Overview
Recent regulatory changes require hospitals with off-campus provider-based outpatient locations to file provider-based attestations for each location before January 1, 2028. Hospitals must also obtain a separate national provider identifier (NPI) for each location. Hospital locations that fail to comply with the new requirements will no longer qualify as provider-based, which will have broad-reaching impact. While the attestation form appears straightforward, preparation can take many months. Hospital leaders need to act now to understand the requirements and develop a compliance roadmap.
This program covered:
- Details of the new law
- Medicare’s Provider-Based Rule and requirements
- How to prepare and file a provider-based attestation
- How to obtain a new NPI
- Risk areas and consequences for noncompliance
Webinar takeaways and Q&A:
What changed?
- Previously, provider-based attestations were voluntary and allowed providers to obtain a determination of provider-based status.
- The 2026 Consolidated Appropriations Act (“CAA”) makes attestations mandatory for off-campus hospital outpatient departments (“HOPDs”) seeking reimbursement under the Outpatient Prospective Payment System (“OPPS”).
What’s required?
To continue receiving payments under the OPPS after January 1, 2028, providers must:
- Before 2028:
- Obtain separate NPIs for all off-campus provider-based HOPDs
- Submit an initial provider-based status attestation (showing compliance with 42 CFR 413.65)
- After 2028:
- Bill all services at off-campus HOPDs under the separate NPI
- Submit a second attestation within the timeframe to be specified by CMS
- Comply with future CMS requirements, which may include site visits and audits
Why start now?
- Identifying all off-campus HOPDs and preparing attestations is time-consuming and complex
- Typical attestations are 500+ pages and may take weeks or months to prepare
- Some locations may not comply with provider-based rules, which may only be discovered during attestation preparation
- Required documentation may not exist and will need to be created
- Compliance may require internal discussions, union negotiations, or organizational changes
- Discovery of overpayments may require investigation and refund within specified timeframes
Common risk areas:
- Management arrangements that obscure oversight by the main provider
- Lack of necessary clinical and administrative supervision
- Contracts not held by the main provider
- Misunderstanding joint venture restrictions
- Over-reliance on system-level processes
- Incomplete integration of medical records or operations
Additional webinar Q&A by topic:
Process-related Q&A
| Question | Answer |
|---|---|
| When will CMS issue guidance or propose new regulations? | No one knows – CMS may elect not to do so. The CAA states that CMS may rely on existing regulations, or CMS may take rulemaking action in the OPPS Proposed Rule, which we expect to be published in early July. However, the statute appears to be self-implementing and does not necessarily require that CMS take any additional action. CMS may also issue sub-regulatory guidance at any point between now and 2028. It could also modify the attestation form. Hospitals will need to monitor for developments as they prepare for 1/1/2028. |
| Can the MAC disapprove or reject the provider-based attestation? | Yes. However, the new law requires only submission of the attestation. Typically, there is a lengthy back and forth process with the MAC and CMS before a provider-based attestation is finally approved. As such, there is an opportunity to make corrections during the process if issues are raised. This presumes that the original submission was made in good faith and was understood to be compliant. |
| Is there a form attestation available? What types of additional information or documents will need to be submitted at the time of the attestation, or is it just an attestation? Is there information that should be collected now for purposes of follow-up questions that may be posed? | Yes. MAC websites typically have links to the attestation forms and a list of documentation to be submitted with the attestation. |
| Is it worth pursuing an exemption for freestanding pediatric hospitals given low Medicare patient volumes? | The statute does not provide for such an exception. |
| Is it too late to convert non-HOPDs to HOPDs? | No, but done properly, this conversion takes a very long time. If a provider is interested in converting non-HOPDs to HOPDs, this process should start as soon as possible. |
Timing Q&A
| Question | Answer |
|---|---|
| What if an attestation was filed and approved more than 2 years prior to Jan 1, 2028? | Under the statute, you will need to file a new one. |
| How does the 2-year attestation requirement interact with the 2028 effective date? What is the real date by which Hospitals have to attest? | The requirement under the statute is to submit an attestation during the two years prior to 1/1/2028. Accordingly, the “real” date to submit an attestation as we currently understand it would be 12/31/2027. |
| If your organization has submitted a voluntary attestation for a HOPD location – do we still need to submit a 2028 attestation for this location? | The statute requires that an attestation be submitted between 1/1/2026 and 12/31/2027. |
| What about locations opening mid-2027? | You will need to file an attestation and get a separate NPI before 1/1/2028. |
| We have a new off-campus HOPD opening in Q4 2027. When would the mandatory attestation be due? | Before 1/1/2028. |
