Earlier this year, Congress enacted Section 6225 of the Consolidated Appropriations Act, 2026 (“CAA”), establishing a new Medicare condition of payment for off-campus hospital outpatient departments beginning January 1, 2028. As discussed in our prior alerts (here and here), the statute generally prohibits Medicare payment for services furnished by an off-campus hospital outpatient department unless the department bills under a separate National Provider Identifier (“NPI”) assigned to that off-campus department, the hospital submits an initial provider-based attestation within two years prior to furnishing services and the hospital submits subsequent attestations at intervals established by the Centers for Medicare & Medicaid Services (“CMS”).
CMS has now released the CY 2027 Outpatient Prospective Payment System (“OPPS”) Proposed Rule (“Proposed Rule”), which, among other things, contains proposed regulations to implement those statutory requirements. As previously discussed, the statute left many operational questions unanswered, and the Proposed Rule provides the first details for implementation by addressing how attestations will be submitted, when supporting documentation will be required, how frequently attestations must be renewed and how CMS intends to oversee compliance. The Proposed Rule also introduces a new risk-based review process, clarifies the scope of the new requirements and identifies several issues that remain unresolved.
CMS Proposes a Streamlined, Standardized Attestation Process
One of the most significant operational changes in the Proposed Rule is CMS’s plan to replace the current Medicare Administrative Contractor-specific (“MAC”) provider-based attestation process with a standardized national submission system. Rather than submitting attestations using forms and procedures that vary by MAC, providers would submit a standardized CMS attestation form through a centralized electronic system. CMS states that this approach is intended to improve consistency nationwide, reduce administrative burden and streamline review of the significantly larger volume of attestations expected once they become mandatory.
The draft attestation form largely tracks the existing provider-based requirements in 42 C.F.R. § 413.65, converting those regulatory standards into a detailed checklist that providers must affirmatively certify. Rather than requiring a general certification of compliance, the form requires providers to respond “Yes,” “No” or “N/A” to each applicable provider-based criterion. For example, the hospital outpatient department beneficiary notice requirement is broken into multiple subparts, requiring separate attestations regarding the content, timing and delivery of the notice. Likewise, the form addresses each management contract requirement applicable to provider-based facilities separately.
Until the standardized attestation form and centralized electronic submission system are implemented, providers may continue submitting attestations through their servicing MAC using the existing process, and CMS confirms that those submissions will satisfy the statutory attestation requirement. Under the proposed process, providers generally would submit identifying information for the main provider and provider-based department, together with certifications that the applicable provider-based requirements have been satisfied. Based on the draft form and accompanying Proposed Rule discussion, though some ambiguity remains, it seems supporting documentation generally would not accompany the initial submission but instead would be maintained by the provider and furnished only upon CMS request. CMS proposes allowing providers up to 60 days to submit requested documentation.
Although the initial submission process is streamlined, providers should be prepared to demonstrate compliance with the applicable provider-based requirements, including those relating to licensure, clinical and financial integration, ownership and control, public awareness, beneficiary notice obligations, management arrangements and other requirements if requested by CMS or its contractors during a review. The proposed form also reinforces that provider-based compliance is an ongoing obligation by requiring providers to certify that the requirements continue to be met and that material changes, such as changes in ownership or management arrangements, will be reported to CMS.
Automated Validation and Risk-Based Oversight
CMS also proposes a new, layered compliance review process that reflects the agency’s expectation that mandatory attestations will significantly increase review volume. Every attestation would first undergo automated validation to verify completeness and consistency with information already available to CMS, including enrollment information maintained in the Provider Enrollment, Chain and Ownership System. CMS provides little detail regarding what the automated validation process will evaluate or what circumstances may trigger additional review.
Attestations identified through automated screening may then undergo targeted documentation review. Finally, CMS proposes an extended review process involving remote audits, desk reviews, site visits or other program integrity activities.
Although CMS repeatedly characterizes this process as “risk-based,” the Proposed Rule does not explain what factors will cause a provider or department to be considered higher risk. Instead, CMS states that those methodologies will be developed through future operational guidance. That lack of transparency may be one of the more significant issues for providers to consider during the comment period, particularly given the potential payment implications associated with an adverse provider-based determination.
CMS Clarifies Which Departments Are Subject to the New Requirements
In the Proposed Rule, CMS proposes revising the provider-based regulations at 42 C.F.R. § 413.65 to clarify that the mandatory NPI and attestation requirements apply only to outpatient departments that are neither located on the main hospital campus nor within 250 yards of a remote hospital location. This regulatory clarification aligns the provider-based regulations with the statutory language and provides additional certainty for hospitals operating remote campuses with nearby outpatient departments.
