exams, supply the state with a wealth of personal information, allow the state to conduct its own investigation of that information, and pay a fee, among other requirements.92 States do not make it easy to acquire such licenses—nor should they. States have an interest in protecting their citizens from unqualified or malicious practitioners, and licensure is an effective means of limiting consumer access to those practitioners. Because states go to such lengths to ensure that the right professionals obtain licenses, it is likely that their databases of licensed professionals do not include serious discrepancies that would impede data collection and verification, making it an effective and efficient tool to ensure that the NPS assigns only a single, unique NPI to an individual. Had the NPS used license verification when David Williams was attempting to get his insurance scheme off the ground, then it is unlikely that he would have been able to obtain one NPI, let alone the nearly two dozen that he collected before his capture. On his applications, Williams used his real name, address, and contact information, but he supplied false license information and lied about his status as a medical doctor.93 The NPS would have scanned the Texas database for medical licenses and found that the number Williams had submitted did not match any existing records in the database. This would have trigged an inquiry to ensure that a clerical error did not occur in Williams’s submission, and this inquiry is likely to have ended either with Williams abandoning this avenue in favor of one with less oversight or with CMS ultimately not issuing an NPI because Williams had no reason to possess one. Even if Williams had tried to be 92. See, e.g., Ind. Prof’l Licensing Agency, License Information for Physician/Osteopathic Physician Applicants: Minimum Requirements to Apply for a License, ST. IND., https://www.in.gov/ pla/files/License%20checklist%20for%20physicians.pdf [https://perma.cc/8XTZ-2TKV] (last visited July 25, 2020); Med. Bd. of Cal., Physicians and Surgeons, ST. CAL., https://www.mbc. ca.gov/Applicants/Physicians_and_Surgeons/ [https://perma.cc/5M2L-G9T3] (last visited July 25, 2020). 93. Allen, Scammers, supra note 5. 2021] TEAMWORK MAKES THE SCHEME WORK 433 clever by using the information of a real physician with a genuine medical license, it is likely that the real physician would have already acquired an NPI, so the NPS would have noticed the duplication during its normal internal verification and not assigned Williams the NPI without further investigation. Presented with this suggestion, CMS would likely raise two concerns. First, CMS has stated that the assignment of NPIs is separate from, and would not eliminate, the existing processes that insurers use to verify the information that providers submit upon enrollment into their programs94 and that the NPS is not meant to duplicate the efforts of other entities.95 Second, the goal of the NPS is to improve efficiency in health care, not to create additional barriers for providers. These concerns, though valid, are easily allayed. An automated license check to ensure that the NPS assigns only a single, unique NPI to an individual would be an infinitesimal step in comparison to the procedures that network enrollees must go through, and even if it is a duplication of effort, it would be a considerably small one at that. Adding an automated license check would not require that applicants submit additional information, and it is unlikely that the check would drastically increase the amount of time that it takes the NPS to assign an NPI. The NPS already carries out cursory investigations to resolve the discrepancies that it finds, so adding another one, especially one more effective at accomplishing the intended goal of the system, does not seem unreasonable. IV. A PROPOSED SOLUTION Because NPIs are so integral to the business of modern health care and because license verification is much easier today than it was in 2004, the NPI application process should be used to screen bad actors in order to prevent them from billing insurers or causing other mayhem. From the inception of the NPS and NPI, CMS theorized that the standardization that the NPS created and maintained would enhance the agency’s ability to eliminate—or at least limit—fraud and abuse in health care programs by facilitating the tracking of providers and their activity, preventing duplication of identifiers and unauthorized access to data, and allowing government investigators and private entities to efficiently share provider information.96 Those behind the passage of HIPAA were eminently aware of the threat posed by fraudulent activity and included a provision for the establishment of a national health care fraud and abuse data collection program for the reporting and disclosing of certain final adverse actions taken against health care providers, suppliers, or practitioners, as well as maintaining a database of final adverse actions taken against health care 94. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. at 3446. 95. Id. at 3468. 96. National Standard Health Care Provider Identifier, 63 Fed. Reg. 25320, 25347 (May 7, 1998). 434 INDIANA HEALTH LAW REVIEW [Vol. 18:417 providers, suppliers, and practitioners.97 CMS, agreeing with many commenters, maintained that verifying the information submitted by NPI applicants would be too costly, as well as duplicative of the procedures that health plans use when they are deciding who to accept into their networks.98 Recall that even though CMS and many private insurers verify a provider’s credentials before granting admission to their networks, out-of-network providers can still tap into those private insurance dollars since insurers will pay them for submitted claims without verifying the credentials of the provider billing them.99 All states now have easily navigable, rapid-return license record databases for most professions, including physicians and others who might apply for NPIs;100 verifying whether NPI applicants have the requisite licensure to provide the services they claim to provide would be quick, especially if the process was automated.101 Therefore, because NPIs are so integral to the business of modern health care and because license verification is much easier today than it was in 2004, the NPI application process should be used to screen bad actors in order to prevent them from billing insurers or causing other mayhem. V. THE POLICY LANDSCAPE AS IT STANDS CURRENTLY Policy change does not occur in a vacuum. This process is subject to a myriad of influences, and there are many competing theories and frameworks that attempt to impose some modicum of logic and to explain the extent to which different factors shape the process.102 While the efficacy of these ideas is up for debate, one common thread is the importance of individuals working together within and between institutions: policy change tends to be the product of sustained cooperation among appropriately situated actors.103 Administrative officials, legislators, and the judiciary all have a role to play in protecting NPIs 97. Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 221, 110 Stat. 1936, 2009; see also Health Care Fraud and Abuse Data Collection Program: Reporting of Final Adverse Actions, 63 Fed. Reg. 58341 (Oct. 30, 1998); Health Care Fraud and Abuse Data Collection Program: Reporting of Final Adverse Actions, 64 Fed. Reg. 57740 (Oct. 26, 1999); Health Care Fraud and Abuse Data Collection Program: Reporting of Final Adverse Actions; Correction, 62 Fed. Reg. 70506 (Nov. 24, 2000). 98. HIPAA Administrative Simplification: Standard Unique Health Identifier for Health Care Providers, 69 Fed. Reg. at 3452. 99. Allen, Loopholes, supra note 2. 100. See, e.g., Search for a License, ST. IND., https://mylicense.in.gov/everification/ Search.aspx [https://perma.cc/25ZS-2Z2G] (last visited July 25, 2020); License Search, ST. CAL., https://search.dca.ca.gov/ [https://perma.cc/D66Y-9R6H] (last visited July 25, 2020). 101. Allen, Scammers, supra note 5. 102. For a useful table that summarizes major policymaking frameworks and their theoretical limitations, see generally MATT GROSSMAN, ARTISTS OF THE POSSIBLE: GOVERNING NETWORKS AND AMERICAN POLICY CHANGE SINCE 1945, at 18 (2014). 103. Id. at 173-74. 2021] TEAMWORK MAKES THE SCHEME WORK 435 from misuse; however, because not all of these actors have engaged directly with the matter, what follows is an examination of their recent actions related to health care fraud and how these actions may provide hints about the actors’ openness to a change in policy. A. CMS Despite Administrator Verma’s intense commitment to reducing the role of government in health care,104 CMS has shown a recent willingness to be proactive in its fight against bad actors, though only to protect the integrity of its own programs. CMS promulgated a new rule in September 2019 with the intent to ensure the removal and exclusion of entities and individuals who may threaten the integrity of Medicare, Medicaid, and the Children’s Health Insurance Program (“CHIP”) (collectively “CMS programs”).105 The rule, which became effective on November 4, 2019, implemented a provision of the Social Security Act that requires CMS program