CMS Proposes Implementation Framework for Provider-Based Attestation and Separate NPI Requirements for Off-Campus Hospital Outpatient Departments

Firm Publication

Earlier this year, Congress enacted legislation requiring hospitals to submit provider-based attestations and obtain separate National Provider Identifiers (NPIs) for each off-campus outpatient department as a condition of Medicare payment beginning January 1, 2028. On July 7, 2026, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule to implement these requirements.

For hospitals and health systems, the proposals are a mixed bag: CMS proposes welcome simplifications—a standardized attestation form, centralized electronic submission, and reduced upfront documentation requirements—but declines to grandfather previously approved attestations and leaves significant uncertainty regarding the frequency of subsequent attestations, the operation of the centralized submission process, and how the agency will exercise its oversight authority.

This alert summarizes CMS’s key proposals and identifies practical steps hospitals and health systems should consider as they prepare for compliance. Comments on the proposed rule are due August 31, 2026.

Background

Under current law, hospitals may operate off-campus outpatient departments without formally attesting to their provider-based status. Although hospitals have long been required to comply with the Medicare provider-based rules for any facility treated as a department of the hospital, submission of a provider-based attestation to CMS has been voluntary since the Benefits Improvement and Protection Act of 2000. A hospital could submit an attestation to obtain a CMS determination of provider-based status, but payment was not conditioned on verification of compliance.

Section 6225 of the Consolidated Appropriations Act, 2026 (CAA) changes that. Beginning January 1, 2028, no Medicare payment may be made under the Outpatient Prospective Payment System (OPPS) (or, for nonexcepted off-campus departments, under the applicable site-neutral payment system) for items and services furnished by an off-campus outpatient department of a provider unless the following criteria are met:

  1. The department has obtained and bills under a department-specific NPI separate from the hospital’s NPI.
  2. The hospital has submitted an initial provider-based status attestation during the two-year period ending on the date items or services are furnished.
  3. The hospital has submitted a subsequent attestation within a timeframe specified by the Secretary.

The law also requires the Secretary, through notice-and-comment rulemaking, to establish a process for submission and review of attestations and for determining compliance through site visits, remote audits, or other means.

Summary of Key CMS Proposals

The proposed rule provides the first details on how CMS plans to satisfy its statutory directive. CMS proposes to establish a standardized, centralized attestation process designed to handle the significantly increased volume of submissions that the new mandatory attestation requirement will generate. Rather than building on an existing reporting framework—such as the provider enrollment revalidation process, which operates on a regular cycle and already touches some of the same information—CMS proposes an entirely new submission and review infrastructure. On the positive side, CMS proposes a uniform process across all Medicare Administrative Contractors (MACs), reduced upfront documentation requirements, and a centralized electronic submission system. But CMS proposes periodic subsequent attestations rather than requiring re-attestation only upon a material change in the department. The agency also declines to automatically grandfather previously approved provider-based determinations, and it reserves broad authority to conduct site visits, remote audits, and extended reviews.

No-Payment Rule Codified

CMS proposes new 42 C.F.R. § 419.23 to codify the statutory no-payment rule: Effective January 1, 2028, Medicare will not pay under the OPPS (or the applicable payment system) for items or services furnished by an off-campus outpatient department that has not satisfied the separate NPI and attestation requirements.

Definition of “Off-Campus Outpatient Department of a Provider”

CMS proposes to add a definition of “off-campus outpatient department of a provider” at 42 C.F.R. § 413.65(a)(2), consistent with the statutory definition. Under the proposed definition, a department is “off campus” if it is located more than 250 yards from both the main hospital campus and any remote location of the hospital. CMS also proposes conforming changes to the existing off-campus provider-based requirements at § 413.65(e) to clarify that those requirements do not apply to outpatient departments located within 250 yards of a remote location—aligning the regulations with the statutory distinction between on-campus and off-campus locations that Congress drew in both Section 603 of the Bipartisan Budget Act of 2015 and Section 6225 of the CAA.

