- Access the page that contains the information to be updated by selecting the ‘Next’ button located at the bottom of each page or by selecting the desired page from the left hand navigation bar.
- Update the necessary information.
- Once all desired information is updated navigate to the Submission page. Check the Certification Statement box at the bottom of this page.
- Select Submit. This button will not be enabled until you check the Certification Statement box at the bottom of this page.
Making Changes with a Paper Application/Update Form
Updates can be made by mailing a Paper Application/Update Form available for download: NPI Application/Update Form.
- In Section 1A Reason For Submittal of this Form, select the Change of Information box.
- Provide the correct NPI on the line below the Change of Information box.
- Complete the sections that need to be updated. If you are making an update to Section 3C Other Provider Identification Numbers or Section 3D Provider Taxonomy Code, be sure to indicate if the information is to be added to the NPI record or if it is to replace the information that is currently in the NPI record.
- In Section 4A or 4B Certification Statement, the Provider/Authorized Official will sign the application. Note: For Entity Type 1 applications, the Provider will sign in Section 4A.
- Once the paper NPI Application/Update form is completed, it must be returned to the NPI Enumerator via mail at the address provided on the third page of the application.
Note: NPI Application/Update forms received via email and/or fax will not be processed.
How do I change my Primary Taxonomy?¶
Adding, changing or Deleting a Taxonomy Code or Changing the Primary Taxonomy Online A provider can change the Primary Taxonomy online by accessing https://nppes.cms.hhs.gov and completing the steps below:
- On the Home Page of the NPPES website, enter your I&A User ID and password.
- Select the “Pencil” ICON in the Action column of the NPI you wish to modify.
- Navigate to the Taxonomy page by either:
- Selecting Taxonomy from the left navigation panel
- Selecting Taxonomy on the top progression bar.
- Selecting Next until you are navigated to the Taxonomy page.
- Select Add Taxonomy.
- Once you have selected the desired Taxonomy code, it will allow you to input an associated license and state of issue, if applicable.
- Select Save to store the new information and return to a list of all Taxonomy and licenses currently on the record.
- Select Delete associated with the Taxonomy code you wish to remove.
What do I do if I cannot remember my password?¶
Select the FORGOT USER ID OR PASSWORD button on the on the Home Page of the NPPES website, this will navigate you to the Identity and Access (I&A) system. If you remember your User ID but cannot remember your password, you may reset your password by selecting the “Forgot Password” link on the I&A Sign In page and follow the instructions on the screen. You must either answer three of the challenge/security questions associated with the User ID, or enter the required User Information associated with your account (see an example screen shot below).
Note: After three unsuccessful attempts to answer the three security questions, you will be required to enter the User Information associated with your account.What do I do if I cannot remember my User ID?¶
If you cannot remember your User ID, you may select the “Retrieve Forgotten User ID” link on the I&A Sign In page and follow the instructions on the screen. You must provide either a unique email address associated with your account to receive your User ID via email, or enter the required User Information associated with your account to view your User ID immediately.
Note: If you retrieve your User ID without using your email, you will also be required to change your password.When should a provider apply for an NPI?¶
Please consider the appropriate time in the process for a provider to apply for an NPI. Consider residents and interns. If your understanding is that they are eligible to apply for an NPI but may not do so if they do not submit claims. This may be different in a prescribing or referring scenario for Medicare. This may be different for other payers. Guidance as to when a provider should apply, given the nuances in the payer world as a whole, would be a good place to focus.
Why can’t I use my Type 2 NPI User ID and Password to log into NPPES to access my NPI?¶
NPPES now uses I&A to determine the Providers you have access to in NPPES. If you have access to a Provider, you will have access to all NPIs associated with the Provider.
How can I gain access to my Type 2 NPI?¶
You must first create an account in I&A. Once you have successfully created your account if you are on an approved enrollment in PECOS, your Provider Organization will be automatically added to your profile. If your Provider Organization is not added to your profile, you can gain access to your Provider’s Type 2 NPI in I&A by doing the following:
- Gaining access via I&A
- If you are an employee/owner of the Provider Organization, you can submit an employer request.
- If you request to be an Authorized Official, you must submit the required paper work to EUS for approval.
- If you request to be an Access Manager, you can either have an existing Authorized Official approve your request, or you can submit the required paper work to EUS for approval.
- If you request to be a Staff End User, you can either have an Authorized Official or Access Manager approve your request, or you can contact the Enumerators and request them to approve your employer request.
- If you work for an organization that is a surrogate working on behalf of the Provider, you will need to ensure that there is an approved surrogacy connection between your employer and the Provider for the NPPES business function and that you have been granted access rights to the Provider.
