The new law imposes two principal requirements that must be satisfied before January 1, 2028, for off-campus hospital outpatient departments to continue receiving Medicare OPPS payments.
On February 3, 2026, President Donald Trump signed the 2026 Consolidated Appropriations Act (CAA) into law. Section 6225 of the CAA requires hospitals to submit mandatory attestations confirming compliance with Medicare’s provider-based regulations for all off-campus hospital outpatient departments and to obtain distinct National Provider Identifiers (NPIs) for each such location.
Hospitals that fail to meet both requirements by January 1, 2028, will lose eligibility for Medicare reimbursement under the Outpatient Prospective Payment System (OPPS) at those locations.
Understanding Provider-Based Departments
Many hospitals operate outpatient clinics, specialty offices and other care sites away from the main hospital campus. Under Medicare rules, these locations can bill as part of the hospital—and receive higher hospital-level reimbursement under the OPPS—if they qualify for “provider-based status” under 42 C.F.R. § 413.65. In practical terms, provider-based status means that the Centers for Medicare and Medicaid Services (CMS) treats the off-site location as a department of the hospital rather than as a freestanding facility.
To earn that designation, a location must demonstrate genuine integration with the main hospital. Key requirements include shared licensure (the department and hospital operate under the same license), clinical integration (physicians at the department hold privileges at the hospital and patient records flow through a unified system) and public awareness (patients are informed they are receiving care at a hospital department, not an independent office). Off-campus hospital departments—generally those more than 250 yards from the main campus—must be owned, controlled, administered and supervised by the main hospital, reinforcing that the department functions as an extension of the hospital rather than as a separate entity.
The Shift from Voluntary to Mandatory Attestation
Provider-based attestations are formal declarations submitted by a hospital to CMS verifying that a facility meets certain licensure, financial integration and other requirements under 42 C.F.R. 413.65 to bill as a provider-based entity. These attestations include detailed documentation—often hundreds of pages—and require considerable time and administrative resources for hospital staff to compile.
Historically, submission of a provider-based attestation to CMS was entirely voluntary. Hospitals could submit attestations to their Medicare Administrative Contractor if they chose, and the primary benefit was limiting exposure to retrospective overpayment liability if CMS later determined a location was noncompliant. Because the process is labor-intensive and inherently invites CMS scrutiny, many hospitals historically opted not to submit voluntary attestations.
Key Requirements Under Section 6225
The new law imposes two principal requirements that must be satisfied before January 1, 2028, for off-campus hospital outpatient departments to continue receiving Medicare OPPS payments:
Mandatory Provider-Based Attestations
Section 6225 of the CAA eliminates hospitals’ discretion that hospitals have previously employed to determine whether to submit a provider-based attestation for an off-campus hospital outpatient department. Beginning January 1, 2028, attestations become a statutory prerequisite for Medicare OPPS payments at off-campus provider-based locations.
Each off-campus hospital outpatient department must have a current provider-based attestation on file with CMS. The statute requires two categories of attestation: (1) an initial attestation submitted within the two-year period ending on the date services are furnished (meaning it must be dated on or after January 1, 2026) and (2) subsequent attestations on a schedule to be established by the Secretary of Health and Human Services through future rulemaking.
Importantly, hospitals that previously submitted voluntary attestations before January 1, 2026, cannot rely on those prior filings—they must submit new attestations dated on or after January 1, 2026, to satisfy the statute. Until CMS establishes a new attestation process through notice-and-comment rulemaking, hospitals may submit attestations under the existing voluntary framework described in 42 C.F.R. § 413.65(b)(3).
Distinct National Provider Identifiers
In addition to attestations, each off-campus hospital outpatient department must obtain and bill under a distinct organizational (Type 2) NPI that is separate from the main hospital’s NPI. Hospitals will no longer be permitted to bill multiple off-campus locations under a single NPI. The separate NPI requirement is widely viewed as enabling CMS to better track services for which hospitals charge facility fees at off-campus locations.
Payment Consequences for Noncompliance
The consequences of noncompliance are significant: Off-campus hospital outpatient departments that fail to submit attestations and acquire separate NPIs by January 1, 2028, will become ineligible for Medicare facility payments under the OPPS.
Broader Implications
The reach of this mandate extends well beyond the immediate attestation and NPI obligations. Hospitals that do not already use distinct NPIs for each off-campus location will likely need to update their Medicare provider enrollment records carefully, which could create cascading effects on commercial payer agreements, managed care contracting, state licensure, Medicaid enrollment and 340B drug program registrations.
Regarding the 340B program specifically, this new attestation requirement has potential implications for hospital departments registered as 340B child sites. If a hospital fails to comply, the Health Resources and Services Administration may consider that noncompliance when determining whether a hospital department should remain an eligible 340B child site. The attestation process is also likely to unearth current or past compliance gaps. Where compliance reviews uncover historical issues, hospitals must carefully evaluate potential overpayment exposure and False Claims Act risk.
Next Steps for Hospitals
Given the complexity and scope of the new requirements, hospitals with off-campus hospital outpatient departments should begin preparation immediately. Key steps include:
Prepare Well in Advance of the January 1, 2028, Deadline
Submitting a provider-based attestation is time-consuming, and hospitals must complete one for each off-campus hospital outpatient department. Hospitals should begin planning their information-gathering and submission strategies as soon as possible—not only to prepare the required materials, but also to allow time for follow-up questions and requests for additional documentation.
Conduct a Comprehensive Inventory
Identify all off-campus hospital outpatient locations and assess each location’s current compliance with the requirements at 42 C.F.R. § 413.65. This review should encompass legacy departments, recently acquired or reorganized facilities, and departments relying on older attestations.
Initiate NPI Enrollment
Begin the process of obtaining separate organizational NPIs for each off-campus hospital outpatient department and submit the associated federal and state filings.
Assemble Attestation Documentation
Begin gathering the documentation necessary to support attestations, including evidence of licensure, clinical integration, public awareness, ownership and control, and administration and supervision.
Establish Tracking and Monitoring Systems
Develop internal processes to track attestation submission deadlines, NPI assignments and subsequent attestation requirements once CMS establishes the periodic schedule.
Plan Ahead for Future Off-Campus Sites
Any future off-campus hospital outpatient locations should incorporate NPI enrollment and provider-based attestation timelines into their project development roadmaps.
For More Information
If you have any questions about this Alert, please contact Erin M. Duffy, Zeke Van Keuren, Annie Blackman, any of the attorneys in our Health Law Practice Group or the attorney in the firm with whom you are regularly in contact.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.