QUESTION: I have been using my providers’ PECOS (Provider Enrollment, Chain and Ownership System) passwords and logins to update their Medicare and Medicaid enrollments. When I submit their information, the required signature at the end indicates that I am the practitioner, when I’m clearly not. Should we consider handling updating enrollments a different way?

Question from Omaha, Nebraska Subscriber

ANSWER: You are not alone. It is common for someone other than a provider to manage Medicare and Medicaid enrollments, and for this other person to use the provider’s username and password to do so. However, there is a better more compliant way.

Use a PECOS Surrogacy Login to Stay Compliant

CMS created the PECOS Identify & Access (I&A) Management System to help you manage provider enrollment under a PECOS surrogacy login that is specific to you. Unfortunately, many practices don’t take advantage of this functionality.

In reality, you’re not supposed to use your providers usernames and passwords. However, if you do, you should get written permission from each practitioner to protect yourself.

There are a variety of benefits to utilizing the PECOS I&A System beyond just compliance. Having one central login will save you time and help you better manage your enrollments more accurately and compliantly. And keep you out of trouble should something go wrong.

Here is a real-life cautionary tale.

An office manager worked for a practice that has several practitioners up for revalidation. The practice manager handled these enrollments by logging in with individual provider usernames and passwords. However, one day when she tried to log in, someone had changed the login passwords for three of the providers. The office manager had no idea who had changed them or how to get them back. So, each practitioner in question had to call into PECOS customer service to get a temporary password. They also needed to have their account reset so that the manager could go in and complete the revalidation.

If the practice manager had gone through the steps to set up surrogacy access for her practitioners, she would have been able to log in under one account and managed all validations more easily. Once you are set up in this system, your access cannot be affected by individual login password changes and expirations.

To set up a surrogacy account, each individual practitioner much request it. It may seem like a pain, but it only needs to be done once. Once set up, your surrogacy login will give you the ability to manage information for all of your providers with a variety of systems. The four accessible systems that CMS includes with your login are the: :

National Plan & Provider Enumeration System (NPPES). This is where you request an NPI or update an existing NPI.
Provider Enrollment Chain and Ownership System (PECOS). You can perform any Medicare enrollment functions such as initial applications, updates, revalidations and voluntary terminations.
EHR Registration & Attestation System. This is used for eligible hospitals to register and attest for Meaningful Use.
PECOS I&A Management System. This is the gatekeeper system that maintains and gives permissions for the access to the above systems. To get access to the NPPES, EHR and/or PECOS systems, you must have the proper permissions on behalf of the organization and individual practitioners to go in and complete their updates.

With your one login that you create in PECOS I&A, you can now access all four systems compliantly, efficiently and without providers throwing up unexpected password reset obstacles.

Enrollment expert, Gretchin S. Heckenlively, CPA, FHFMA, can help you more easily and successfully set up and maintain a surrogacy account for your Medicare and Medicare providers during her online training session, “PECOS: Master CMS Surrogacy Enrollment Requirements.”