Why Hospitals Should Start Now on Off-Campus NPIs and Attestations

What general counsel and business leaders need to know:

Separate NPI for Each Location: Starting January 1, 2028, each off-campus hospital outpatient department covered by the Consolidated Appropriations Act of 2026 must have its own unique National Provider Identifier (NPI) rather than billing under the main hospital’s NPI. Large multi-campus hospitals and systems may need hundreds of new NPIs, and billing systems must be updated so claims carry the correct one.
Mandatory Attestation: Existing off-campus outpatient departments must submit an attestation confirming compliance with the provider-based regulation by December 31, 2027. Those that file by that date can keep billing as provider-based while the Centers for Medicare & Medicaid Services reviews the attestation.
Consequences of Not Filing: A hospital that does not file an attestation or use a separate NPI for an applicable location loses the ability to be paid as part of the hospital under the preferential Outpatient Prospective Payment System reimbursement scheme at that location, even if the location has been a grandfathered location for years.

In this episode of Diagnosing Health Care^®, Epstein Becker Green attorneys David M. Johnston, Allen R. Killworth, and Shannon K. DeBra discuss the new attestation and separate NPI requirements for off-campus hospital outpatient departments under the Consolidated Appropriations Act of 2026; what hospitals must do before the January 1, 2028, deadline; and open questions they are hearing from clients.

Transcript

[00:00:00] David Johnston: Today on Diagnosing Health Care®, we're discussing the new mandatory attestation and separate NPI requirements for off-campus hospital outpatient departments under the Consolidated Appropriations Act of 2026. What hospitals have to do to keep their Medicare payments flowing beginning in 2028, the difference between off-campus departments that are subject to the rule and ones that aren't, the key operational and financial considerations of missing those deadlines, and some of the things that we don't know yet, and some of the key questions that we're getting.

[00:00:35] David Johnston: Hello, and welcome to Diagnosing Health Care. My name is David Johnston. I'm joined by Allen Killworth and Shannon DeBra. All of us are members of Epstein Becker & Green's Health Care and Life Sciences Group, and we're going to talk to you about some of these new developments.

[00:00:52] Allen Killworth: Glad to be here. Thanks, David.

[00:00:53] Shannon DeBra: Thanks, David. I'm happy to be here.

[00:00:55] David Johnston: Congress just passed a law that's going to force every hospital with off-campus outpatient departments to prove they're complying with regulations that have existed for decades. But here's the thing, most haven't had to prove it before, but they will starting January 1st of 2028.

[00:01:12] David Johnston: They're going to have to submit the right paperwork and have the correct separate billing numbers set up, and if they don't, they could lose Medicare payments at those locations entirely. It's not optional, and the deadline is less than 18 months away. So what is this new law? How did we get here? It's the Consolidated Appropriations Act of 2026.

[00:01:34] David Johnston: It came into effect earlier this year in February, and it was born out of a concern by Congress that there was an expansion of provider-based billing, more and more of these locations were starting that cost the Medicare program more money in higher reimbursements, and Congress also had a concern that there was a lack of enforcement under the current regime of provider-based billing on some of these new locations.

[00:02:06] David Johnston: One important thing to note, this is congressional action. It's not a regulation, and so this act came from Congress. So what are some of the requirements of the new law? What are the big things that we've got to do?

[00:02:18] Shannon DeBra: There are two key changes that come with this new law. Number one, each qualifying off-campus provider-based location will need its own unique NPI, separate from the main hospital.

[00:02:29] Shannon DeBra: And number two, you must submit an attestation for each qualifying off-campus provider-based location confirming compliance with the provider-based regulation. You may be wondering, how is this different than current regulations?

[00:02:41] Allen Killworth: So there are some key differences. As David mentioned, the provider-based rules have been around for a long time.

[00:02:47] Allen Killworth: Hospitals are very familiar with them, and you may be well-versed in complying with provider-based rules. But some key distinctions between the current requirements and the new requirements are that each hospital outpatient off-campus department is going to have to have a separate NPI number and is going to have to submit an attestation form.

[00:03:08] Allen Killworth: The attestation form is mandatory, and getting a separate NPI is also going to be required for each of those departments. So let's talk about who this applies to, what locations are subject to the new rules. You mentioned off-campus outpatient departments. What are those?

