Introduction and Summary
As part of the Consolidated Appropriations Act, Congress established new identification and attestation requirements for off-campus outpatient departments of acute care hospitals. Although Medicare requires that all off-campus outpatient departments billing for outpatient hospital services satisfy the provider-based requirements set forth in 42 CFR § 413.65, the submission of provider-based attestations (PBAs) to CMS has historically been optional.
Effective January 1, 2028, though, Medicare will not make payments under the Outpatient Prospective Payment System (OPPS) for items and services furnished by an off-campus outpatient department unless the department has obtained a separate National Provider Identifier (NPI) and the provider has submitted an attestation confirming compliance with provider-based regulations set forth in 42 CFR § 413.65. For many hospitals, this change will necessitate compiling the required documentation and submitting a PBA for the first time.
Hospitals undertaking this process must take into account that noncompliance with provider-based requirements can give rise to significant legal exposure, including potential overpayment obligations and False Claims Act liability. Where compliance assessments identify current or historical deficiencies, providers must carefully evaluate potential overpayment exposure and false claims risk. In light of these significant new statutory requirements – and the possibility that compliance reviews may uncover prior issues – providers should seek guidance from legal counsel.
The legislation directs the Secretary of Health and Human Services to establish, through notice-and-comment rulemaking, a process for providers to submit initial and subsequent attestations and for the Secretary to review compliance through site visits, remote audits, or other means. Congress has appropriated $20,000,000 to the CMS Program Management Account for fiscal year 2026 to implement these requirements. Additionally, the HHS Office of Inspector General is required to submit a report to Congress by January 1, 2030, analyzing the attestation review process and providing recommendations.
Practical Next Steps
Providers operating off-campus outpatient departments should evaluate, manage, and address the following key considerations prior to the January 1, 2028, deadline:
- Conduct a comprehensive inventory of all off-campus outpatient departments.The statute defines an "off-campus outpatient department of a provider" as a department of a provider (as defined in 42 CFR § 413.65) that is not located on the campus of such provider (within 250 yards of the main buildings providing inpatient services) or within that distance from a remote location of a hospital facility, as described in the regulatory definition of campus.
- Obtain a separate NPI for each off-campus outpatient department. Items and services must be billed under this separate identifier to receive payment.
- Evaluate current compliance with provider-based status requirements under 42 CFR § 413.65 and remediate any deficiencies in advance of submitting attestations. Providers will have to assess current compliance with provider-based requirements including those related to clinical and financial integration. It will be important to consider whether any material changes have occurred in the relationship between the department and the main provider that could jeopardize provider-based status. Certain facilities currently operating as off-campus hospital outpatient departments may ultimately need to be restructured as a different provider type to maintain Medicare reimbursement eligibility. This process entails its own time-consuming processes, which should be identified and implemented as soon as possible. Other departments will need to make changes to ensure compliance with provider-based regulations. If a department has inappropriately been receiving OPPS payments based on an incorrect assumption that provider-based requirements were satisfied, the hospital should work with counsel to identify overpayments and determine appropriate next steps with respect to repayment and disclosure.
- Prepare attestation documentation confirming compliance with provider-based requirements and monitor CMS rulemaking for the formal attestation submission process. PBAs are comprehensive submissions that necessitate extensive documentation, including operational policies, procedures, and other facility-specific materials. The preparation of a thorough PBA frequently requires a significant amount of time, and providers should plan accordingly rather than anticipating a rapid turnaround. Currently, it remains unclear whether CMS will maintain the longstanding attestation form and process or implement a new one. Therefore, providers should work with counsel to carefully monitor implementing regulations for further guidance.
- Establish internal processes to track attestation submission deadlines and ensure subsequent attestations are submitted within the timeframes specified by the Secretary. Providers should anticipate dedicating additional resources and administrative capacity to the ongoing PBA submission process, particularly given that CMS review typically generates supplemental inquiries and documentation requests.
- Maintain appropriate documentation demonstrating compliance with provider-based status requirements under 42 CFR § 413.65. Under the current provider-based status regulations, providers are required to supply documentation supporting the basis for the attestation to CMS at the time PBAs are submitted. Therefore, all efforts to demonstrate compliance with the requirements should be appropriately and thoroughly documented, including any efforts undertaken to bring certain locations into compliance.
What This Means for You
Section 6225 represents a significant new compliance obligation for hospitals and hospital systems operating off-campus provider-based departments. The January 1, 2028, effective date provides approximately two years for providers to obtain separate NPIs, ensure provider-based compliance, and submit initial attestations. Under the plain language of the statute, hospitals that fail to submit the required PBAs before January 1, 2028, risk the discontinuation of OPPS payment for their off-campus provider-based locations.
The HHS Office of Inspector General's mandated review of the attestation process by January 1, 2030, suggests ongoing oversight and the potential for future modifications to these requirements, as well as potential enforcement activity related to failures to meet the provider-based status requirements. Providers should monitor CMS rulemaking closely for the establishment of the formal attestation submission and review process and adjust compliance strategies accordingly.
For more information about the updated requirements for provider-based attestations or further analysis regarding these issues, please contact Allison M. Cohen, Alissa D. Fleming, Katherine Denney, or any other member of Baker Donelson's Health Law Group.