The Consolidated Appropriations Act, 2026, which was signed into law on February 3, 2026, includes a significant new requirement affecting off-campus hospital outpatient departments. The law requires hospitals to obtain and use separate National Provider Identifiers (NPIs) for each off-campus outpatient department. It also requires hospitals to submit provider-based attestations for each off-campus outpatient department. These actions must be taken by January 1, 2028; otherwise, no Medicare payment under the Outpatient Prospective Payment System (OPPS) will be made for items or services furnished by the off-campus outpatient department. The new law represents a highly significant development for hospitals and health systems—one that will put real strain on operators and force the redirection of compliance resources.
Overview of the New Requirements
Section 6225 of the Act provides that no payment will be made under the OPPS (or an applicable payment system in the case of off-campus outpatient departments that are subject to existing site-neutral payment limitations) for items or services furnished on or after January 1, 2028, by an off-campus outpatient department unless the following two requirements are met:
- The department has obtained and bills under a unique NPI separate from that of the hospital.
- The hospital has submitted an attestation for the department evidencing compliance with the Medicare provider-based status regulations at 42 C.F.R. 413.65.
Separate NPI Requirement
Hospitals must obtain a location-specific NPI for each off-campus outpatient department and use it when billing Medicare. This requirement will enable the Centers for Medicare & Medicaid Services (CMS) to better track the services for which hospitals are charging facility fees for care delivered at off-campus locations—data widely viewed as a precursor to more aggressive site-neutral payment policies.
Provider-Based Attestation Requirement
Hospitals must submit attestations demonstrating compliance with the Medicare provider-based status rules at 42 C.F.R. § 413.65. Notably, the statute requires two attestations: (1) an initial attestation submitted within the “[two]-year period ending on the date … services are so furnished” and (2) a subsequent attestation submitted within a timeframe to be specified by the Secretary. This means that to bill for services on January 1, 2028, a hospital must have submitted an initial attestation on or after January 1, 2026, and must thereafter submit at least one subsequent attestation on a schedule CMS will establish through rulemaking. Until CMS establishes a new attestation process, hospitals may submit attestations under the existing voluntary framework described at § 413.65(b)(3). CMS must also establish, through notice and comment rulemaking, a process for reviewing attestations, including authority to verify compliance through “site visits, remote audits, or other means.”
Covered Locations
The law applies to any “off-campus outpatient department of a provider,” which is defined as any department of a provider within the meaning of the provider-based rules that, in general terms, is located more than 250 yards from the main hospital campus or from a remote location of a hospital.
OIG Review
The law also requires the Office of Inspector General of the Department of Health and Human Services (OIG) to submit to Congress, by January 1, 2030, an analysis of the attestation review process and recommendations based on that analysis.
Takeaways
Although these proposals have been floated in prior legislation that never became law, they now must be treated as a compliance priority. Hospitals and health systems should consider the following points.
First and foremost, the new law creates real financial consequences for non-compliance. Under current law, hospitals may operate off-campus outpatient departments without formally attesting to their provider-based status. Beginning January 1, 2028, that changes: no attestation means no payment. Hospitals that cannot demonstrate compliance with the provider-based rules will be unable to bill Medicare for services furnished at their off-campus locations, potentially resulting in millions of dollars in lost revenue.
Second, although little has changed with respect to the provider-based rules and many hospitals have devoted significant resources to ensuring ongoing compliance with these requirements, there may be compliance gaps. A 2016 OIG study found that more than three-quarters of the 50 sampled hospitals that had not voluntarily attested for all of their off-campus facilities operated facilities that did not meet at least one provider-based requirement.
Third, there are major implementation questions. Chief among these questions is whether CMS will build on the existing voluntary attestation framework or instead create a new system. Given the huge volume of submissions necessitated by the new law, CMS may look to fold provider-based attestations into the provider enrollment process and reduce the documentation burden. But the statutory directive to review each attestation and determine compliance “through site visits, remote audits, or other means” may portend a more onerous approach.
Fourth, despite the implementation uncertainty, hospitals should begin preparing now. Hospitals should conduct a comprehensive inventory of all off-campus provider-based locations, assess each location’s compliance with the provider-based requirements, and begin assembling documentation to support attestations. This is no small burden, especially for large health systems with extensive outpatient care networks.
Lastly, the data collection enabled by the unique NPI requirement will provide CMS with more information about services furnished at off-campus locations. This information could inform future rulemaking extending site-neutral payment beyond its current scope or prompt additional legislative action. Hospitals should view this legislation not as a one-time compliance exercise but as part of a longer-term shift in how Medicare pays for outpatient services.
If you have any questions about the new legislation or the Medicare provider-based status requirements, please contact the author.