providers and suppliers to disclose any current or previous direct or indirect affiliation106 with a provider or supplier that has uncollected debt; has been or is subject to a payment suspension under a federal health care program; has been or is excluded by the Office of Inspector General from Medicare, Medicaid, or CHIP; or has had its Medicare, Medicaid, or CHIP billing privileges denied or revoked (collectively “disclosable events”).107 Once a provider has disclosed those affiliations, the HHS Secretary is then permitted to deny enrollment in CMS programs based on such an affiliation when the Secretary determines that it poses an undue risk of fraud, waste, or abuse;108 CMS also has the authority to deny or revoke enrollment across a wide range of circumstances, prohibit subsequent application attempts after an enrollment application has been submitted with false information, impose longer bars to re- enrollment after having enrollment revoked, and more.109 When those providers make their disclosures about affiliations with certain entities, they are required to provide a wealth of information about the affiliation, including “general identifying data about the affiliated provider or supplier,”110 104. See Seema Verma, Admin., Ctrs. for Medicare & Medicaid Servs., Keynote Remarks at the Better Medicare Alliance 2019 Medicare Advantage Summit (July 22, 2019), https://www.cms. gov/newsroom/press-releases/keynote-remarks-administrator-seema-verma-better-medicare- alliance-bma-2019-medicare-advantage [https://perma.cc/5JQ7-AV3E]. 105. See Medicare, Medicaid, and Children’s Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process, 84 Fed. Reg. 47794 (Sept. 10, 2019). 106. Id. at 47798. 107. Id. at 47794-95. 108. Id. at 47794. 109. Id. at 47794-95. 110. Id. at 47810. This information includes the legal name reported to the Internal Revenue Service or the Social Security Administration, “doing business as” name, tax identification number, and NPI. Id. 436 INDIANA HEALTH LAW REVIEW [Vol. 18:417 the “reason for disclosing the affiliated provider or supplier,” and “specific data regarding the relationship between the affiliated provider or supplier and the disclosing party,” as well as other information.111 Before this new rule, CMS lacked a regulatory basis to prevent such individuals or entities from continuing their fraudulent or abusive practices through other entities—absent factors such as the owning or managing of an individual’s or organization’s felony conviction, exclusion from Medicare by the Office of Inspector General, or debarment from participating in similar federal programs.112 Therefore, CMS has shown a recent willingness to be proactive in its fight against bad actors and is using NPIs to aid in that fight, but only explicitly to protect the integrity of its own programs, though a compelling argument could be made that exclusion from participating in government health insurance programs would be such a stain on a provider’s reputation that private insurers would be unlikely to engage in official business relationships with that provider as well. B. The Judiciary At least one federal court has exhibited a greater willingness to facilitate the investigation and elimination of health insurance fraud—albeit only with regard to government insurance programs. The Third Circuit Court of Appeals, in a decision issued in September 2019,113 held that qui tam relators offered enough facts to plausibly allege that a compensation agreement between the University of Pittsburgh Medical Center (“UPMC”) and neurosurgeons employed by its subsidiaries was in violation of the Stark Act.114 The compensation arrangement, wherein the neurosurgeons were rewarded as they completed more procedures which then necessitated referrals for ancillary hospital services (nursing, overhead, etc.), is not an uncommon arrangement across the country, which means that, if other courts take similar positions in the future, other hospitals and hospital systems might find themselves running into lengthy legal proceedings.115 Even so, the Third Circuit’s willingness to ensure that critical government insurance dollars are not lost to fraudulent or abusive practices by ordering that 111. Id. 112. Id. at 47797. 113. United States ex rel. Bookwalter v. UPMC, 938 F.3d 397, 397 (3d Cir. 2019). For the statute restricting physician referrals, see 42 U.S.C. § 1395nn (2021). 