New Departments Would Not Need to Wait for CMS Approval Before Billing
The Proposed Rule also answers one practical question left unresolved by the statute. Hospitals opening new off-campus provider-based departments after January 1, 2028, would not be required to wait for CMS to approve a provider-based determination before billing Medicare as a hospital outpatient department.
Instead, CMS proposes allowing providers to bill as provider-based immediately upon submitting the required attestation, provided the department has not previously been found to have been improperly treated as provider-based.
CMS, however, retains the authority to conduct subsequent audits, site visits or other reviews. If CMS later determines the department failed to satisfy the provider-based requirements, the agency proposes recovering the difference between the provider-based reimbursement actually paid and the amount that would have been payable had the department billed as a freestanding facility, retroactive to the date the attestation was submitted.
CMS Proposes a Five-Year Maximum Attestation Cycle
Although the statute required hospitals to submit subsequent attestations at intervals established by CMS, it did not specify how frequently those attestations would be required. CMS now proposes that subsequent attestations be submitted at intervals not to exceed five years. The agency indicates it intends to address the specific renewal process in future rulemaking but is proposing a five-year outer limit on subsequent attestations.
The Proposed Rule also states that providers submitting initial attestations between January 1, 2026, and December 31, 2027, would satisfy the statutory requirement for departments already furnishing services before January 1, 2028, even if CMS has not completed its review by the statutory effective date.
Previously Approved Departments May Receive Streamlined Treatment
One welcome aspect of the proposal is CMS’s request for comment on a streamlined process for hospitals that previously received a provider-based determination. Rather than requiring those providers to prepare an entirely new attestation package, CMS is considering allowing an authorized official to submit a letter affirming the department remains compliant with the provider-based requirements while attaching CMS’s prior determination.
If adopted, this approach could significantly reduce the burden for hospitals that have already completed the provider-based review process and have remained compliant since receiving their determination.
Looking Ahead
The Proposed Rule answers some of the implementation questions left open by CAA Section 6225 and provides the first details for how CMS intends to administer mandatory provider-based attestations beginning in 2028. Hospitals now have greater visibility into the agency’s proposed submission process, documentation expectations and compliance oversight framework, although many operational details remain subject to public comment and future CMS guidance.
Hospitals should consider beginning or updating an inventory of off-campus outpatient departments, confirming which locations are billed as provider-based, identifying whether each location has or will need a separate NPI and reviewing existing provider-based documentation against the proposed attestation format. Locations with management arrangements, recent ownership changes, shared space, unclear signage or public awareness issues, or incomplete beneficiary notice processes may warrant particular attention before attestations become mandatory.
That preparation is especially important because several aspects of CMS’s proposed review process remain undefined. For example, CMS has not explained what criteria it will use to identify providers or departments for extended risk-based review or what information will be evaluated through the proposed automated validation process. These issues will be of significant interest during the comment period and may substantially affect how burdensome the final attestation process ultimately becomes.
Providers with off-campus outpatient departments should closely review the Proposed Rule and consider submitting comments on the proposed risk-based review process, documentation requirements and other aspects of the new attestation framework. Comments on the Proposed Rule are due by August 31, 2026. A separate bulletin will address proposed substantive changes to the provider-based regulations that are not directly related to CAA Section 6225, such as the applicability of certain provisions to remote locations.
For more information on the Proposed Rule or assistance with submitting comments, please contact:
- David Snow at (303) 801-3536 or dsnow@hallrender.com;
- Lauren Hulls at (317) 977-1467 or lhulls@hallrender.com;
- Brian Jent at (317) 977-1402 or bjent@hallrender.com;
- Joseph Krause at (414) 721-0906 or jkrause@hallrender.com;
- Benjamin Fee at (720) 282-2030 or bfee@hallrender.com;
- Regan Tankersley at (317) 977-1445 or rtankersley@hallrender.com;
- Lori Wink at (414) 721-0456 or lwink@hallrender.com;
- Susan Banks at (720) 844-6207 or sbanks@hallrender.com;
- Raminta Kizyte at (303) 557-2112 or rkizyte@hallrender.com; or
- Your primary Hall Render contact.
Hall Render blog posts and articles are intended for informational purposes only. For ethical reasons, Hall Render attorneys cannot—outside of an attorney-client relationship—answer specific questions that would be legal advice.
