The submission of an attestation to a hospital’s and its off-campus outpatient department’s compliance with Medicare’s provider-based rules has long been voluntary under the Centers for Medicare & Medicaid Services’ (“CMS’”) provider-based regulations. The Consolidated Appropriations Act, 2026 (the “Act”)[i], which the President signed into law on February 3, 2026, now mandates the submission of an attestation to compliance. As detailed herein, with respect to items and services furnished on and after January 1, 2028, the Act requires a hospital to submit an attestation to compliance with the provider-based rules for each off-campus outpatient department operating as provider-based. Additionally, the Act will require each such off-campus outpatient department to obtain, and bill such items and services under, its own National Provider Identifier (“NPI”) separate from the NPI for the main provider. These requirements were first proposed over a year ago in the Further Continuing Appropriations and Disaster Relief Supplemental Appropriations Act, 2025 (the “2025 Act”), which stalled near the transition of administrations.[ii] The passage of these requirements many months later reflects the federal government’s continued prioritization of strategies that purport to reduce Medicare spending and inefficiencies.
Overview of Provider-Based Billing and Related Attestation
A hospital that owns and operates multiple departments, locations, and facilities can operate those departments, locations, and facilities as ‘provider-based’ and, consequently, receive increased Medicare payment amounts under the Outpatient Prospective Payment System (“OPPS”) for items and services provided therein. However, in order to achieve provider-based status, the department, location, or facility must meet several requirements, including its licensure, clinical services, financial and administrative integration with the hospital, the public’s awareness of its ‘provider-based’ status, and more.[iii]
Hospitals may, but are not required to, submit an attestation to CMS that it and its provider-based department satisfy Medicare’s provider-based compliance requirements. In order to encourage the submission of attestations, CMS’ provider-based regulations state that if a hospital submits an attestation for a department that is later found to not comply with the provider-based rules, CMS will only seek to recover overpayments related to services provided on and after the date the attestation was submitted (i.e., and not look back to payments made for services provided on any prior date). As such, some hospitals and other “main providers” have sought to prepare and submit attestations as a means of limiting the risk of potential overpayment liability associated with any unwitting noncompliance with the provider-based rules. Other hospitals and “main providers” choose not to deploy this strategy, in part because the preparation of a complete and comprehensive attestation can be a significant administrative and resource burden.
The Growth of Off-Campus, Provider-Based Hospital Outpatient Departments
In part as a result of the financial benefit offered by the achievement of provider-based status, for many years hospitals have acquired physician practices, converted the associated practice sites to provider-based outpatient departments of the hospital, and billed for items and services provided therein under the OPPS instead of the Medicare Physician Fee Schedule. Over the years, Congress has engaged in a number of efforts to stem the financial effect on the Medicare program. As one example, Congress passed the Bipartisan Budget Act of 2015, effective January 1, 2017, which imposed ‘site neutrality’ and provided that no off-campus outpatient department of a hospital may bill under the OPPS unless it had achieved provider-based status prior to November 2, 2015.[iv]
Overview of the Act’s New Requirements
Regardless of whether or not an off-campus hospital outpatient department had achieved provider-based status prior to November 2, 2015, the Act imposes the following new requirements, effective for items and services provided on and after January 1, 2028:
- NPI Number: Each off-campus, provider-based hospital outpatient department must obtain its own NPI that is separate from the NPI of the main provider. Items and services which are provided in the off-campus, provider-based outpatient department must be billed under that separate NPI.
- Multiple Attestations of Compliance: Under the Act, the hospital must submit multiple attestations that it and its off-campus outpatient department comply with the requirements of 42 CFR § 413.65. The initial attestation must be submitted within the two years prior to the date on which items or services are furnished in the off-campus outpatient department and for which OPPS reimbursement will be sought. Therefore, if a hospital plans to continue to claim and receive OPPS-based reimbursement for items and services furnished on and after January 1, 2028 in any off-campus, provider-based outpatient department, the hospital must submit an initial attestation within the balance of calendar year 2026 or 2027. In addition to the initial attestation, the hospital will be required to submit subsequent attestations within timeframes to be specified by the Secretary of the Department of Health and Human Services (“HHS”).
- Process for Submission and Review: The Act requires HHS to establish a process for the submission and review of initial and subsequent attestations. As CMS and its contractors have long maintained a process for reviewing and evaluating voluntary attestations to provider-based compliance, HHS may simply choose to expand that process. The Act appropriates $20,000,000 to HHS in order to implement this process.
Looking Forward
The provider-based attestation process can be burdensome, lengthy, and resource-intensive, particularly for hospital systems with numerous hospitals that have each proliferated off-campus provider-based outpatient departments. Familiarity with the various types of documentation and information that CMS and its contractors deem to be sufficient can be crucial to avoiding elongated follow-up inquiries and, thus, obtaining a quick(er) and favorable result. Because the attestation process has historically been voluntary, some providers may be underprepared for the process. Although the process can be cumbersome, our team is familiar with the types of information and documentation of provider-based compliance that CMS and its contractors have historically viewed as sufficient to garner approval, or that prompt follow-up questions, or that are dismissed as insufficient to prove compliance.
In light of the number of provider-based off-campus outpatient departments that a hospital could have, hospitals and health systems should begin evaluating how they can prepare for, standardize, and make as efficient as possible the attestation process. Hospitals and health systems should also begin to understand and address any clinical, administrative, or operational difficulties that their off-campus provider-based outpatient departments encounter in achieving provider-based compliance. Submission of an inaccurate attestation to provider-based compliance can raise potentially material legal implications, in addition to reimbursement implications.
FOOTNOTES
[i] H.R. 7148, 119th Cong. (2026), available at: https://www.congress.gov/bill/119th-congress/house-bill/7148/text.
[ii] H.R. 10445, 118th Cong. (2024), available at: https://www.congress.gov/bill/118th-congress/house-bill/10445/text.
[iii] See 42 C.F.R. 413.65.
[iv] Bipartisan Budget Act of 2015, Pub. L. No. 114-74 (2015).