Attestation Timing

CMS proposes to add the attestation requirement at 42 C.F.R. § 413.65(b)(6) with the following timing framework:

  • Initial attestation: For off-campus outpatient departments furnishing services on or before January 1, 2028, the initial attestation must be submitted between January 1, 2026, and December 31, 2027. For departments beginning services after January 1, 2028, the attestation must be submitted within the two years before the billed services are delivered.
  • Subsequent attestations: After the initial attestation, subsequent attestations must be submitted at an interval specified by CMS, not to exceed five years. CMS defers the specific interval to next year’s rulemaking cycle.

Importantly, CMS states that hospitals submitting initial attestations during the two-year period before January 1, 2028, will satisfy the statutory attestation requirement even if CMS has not issued a provider-based status determination by that date.

CMS also proposes that hospitals must obtain a separate NPI for each off-campus outpatient department and update PECOS enrollment records before submitting an attestation. CMS does not, however, propose a detailed operational framework for the separate NPI requirement or the downstream systems and processes that may need to be updated to implement it.

Treatment of Prior CMS Determinations

Notably, CMS does not propose to automatically grandfather previously approved provider-based determinations. Hospitals that received a CMS determination of provider-based status before January 1, 2026, would not be deemed compliant under the new framework without additional action. CMS seeks comment on what that additional action should look like and is considering a streamlined approach under which the authorized official could submit a letter to CMS with evidence of the prior determination attached, affirming continued compliance with § 413.65. But the details remain to be worked out, and hospitals should not assume that their existing determinations will carry forward automatically.

Standardized Attestation Form and Supporting Documentation

CMS proposes to establish a standardized attestation form, replacing the current MAC-specific templates, and to require submission through a centralized electronic system. Until the standardized form and centralized system are finalized, hospitals may continue to submit attestations under existing 42 C.F.R. § 413.65(b)(3)(ii) to their MAC.

The draft form is structurally similar to the sample attestation CMS published in 2003. Like the 2003 sample, the proposed form is organized as a series of yes/no statements that track the regulatory requirements at § 413.65, requires identifying information for the main provider and provider-based department, and must be signed by an authorized official.

The form covers nine categories of requirements: (1) licensure; (2) clinical integration (including privileges, oversight, medical staff committees, unified medical records, and service integration); (3) financial integration; (4) public awareness; (5) hospital outpatient department obligations (including EMTALA, anti-dumping, site-of-service billing, payment window, beneficiary notice, and health and safety requirements); (6) ownership and control; (7) reporting relationship and administrative integration; (8) geographic proximity; and (9) management contract requirements (if applicable). Each requirement offers a Yes/No/N/A checkbox response.

In a notable departure from past practice, CMS proposes that hospitals would not be required to submit all supporting documentation with the initial attestation. Instead, hospitals must maintain documentation demonstrating compliance and be prepared to furnish it upon request. CMS anticipates giving providers generally not more than 60 days to respond.

Review and Determination Process

CMS or its agents would send written acknowledgment of receipt, review each attestation for completeness and consistency with CMS records (including PECOS enrollment records), and issue a determination. Determinations would constitute CMS initial determinations subject to the appeals process under 42 C.F.R. Part 498. CMS proposes to use standardized review, risk-based screening, automated validation, and targeted documentation review—though the proposed rule does not define these terms or explain what specific checks will be performed at each stage, leaving hospitals with little visibility into what will actually happen after they submit.

Verification, Oversight, and Payment Recovery

CMS proposes broad authority to evaluate ongoing compliance through site visits, remote audits, investigations, desk reviews, automated validation, data analysis, and risk-based methodologies. Failure to submit requested documentation within a CMS-specified timeframe may result in a non-compliance determination and payment recovery. Under proposed 42 C.F.R. § 413.65(k), a hospital may bill and be paid as provider-based from the date it submits an attestation until CMS determines the facility does not meet provider-based requirements. If CMS later determines non-compliance, it will recover the difference between payments made since attestation submission and estimated payments that should have been made absent provider-based status. This payment-recovery framework is substantively the same as the existing standard under current § 413.65(k). The key change is that CMS now explicitly codifies its authority to initiate extended compliance reviews—including site visits and remote audits—at any time, rather than only in connection with a determination triggered by a provider’s initial attestation submission.