| Can new HOPDs be opened after December 31, 2027? | It’s unclear what the process would be to open new HOPDs after this date. It is possible that this is the intent. Additional rulemaking may shed light on this issue. |
| Would a limit on HOPDs after 1/1/2028 also apply to new remote locations of a hospital? | No. |
Location v. department Q&A
| Question | Answer |
|---|---|
| We have many offsite locations with many departments within. Please clarify the requirement is location based not departments within a location. | Without more facts, it is difficult to opine, but what you are describing would likely require separate attestations per department. The statute says “department” and not “location.” In general, if there is information required for the attestation that would be different between various locations/departments, a separate attestation will be required. |
| What if there are multiple departments at one location? Are we required to have a separate attestation for each department? | Yes – although “Department” is not clearly defined. |
Non-OPPS provider Q&A
| Question | Answer |
|---|---|
| What about off-campus hospital locations where only therapy services are provided, such as PT, OT, or ST, which are reimbursed under the MPFS? Will the location specific NPI be required? | Attestations and individual NPIs are required only for locations providing services paid under OPPS. Most therapy services are paid under the Medicare Physician Fee Schedule, even when furnished by a hospital. If the location where the therapy is provided is also providing services paid under OPPS, an attestation would be required. |
| Confirming this is only OPPS paid providers. Cost based providers like Critical Access Hospitals do not need to file attestations, correct? | Yes, HOPDs of CAHs are not subject to the new requirement. |
Site neutral payment Q&A
| Question | Answer |
|---|---|
| How does this requirement apply to off-campus HOPDs with grandfathered status versus those established after Nov 2, 2015? | The requirement applies to all off campus HOPDs paid under the OPPS, whether paid at a site-neutral rate or not. |
General provider-based compliance Q&A
| Question | Answer |
|---|---|
| Under what circumstances is the Beneficiary Notice is required? Is it only required when there is both a Physician and a Hospital service provided (e.g. Cancer Center), or should it be provided in all circumstances (e.g. Infusion Center where the patient only receives a hospital service)? | The notice must be provided to Medicare beneficiaries receiving outpatient services at locations not on the main provider campus. |
| If PECOS has outdated or incorrect location information, what documentation does CMS expect providers to rely on for determining accurate HOPD status? | If the PECOS record is incurred, it needs to be updated. Providers are required to keep their PECOS records complete and up to date. |
| Will freestanding emergency rooms continue to be exempt from provider-based rules? | Freestanding emergency rooms are not exempt from the provider-based rules. |
| If you submit an Attestation for a new department right now (opening June 2026), do you need to receive approval before becoming operational? | You cannot submit an attestation until after the location is operational and providing hospital services. |
| Is there any guidance you could provide on the org charts? We continue to get questions from the operational side even utilizing the CMS guidance. | Org charts are often one of the most difficult parts of preparing the attestation. It typically requires input from many people and can be contentious and time consuming. |
Campus Q&A
| Question | Answer |
|---|---|
| Can you further define “Campus?” We have a few campus locations with several HOPD in them. | Campus means the physical area immediately adjacent to the provider’s main buildings, including other areas and structures that are not strictly contiguous to the main buildings but are located within 250 yards of the main building. |
| Do attestations need to be completed for freestanding locations that are within 250 yards of the hospital the location is licensed to? | The requirements apply to off-campus locations – so if the location is within 250 yards of the hospital (including remote location hospitals) they are on campus and the new requirements do not apply. |
| Where should measurements be taken to determine whether a location is on campus (e.g., end of the building, side, front door, etc.)? Is the requirement from the corner of a main hospital building to corner of HOPD or door to door? | The measurement per CMS is from any point on the main provider building to any point on the provider-based location building. |
| Can the parking lot of the main campus be utilized for calculating the distance between the department and the hospital, or is it required to be physical building to physical building? | The measurement is from any point on the main provider building to any point on the provider-based location building. |
340B-focused Q&A
| Question | Answer |
|---|---|
| Since drugs are reimbursed the same under PFS vs. OPPS, is there a way to stay on a hospital Medicare cost report for 340B purposes and accept non-OPPS reimbursement? | This is a very nuanced and fact-specific analysis. This can be done in some situations but is not broadly applicable. |
| These attestations/applications could be part of future HRSA audit DRL post Jan 2028? | We would expect this to be more likely if the 340B Program moves to CMS. |