- If you are an approved Authorized Official or Access Manager for your organization you will automatically have access to all the NPIs associated with the Providers for which your organization has an approved surrogacy connection for the NPPES business function.
- If you are an approved Staff End User, an Authorized Official or Access Manager for your organization must grant you access rights to the Provider for which your organization has an approved surrogacy connection for the NPPES business function.
I have a Type 2 account, what do I do?¶
Assuming that you have an AO and AM already existing, the following the below mentioned steps:
- Create an I&A account
- Add your organization as an employer to request to be a Staff End User
- Have AO or AM approve your request
- Once you have created an I&A account return to the NPPES sign-in page and use the credentials to login
I have a Type 2 account, but AO and AM are not defined, what do I do?¶
- Create an I&A account
- Add your organization as an employer to request to be a Staff End User
- Contact the Enumerator to approve your Staff End User request, by calling them 1-800-465-3203 (NPI Toll-free) or 1-800-692-2326 (NPI TTY)
- Once you have created your I&A account return to NPPES and login with your I&A User ID and Password
How do I deactivate my active NPI record?¶
If you would like to deactivate an active NPI, please follow the steps below:
- Select the NPI Deactivate ICON to deactivate the desired NPI application.
- Enter the deactivation reason.
- Select “Yes” for “Are you sure you want to deactivate this NPI? All enrollment associated to this NPI. In other CMS systems maybe impacted” pop up question.
- NPI has been deactivated successfully message will be displayed.
What browser should I use to access NPPES?¶
The NPPES system is most compatible with the following browsers:
- Google Chrome V 102+
- Microsoft Edge V 102+
Do I need to have my browser cookies enabled to access NPPES?¶
Yes, our system uses cookies for security purposes ensuring unauthorized users cannot access our system. The cookies are not storing personally identifiable information about our users. For increased security to your account, please make sure Cookies are enabled in your browser.
What is Multi-Factor Authentication?¶
Multi-Factor Authentication (MFA) combines two or more independent credentials: what the user knows (password), what the user has (security token) or what the user is (biometric verification) to verify a user. The goal of MFA is to create a layered defense and make it more difficult for an unauthorized person to access a target such as a physical location, computing device, network, or database. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target.
Why is CMS implementing MFA?¶
CMS is improving identification and authentication security for the following 4 public facing applications: I&A, NPPES, PECOS, and HITECH.
How long will my MFA code last?¶
The MFA code will last between 5 minutes to 15 minutes. For SMS (Text) or Voice call, the code will be valid for 5 minutes. For Email, the code will be valid for 15 minutes. Users have the option to declare that the current computer used to login is a private computer. In that case, the MFA validation will last for 24 hours. The user will still need to use his/her login credential, but the user will not be prompted for MFA validation within that timeframe.
What are the benefits of using MFA?¶
Using MFA makes your user authentication process more secure. For example, if your login credential is compromised, your account will still be secure since the hackers will not be able to log into your account without having access to the second factor (your phone or your email).
What services will be affected by implementing Multi-Factor Authentication?¶
I&A, NPPES, PECOS, and HITECH will be affected by MFA because these applications use the same identity management system.
Do I need to use a mobile device to setup MFA?¶
No, you have the option to use a landline phone or email address. I&A MFA supports three types of secondary authentication: SMS/TEXT, Voice call, and Email.
Does CMS gain control of my personally-owned mobile device once I enable MFA?¶
No. CMS only sends the MFA verification code to your phone or email.
Who is required to use Multi-Factor Authentication?¶
All users who use CMS Identity and Access Management System (I&A) to log into their applications, this includes I&A, NPPES, PECOS, and HITECH, will need to set up an option for MFA.
How do I start my MFA setup?¶
If you are an existing I&A user, you will be prompted with an option to setup your MFA devices when you log into the I&A application. You will have a grace period of up to 568 days to bypass setting up your MFA method(s).
If you are a new I&A user, you will be prompted to setup your MFA method(s) as you set up your account. You will not be able to create an account in I&A if MFA setup is not completed.
What is the cut-off date where all NPPES users are required to use Multi-Factor Authentication to access NPPES?¶
As of 04/21/2022 all NPPES users will be required to use MFA in order to successfully log into NPPES.
How long is the grace period that NPPES users have before they are required to use MFA in order to successfully log into NPPES?¶
Users who log into NPPES after 12/09/2019, but before 04/21/2022, will have 568 days or until the cutoff date (04/20/2022) whichever is closer before they are required to use MFA in order to successfully log into NPPES.
Am I required to set up two methods of MFA or just one?¶
Users are only required to set up one method of MFA but it is recommended to set up 2 methods of MFA (e.g.: Email, SMS/Text) to have an alternative MFA method as a backup option in case the primary MFA method is experiencing difficulties or no longer in your possession.
