feat(npi): offer paper CMS-855 path (e-sign + we mail to MAC) alongside I&A surrogacy

- order-confirmation email presents both filing methods: paper CMS-855 (no account needed, client e-signs one page, we print+mail to their MAC) and I&A surrogacy (faster, needs CMS account). NPPES-only services note that surrogacy is required (web-only). - npi_provider handlers record the access model per service in admin todos. - marketing copy leads with the lowest-friction paper option.
2026-06-05 01:53:44 -05:00 · 2026-06-05 01:53:44 -05:00 · 31a53f89a6
commit 31a53f89a6
parent e32193352b
4 changed files with 104 additions and 4 deletions
--- a/api/src/routes/checkout.ts
+++ b/api/src/routes/checkout.ts
@ -2113,6 +2113,15 @@ export async function sendComplianceIntakeEmail(
    ((o.service_name as string) || "").toLowerCase().includes("499"),
  );

+  // PECOS / NPPES orders need CMS I&A surrogate access (the healthcare analog
+  // of USAC E-File delegation). OIG/SAM screening needs no access (public DBs).
+  const PECOS_ACCESS_SLUGS = new Set<string>([
+    "npi-revalidation", "npi-reactivation", "nppes-update",
+    "medicare-enrollment", "provider-compliance-bundle",
+  ]);
+  const npiAccessOrders = orders.filter(o => PECOS_ACCESS_SLUGS.has(o.service_slug as string));
+  const hasNpiAccess = npiAccessOrders.length > 0;
+
  const SITE_DOMAIN = process.env.DOMAIN ? `https://${process.env.DOMAIN}` : "https://performancewest.net";
  const confirmUrl = `${SITE_DOMAIN}/order/success?action=usac_delegation&order_id=${orderId}`;

@ -2143,6 +2152,59 @@ export async function sendComplianceIntakeEmail(
      </p>
    </div>` : "";

