CMS Proposes Mandatory Provider-Based Attestation Framework For Off-Campus Hospital Outpatient Departments

Key Takeaways

• The Centers for Medicare & Medicaid Services (CMS) has proposed a process for hospitals to comply with the new statutory requirement that off-campus hospital outpatient departments (HOPDs) submit provider-based attestations. Previously, submitting these attestations was voluntary.
• Starting January 1, 2028, a new HOPD providing services must have its own National Provider Identifier (“NPI”) prior to submitting an attestation form and must submit an initial attestation within the two-year period before providing billed services.
• Existing HOPDs already providing services before January 1, 2028, must submit the required information between January 1, 2026, and December 31, 2027.
• Hospitals should begin preparing now by identifying affected departments, evaluating provider-based compliance, obtaining separate NPIs where necessary and organizing documentation that supports provider-based status.

CMS has issued a proposed rule detailing how the mandatory provider-based attestation requirements will be submitted, as required by the Consolidated Appropriations Act, 2026 (“CAA”) passed earlier this year. The proposal provides the first detailed framework for how hospitals will demonstrate compliance with Medicare’s provider-based requirements before the statutory January 1, 2028 implementation date.

Beginning January 1, 2028, HOPDs not located on a hospital’s main campus, or within 250 yards of a remote hospital location, must submit the required attestation—and each off-campus HOPD must bill under its own organizational NPI—in order to receive Medicare payment for services furnished by those departments.

To accommodate the anticipated increase in attestation requests and promote consistency, CMS has proposed replacing the current Medicare Administrative Contractor (“MAC”) provider-based process with a centralized electronic submission system administered directly by CMS. The draft attestation form closely aligns with the requirements under 42 CFR §413.65 and contains a detailed checklist for providers to certify. Each attestation will first be reviewed by an automated validation system to verify consistency with information CMS already has. From there, attestations may undergo targeted documentation review and an extended review process with site visits or remote audits to verify the provided information.

For hospitals opening new HOPDs after January 1, 2028, providers will be able to bill Medicare as provider-based entities immediately upon submitting the new required attestation. However, CMS also reserves the right to conduct audits or site visits to determine compliance.

CMS also requests comments on whether hospitals that previously received an affirmative provider-based determination should be eligible for a streamlined re-attestation process. Under the proposal, these hospitals could potentially certify continued compliance rather than submitting a completely new attestation package, reducing the administrative burden for existing provider-based departments.

Although the rule is not yet final, hospitals should begin evaluating the required information now. Health systems with numerous off-campus departments may need significant time to assess compliance with the provider-based regulations, obtain separate organizational NPIs and assemble supporting documentation before the statutory deadline.

Hospitals should consider:

• Identifying all off-campus provider-based departments.
• Reviewing each department’s compliance with the provider-based requirements in 42 CFR. § 413.65.
• Determining which locations require separate NPIs.
• Gathering documentation that supports provider-based status and establishing internal processes to monitor ongoing compliance and future re-attestations.

CMS’s proposal provides long-awaited guidance on how the agency intends to implement Congress’s mandatory provider-based attestation requirements. While this guidance is still only a proposed rule, hospitals should not delay preparing for compliance. Early planning will help organizations ensure compliance ahead of the January 1, 2028, deadline and minimize the risk of reimbursement disruptions once the requirements take effect.