Key Takeaways

The proposed rule answers some important implementation questions but leaves others unresolved. The following are the key takeaways for hospitals and health systems:

  • The standardized form is a welcome simplification. CMS has published a draft attestation form that requires only yes/no certifications tracking the regulatory requirements—no narrative explanations or supporting documentation. This is a meaningful reduction in upfront burden compared to the current MAC-based process. However, the centralized electronic submission system is not yet built and the details are unclear. Furthermore, documentation should be assembled and maintained even though it need not be submitted upfront. Hospitals must maintain evidence of compliance and be prepared to furnish it within as few as 60 days upon request.
  • Previously approved attestations will not be automatically grandfathered. Hospitals that invested significant time and resources in obtaining voluntary provider-based determinations prior to January 1, 2026 will need to take additional action under the new framework. CMS has not specified what that action must include, and hospitals with longstanding determinations face uncertainty about what steps they must take to remain in compliance.
  • The frequency and trigger for subsequent attestations are unresolved. CMS proposes a ceiling of five years but defers the specific interval to future rulemaking and does not address whether re-attestation should be triggered only by a material change rather than imposed on a fixed calendar.
  • CMS reserves broad oversight authority with little transparency into how it will be exercised. The proposed rule describes a layered review process but does not disclose the criteria for flagging attestations for additional scrutiny, and reserves authority to conduct site visits, remote audits, and investigations at any time without limiting that authority to cases involving evidence of material misrepresentation.
  • The separate NPI requirement creates operational coordination challenges that the proposed rule does not address. Hospital systems that rely on provider identifiers across electronic health records, billing platforms, payer credentialing, pharmacy networks, and e-prescribing systems will need to update those systems for each off-campus department. CMS does not propose a detailed operational transition framework for those downstream systems.

The proposed rule provides the first real details on how CMS plans to operationalize the new mandatory attestation and separate NPI requirements. Finalization is expected later in 2026. Given the January 1, 2028, compliance deadline and the scope of operational work required, hospitals and health systems should begin preparation now.

If you have any questions about the proposed rule or the Medicare provider-based status requirements, please contact the author.

Related Professionals
Related Services
Firm Publication

Earlier this year, Congress enacted legislation requiring hospitals to submit provider-based attestations and obtain separate National Provider Identifiers (NPIs) for each off-campus outpatient department as a condition of Medicare payment beginning January 1, 2028. On July 7, 2026, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule to implement these requirements.

For hospitals and health systems, the proposals are a mixed bag: CMS proposes welcome simplifications—a standardized attestation form, centralized electronic submission, and reduced upfront documentation requirements—but declines to grandfather previously approved attestations and leaves significant uncertainty regarding the frequency of subsequent attestations, the operation of the centralized submission process, and how the agency will exercise its oversight authority.

This alert summarizes CMS’s key proposals and identifies practical steps hospitals and health systems should consider as they prepare for compliance. Comments on the proposed rule are due August 31, 2026.

Background

Under current law, hospitals may operate off-campus outpatient departments without formally attesting to their provider-based status. Although hospitals have long been required to comply with the Medicare provider-based rules for any facility treated as a department of the hospital, submission of a provider-based attestation to CMS has been voluntary since the Benefits Improvement and Protection Act of 2000. A hospital could submit an attestation to obtain a CMS determination of provider-based status, but payment was not conditioned on verification of compliance.

Section 6225 of the Consolidated Appropriations Act, 2026 (CAA) changes that. Beginning January 1, 2028, no Medicare payment may be made under the Outpatient Prospective Payment System (OPPS) (or, for nonexcepted off-campus departments, under the applicable site-neutral payment system) for items and services furnished by an off-campus outpatient department of a provider unless the following criteria are met:

  1. The department has obtained and bills under a department-specific NPI separate from the hospital’s NPI.
  2. The hospital has submitted an initial provider-based status attestation during the two-year period ending on the date items or services are furnished.
  3. The hospital has submitted a subsequent attestation within a timeframe specified by the Secretary.

The law also requires the Secretary, through notice-and-comment rulemaking, to establish a process for submission and review of attestations and for determining compliance through site visits, remote audits, or other means.

