CMS Finalizes Mandatory Provider-Based Attestation Requirements for Off-Campus Outpatient Departments

Section 6225 of the Consolidated Appropriations Act, 2026, made provider-based attestations mandatory for hospital off-campus outpatient departments.

In response, the Centers for Medicare & Medicaid Services (CMS) previously published a proposed rule on July 7, 2026, as discussed in our prior Insight, and on November 6, 2026, CMS issued the final rule implementing the attestation requirements.

The final rule keeps the framework CMS proposed in July, but it changes several points that affect compliance planning—most notably clarification regarding when a single National Provider Identifier (NPI) can be used for an off-campus location and the treatment of departments that had already submitted an attestation and hold a provider-based determination.

What You Need to Know

• Attestation Deadlines Unchanged from the Proposed Rule: Existing off-campus departments must submit initial attestations between January 1, 2026, and December 31, 2027. Departments that begin services after January 1, 2028, must attest within the two years before billed services are delivered.
• No Documentation at Submission: Attestations are certifications of compliance. Supporting documentation is not required to be submitted with the initial attestation and must be furnished only upon CMS’s request.
• Notice and Limited Correction Opportunity: CMS will provide written notice of review outcomes with appeal rights and may offer an informal opportunity to correct minor attestation deficiencies before a determination issues.
• Separate NPI per Physical Address: A single off-campus location needs one NPI regardless of how many service lines it operates at that location. However, separate locations are identified by designation in the Provider Enrollment, Chain, and Ownership System (PECOS) and will include locations with separate suite numbers at the same building (if so designated in PECOS).
• Department with Pre-2026 Determinations Must Re-Attest: Departments that received a provider-based status determination before January 1, 2026, must submit a new attestation. CMS did not finalize the letter-based alternative it had considered for these departments.

Background

Effective January 1, 2028, Medicare will not pay for items and services furnished by an off-campus outpatient department unless (1) the department bills under its own NPI, separate from the main provider’s NPI, and (2) the main provider has submitted an attestation that the department complies with the provider-based rules at 42 CFR 413.65. The final rule amends 42 CFR 413.65 and adds a new section, 42 CFR 419.23, to codify these requirements.

Key Provisions and Changes

Off-Campus Definition and 250-Yard Rule

CMS finalized the definition of “off-campus outpatient department” without modification, along with the provisions that exclude remote locations and departments located within 250 yards of a remote location of a hospital. Accordingly, hospitals will need to identify which of their outpatient departments are located off the main provider’s campus and more than 250 yards from any remote location of a hospital, because only those are subject to the separate NPI and attestation requirements.

CMS clarified that when measuring to determine if an outpatient department is within 250 yards of a remote location, the measurement may begin at any point of the remote location facility that provides inpatient care, measured in a straight line to the nearest point of the potential department. Non-structural features, such as awnings and walkway overhangs, are not appropriate starting points.

Timing and Subsequent Attestations

CMS finalized the initial attestation windows as proposed. Each existing off-campus outpatient department must obtain its own NPI, update PECOS, and submit an attestation before January 1, 2028. Thereafter, initial attestations must be filed within the two-year period prior to a location furnishing services. CMS also finalized the rule providing that for initial attestations, the submission requirement is satisfied even if CMS has not issued a provider-based status determination before the first day the department furnishes services. Subsequent attestations will be required at intervals not to exceed five years, with the final rule clarifying that the five-year period will run from the date the previous attestation was submitted. CMS deferred other details related to subsequent attestations to the 2028 rulemaking cycle.

Submission Process and Documentation

The final rule implements the process for use of a standardized attestation form and centralized electronic submission system as proposed. One significant clarification in the final rule is that supporting documentation is not required to be submitted with the initial attestation. However, providers must be prepared to furnish documentation demonstrating compliance upon request. Failure to furnish requested documentation may lead to a noncompliance determination and recovery of payments under 42 CFR 413.65(k). CMS also indicated it will use the centralized electronic system to minimize duplicative submissions where a single document supports multiple departments. CMS stated it will provide guidance on required documentation for each provider-based requirement through future rulemaking or sub-regulatory guidance. CMS did not adopt a different process for departments that previously submitted an attestation and received a provider-based determination before 2026, as the proposed rule had suggested. Therefore, all existing off-campus outpatient departments, even those that previously submitted a voluntary provider-based attestation, must comply with the new initial attestation requirements in the final rule.

Review, Verification, and Correction

In response to comments, CMS added commitments to provide written notice of review outcomes, including the basis for any adverse determination and applicable appeal rights. CMS also stated that it may give providers with minor attestation-based deficiencies an informal opportunity to correct them before a determination issues.

The attestation verification process is finalized as proposed. In this process, all attestations will be subject to initial review consisting of an automated validation of attestation completeness, consistency with PECOS enrollment records, and the presence of the required elements. Attestations may be subject to targeted review and extended review based on indicators of incompleteness, inconsistency, or elevated compliance risk. CMS stated that it also anticipates using random sampling to select both hospitals with a single off-campus department and hospitals with multiple off-campus departments for targeted or extended review.

In the event an off-campus location is determined not to meet the provider-based requirements, CMS emphasized in the final rule that the Outpatient Prospective Payment System (OPPS) billing restriction applies only to the specific noncompliant off-campus outpatient department and does not reach all OPPS payments to the main provider.

NPIs and Claims

Based on comments asking whether hospitals should obtain new NPIs for off-campus outpatient departments based on the physical address, how the location is designated in PECOS, or by each individual hospital department at a location (e.g., radiology versus surgery), CMS stated that a single off-campus location operating at one address needs one NPI, even if it provides several types of services in separate hospital departments. However, CMS further clarified that an off-campus outpatient department location “is identified by the hospital’s submission of its physical facility location in the enrollment system—its street address, including suite or floor number, where applicable.” Thus, a single building with multiple locations identified in PECOS by separate suite or floor numbers would require multiple NPIs (one NPI for each location as separately identified in PECOS).    

In response to additional comments noting that requiring separate NPIs for off-campus provider-based departments could conflict with CMS requirements to combine same-day outpatient services on a single claim given that the standard claims format permits only one billing NPI, CMS stated that it is taking steps to permit multiple NPIs on a single claim, pairing the hospital’s claim-level NPI with service-line NPIs.

Key Takeaways and Recommendations

To ensure compliance by January 1, 2028, hospitals should begin now and take the following steps:

1. Inventory off-campus departments using the final definition, paying particular attention to the remote location 250-yard measurement and to any critical access hospital-affiliated departments that are excluded from the separate NPI and attestation requirements.
2. Identify pre-2026 determinations. Departments that previously received a provider-based determination must submit a new attestation within the required window, so these departments should be included.
3. Obtain NPIs and update PECOS for each off-campus outpatient department, applying the physical-address approach CMS described.
4. Assess compliance with the provider-based requirements in 42 CFR 413.65(d), (e), (g), and (h) for each department, and assemble documentation that can be produced promptly on request.
5. Plan attestation timing within the December 31, 2027, deadline for existing departments, accounting for the time needed to add a department to the enrollment record.
6. Monitor sub-regulatory guidance, including the operational instructions for the centralized system and the documentation guidance CMS has committed to provide.

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.