114. The Stark Act, passed in 1989 and named for then-Congressman Pete Stark, is the federal prohibition on physician self-referral for health services covered by government insurance programs. Originally, the Stark Act had a narrow focus on clinical laboratory services covered by Medicare, but upon its expansion in 1993, the law’s scope grew to include a multitude of services covered by both Medicare and Medicaid. DAVID E. MATYAS ET AL., LEGAL ISSUES IS HEALTHCARE FRAUD AND ABUSE: NAVIGATING THE UNCERTAINTIES 131 (4th ed. 2012); see Omnibus Reconciliation Act of 1989, Pub. L. No. 101-239, 103 Stat. 2106; see also Omnibus Reconciliation Act of 1993, Pub. L. No. 103-66, 107 Stat. 312. 115. Bookwalter, 938 F.3d at 423 (Ambro, J., concurring). 2021] TEAMWORK MAKES THE SCHEME WORK 437 the details of the situation are brought before the revealing light of discovery116 is heartening—even if the decision was an isolated occurrence and unlikely to bring about substantive change in the health care industry. C. The Department of Justice That the action exists at all seems to be in contravention of a prevailing trend within the Department of Justice. In January 2018, Michael Granston, director of the Justice Department’s Fraud Section, penned an internal memo117 outlining factors118 to be considered in the determination of qui tam119 action120 dismissals, citing a provision of the False Claims Act,121 which provides that the government “may dismiss” a False Claims Act case over the objections of the whistleblower who filed the suit, even for cases in which the Justice Department decides not to intervene—that is, as long as the court finds that the Justice Department’s rationale for dismissal meets one of two standards: one that generally favors the Justice Department122 or one that generally favors the relator.123 116. Id. at 409-10, 417. 117. Memorandum from Michael D. Granston, Dir., Fraud Section, Com. Litig. Branch, Dept. of Just., to Fraud Section Att’ys & Assistant U.S. Att’ys Handling False Claims Act Cases (Jan. 10, 2018), https://www.fcadefenselawblog.com/wp-content/uploads/sites/561/2018/01/Memo-for- Evaluating-Dismissal-Pursuant-to-31-U-S.pdf [https://perma.cc/YB83-LCTC]. 118. Id. The “non-exhaustive” list of factors that the Justice Department may consider as basis for a dismissal: (1) curbing meritless actions, (2) preventing parasitic or opportunistic actions, (3) preventing interference with agency policies and programs, (4) controlling litigation brought on behalf of the federal government, (5) safeguarding classified information and national security interests, (6) preserving government resources, and (7) addressing egregious procedural errors. 119. “Qui tam” is an abbreviation of the Latin phrase “qui tam pro domino rege quam pro se ipso,” which means, “Who sues on behalf of the King as well as for Himself.” E.g., MATYAS ET AL., supra note 114, at 240. 120. The False Claims Act allows for an individual to come forward and provide to the government information about potential fraud. This individual, known as a qui tam relator, must serve both the local U.S. Attorney and the U.S. Attorney General with a copy of the complaint and written disclosure of the material evidence and information that the relator possesses. This complaint is then sealed for sixty days while the Justice Department investigates the allegations therein. The Justice Department can then decide to intervene and take over the litigation, to decline and allow the relator to proceed independently, or to seek dismissal of the action entirely. If the action is successful, including resolution through settlement, relators are given a portion of the recovery – up to thirty percent. Veronica M. Lei, Ass’t Gen. Couns., Eli Lilly & Co., & Sara L. Shudofsky, Partner, Arnold & Porter Kaye Scholer LLP, Strange Bedfellows: When DOJ Moves to Dismiss Relator Qui Tams Against Pharma (Oct. 8, 2019) (notes on file with author). 121. 31 U.S.C § 3730(c)(2)(A) (2021). 122. Swift v. United States, 318 F.3d 250, 252 (D.C. Cir. 2003) (“Reading [31 U.S.C.] § 3730(c)(2)(A) to give the government an unfettered right to dismiss an action is . . . consistent with the Federal Rules of Civil Procedure.”). 