+  // CMS filing-method section for PECOS / NPPES orders. We offer two paths and
+  // let the provider pick the one that's easiest for them:
+  //   (1) Paper CMS-855  — they e-sign one page, we print + mail to their MAC.
+  //                        Zero account setup. Default for revalidation/enrollment.
+  //   (2) I&A surrogacy  — faster/trackable, but needs a CMS I&A account.
+  // NPPES-only services (reactivation, update) are web-only, so surrogacy is
+  // the only path for those. We never ask for the provider's password.
+  const npiConfirmUrl = `${SITE_DOMAIN}/order/success?action=ia_surrogacy&order_id=${orderId}`;
+  // Which ordered services can use the paper CMS-855 path (PECOS enrollment/reval)
+  // vs. are NPPES-web-only (surrogacy required).
+  const PAPER_855_SLUGS = new Set<string>(["npi-revalidation", "medicare-enrollment", "provider-compliance-bundle"]);
+  const NPPES_ONLY_SLUGS = new Set<string>(["npi-reactivation", "nppes-update"]);
+  const hasPaper855 = npiAccessOrders.some(o => PAPER_855_SLUGS.has(o.service_slug as string));
+  const hasNppesOnly = npiAccessOrders.some(o => NPPES_ONLY_SLUGS.has(o.service_slug as string));
+
+  const paper855Block = hasPaper855 ? `
+      <p style="margin:0 0 6px;font-size:13px;font-weight:700;color:#115e59;">Option 1 (easiest): Paper CMS-855 &mdash; no account needed</p>
+      <p style="margin:0 0 12px;font-size:13px;color:#134e4a;line-height:1.5;">
+        We complete the correct CMS-855 form for you. You e-sign the certification page
+        from a secure link we send (takes about a minute), and we print it and mail it to
+        your Medicare Administrative Contractor (MAC). Nothing for you to set up.
+      </p>` : "";
+
+  const surrogacyHeading = hasPaper855
+    ? `Option 2 (faster): CMS I&amp;A surrogate access`
+    : `Grant CMS I&amp;A surrogate access`;
+
+  const npiSection = hasNpiAccess ? `
+    <div style="background:#ccfbf1;border:1px solid #5eead4;border-radius:8px;padding:16px 20px;margin:20px 0;">
+      <p style="margin:0 0 10px;font-size:14px;font-weight:700;color:#115e59;">Action Required: Choose How We File</p>
+      ${paper855Block}
+      <p style="margin:0 0 6px;font-size:13px;font-weight:700;color:#115e59;">${surrogacyHeading}</p>
+      <p style="margin:0 0 12px;font-size:13px;color:#134e4a;line-height:1.5;">
+        ${hasNppesOnly ? "NPPES updates and reactivations are online-only, so this is required for those. " : ""}You add us as a
+        <strong>Surrogate</strong> in CMS Identity &amp; Access (I&amp;A) &mdash; you never share your password.
+        We then file in PECOS / NPPES under our own credentials, e-sign where permitted, and capture the tracking ID.
+      </p>
+      <ol style="margin:0 0 12px;padding-left:20px;font-size:13px;color:#134e4a;line-height:1.7;">
+        <li>Log in to <a href="https://nppes.cms.hhs.gov/IAWeb/login.do" style="color:#0f766e;">CMS I&amp;A (I&amp;A System)</a></li>
+        <li>Go to <strong>My Connections &rarr; Add Surrogate</strong></li>
+        <li>Add surrogate organization: <strong>Performance West Inc.</strong> (email <strong>filings@performancewest.net</strong>)</li>
+        <li>Grant access to <strong>PECOS</strong> and <strong>NPPES</strong> for your NPI, then approve our request</li>
+      </ol>
+      <p style="margin:12px 0;text-align:center;">
+        <a href="${npiConfirmUrl}" style="display:inline-block;background:#0f766e;color:#ffffff;font-weight:700;padding:12px 28px;border-radius:8px;text-decoration:none;font-size:14px;">
+          I've granted surrogate access &rarr;
+        </a>
+      </p>
+      <p style="margin:8px 0 0;font-size:12px;color:#115e59;text-align:center;">
+        ${hasPaper855 ? "Prefer the paper option? Just reply to this email and we'll send your CMS-855 to e-sign &mdash; no further action needed from you here." : "Clicking this notifies our team so we can begin your filing."}
+      </p>
+    </div>` : "";
+
  // Fully admin-assisted services with NO customer intake form. State-level
  // trucking + hazmat/emissions now have a dedicated intake step, so they are
  // NO LONGER in this set — customers get an intake link like other services.
@ -2222,6 +2284,8 @@ export async function sendComplianceIntakeEmail(

    ${usacSection}

+    ${npiSection}
+
    ${dotSection}

    ${intakeSection}
--- a/scripts/workers/services/npi_provider.py
+++ b/scripts/workers/services/npi_provider.py
@ -40,6 +40,9 @@ _SLUG_META = {
            "the revalidation due date on the CMS revalidation list, update the "
            "enrollment record, and submit. Capture the PECOS tracking ID."
        ),
+        "access": (
+            "PECOS via CMS I&A surrogacy (preferred). Fallback: paper CMS-855I/B/R, provider wet-signs cert page, mail to provider's MAC."
+        ),
        "priority": "high",
    },
    "npi-reactivation": {
@ -49,6 +52,9 @@ _SLUG_META = {
            "Reactivate the deactivated NPI in NPPES. Verify the deactivation "
            "reason, correct any stale data, and re-certify the record."
        ),
+        "access": (
+            "NPPES via CMS I&A surrogacy. No paper option (NPPES is web-only)."
+        ),
        "priority": "high",
    },
    "nppes-update": {
@ -59,6 +65,9 @@ _SLUG_META = {
            "updates within 30 days of any change). Apply the requested field "
            "changes and certify."
        ),
+        "access": (
+            "NPPES via CMS I&A surrogacy. No paper option (NPPES is web-only)."
+        ),
        "priority": "normal",
    },
    "medicare-enrollment": {
@ -68,6 +77,9 @@ _SLUG_META = {
            "Complete the provider's Medicare enrollment in PECOS (CMS-855). "
            "Confirm taxonomy, practice location, and authorized official."
        ),
+        "access": (
+            "PECOS via CMS I&A surrogacy (preferred). Fallback: paper CMS-855, provider wet-signs, mail to MAC."
+        ),
        "priority": "high",
    },
    "oig-sam-screening": {
@ -78,6 +90,9 @@ _SLUG_META = {
            "SAM exclusion lists. Produce the screening certificate and flag any "
            "matches for escalation."
        ),
+        "access": (
+            "No client access needed - OIG LEIE + SAM.gov are public. Screen by NPI/name, issue certificate."
+        ),
        "priority": "normal",
    },
    "provider-compliance-bundle": {
@ -88,6 +103,9 @@ _SLUG_META = {
            "revalidation watch, run OIG/SAM screening, and refresh the NPPES "
            "record. Set the next revalidation reminder."
        ),
+        "access": (
+            "PECOS/NPPES via CMS I&A surrogacy; screening is public. Paper CMS-855 fallback for the enrollment/revalidation piece."
+        ),
        "priority": "high",
    },
 }
@ -123,7 +141,8 @@ class _BaseNPIHandler:
            f"PECOS Enrollment ID: {pecos_id or 'not provided'}\n"
            f"Specialty: {specialty or 'not provided'}\n"
            f"Practice state: {practice_state or 'not provided'}\n"
-            f"Portal: {meta['portal']}\n\n"
+            f"Portal: {meta['portal']}\n"
+            f"Access model: {meta['access']}\n\n"
            f"Review-staged: file manually, then mark this order complete."
        )

--- a/site/src/pages/services/healthcare/medicare-enrollment.astro
+++ b/site/src/pages/services/healthcare/medicare-enrollment.astro
@ -43,13 +43,18 @@ const description = "New to Medicare or adding a practice location? We assemble
    </section>

    <section>
-      <h2>How it works</h2>
+      <h2>How it works (without sharing your password)</h2>
      <ol>
        <li>You place the order and give us your NPI and basic practice details.</li>
+        <li>We send a one-time link to add us as a <strong>Surrogate</strong> in CMS I&amp;A. You never share your login.</li>
        <li>We pull your NPPES record and identify exactly which 855 forms apply.</li>
-        <li>We assemble the package and send it to you for signature/attestation.</li>
-        <li>We submit in PECOS and track it through your MAC, resolving any development requests.</li>
+        <li>We file in <strong>Internet-based PECOS</strong> under our own CMS credentials and track it through your MAC.</li>
      </ol>
+      <div class="pw-callout">
+        <strong>Prefer paper?</strong> We can complete a paper CMS-855 instead,
+        send it for your wet signature, and mail it to your Medicare
+        Administrative Contractor (CMS does not accept faxed 855s).
+      </div>
    </section>

    <section class="pw-cta-section">
--- a/site/src/pages/services/healthcare/npi-revalidation.astro
+++ b/site/src/pages/services/healthcare/npi-revalidation.astro
@ -66,6 +66,18 @@ const description = "CMS requires every enrolled provider and supplier to revali
      </ul>
    </section>

+    <section>
+      <h2>How we file for you</h2>
+      <p>
+        You pick whichever path is easiest. <strong>You never share your CMS
+        password.</strong>
+      </p>
+      <ul>
+        <li><strong>Paper CMS-855 (easiest, nothing to set up).</strong> We complete the correct CMS-855 form, you e-sign the certification page from a secure link (about a minute), and we print it and mail it to your Medicare Administrative Contractor (MAC). CMS does not accept faxed 855s, so we handle the mailing.</li>
+        <li><strong>Internet-based PECOS (faster, needs a CMS account).</strong> You add us as a <strong>Surrogate</strong> in the CMS Identity &amp; Access (I&amp;A) system; we then file in PECOS under our own credentials and capture the tracking ID.</li>
+      </ul>
+    </section>
+
    <section class="pw-cta-section">
      <a class="pw-cta" href="/order/npi-revalidation">File my Medicare revalidation — $399 →</a>
    </section>