The Consolidated Appropriations Act of 2026 (the Act), signed into law on February 3, 2026, introduces a new requirement that hospitals file attestations of compliance with provider-based rules for all provider-based off-campus outpatient departments. Hospitals must also obtain separate National Provider Identifiers (NPIs) for each off-campus outpatient department, and bill for items and services using these NPIs. Failure to submit attestations and obtain separate NPIs by January 1, 2028, will result in noncompliant provider-based departments forfeiting Medicare facility payments under the Outpatient Prospective Payment System (OPPS) for items or services furnished. Below is a summary of the new requirements:
Provider-based billing
Provider-based status is a Medicare designation for a department owned or operated by a main provider, such as a hospital, that allows a department to bill as a part of the hospital and receive higher reimbursement rates under OPPS. To qualify for provider-based status, a department must meet the requirements set forth in 42 CFR §413.65, including proper licensure; integration of clinical, financial, and administrative services with the main hospital; public awareness that the department is part of the hospital; and fulfillment of the obligations applicable to hospital outpatient departments and hospital-based entities.
These new requirements are a response, in part, to concerns associated with hospitals acquiring physician practices and converting or relocating these former private practice sites to provider-based outpatient departments. As a provider-based department, the hospital is able to bill both professional and facility fees for services rendered to Medicare beneficiaries. In turn, Medicare beneficiaries are subject to increased costs, in the form of higher cost-sharing for services delivered at these provider-based sites. Before this new law, submitting an attestation confirming compliance with Medicare’s provider-based rules was entirely voluntary. Some hospitals would submit attestations as a strategy to limit potential overpayment liability if compliance issues were later discovered. Others opted not to submit an attestation, partly because preparing the attestation was viewed as a significant administrative burden.
Overview of the new requirements
Mandatory attestations
Hospitals must now file attestations for all off-campus provider-based locations and obtain separate and unique NPIs for each location. The Act requires the following attestations:
- For existing off-campus provider-based locations: an initial attestation must be submitted before December 31, 2027.
- Subsequent attestations will be required on a periodic basis, in a manner and timeframe to be specified by the Secretary of the Department of Health and Human Services (HHS). The Centers for Medicare & Medicaid Services (CMS) also must establish a process to review attestations.
Hospitals may submit their attestations under the existing voluntary structure set forth in 42 CFR §413.65(b)(3) or elect to wait for the CMS to adopt regulations addressing these new requirements.
Locations
Attestations must be submitted for any off-campus department of a provider, which is generally defined as a location that is more than 250 yards away from the main hospital campus, as defined in 42 CFR §413.65(a)(2).
The new requirements also apply to grandfathered sites, which are “excepted” off-campus provider-based departments that furnished and billed for services under OPPS before November 2, 2015. In addition to billing before that date, a site qualifies for “grandfathered” or “excepted” status if 1) it has not relocated from its physical address as of November 2, 2015 (including moving units within the same medical office building if the site’s unit number is listed on a provider’s PECOS enrollment record), except in exceptional circumstances, and 2) any new owners in a change of ownership have accepted the existing Medicare provider agreement and ownership of the main hospital entity. As it pertains to the Act, grandfathered sites are subject to the same attestation and NPI requirements as non-grandfathered sites.
Separate NPIs
Hospitals must obtain separate NPIs for each off-campus provider location by January 1, 2028.
Ongoing Compliance and CMS Oversight
The Act requires CMS to establish rules regarding attestation compliance and allocates $20 million to establish processes to 1) review initial and ongoing attestations to determine compliance, and 2) review compliance with subsequent attestation requirements.
Looking ahead
We anticipate that the requirements and process to submit attestations will be lengthy and time-consuming. Currently, there is no indication that a hospital may provide one submission containing multiple attestations. As we await rules from CMS, we recommend that hospitals review the new requirements imposed by the Act and begin to plan for future compliance because the consequences of noncompliance are significant.
Despite the need for additional direction from CMS, hospitals can prepare by dedicating administrative resources to conduct a comprehensive review of their off-campus provider-based locations and assess each location’s compliance with the provider-based requirements. Hospitals can also begin to prepare NPI applications for the identified provider-based locations. The law also directs heightened CMS compliance oversight through site visits, remote audits, and other means, so hospitals can expect increased scrutiny of the operations of their provider-based locations.