123. Sequoia Orange Co. v. Baird-Neece Packing Co., 151 F.3d 1139, 1145 (9th Cir. 1998) 438 INDIANA HEALTH LAW REVIEW [Vol. 18:417 The Granston memo suggested that the Justice Department, newly equipped with enumerated and clarified bases for dismissal, would move to dismiss more qui tam relator actions in the future and be more successful when it does seek dismissal—and it has.124 Since Granston released the memo, the Justice Department has sought the dismissal of several actions for the reasons cited in the memo,125 and the Justice Department has had a success rate of nearly ninety-five percent when seeking dismissal.126 Perhaps, though, the most emblematic application of the principles set forth in the memo has been the Justice Department’s efforts to dismiss a bevy of actions brought by the National Healthcare Analysis Group127 (“NHAG”), a data- driven, Wall Street-financed fraud detection firm. In June 2017, NHAG, through one of its shell companies, Health Choice Alliance (“HCA”), filed eleven qui tam complaints in seven jurisdictions against dozens of defendants for essentially identical claims of self-enrichment at the federal government’s expense.128 After (“The qui tam statute itself does not create a particular standard for dismissal . . . . ‘A two-step analysis applies here to test the justification for dismissal: (1) identification of a valid government purpose; and (2) a rational relation between dismissal and accomplishment of the purpose.’”); see, e.g., Lei & Shudofsky, supra note 120. 124. For a discussion of how the approach outlined by the Granston memo is a significant departure from prior Justice Department practices, see Steven L. Schooner, FALSE CLAIMS ACT: Greater DOJ Scrutiny of Frivolous Qui Tam Actions?, 32 NASH & CIBINIC REP. 59, 59-60 (2018). For a discussion of the Granston memo’s near-immediate impact on actions from certain industries, see DOJ’s Granston Memo and Recent Government-Requested Dismissal of False Claims Act Case Have Significant Implications for FDA-Regulated Entities, ROPES & GRAY (Nov. 26, 2019), https://www.ropesgray.com/en/newsroom/alerts/2019/11/DOJs-Granston-Memo-and-Recent- Government-Requested-Dismissal-of-False-Claims-Act-Case [https://perma.cc/5DFW-AK55]. 125. See Motion to Dismiss, United States ex rel. Campie v. Gilead Scis., Inc., No. C-11-0941 EMC (N.D. Cal. Mar. 28, 2019), United States ex rel. Cimznhca, LLC. v. UBC Inc., No. 17-CV- 765-SMY-MAB (S.D. Ill. Apr. 15, 2019), Motion to Dismiss, United States ex rel. Polansky v. Exec. Health Res., Inc., No. 12-CV-4239-MMB (E.D. Pa. Aug. 20, 2019); Universal Health Servs. Inc. v. United States ex rel. Escobar, 136 S. Ct. 1986 (2016). 126. Michael W. Paddock & Keeley A. McCarty, The Granston Memo in 2019: Recent Cases Highlight the Granston Memo’s Effectiveness as a Tool to Dismiss False Claims Act Cases, NAT’L L. REV. (Dec. 5, 2019), https://www.natlawreview.com/article/granston-memo-2019-recent-cases- highlight-granston-memo-s-effectiveness-tool-to [https://perma.cc/DK9A-6VZE]. 127. For a profile on the firm, its methods, and its founder, see J. C. Herz, Medicare Scammers Steal $60 Billion a Year. This Man Is Hunting Them, WIRED (Mar. 7, 2016), https://www.wired. com/2016/03/john-mininno-medicare/ [https://perma.cc/4U4M-MGK4]. 128. John O’Brien, Plaintiffs Lawyers in Philly Area Representing Clients that the DOJ Says Are Wasting Time Filing Meritless Lawsuits, PA. REC. (Jan. 8, 2019), https://pennrecord.com/ stories/511717647-plaintiffs-lawyers-in-philly-area-representing-clients-that-the-doj-says-are- wasting-time-filing-meritless-lawsuits [https://perma.cc/UCJ4-EZJU]. For a complete list of the False Claims Act actions that NHAG and its subsidiaries brought in 2017, see P. David Yates, DOJ: A Company Created to File Lawsuits Has Wasted 1,500 Hours of the Government's Time, FORBES (Dec. 19, 2018), https://www.forbes.com/sites/legalnewsline/2018/12/19/doj-a-company- 2021] TEAMWORK MAKES THE SCHEME WORK 439 investigating the allegations, the Justice Department moved to dismiss all of the actions, arguing that the claims lacked the merit necessary to justify the cost of investigation.129 The U.S. District Court for the Eastern District of Texas, for example, agreed with the Justice Department’s assessment and granted the motion to dismiss, finding that the government had met the more rigorous, relatively relator-friendly Sequoia Orange standard for dismissing the action.130 More than a year after the memo was released, Granston did seem to temper the memo’s tenor and indicate that the Justice Department would not be scared off easily from pursuing worthy cases. Granston warned attendees at the 2019 Federal Bar Association’s False Claims Act Conference that angling for “undue or excessive discovery will not constitute a successful strategy for getting the government to exercise its dismissal authority,”131 implying that the preservation of government resources lacks the primacy it was purported to have among the factors considered for dismissal. This ostensible change in tack, however, did not dissuade Senator Chuck Grassley, the chairman of the Senate Finance Committee, from penning a letter to Attorney General William Barr in September 2019 in order to relay his concerns about the Department’s justifications for dismissing qui tam actions.132 A longtime advocate for qui tam relators, Senator Grassley opined that the trend started by the Granston memo’s release would send a message that fraudulent activity would go unpunished as long as the litigation was sufficiently arduous and resource-intensive.133 Senator Grassley specifically questioned the role of the Granston memo in the Justice Department’s decision created-to-file-lawsuits-has-wasted-1500-hours-of-the-governments-time/?sh=72d65307290b [https://perma.cc/YKY7-LCLW]. 