[00:03:26] Shannon DeBra: The Consolidated Appropriations Act of 2026 gave us a definition of off-campus outpatient department, which we didn't previously have.

[00:03:34] Shannon DeBra: The new definition defines an off-campus outpatient department as any provider-operated facility that is not located on the main provider's campus or is not within 250 yards of a remote hospital location. So what does that mean? What types of provider-based locations does this apply to and conversely not apply to?

[00:04:22] David Johnston: So an important piece of this is knowing what types of provider-based locations these new rules apply to.

[00:04:45] David Johnston: They do not apply to any on-campus locations that you may have that's within 250 yards of the main campus of your hospital. They do not apply to a remote location, which is like a second campus that has inpatient care of your hospital, and they also don't apply to any locations that are within 250 yards of that remote location.

[00:05:11] David Johnston: So essentially, if you're on campus to your main provider or you're on campus to one of your remote locations, or that remote location, these new requirements don't apply to you. They also don't apply to any provider-based rural health clinics that you may have. But any grandfathered or non-grandfathered other locations that aren't in one of those exclusions, these rules are going to apply to you.

[00:05:39] David Johnston: Sometimes we get asked, what about critical access hospitals or children's hospitals? Does it apply to those?

[00:05:47] Allen Killworth: The answer is yes, both of those types of hospitals can have provider-based locations. And so to the extent that they do, and if you're a critical access hospital or a children's hospital that has off-campus provider-based departments, the rule will apply to those locations also.

[00:06:06] Shannon DeBra: Allen, let's talk a little more about the new NPI requirement. What is the new requirement, and when do hospitals need to do this?

[00:06:13] Allen Killworth: Currently, hospitals could have a single NPI, and the off-campus department could be using and billing under that main provider's NPI number.

[00:06:25] Allen Killworth: So the change is significant because after January 1, 2028, every off-campus outpatient department of a hospital is going to have to have its own organizational NPI, it's got to be unique. You can't use one for multiple off-campus departments. You're going to have to have one for each outpatient off-campus department of the hospital.

[00:06:50] Allen Killworth: So you're going to have to enroll and get the NPI for each one of those locations. As far as timing goes, this is something that hospitals are going to need to do before the deadline of January 1, 2028. And probably going to want to start the process sooner rather than later, because you're going to need to have that NPI as part of the submission of the mandatory attestation.

[00:07:11] Allen Killworth: That's part of the information that you're going to have to supply when you submit that attestation by December 31st of next year. And maybe, David, you could talk about why this is a big deal for hospitals and health systems, especially larger hospitals and health systems.

[00:07:25] David Johnston: Yeah, absolutely, Allen. Because generally, hospitals and health systems don't think of getting a new NPI as that difficult.

[00:07:34] David Johnston: It's a pretty simple system and process to go through with NPPES, the government system that grants those NPIs, and that's true if you are getting one or two of them. So it's maybe not as big a deal for a small hospital with just a couple of hospital outpatient locations. But if you're a large multi-campus hospital or a large system, you may be getting hundreds of new NPIs, and that just begins to have an administrative burden to it and process. But beyond just getting those NPIs, there's other implications, right Shannon, for having lots of different NPIs that you're going to use?

[00:08:17] Shannon DeBra: Yes, absolutely. The new NPIs will need to be added to each hospital's Medicare enrollment in PECOS. Other payors may need to be updated as well. And probably the most complicated part of this is the billing implications that are going to stem from the changes in the NPIs. Billing systems, which often run out of a hospital or system's electronic medical record, like Epic or Cerner, for example, will need to be modified to associate the new NPIs with each specific location so that the claims coming out of those off-campus outpatient departments include the unique NPI and not the main hospital's NPI anymore.

[00:08:55] Shannon DeBra: So every hospital in the country will be contacting their EHR vendor to get these changes made, which obviously can't happen until the new NPIs are obtained and on record with payors. Sequencing of events will be key to avoiding claims denials during this transition time. The other new requirement that we mentioned before is the mandatory attestation.

[00:09:15] Shannon DeBra: When are these due?

