CAA 2026: NPI and Attestation Requirements for Off-Campus Provider-Based Departments to Avoid Losing Medicare Reimbursement

Section 6225 of the Consolidated Appropriations Act of 2026 (CAA 2026), enacted on February 3, 2026, fundamentally changes Medicare's treatment of hospital off-campus provider-based departments.

Beginning January 1, 2028, each off-campus provider-based location must satisfy two new statutory prerequisites—obtaining a distinct organizational National Provider Identifier (NPI) and filing a current provider-based attestation—or face loss of Medicare payment eligibility.

Hospitals should begin planning now, as compliance will require coordinated action across legal, compliance, reimbursement, enrollment, IT, and operations teams.

What You Need to Know:

• Attestations Become Mandatory: Beginning January 1, 2028, each off-campus provider-based department must submit a provider-based attestation dated on or after January 1, 2026, converting attestations from voluntary compliance tools into statutory prerequisites for Medicare payment.
• Distinct NPI Required: Each off-campus location must obtain and bill Medicare under a distinct organizational (Type 2) NPI assigned to that specific location, likely requiring corresponding amendments to the hospital's Medicare enrollment record (Form CMS-855A).
• Payment Eligibility at Risk: Off-campus departments that fail to meet both requirements by January 1, 2028, will be ineligible for Medicare payment. Hospitals that previously submitted attestations must resubmit updated attestations on or after January 1, 2026.

Background: From Voluntary Practice to Statutory Requirement

Under current regulations (42 C.F.R. § 413.65), submission of a provider-based attestation is voluntary. An approved attestation limits a hospital's exposure to retrospective overpayment liability if the Centers for Medicare & Medicaid Services (CMS) later determines that a location failed to meet provider-based requirements. Historically, CMS has declined to process attestations for certain types of sites—for example, therapy-only locations—reinforcing the optional nature of the process.

Similarly, current Medicare rules do not require hospitals to obtain separate NPIs for individual off-campus departments. Many hospitals have elected to use distinct NPIs for operational or strategic reasons—including internal cost tracking, 340B program administration, commercial payer contracting, and participation in certain group purchasing organization (GPO) or pharmacy benefit manager (PBM) arrangements—but the choice has been discretionary.

CAA 2026 eliminates that discretion. Attestations will no longer be optional compliance tools; they become statutory prerequisites to Medicare payment. Likewise, a distinct NPI for each off-campus location is now a condition of payment eligibility, not an administrative election.

Scope of the Requirements: Which Locations Are Covered

The new requirements apply to all off-campus outpatient departments, regardless of payment status. This includes both “excepted” (grandfathered) departments that continue to receive full Outpatient Prospective Payment System (OPPS) reimbursement, and “non-excepted” departments paid under the Medicare Physician Fee Schedule (MPFS) or another applicable payment system.

The only off-campus provider-based locations exempt from these new requirements are:

• on-campus locations (generally defined as those within 250 yards of the main hospital location); and
• those within 250 yards of a remote location of the hospital.

All other off-campus outpatient departments are subject to the new requirements.

Enrollment Implications Beyond the NPI Application

Although the statute speaks in terms of NPIs, obtaining and billing under a distinct organizational (Type 2) NPI will likely require corresponding amendments to the hospital’s Medicare enrollment record (Form CMS-855A). Depending on forthcoming CMS guidance, hospitals may be required to enroll each off-campus department as a separately enrolled practice location or subpart tied to its own NPI.

CMS has not yet specified the enrollment mechanics, but the operational implications are likely to extend beyond a simple NPI application. Hospitals should also be aware that separate NPIs may carry downstream consequences for 340B program eligibility, managed care contracting, state licensure, facility designation, Medicaid enrollment, and commercial payer contracting—all of which warrant early evaluation.

Re-Attestation Required for Previously Attested Locations

Hospitals that previously submitted provider-based attestations should not assume those filings satisfy the new statutory requirement. The CAA 2026 requires that attestations be dated on or after January 1, 2026. Accordingly, previously submitted attestations must be resubmitted with updated dates to satisfy the statute. The law also contemplates periodic “refresh” attestations at intervals to be specified by CMS through future rulemaking.

By January 1, 2028, each off-campus provider-based department must (1) have a distinct organizational NPI separate from the main hospital’s NPI and (2) maintain a current provider-based attestation on file with CMS dated on or after January 1, 2026. This change represents a structural shift in Medicare’s oversight of hospital outpatient departments and requires hospitals to begin planning immediately.

What Hospitals Should Do Now

• Inventory Off-Campus Locations: Conduct a comprehensive inventory of all off-campus departments currently billing under the hospital’s primary NPI.
• Develop an Enterprise NPI Strategy: Develop an enterprise-wide NPI strategy that accounts for operational, reimbursement, 340B, managed care, and IT system implications. Begin enrollment processes early to allow for potential processing delays.
• Conduct a Provider-Based Compliance Audit: Conduct a structured provider-based compliance audit under 42 C.F.R. § 413.65, including clinical integration, financial integration, public awareness, EMTALA implications for off-campus emergency departments, and medical staff oversight.
• Prepare and Submit Attestations: Prepare and submit updated attestations for all off-campus provider-based departments, including resubmission for any locations previously attested. Expect CMS to formalize review procedures through rulemaking.
• Monitor CMS Rulemaking: Closely monitor CMS rulemaking regarding attestation format, renewal intervals, review standards, and appeal rights.
• Evaluate State Law Implications: Evaluate potential state licensure, facility designation, Medicaid enrollment, and commercial payer contracting implications of separate NPIs.

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.