| If a previous Off-Campus Provider-based approval after November 2, 2015 (for Section 603 purposes) and reimbursed with a PN Modifier, but “hospital space” for 340B Child Site status, would those be impacted since they are not reimbursed under OPPS? | Yes. The law applies to services paid both under the full OPPS rate and under the Section 603 site neutral rate. |
| Is it correct that from a 340B perspective this would need to be done for every child site that is outside of 250 yards of the main hospital campus, correct? | The 340B definition of child site and provider-based department are not entirely identical. For example, a child site that is on the campus of a remote location would not fall under this new law. |
NPI-focused Q&A
| Question | Answer |
|---|---|
| Is the NPI needed per department or location? The law states NPI per location, this webinar is stating per department. Can you please clarify? | The statute says per department. |
| Once we enroll all of these additional NPIs with CMS Medicare, will Medicaid also need to have all of these NPIs enrolled as well? | We have not seen any guidance from state Medicaid programs related to this new law. |
| Will we need to enroll the new NPI’s with Medicare Prior to submitting the Attestations? | No. The attestation can be submitted before the NPI is obtained. However, you may need to update the attestation to reflect the new NPI. |
| If we are required to have a separate NPI then is a separate 855 needed as well or can the location remain on the main 855 as a practice location? | No, a separate 855 is not required. However, you will need to update the 855 to include the new NPIs. |
| For the new NPIs do we add it to the 855A or 855B? | Definitely the 855A. Whether or not it is added to the 855B depends on whether or not you are using it to bill for services/locations subject to the 855B enrollment. |
| Are we able to submit multiple attestations per NPI or is it a 1:1 relationship? I am specifically thinking about a medical office building with multiple HOPD suites within the same building. | We anticipate a 1:1 relationship. |
| If your group is paid under the PFS but the off-site facility does not get a new NPI how would that affect us? | We would expect the payment to be made to the group to be paid in accordance with their submitted claims. |
| We have an NPI for which we bill Part B claims at each location that is provider based. The Part A claims are billed using the hospital NPI. Can I use the location specific NPI now for the Part A claims? | The rule applies only to hospital outpatient departments, which are billed as Part A, but covered under Part B. |
| Does the NPI have to be the same on the 1500 and UB? | OPPS claims are submitted on UBs. The NPI of the practitioner furnishing the services billed on the 1500 will likely have a different NPI. |
| Will the new NPI requirement apply to non-Medicare (commercial) payers? | These rules do not apply to any payors other than Medicare. Hospitals frequently use different NPIs for different payors. |
| Do you think CMS will issue sub-regulatory guidance on when to use the new NPIs, similar to the previously implemented requirements for off-campus addresses on the UB-04? In other words, will CMS modify this requirement? | The separate NPI requirement is a clear statutory requirement. CMS may not have discretion to modify this requirement. |
| If we are enrolled at a building level, does that one service location need one NPI and the departments are attested within that building with that one NPI per location? | CMS guidance requires enrollment at the lowest level of specificity. If there is an MOB with multiple office suites, CMS guidance requires enrolling each suite separately. |
| If you submitted an attestation when you added the off-campus (FSED) using the hospital NPI, will you have to submit a new attestation after receiving the NPI of the site? | There is not currently information to clearly answer this question, but it is generally easy to make updates to a previously-submitted attestations. |
| Any insight on whether it’s been considered to update NPPES to support a “child site” number similar to what is used in OPAIS for 340B (i.e, the main provider’s NPI with a modifier affixed)? | We’ve not heard anything about this and would not expect any changes to the NPI rules/requirements. |
| If I apply for and receive a new NPI, and it remains unused for over a year, will it still be active to begin billing after 1/1/2028? | Yes. |
| How does the timing work for obtaining attestation approval and NPI prior to 1/1/2028, and if non-compliance is found, when is the 60-day overpayment rule triggered? | The requirement is to submit an attestation in the two years prior to 1/1/2028. The statute does not require that the attestation be formally approved by that date. If a hospital discovers during the attestation preparation process that it has overpayments, the 60-day period will likely be triggered before the attestation is submitted. |
| If we are enrolled at a building level with Medicare with several different provider based departments. Do we order the NPI per the location and attest each department within that location with that NPI? | “Location” and “department” are not clearly defined. In general, if the information prepared for an attestation would be different between two different locations/entities, separate attestations would be required. For example, if there are two office suites with different signage, then two attestations are likely required. |
Questions?
Please contact Emily Cook, Sandra DiVarco, or Madeline Wallack.