[00:09:17] Allen Killworth: For existing entities, entities that are currently operating or they're in operation before next December 31st … December 31st, 2027, the attestation is due before January 1, 2028, so by December 31st, 2027. For new entities that get formed after that, so fast-forwarding up to January 1st, 2028, if you create a new hospital off-campus outpatient department, you are going to have to submit the attestation before and get it approved before you bill OPPS.

[00:09:53] Allen Killworth: So you're going to want to submit that attestation really as soon as you’re ready to do so prior to beginning services so that you can bill for OPPS. You're allowed to submit up to two years prior to your first billing as an outpatient department. Obviously, most entities that are being formed probably won't be submitting that far in advance, but you definitely are going to want to submit the initial attestation prior to opening as an outpatient department.

[00:10:26] David Johnston: Well, what if hospitals already submitted a voluntary attestation?

[00:10:31] Shannon DeBra: I'll take that one, David. It's a great question, and unfortunately, we don't have the answer yet. In the proposed rule, CMS asked for comments and said it was considering an abbreviated process for those off-campus outpatient departments that had previously submitted an attestation and received an approval.

[00:10:46] Shannon DeBra: We don't know yet if that will apply to all attested locations, regardless of how much time has passed or if there will be time limits. We'll be watching the final rule on this one.

[00:10:55] David Johnston: And CMS is going to adopt some kind of national standardized attestation form, we understand. But until then, for anybody that wants to submit early, you can use those MAC-specific forms that are currently in existence out there.

[00:11:14] David Johnston: Hopefully the new standardized form doesn't look too different, but we're not sure yet. What is that attestation form going to require in any of its iterations?

[00:11:25] Allen Killworth: The attestation form, there's a draft that's available. CMS already released a draft. They are going to adopt a standardized national form.

[00:11:34] Allen Killworth: There's some MAC-specific forms that are available now and entities have been using for some time. So you might be familiar with your own MAC’s form, but there will be, with the new rule and the new requirement that all off-campus outpatient departments are going to have to submit an attestation, there was a push to standardize the process.

[00:11:53] Allen Killworth: There's going to be a new electronic submission system, like a portal system, where you're going to submit these attestations, and the form is going to be a standardized national form. As David mentioned, we don't know exactly what the form's going to require. The draft form is out, so we know what that requires, and it's very similar to the existing forms.

[00:12:08] Allen Killworth: Essentially it's going to have places for hospitals to attest that they meet the specific existing provider-based rules at 42 CFR 413.65. So those rules for off-campus outpatient departments are going to be described in the attestation form where you will be checking the box to state and confirm that you meet those rules.

[00:12:34] David Johnston: So after we file one of these attestations, what's going to happen then?

[00:12:40] Shannon DeBra: CMS will review the attestations. In the proposed rule, CMS estimated that it will receive 16,488 attestations, so the review and determination process may take some time. What's important to know is that existing off-campus outpatient departments that submit their attestations by the deadline of December 31st, 2027, can continue to bill as provider-based while their attestation is being reviewed.

[00:13:05] David Johnston: And is that the same sort of set of evaluation rules as currently exist, or are there new rules for this process?

[00:13:13] Allen Killworth: There are new rules on the process itself. Like the form, CMS is standardizing the process so it's not MAC by MAC. There will be a new standardized review process used by all the MACs across the country.

[00:13:25] Allen Killworth: That process for the review of these attestation forms is a three-tiered process described in the proposed rules. The first tier is done for all of the attestations, every single one that's submitted. It's an initial review. They check for completeness, make sure that you've provided all the information that's required, that you've filled out the form properly.

[00:13:44] Allen Killworth: And if there's no questions, all your information is submitted and indicates your compliance with the provider-based rules, that may be the only tier that you get to when you submit an attestation. But there's two other tiers. The second one is a targeted review process, and the proposed rules mention that this might be due to the fact that you've missed some information or that your form is incomplete, or there are some inconsistencies.

[00:14:09] Allen Killworth: And in that case, they would ask for you to resubmit additional information. CMS would point out the additional information that's needed, and there's an anticipated timeframe of at least 60 days in which you'd have to go back and forth with CMS and provide additionally requested information.

[00:14:26] Allen Killworth: And the third tier is the extended review. This is going to be the last tier that's used just for certain attestations filed - with risk-based methodologies identifying those attestations that might need greater scrutiny. We don't know exactly what this is going to look like, this is still part of the proposed rules but it is sort of the highest level of scrutiny.

