Section 6225 of the Consolidated Appropriations Act, 2026 (CAA 2026), fundamentally altered the compliance and payment landscape for off-campus outpatient departments, as discussed in our prior Insight.

On July 7, 2026, the Centers for Medicare & Medicaid Services (CMS) proposed a regulatory framework implementing changes to ensure that existing regulations comport with the new provisions of the law. CMS is accepting public comments on the proposed rule until August 31, 2026.

What You Need to Know

  • Initial Attestation Deadline: Providers with existing off-campus outpatient departments would be required to submit initial attestations by December 31, 2027, while departments that begin operations after January 1, 2028, would need to submit an attestation within two years before furnishing services.
  • Standardized Attestation Form and Process: CMS proposes establishing a standardized attestation form and centralized electronic submission system. Until finalized, providers may continue to submit attestations through Medicare Administrative Contractor (MAC)-specific templates.
  • Required Information and Documentation. The proposed attestation form would require providers to demonstrate compliance with certain provisions of 42 CFR 413.65, including structural, clinical, financial, and operational requirements, and maintain supporting documentation.
  • Three-Tiered Review Process: CMS and MACs would conduct automated validation of attestation completeness, targeted review of those with elevated compliance risk, and extended on-site audits for a subset selected using risk-based methodologies. All determinations would be subject to standard administrative appeal procedures.

Background

Effective January 1, 2028, Medicare will deny all Outpatient Prospective Payment System (OPPS) payments to off-campus outpatient departments that do not meet two new requirements: (1) compliance with new mandatory attestation requirements, and (2) use of a National Provider Identifier (NPI) separate from that of the main hospital for each off-campus outpatient department.

The proposed rule would revise the existing provider-based rule, at 42 CFR 413.65, to implement the statutory requirements of CAA 2026 and add details regarding the provider-based attestation process and compliance requirements.

Proposed New Regulations

Key elements of the proposed rule are discussed below.

Definition of “Off-Campus Outpatient Department”

A new definition, consistent with that in CAA 2026, would be added to define “off-campus outpatient department” as any provider-operated facility that (1) is not located on the main provider’s campus or (2) is not within 250 yards of a remote hospital location. While a remote location is a provider-based entity, it is not an “off-campus outpatient department” and is not subject to the attestation or separate NPI requirements of the CAA 2026. Similar to the Section 603 payment reduction rules,[1] the proposed rule treats off-campus outpatient departments within 250 yards of a remote location differently than other off-campus departments—they are not subject to the new attestation or NPI requirements. This creates important operational and compliance distinctions for multicampus hospitals.

Attestation Requirement

For existing off-campus outpatient departments, providers must submit initial attestations by December 31, 2027. Providers who submit initial attestations within the two-year period prior to January 1, 2028, are deemed to meet the attestation requirements of CAA 2026 even if they have not yet received a provider-based status determination by January 1, 2028. Thereafter, for newly operational departments, an attestation must be submitted within two years prior to furnishing services. Subsequent attestations are required within intervals not to exceed five years, and CMS stated that this requirement will be addressed in future rulemaking.

Attestations must be signed by an authorized official identified in the Provider Enrollment, Chain, and Ownership System (PECOS) and submitted through a CMS-standardized electronic system, which is currently under development. To ensure consistency across MACs, CMS is in the process of creating a standardized attestation form, but until the new form has been finalized, legacy MAC-specific attestation templates will be accepted by the various MACs.

The proposed attestation form will require providers to demonstrate compliance with 42 CFR 413.65(d), (e), (g), and (h), including (1) Structural Requirements, (2) Clinical Integration, (3) Financial Integration, (4) Public Awareness & EMTALA Compliance, and (5) Location Documentation.

Documentation sufficient to demonstrate compliance is required to be maintained by the provider; however, not all documentation is required to be submitted with the initial attestation but, rather, is required only upon request by CMS or the MAC. Notably, the proposed rule does not provide many additional specifics about how providers should show compliance with the particular requirements set forth in 42 CFR 413.65.

Significantly, CMS is seeking comment regarding whether to permit off-campus outpatient departments that previously submitted an attestation and received a determination of provider-based status prior to January 1, 2026, to use an alternative process and submit a letter to CMS verifying continued compliance rather than submitting an initial attestation.

CMS Verification and Oversight

The proposed rule describes the verification process to be used by CMS and MACs in processing the attestations:

  • Initial Review: An automated validation of attestation completeness, consistency with PECOS enrollment records, and the presence of the required elements will be conducted for all attestations.
  • Targeted Review: Attestations that present indicators of incompleteness, inconsistency, or elevated compliance risk would be flagged for targeted documentation review. CMS and MACs will request supporting documentation for flagged attestations with providers having a 60-day response period.
  • Extended Review: A subset of attestations would be selected using (yet to be developed) risk-based methodologies for extended review. This review may include remote audits of provider records, on-site visits to verify compliance, and investigation of potential non-compliance.

CMS or the MAC will issue an approval notice when the attestation demonstrates compliance with 42 CFR 413.65. CMS or the MAC may request additional information throughout the process to evaluate compliance. When CMS or the MAC determines that the attestation fails to demonstrate compliance or if the provider fails to furnish all requested information or to attest to all applicable requirements, a denial would be issued. All determinations issued through the new process will constitute initial CMS determinations appealable under standard administrative appeal procedures.

Separate NPI Requirement

Effective January 1, 2028, Medicare will not provide OPPS reimbursement to an off-campus outpatient department unless it has a separate NPI distinct from the main provider’s NPI. As the NPI must be included in the attestation for each off-campus outpatient department seeking provider-based status, this means that the NPI must be obtained prior to submitting the attestation.

Key Takeaways and Recommendations

As noted in our prior Insight, even though these regulations are not yet finalized, hospitals should begin work in order to comply by the effective dates. Therefore, we recommend that the following immediate action items be taken:

  1. Conduct an inventory of all off-campus outpatient departments using the definition set forth in the proposed rule, with particular attention to whether the facility is located within 250 yards of a remote location.
  2. Apply for NPIs for each off-campus department if not already obtained and update PECOS. As noted above, a separate NPI is required for each off-campus department as of January 1, 2028, but will be needed prior to that, as it is information required to be submitted in the attestation.
  3. Audit compliance with 42 CFR 413.65(d), (e), (g), and (h) for each existing off-campus outpatient department.
  4. Develop attestation documentation demonstrating compliance with applicable requirements in preparation for completing the attestations. As noted above, hospitals may continue to use MAC-specific forms at this time.
  5. Submit comments to the proposed rule by August 31, 2026, specifically on the scope and sequencing of the documentation requirements and the operational feasibility, potential burden, and unintended consequences of the proposed rule.

* * * *

As stated above, this is a proposed rule, and CMS is accepting public comments until August 31, 2026. For additional information about the issues discussed in this Insight or if you would like to discuss Epstein Becker Green assisting your organization with the submission of comments to CMS about the proposed rule, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.


ENDNOTES

[1] Section 603 of the Bipartisan Budget Act of 2015 (Pub. L. 114-74) enacted “site-neutral” payment reform, mandating that certain services provided at off-campus hospital provider-based departments no longer qualify for Medicare OPPS reimbursement. However, excepted from the reduced payment rates were departments within 250 yards of the hospital’s main building or a remote location of the hospital (as well as departments in existence at the time under a separate grandfathering exception).

Jump to Page
Advanced Search ›

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.