Summary of Key CMS Proposals

The proposed rule provides the first details on how CMS plans to satisfy its statutory directive. CMS proposes to establish a standardized, centralized attestation process designed to handle the significantly increased volume of submissions that the new mandatory attestation requirement will generate. Rather than building on an existing reporting framework—such as the provider enrollment revalidation process, which operates on a regular cycle and already touches some of the same information—CMS proposes an entirely new submission and review infrastructure. On the positive side, CMS proposes a uniform process across all Medicare Administrative Contractors (MACs), reduced upfront documentation requirements, and a centralized electronic submission system. But CMS proposes periodic subsequent attestations rather than requiring re-attestation only upon a material change in the department. The agency also declines to automatically grandfather previously approved provider-based determinations, and it reserves broad authority to conduct site visits, remote audits, and extended reviews.

No-Payment Rule Codified

CMS proposes new 42 C.F.R. § 419.23 to codify the statutory no-payment rule: Effective January 1, 2028, Medicare will not pay under the OPPS (or the applicable payment system) for items or services furnished by an off-campus outpatient department that has not satisfied the separate NPI and attestation requirements.

Definition of “Off-Campus Outpatient Department of a Provider”

CMS proposes to add a definition of “off-campus outpatient department of a provider” at 42 C.F.R. § 413.65(a)(2), consistent with the statutory definition. Under the proposed definition, a department is “off campus” if it is located more than 250 yards from both the main hospital campus and any remote location of the hospital. CMS also proposes conforming changes to the existing off-campus provider-based requirements at § 413.65(e) to clarify that those requirements do not apply to outpatient departments located within 250 yards of a remote location—aligning the regulations with the statutory distinction between on-campus and off-campus locations that Congress drew in both Section 603 of the Bipartisan Budget Act of 2015 and Section 6225 of the CAA.

Attestation Timing

CMS proposes to add the attestation requirement at 42 C.F.R. § 413.65(b)(6) with the following timing framework:

  • Initial attestation: For off-campus outpatient departments furnishing services on or before January 1, 2028, the initial attestation must be submitted between January 1, 2026, and December 31, 2027. For departments beginning services after January 1, 2028, the attestation must be submitted within the two years before the billed services are delivered.
  • Subsequent attestations: After the initial attestation, subsequent attestations must be submitted at an interval specified by CMS, not to exceed five years. CMS defers the specific interval to next year’s rulemaking cycle.

Importantly, CMS states that hospitals submitting initial attestations during the two-year period before January 1, 2028, will satisfy the statutory attestation requirement even if CMS has not issued a provider-based status determination by that date.

CMS also proposes that hospitals must obtain a separate NPI for each off-campus outpatient department and update PECOS enrollment records before submitting an attestation. CMS does not, however, propose a detailed operational framework for the separate NPI requirement or the downstream systems and processes that may need to be updated to implement it.

Treatment of Prior CMS Determinations

Notably, CMS does not propose to automatically grandfather previously approved provider-based determinations. Hospitals that received a CMS determination of provider-based status before January 1, 2026, would not be deemed compliant under the new framework without additional action. CMS seeks comment on what that additional action should look like and is considering a streamlined approach under which the authorized official could submit a letter to CMS with evidence of the prior determination attached, affirming continued compliance with § 413.65. But the details remain to be worked out, and hospitals should not assume that their existing determinations will carry forward automatically.

Standardized Attestation Form and Supporting Documentation

CMS proposes to establish a standardized attestation form, replacing the current MAC-specific templates, and to require submission through a centralized electronic system. Until the standardized form and centralized system are finalized, hospitals may continue to submit attestations under existing 42 C.F.R. § 413.65(b)(3)(ii) to their MAC.

The draft form is structurally similar to the sample attestation CMS published in 2003. Like the 2003 sample, the proposed form is organized as a series of yes/no statements that track the regulatory requirements at § 413.65, requires identifying information for the main provider and provider-based department, and must be signed by an authorized official.