[00:14:47] Allen Killworth: It could include additional documentation requirements or even on-site survey activity by CMS.

[00:14:52] David Johnston: Even after a hospital has submitted its attestation under the new rules and gone through one of those three tiers of review, it's not automatic that they would be approved for that location for qualifying for provider-based status.

[00:15:09] David Johnston: And if they are denied, then the standard appeal process that exists today and has existed for years for the denial of a provider-based location would still come into play there. So we've talked about some of the things that are in this new rule. There's a lot there. There's a lot for hospitals to do.

[00:15:31] David Johnston: What are some of the next steps? What do they do from here?

[00:15:35] Shannon DeBra: Well, David, as you can imagine, it's a multi-step process. Hospitals first have to start by inventorying all of their provider-based locations and figuring out which ones fall under the rule using the 250-yard definition for what's considered on and off campus.

[00:15:50] Shannon DeBra: Then, for each location that's subject to the new requirement, they should assess current compliance with all of the elements of the provider-based regulation at 42 CFR 413.65, since it really isn't changing for the most part. From there, they should identify any gaps, missing documentation, integration issues, signage, public awareness, financial systems, and remediate those before submitting the attestation.

[00:16:14] Shannon DeBra: And as we've said, each off-campus outpatient department needs a new NPI, so they need to apply for that. And they also need to pull together all the supporting documentation for the attestation. We don't yet know exactly what's going to need to be submitted with the attestation, but they should be able to produce that pretty much with a moment's notice if they get a request for additional information.

[00:16:35] Shannon DeBra: Then they can prepare the attestation itself. Right now, that can be done using the MAC template, as we've said, though a standardized form is expected later. We don't know exactly when, whether it will be before January 1st, 2028, or not. Coordinate with the MAC and CMS on submitting the attestation as the process gets finalized, and then monitor for CMS approval and respond to any follow-up documentation or information requests.

[00:17:00] Shannon DeBra: Additionally, payors, in addition to Medicare, will need to be notified of the new NPIs, and billing systems need to be updated to accept unique NPIs from each off-campus outpatient department, since billing systems historically would have been generally using a single NPI for all parts of the hospital, both on and off campus.

[00:17:19] David Johnston: And this is going to require a lot of coordination amongst a lot of different hospital functions. There's going to be billing, operations, legal, compliance, different contracting teams. This is going to be a big effort internally. CMS has offered some estimates of how long they think it will take for each attestation.

[00:17:42] David Johnston: I think our educated guess is that it's going to take longer than that, longer than CMS anticipates. This is going to be a big job for hospitals, even small hospitals with a couple of locations, and a much bigger job for large health systems. There's going to be some economies of scale because you're going to be doing some of the same things over and over, gathering the same types of documentation, but just the volume of it is going to be quite significant. So what's the one thing that hospitals and health systems should do now to keep from fumbling the ball and putting themselves in a bad position before the effective date?

[00:18:26] Allen Killworth: The key is really just to start planning and start soon. January 1st, 2028, sounds like a long ways off, but it's really not all that far. And there's a lot to do, as David was just mentioning. There's really a lot to do between now and then. So I think, you know, not waiting is maybe the key for hospitals. Just to start even inventorying and planning for the steps of getting a new NPI and getting attestation forms completed for each provider-based location.

[00:19:00] Allen Killworth: Even having an accurate and full list of all of those off-campus outpatient departments is going to take some time. So getting started early and just preparing your organization so that you're ready to take those two steps is really what hospitals should be focusing on now, and preparing for a lot of work next year but making it a little easier for yourself by being ready for it.

[00:19:22] David Johnston: To close out, we wanted to talk a little bit about questions that we've already gotten from our provider clients, as well as some things that maybe CMS hasn't clarified yet, open questions that are out there that we want to keep an eye on.

[00:19:38] David Johnston: One big one we're getting is: Could any of this change or go away or be modified? Because I think a lot of hospitals are worried about, well, we don't want to spend a lot of effort going down this road if CMS is going to change directions. As I mentioned at the beginning, one important thing to keep in mind is that all of this started from an act of Congress, so it's different than the sort of rulemaking that you might see in another context where CMS decides to delay it or pull back the implementation of a new regulatory scheme.

[00:20:14] David Johnston: Absent Congress doing something, this is all going to go forward. There may be tweaks around the edges with CMS rulemaking, but substantially this is going to happen and on the timeline that was set out in that initial act. So January 1, 2028, is going to be a pretty hard deadline.

[00:20:35] David Johnston: CMS sought comments from the provider community. Those were due at the last day of August, so there are going to be some changes that CMS may make, especially to the ways in which the requirements are implemented and the specific steps that have to be taken. But the main pieces of this are going to continue to happen.

[00:21:00] David Johnston: Another question we get is how should we handle new locations that aren't open yet?

[00:21:07] Allen Killworth: Yeah, another question we're getting is regarding new locations. You know, how should we handle new or anticipated outpatient departments that are going to come online in the next year or two?

[00:21:22] Allen Killworth: And that's a bit tricky. The answer there really depends on what your timeframe is like. You're probably going to want to avoid opening any right around January 1, 2028, and may be better to get those open beforehand or wait a little bit after that. Really the reason is because there's going to be a lot of work and activity going up to that December 31st, 2027, timeframe.

[00:21:48] Allen Killworth: But there is an advantage to opening a location prior to that because that's going to be then considered an existing location and it doesn't have to have its attestation approved prior to billing. As Shannon mentioned, you're going to be deemed to be provider-based while your application's pending, so you can bill assuming that you've filed that attestation by December 31st, 2027. If you are opening after January 1, 2028, you have to have approval before you can bill as OPPS.

[00:22:20] Allen Killworth: So you might want to get it in before that and hit that December 31st, 2027, deadline so that you're considered an existing department. Another question we've been getting is how long will it take for CMS to approve the attestations? That one we really, that's a really an unknown.

[00:22:39] Allen Killworth: CMS is going to have a lot, and the MACs are going to have a lot of attestations to review and approve. So it's hard to know how long, and there's no timeframe set forth in the rule as to know when those are going to come back. Again, if you get your application in for existing locations prior to December 31st, 2027, it sort of doesn't matter because you can bill for OPPS as provider-based while the application's pending.

[00:23:07] Allen Killworth: We really don't know how long those attestation reviews are going to take.

[00:23:10] Shannon DeBra: I've been getting a question about what the submission mechanics for these attestations are going to look like. And for now, while we await CMS action, the attestations are submitted to the MAC under the existing process each MAC has.

[00:23:22] Shannon DeBra: So no changes for now. But CMS has told us in the proposed rule that they plan to open what it refers to as a centralized electronic system, a portal that will allow for the electronic submission of attestations and supporting documentation. They think that's going to reduce some of the administrative burden because providers won't have to resubmit the same documents that might apply to a number of their provider-based locations.

[00:23:48] Shannon DeBra: They'll have it within … already within the portal before they do a submission. But we'll have to wait and see what that looks like and see how that works.

[00:23:55] David Johnston: Another comment that hospitals have had as they hear about all of us talking about all these requirements and all this work and all this time is, "Well, can we just avoid this and not submit an attestation?

[00:24:08] David Johnston: “What's the worst that could happen here?" So there are some real downsides to that, of just choosing to opt out of the whole regulatory scheme. You're going to lose the ability to be paid under the OPPS, that preferential reimbursement scheme, for any services at that provider-based location. Even if you've been previously enjoying grandfathering for years, you're going to lose that by not filing the attestation.

[00:24:37] David Johnston: And you are probably going to have to take that location off of your hospital enrollment and potentially enroll as some other type of provider there. We're hoping for a little bit more guidance from CMS on that sort of second-order impact beyond just the reimbursement. Can you still be provider-based and not be getting OPPS if you don't meet these attestation requirements?

[00:25:07] David Johnston: That's somewhat of an open question, but there's a lot of indication, especially in the proposed rule, that no, you cannot.

[00:25:15] Allen Killworth: Yeah, and a related question is, what happens if your attestation is denied? What if, what happens if you submit an attestation on time by December 31st, 2027, it gets reviewed by CMS, and it's actually denied?

[00:25:26] Allen Killworth: They say that you don't meet the provider-based rules. That would also result in a loss of provider-based status. That location would no longer be considered provider-based under the rules, and you would not be able to bill under OPPS for that. So that's a significant issue and also one of the things that hospitals can be looking at now to make sure that they do meet all of the provider-based rules for each location so that you don't run into those denials.

[00:25:52] Shannon DeBra: And I've been hearing from some clients that have concerns that when they've done a survey of their current provider-based locations, that they found some issues, some compliance issues, and they're wondering, what do they do now? They need to get to work. They need to get started now with bringing each location into compliance if they plan to continue billing those locations as part of the hospital.

[00:26:14] Shannon DeBra: So they need to go back through the provider-based regulation at 413.65, go through each of the requirements, and make sure that each off-campus outpatient department complies with the applicable parts of that regulation. Then they need to decide, can they qualify, and will they come into compliance and submit an attestation?

[00:26:35] Shannon DeBra: Some of them may decide that they absolutely can't come into compliance, and then they won't submit an attestation. Some of them may also need to evaluate whether they've received an overpayment from Medicare or any other payor that utilizes the provider-based rules, and if they have incorrectly billed one or more locations as if they met the provider-based requirements.

[00:26:54] David Johnston: Clients are also asking, "Hey, we just submitted an attestation. Do we have to do this again?" And also, "Hey, we've never submitted an attestation for any of our locations. Is that going to be a problem?" So in those two situations, if you've just submitted an attestation, say, in the last couple of months, technically from when that law was passed until the end of next year, the end of 2027, you're going to be covered for that attestation requirement.

[00:27:25] David Johnston: But if you submitted something a year ago outside of that two-year window, unfortunately, you're going to have to submit that attestation again under the new methodology that CMS releases that Shannon was talking about. But if you're a provider who's never submitted a provider-based attestation, you're complying with all the pieces of the rule, you have just never gone through that voluntary formalized step of submitting that attestation.

[00:27:55] David Johnston: That doesn't create any problems for you under this new regime. You're just going to have to submit that initial attestation just as all other providers are.

[00:28:06] Shannon DeBra: So one thing we've been asked is some providers are worried or wondering what happens to them if they already have submitted an attestation for a location.

[00:28:14] Shannon DeBra: And I guess it depends whether they've already been approved for that, that attestation has already been approved, or whether they're still awaiting approval. In the proposed rule, CMS indicated that it was requesting comments and feedback on what they should do with providers who have already submitted an attestation that's been approved.

[00:28:34] Shannon DeBra: So we're hoping for some kind of an abbreviated process or perhaps they can get a buy through this first process, maybe get grace until the repeat attestation process that CMS and Congress have told us is going to be coming down the road. If they've submitted an attestation but haven't yet heard, I think that's an open question and they may need to reach out to their MAC to figure out what the right answer is on that one.

[00:28:59] David Johnston: Well, Shannon and Allen, thank you for sitting down today and talking about all of this with me. It's a really complex and high-stakes new requirement for all hospitals. And I think all three of us want to leave all of our listeners, all of our hospital provider clients, with the sort of big takeaway from this is to start early.

[00:29:25] David Johnston: The best time to have started this is a month ago, and the next best time is today. There's a lot of work to do, and there's not as much time as you might think to do it. You want to start on your compliance audit, your NPI applications, your documentation gathering, talking to your EMR provider with some of these new NPI requirements.

[00:29:50] David Johnston: Do all of that early. So thank you to all of our listeners on today's Diagnosing Health Care podcast. On behalf of myself, David Johnston, and our guests, Allen Killworth and Shannon DeBra, if you've liked what you've heard today, please don't forget to subscribe. Diagnosing Health Care is available wherever you get your podcasts.

[00:30:12] David Johnston: We'll see you next time.

In Case You Missed It

States Further Legislation to Restrict Sale of Weight Loss, Muscle Building Products to Minors, Health Law Advisor

DOJ Revises Justice Manual on Non-Binding Guidance and Qui Tam Dismissals: Practical Considerations, Health Law Advisor

How the FCA Now Threatens Health Care’s DEI Programs, Diagnosing Health Care

About Diagnosing Health Care

What health care and life sciences decision-makers need to lead, comply, and compete. The health care industry is full of high-stakes legal, policy, and regulatory obstacles. And significant opportunities for those prepared to act on them. Diagnosing Health Care® delivers the intelligence executives, general counsel, and administrators need to navigate both. Part of the Epstein Becker Green Insights Network.