What if I no longer have the phone or email that I have set up to use as my MFA?¶
Users can reset their MFA methods by logging into I&A (User ID, Password) and choosing the option to Reset MFA on the screen. They must be able to correctly answer security questions or enter personal information in order to successfully reset their MFA.
What if my account is locked and I can no longer access the account?¶
Users can unlock their accounts by either correctly answering the security questions or providing personal information. If users fail to successfully answer security questions or provide personal information, then they must contact EUS help desk.
Whom should I contact if I have questions or concerns about the requirement to use MFA?¶
The primary contact should be the EUS Help Desk for users logging into I&A, NPPES, PECOS, and HITECH. The EUS Help Desk can be reached via phone call at 866-484-8049 or via email at EUSSupport@cgi.com.
For NPPES users, they can also contact the NPPES Helpdesk (Enumerator Team).
Does MFA see my password?¶
No, your password will not be seen by the MFA service provider or the I&A administrator.
How Does Multi-Factor Authentication (MFA) Work?¶
Users will be guided by the application to set up their MFA methods in I&A. Once the MFA setup is confirmed, as the user logs into the application with their User ID/Password credential, an MFA verification code will also be sent via the user’s preferred MFA method. Upon receiving the code from the MFA services the user will enter the code in I&A to verify the account.
What Devices Can I Use?¶
You can use: Mobile Phone (SMS/Text or Voice), landline phone (Voice) and Email Address (Email).
How many authentication devices/methods can I add?¶
You can add up to two authentication devices/methods, a primary authentication device/method and an alternative authentication device/method.
Can I use the MFA internationally?¶
Text/SMS and Voice Call only support US States and US Regions. Email support can be used when you are outside of the United States.
Can the system handle international phone numbers?¶
Text/SMS and Voice Call do not support international phone numbers. For international users, please add email as your MFA method.
How long will my authentication last?¶
Applications authentication (your regular User ID/password credential) will time out after 15 mins of inactivity for I&A and NPPES. (Note: We believe it is the same for PECOS and HITECH as mandated by CMS.) MFA will expire as the applications authentication expires EXCEPT if the user has declared that the current computer/device in use is a private computer/device. In that case, the MFA authentication will be valid on the specified computer/device for that particular user for 24 hours.
Does the MFA email need to be the same as the email listed on the user’s I&A account?¶
Users are not required to use the email associated with their I&A account.
Does the private computer option remember your login; and what if more than one doctor uses the same computer for enrollment purposes?¶
The private computer consent is based on per user per computer. If two users log in using the same computer, each user account will have a reference to the account’s cookies.
What happens if the MFA is never setup?¶
Nothing will happen if the user never sets up MFA and the user never attempts to log into I&A. The next time the user attempts to login, after their grace period and MFA cutoff date have passed, the user will be forced to setup MFA to access I&A.
Can a user setup MFA with the same primary and secondary MFA method?¶
The primary and secondary MFA methods have to be different. Users cannot use two SMS/Text or two emails for MFA setup.
Does a company that completes applications on behalf of providers have to use MFA when accessing the provider’s accounts?¶
User’s should have their personal information associated to their I&A account information and establish surrogacy or employer connections as needed to allow others to work on their behalf in other CMS applications (NPPES, PECOS, HITECH). Each user should only control and access their own I&A account.
Are you required to setup MFA with your personal information if you manage the provider's account and login on their behalf directly into their account?¶
MFA is required for all I&A accounts. It is not recommended for any user to log into a provider’s I&A account. Each user should access their own I&A account using their private login information. Users are recommended to setup surrogacy connections and/or employer relationships in I&A to gain access to manage the desired providers’ information in the other CMS applications (NPPES, PECOS, HITECH).
Is Practice Location office accessible to individuals with mobility disabilities? ¶
Accessible locations include those where there are no architectural barriers to facility access by individuals with mobility disabilities.
Does the Practice Location office have exam rooms accessible to individuals with mobility disabilities?¶
Accessible exam rooms allow patients with mobility disabilities to enter the room, move around inside the room, and utilize medical equipment.
Does the Practice Location office have medical equipment accessible to individuals with mobility disabilities?¶
Accessible medical equipment allows an individual with mobility disabilities to receive medical services equal to those received by a person without a disability such as diagnostic equipment, adjustable-height exam tables and chairs, wheelchair-accessible scales, adjustable-height radiologic equipment, portable floor and overhead track lifts, and gurneys and stretchers.
To learn more about accessibility click here.
FAQS (Frequently asked Questions)
- If you are an employee/owner of the Provider Organization, you can submit an employer request.