The form covers nine categories of requirements: (1) licensure; (2) clinical integration (including privileges, oversight, medical staff committees, unified medical records, and service integration); (3) financial integration; (4) public awareness; (5) hospital outpatient department obligations (including EMTALA, anti-dumping, site-of-service billing, payment window, beneficiary notice, and health and safety requirements); (6) ownership and control; (7) reporting relationship and administrative integration; (8) geographic proximity; and (9) management contract requirements (if applicable). Each requirement offers a Yes/No/N/A checkbox response.

In a notable departure from past practice, CMS proposes that hospitals would not be required to submit all supporting documentation with the initial attestation. Instead, hospitals must maintain documentation demonstrating compliance and be prepared to furnish it upon request. CMS anticipates giving providers generally not more than 60 days to respond.

Review and Determination Process

CMS or its agents would send written acknowledgment of receipt, review each attestation for completeness and consistency with CMS records (including PECOS enrollment records), and issue a determination. Determinations would constitute CMS initial determinations subject to the appeals process under 42 C.F.R. Part 498. CMS proposes to use standardized review, risk-based screening, automated validation, and targeted documentation review—though the proposed rule does not define these terms or explain what specific checks will be performed at each stage, leaving hospitals with little visibility into what will actually happen after they submit.

Verification, Oversight, and Payment Recovery

CMS proposes broad authority to evaluate ongoing compliance through site visits, remote audits, investigations, desk reviews, automated validation, data analysis, and risk-based methodologies. Failure to submit requested documentation within a CMS-specified timeframe may result in a non-compliance determination and payment recovery. Under proposed 42 C.F.R. § 413.65(k), a hospital may bill and be paid as provider-based from the date it submits an attestation until CMS determines the facility does not meet provider-based requirements. If CMS later determines non-compliance, it will recover the difference between payments made since attestation submission and estimated payments that should have been made absent provider-based status. This payment-recovery framework is substantively the same as the existing standard under current § 413.65(k). The key change is that CMS now explicitly codifies its authority to initiate extended compliance reviews—including site visits and remote audits—at any time, rather than only in connection with a determination triggered by a provider’s initial attestation submission.

Key Takeaways

The proposed rule answers some important implementation questions but leaves others unresolved. The following are the key takeaways for hospitals and health systems:

  • The standardized form is a welcome simplification. CMS has published a draft attestation form that requires only yes/no certifications tracking the regulatory requirements—no narrative explanations or supporting documentation. This is a meaningful reduction in upfront burden compared to the current MAC-based process. However, the centralized electronic submission system is not yet built and the details are unclear. Furthermore, documentation should be assembled and maintained even though it need not be submitted upfront. Hospitals must maintain evidence of compliance and be prepared to furnish it within as few as 60 days upon request.
  • Previously approved attestations will not be automatically grandfathered. Hospitals that invested significant time and resources in obtaining voluntary provider-based determinations prior to January 1, 2026 will need to take additional action under the new framework. CMS has not specified what that action must include, and hospitals with longstanding determinations face uncertainty about what steps they must take to remain in compliance.
  • The frequency and trigger for subsequent attestations are unresolved. CMS proposes a ceiling of five years but defers the specific interval to future rulemaking and does not address whether re-attestation should be triggered only by a material change rather than imposed on a fixed calendar.
  • CMS reserves broad oversight authority with little transparency into how it will be exercised. The proposed rule describes a layered review process but does not disclose the criteria for flagging attestations for additional scrutiny, and reserves authority to conduct site visits, remote audits, and investigations at any time without limiting that authority to cases involving evidence of material misrepresentation.
  • The separate NPI requirement creates operational coordination challenges that the proposed rule does not address. Hospital systems that rely on provider identifiers across electronic health records, billing platforms, payer credentialing, pharmacy networks, and e-prescribing systems will need to update those systems for each off-campus department. CMS does not propose a detailed operational transition framework for those downstream systems.

The proposed rule provides the first real details on how CMS plans to operationalize the new mandatory attestation and separate NPI requirements. Finalization is expected later in 2026. Given the January 1, 2028, compliance deadline and the scope of operational work required, hospitals and health systems should begin preparation now.

If you have any questions about the proposed rule or the Medicare provider-based status requirements, please contact the author.

In Case You Missed It: