new-site/docs/healthcare-filing-tiers-verified.md

Healthcare filing: Standard (no-login) vs Expedited (surrogate) — VERIFIED matrix

Internal capability map. Confirms how each healthcare service is fulfilled with no client login and no credential sharing, and where the optional Expedited (CMS I&A Surrogate) path applies.

Client-facing rule (do not break): never expose mechanics to the client. No "paper", "CMS-855", "CMS-10114", "MAC", "Fargo", or form numbers in any client copy. The only client-visible choice is the positive surrogate question ("electronically granting us I&A Surrogate access lets us bulk-file faster / fewer steps on our end"). Declining is silent; we just "file it for you." Same price either way — Expedited is NOT a paid tier.

Two service tiers (internal)

• Standard (default): we complete the official form, client signs ONE certification (e-sign link), we submit + track. For CMS-855s the signed form is mailed to the provider's MAC; for NPPES-only changes via the NPI Enumerator paper path. Daily batched mailing (see §Daily batch).
• Expedited (if client grants I&A Surrogate): we file online in PECOS/NPPES under our own login (surrogate), same-day tracking. Surrogacy is a delegation, NOT a password handover.

VERIFIED from the official CMS form PDFs in docs/ (primary source)

CMS-855I (05/23) — individual practitioner [CONFIRMED, quoted]

• Valid reasons include: revalidation, reactivation ("reactivate your Medicare billing number to resume billing"), changes to enrollment info, and enrolling with another MAC. → revalidation/reactivation/enrollment all ride the 855I paper path.
• Paper submission: "Send this completed application with original signatures and all required documentation to your designated MAC. The MAC that services your State is responsible for processing your enrollment application." → no login required; routed by STATE.
• Signature caveat: "As an individual practitioner, you are the only person who can sign this application. The authority to sign the application on your behalf may not be delegated to any other person." → client must personally sign (pen/e-sign), but that is NOT a login. A surrogate cannot sign the 855 for them — surrogacy speeds the online filing, the cert signature is still theirs.

CMS-855B (12/2025) — clinic/group/supplier [CONFIRMED, quoted]

• Same paper-to-MAC, original-signatures, routed-by-State rule.
• Org signer: a delegated/authorized official signs §15B/15D (not the individual) — still a signature, no login.
• Application FEE required (paid via PECOS feePaymentWelcome) on initial enrollment, new location, and revalidation BEFORE mailing. → org standard path has a fee-payment step we must handle/route; individual 855I does not.

CMS-855O (09/23) — ordering/referring only [CONFIRMED, quoted]

• Paper-to-MAC, original signatures, routed by state. "Sign and date section 8 using ink."

NPPES data update / NPI reactivation (CMS-10114 paper path) [CONFIRMED]

• VERIFIED firsthand against the live CMS-10114 PDF (Rev. 02/25, OMB 0938-0931, exp. 03/2028) downloaded from cms.gov/Medicare/CMS-Forms/CMS-Forms/downloads/CMS10114.pdf, and the CMS "How to Apply" page which titles it the "NPI Application/Update Form".
• The form's Section 1A "Reason for Submittal" has four checkboxes: #1 Initial Application, #2 Change of Information, #3 Deactivation, #4 Reactivation — all completed on the SAME paper form, each requiring a signed + dated certification (Section 4A individual / 4B organization). Verbatim: "If changing information, check box #2... then sign and date the certification... All changes must be reported to the NPI Enumerator within 30 days." and "If you are reactivating the NPI, check box #4... Sign and date the certification."
• So paper CMS-10114 is a valid no-login path for changes AND reactivation, not just initial enumeration. UNCERTAIN flag resolved.
• Mailing address (current, printed on the form page 5):

  CMS NPI Enumerator Services
  Mail Stop DO-01-51
  7500 Security Blvd.
  Baltimore, MD 21244
  

  The previously-documented Fargo, ND PO Box 6059 address is RETIRED — code (mac_routing.NPI_ENUMERATOR) and docs updated to the Baltimore address. Enumerator phone for questions: 1-800-465-3203.
• No electronic no-login equivalent exists for CMS. Unlike FMCSA (whose ask.fmcsa.dot.gov/app/ticket accepts an MCS-150 update + attachments with no account), CMS has no public web form to submit an NPPES change without a login. Probed live: the NPI Registry API (npiregistry.cms.hhs.gov/api) is read-only lookup; PECOS and NPPES I&A both require login. Therefore for NPPES changes the two genuine tiers are: Standard = paper CMS-10114 to Baltimore (no login), Expedited = surrogate files in NPPES online.
• Decision (updated): offer Expedited (surrogate → NPPES online) as the fast path and the CMS-10114 paper-to-Baltimore path as the Standard default. Build cms10114_pdf_filler.py to produce the signable form (Reason checkbox driven by service: change vs reactivation vs deactivation).

CMS I&A Surrogate (Expedited path)

• Provider adds Performance West as a Surrogate in CMS I&A; we then file in PECOS/NPPES under our own credentials. No password shared.
• Scope nuance to verify in copy: confirm a single surrogacy grant covers the PECOS and NPPES functions we need (the checkout copy currently asks for both).

Per-service tier table

Service	Standard (no-login)	Expedited (surrogate)	Fee?
Medicare revalidation	855I/B → MAC, client signs	file in PECOS	855B yes
Medicare enrollment	855I/B/O → MAC, client signs	file in PECOS	855B yes
NPI reactivation	855I → MAC (reactivation reason)	PECOS/NPPES	no
NPPES data update	CMS-10114 → NPI Enumerator (Baltimore), client signs	NPPES online	no
OIG/SAM screening	public DBs, zero client action	n/a (no portal)	no
Provider compliance bundle	spawns reval + screening + NPPES	mixed	per-piece

Daily batch (Standard-path mailing)

Each postal working day morning (skip weekends + USPS/federal holidays — use scripts/workers/business_days.py calendar): gather all signed+pending paper filings, group by destination agency (each MAC; NPI Enumerator Baltimore; each state agency), merge each group into ONE print job + a cover sheet (PW sender, destination, date, enclosed count, per-item order#/provider/NPI/form), one Priority Mail envelope per agency. Mark each order mailed with batch date + tracking. Phase 1: generate per-agency batched PDF + cover sheet + manifest for a human to print & drop. Phase 2: wire a print-mail API (Lob/Click2Mail).

MAC routing

855s route by the provider's State (855I/B/O all say "the MAC that services your State"). Mailing addresses: CMS.gov/Medicare/Provider-Enrollment-and- Certification. Need a state → MAC → mailing-address table to address envelopes

• to group the daily batch. practice_state intake field drives this.

Implementation status (built + validated)

• mac_routing.py — state→MAC (56 jurisdictions, 12 destinations) + NPI_ENUMERATOR (NPI Enumerator Services, Baltimore MD — VERIFIED from CMS-10114 Rev. 02/25). MAC addresses still marked VERIFY before first live mail.
• npi_provider.py — two-tier access strings; NPPES update/reactivation no longer "online-only"; surrogate answer surfaced in the admin todo. nppes-update now generates the CMS-10114 for e-signature (Standard path) via _generate_10114_for_signing.
• cms10114_pdf_filler.py — fills the official CMS-10114 (flat PDF, text overlay): reason checkbox (change/reactivation/deactivation) + NPI + Section 2A identity + Section 4A certification name, with a signature anchor on the cert line. The signed form joins the daily batch to the NPI Enumerator (Baltimore). test_cms10114.py 27/27 pass.
• checkout.ts + service pages + intake — client-facing copy stripped of mechanics; surrogate is the only optional, positively-framed ask (faster, never required, never share password, never mentions paper). Astro build green.
• Daily batched mail — migration 089 (paper_filing_batches + esign_records.paper_batch_id/filing_destination_key); batch_cover_sheet.py (per-agency cover + merged print job); daily_paper_batch.py worker (group by destination, self-gated to postal working days); pw-paper-batch systemd timer. test_paper_batch.py 15/15 pass.
• State/adjacent matrix — A/B/C/D no-login classification added to state-healthcare-compliance-opportunities.md; CLIA (CMS-116) + state CSR are the cleanest A-category additions that reuse the daily batch flow.

TODO before first live mail (manual / verify)

1. Fill the real MAC provider-enrollment PO Box addresses in mac_routing.py (marked VERIFY) from each MAC's current enrollment page.
2. Confirm CMS-10114 paper-for-changes acceptance + obtain the form PDF build cms10114_pdf_filler.py DONE — verified against CMS-10114 Rev. 02/25 (address = NPI Enumerator Services, Baltimore MD); filler built + wired into npi_provider._generate_10114_for_signing; test_cms10114.py 27/27 pass. Remaining nicety: org (Entity Type 2 / Section 4B) overlay path (currently flagged for manual completion when NPI-2 detected).
3. Run migration 089 on the DB; confirm the worker picks up a signed test filing and produces the per-agency cover + merged PDF in MinIO.
4. Phase 2: wire a print-mail API (Lob/Click2Mail) to auto-mail the merged PDF and fill tracking_number.