129. For an analysis of the litigation resulting from HCA’s claim against Bayer and the precedent that the Justice Department’s treatment of NHAG’s actions might set for future False Claims Act dismissals, see Alison Frankel, DOJ Doubles Down in Brief to Discredit ‘Wall Street- Backed’ False Claims Act Whistleblower, REUTERS (Feb. 25, 2019), https://www.reuters.com/ article/us-otc-fca/doj-doubles-down-in-brief-to-discredit-wall-street-backed-false-claims-act- whistleblower-idUSKCN1QE2IX [https://perma.cc/7DHF-94T8]. 130. Health Choice All. LLC v. Eli Lilly & Co., 5:17-CV-00123-RWS-CMC 7-8 (E.D. Tex. 2019) (“Dismissing Health Choice's claims is rationally related to that interest. If Health Choice's claims survived, the Government would be required to expend resources. Primarily, the Government would need to make employees available for depositions . . . . The Government would also need to expend resources monitoring Health Choice's claims. But, if the Government dismisses Health Choice's claims, it will not have to expend those resources. That is a rational relationship: dismissal reduces Governmental burdens.”) 131. Michael A. Rogoff & Jennifer Oh, Michael Granston Cautions FCA Defense Bar Regarding the Granston Memo's "Government Burden" Factor, ARNOLD & PORTER (Mar. 21, 2019), https://www.arnoldporter.com/en/perspectives/blogs/fca-qui-notes/posts/2019/03/granston- cautions-fca-defense-bar [https://perma.cc/RAS4-Y5VP]. 132. Letter from Chuck Grassley, U.S. Sen., Iowa., to William Barr, Att’y Gen., U.S. Dep’t of Just. (Sept. 4, 2019), https://www.grassley.senate.gov/imo/media/doc/2019-09-04%20CEG% 20to%20DOJ%20(FCA%20dismissals).pdf [https://perma.cc/VMP2-S7BC]. 133. Id. 440 INDIANA HEALTH LAW REVIEW [Vol. 18:417 to move for dismissal and asked Attorney General Barr for an explanation of the processes used to determine the extent of strain on government resources that such litigation would incur.134 It is currently unclear as to whether Congress is considering any legislative move to impose a higher standard on the Justice Department when attempting to dismiss a qui tam relator’s action, though legislation compelling the dismissal of qui tam actions when the Justice Department decides against intervention may be on its way. Even as the Third Circuit’s majority in the United States ex rel. Bookwalter v. UPMC apparently ran the risk of “opening the floodgates of litigation” by allowing the relators to proceed with their case, they noted that Granston’s memo, which indicates the Justice Department’s “more aggressive approach to dismissing qui tam actions” by “urging its lawyers to consider dismissal every time the government decides not to intervene,” illustrates the extent to which the Justice Department—not the judiciary—is the true gatekeeper for qui tam actions.135 These actors, in addition to the senators who wrote to HHS Secretary Azar and CMS Administrator Verma about NPI misuse, seem to be at odds about the federal government’s role in policing the health care industry and preventing fraud, even when government resources are in jeopardy. This suggests that changes meant to limit fraud against private insurers would not be met with much enthusiasm under the current administration. VI. CONCLUSION As the new millennium approached, bearing the promise of new opportunities and new complications, the federal government shouldered the responsibility of creating a system to streamline health care administration and developed the NPS and NPI. In doing so, it took up the mantle of gatekeeper for those who wished to bill health insurance plans. Now that David Williams has exposed a gap in the NPS’s defenses, it is time for HHS and CMS to tighten the system’s security in order to comply with its regulations, aided by the essential work that state licensing agencies have already done. The story, however, should not end there. Agencies across the executive branch should reexamine systems of their own to determine whether enhanced data and technological capabilities open new avenues for accomplishing administration goals. 134. Id. 135. United States ex rel. Bookwalter v. UPMC, 938 F.3d 397, 417 (3d Cir. 2019).