The NPI takes the test, the TIN files the report
PAMA’s reporting rule runs on two identifiers that most laboratory organizations hold at different levels, and most of the confusion around the rule comes from mixing them. The status question, was this an applicable laboratory, is asked and answered at the level of a billing NPI. The filing obligation, who actually submits data to CMS and signs for it, sits at the level of a Taxpayer Identification Number. One TIN can hold many NPIs, and the regulation treats the two levels differently on purpose. This page separates the jobs, from the text of 42 CFR part 414 subpart G (eCFR text as of August 20, 2026, read 2026-08-25) and CMS’s PAMA FAQ (updated July 14, 2026, read 2026-08-25).
The NPI is where status lives
The definition of applicable laboratory in 42 CFR 414.502 attaches to an entity that “Bills Medicare Part B under its own National Provider Identifier (NPI)”, then applies two revenue tests to that NPI’s Medicare revenue during the collection period: the majority of Medicare revenues test and the $12,500 low expenditure threshold. The one exception is a hospital outreach laboratory billing under the hospital’s NPI, which runs the same two tests on its revenues attributed to the CMS-1450 type of bill 14x instead.
Consequences of testing at this level, all from CMS’s FAQ. A TIN with several laboratory NPIs does not get one combined answer: status “must be determined” per component, and A3.6 puts the two levels in one sentence: “the TIN-level entity is the reporting entity. The reporting entity must report applicable information for all of its component NPI-level entities that meet the definition of an applicable laboratory.” A hospital whose lab shares the hospital’s NPI is tested on the whole NPI’s revenue mix, which is why A3.8 calls qualification “highly unlikely” in that shape: the denominator is the entire hospital’s Medicare revenue. And a physician office lab with its own NPI is inside the same test as everyone else.
The TIN is where the obligation lives
42 CFR 414.502 defines the filer:
Reporting entity is the entity that reports tax-related information to the Internal Revenue Service (IRS) using its Taxpayer Identification Number (TIN) for its components that are applicable laboratories.
So the entity that owed CMS a report during May through July 2026 was not each lab NPI; it was the TIN above them, filing for whichever of its components passed the two tests. The mechanics follow the same line: CMS’s FAQ Q4.24 says “Submit one file per TIN using the provided Data Template. Data for multiple NPIs may be included in the same file; however, the data collection system will accept only one submission per TIN.” For this cycle the FAQ also describes a condensed option (its Section 5), under which “reporting entities have the option of condensing certain applicable information at the TIN-level instead of reporting individually for each component that is an applicable laboratory”, with one designated NPI carrying the combined rows.
What the TIN actually files
Applicable information, defined at 42 CFR 414.502 as three components per test: “Each private payor rate for which final payment has been made during the data collection period”, “The associated volume of tests performed corresponding to each private payor rate”, and “The specific Healthcare Common Procedure Coding System (HCPCS) code associated with the test.” The same definition excludes tests “for which payment is made on a capitated basis.” Note the time anchor: for private payor data it is the date of final payment inside the collection window, where the status tests anchored on the date of service. Same window, two different clocks.
The signature is personal
42 CFR 414.504(d) puts a named officer behind the file:
To certify data integrity, the President, CEO, or CFO of a reporting entity, or an individual who has been delegated authority to sign for, and who reports directly to, such an officer, must sign the certification statement and be responsible for assuring that the data provided are accurate, complete, and truthful, and meets all the reporting parameters described in this section.
The delegation path is narrow: the delegate must report directly to one of those three officers. CMS’s submission system mirrors the split in its roles, a submitter and a certifier, each with its own user guide on CMS’s CLFS reporting resources page (last modified August 3, 2026, read 2026-08-25). The same section’s paragraph (e) attaches the civil monetary penalty authority for failures and misrepresentations to the reporting entity, which closes the loop: the TIN files, an officer certifies, and the exposure for a bad filing sits where the signature sits.
Two prohibitions that surprise people
Both are one sentence each in 42 CFR 414.504. Paragraph (g): “Applicable information may not be reported for an entity that does not meet the definition of an applicable laboratory.” Reporting is not open to volunteers; a TIN that files for a component that failed the tests has misfiled, not overachieved. And paragraph (f): CMS and its contractors “will not disclose applicable information reported to CMS under this section in a manner that would identify a specific payor or laboratory”, with named oversight exceptions (the Comptroller General, the Congressional Budget Office, MedPAC, HHS OIG and DOJ). The private payor rates a TIN files do not become public rows anywhere.
Walking one organization through it
The figures in this worked example are hypothetical, chosen to sit on either side of the statutory bar; only the thresholds and the rules applied to them come from 42 CFR 414.502 and 414.504.
Take a TIN holding three laboratory NPIs. During January through June 2025, NPI A cleared both revenue tests, NPI B billed $9,000 of CLFS money (under the $12,500 bar), and NPI C billed mostly non-laboratory Part B services (majority test failed). The TIN was a reporting entity, because at least one component was an applicable laboratory. Its one file should have carried NPI A’s applicable information and nothing for B or C, whose data may not be reported at all under 414.504(g). One file, one certifying officer, one component’s data. The dollar figures in this example are invented for arithmetic and belong to no real laboratory; the bars they are measured against are the regulation’s.
Which of its NPIs a laboratory organization should even run the tests on is answerable from its own billing records only. The public half, what CMS’s published payment file shows for one NPI against the one public threshold, is what pamawatch.com/check displays, and the NPI versus TIN split on this page is one more reason that display stops short of a status: even the public file’s unit, the NPI, is not the unit that files.
Sources, each read this session
42 CFR 414.502 and 414.504, eCFR text as of August 20, 2026, read 2026-08-25. CMS, Private Payor Rate-Based CLFS FAQs, updated July 14, 2026, read 2026-08-25 (A3.2, A3.6, A3.8, Q4.24, Section 5). CMS, CLFS and PAMA Reporting and Resources page, last modified August 3, 2026, read 2026-08-25. Quotes verbatim, under this site’s standing rule of no dash characters: a dash in a source renders as a colon or the quote is split around it.
Published by Neige AI, Inc. See the method and sources.
This page is independent research, not legal or financial advice. It quotes 42 CFR part 414, 45 CFR 102.3 and Public Law 119-75 with pinpoint citations. Verify anything load-bearing against the primary text itself before acting on it.
See where your lab’s own billing sits before the next reporting cycle
One NPI or lab name, about a minute, no account required.
Check my lab now