Medicare’s New NPI and Attestation Rules for Hospital Off-Campus Departments: Preparation Starts Now

Hospitals that are paid under the Medicare Outpatient Prospective Payment System (OPPS) need to prepare for new billing and attestation requirements for off-campus outpatient departments that go into effect in January of 2028. These new requirements are included as Section 6225 of the Consolidated Appropriations Act (CAA) and continue the long-term trend of Medicare scrutiny of these locations, introducing a new subsection of the statute, Section 1833t(23) of the Social Security Act. 

Beginning January 1, 2028, Medicare will not pay for services under the OPPS furnished by an off‑campus hospital outpatient department unless that department: (1) bills under its own location specific national provider identifier (NPI) that is separate from the hospital’s NPI, and (2) submits a provider‑based attestation demonstrating compliance with 42 C.F.R. § 413.65 between January 1, 2026 and December 31, 2027.

This is a significant change from current law, where hospitals may operate off-campus outpatient departments without attesting to their provider-based status — a process that has been voluntary since the provider-based regulations formalized the attestation process in 2000, with a few exceptions, such as the “mid build” exemptions from site neutrality. The Centers for Medicare & Medicaid Services (CMS) is also directed by the new statute to set the process for subsequent attestations and to conduct compliance reviews through audits or site visits.

These requirements apply to all off‑campus departments paid under OPPS, including sites previously “excepted” or grandfathered. Congress also allocated funding to CMS for implementation and directed the U.S. Department of Health  Human Services Office of Inspector General to report to Congress on the attestation review process by January 1, 2030.

Compliance with these new requirements will require input from several hospital components, including the enrollment, billing, compliance, and operations teams. Prospective planning now can reduce implementation risk when the attestations are due starting in 2028. Until a new submission process is established, hospitals may continue using existing attestation procedures as described in 42 C.F.R. § 413.65(b)(3). Below is a practical framework hospitals can implement to prepare for these changes.

1) Confirm your on‑ and off-campus footprint.

As only off-campus facilities are implicated by the new law, providers should establish a definitive inventory of off-campus provider-based locations that meet the requirements of 42 C.F.R. § 413.65 and are billed as provider‑based today under the hospital’s NPI. Some facilities that may have been treated as off-campus may, in fact, be on-campus, and exempt from the new rules. There is also an existing process to seek Regional Office approval to deem locations to be on-campus when a campus involves multiple facilities separated by streets or other barriers.

2) Create attestation packages.

Hospitals will need to assess each off-campus provider-based location’s compliance with 42 C.F.R. § 413.65, and begin assembling documentation to support the attestations that will need to be submitted to CMS. Given the extensive requirements, and the potentially high volume of provider-based locations that are part of the inventory, this may be a time-intensive exercise. Creating a playbook or checklist that can standardize the attestation package across multiple sites may be helpful.

3) Review NPI strategy

Hospitals should assess the implications of obtaining an NPI for each off-campus provider-based location, as obtaining a new NPI may require updates to Medicare and Medicaid enrollment information, can impact 340B program eligibility, and require updates to payor contracts. 

4) Thoughtfully address outliers

If the hospital’s review reveals locations that cannot comply with off campus rules set forth in 42 C.F.R. § 413.65, evaluate needed, alternative billing models to preserve payment after January 1, 2028. If historical billing did not meet provider‑based standards, coordinate with counsel on potential overpayment assessments and any necessary disclosures.

There remain a number of questions hospitals are confronting today in connection with preparation for the January 1, 2028 effective date, including:

• Will CMS delay enforcement of the new requirements pending notice and comment rulemaking and assurance that CMS has the capacity to process the attestations and issue new NPIs?
• Will CMS actually impose a draconian penalty of zero reimbursement for services provided at nonconforming facilities, as opposed to payment at a lower, fee schedule rate?  The statutory language explicitly references OPPS, but also includes a further instruction of no payment under an “applicable payment system,” which is how non-exempt, non-grandfathered provider-based departments are currently paid. Forthcoming CMS rulemaking should clarify the reimbursement implications for these locations.

• Will CMS introduce or permit a “short form” attestation process (perhaps a simple 1-page attestation of compliance or through the online enrollment portal of the Medicare Provider Enrollment, Chain, and Ownership System (PECOS)) in lieu of the current Medicare Administrative Contractor attestation forms and attachments, often spanning hundreds of pages?
• Will hospitals that have already attested and received a provide-based determination be required to attest again during the currently-running two-year window? Or will CMS “deem” them to have satisfied the initial attestation requirement?
• Will CMS require all hospitals to re-attest every two years for each off-campus location, even if there is no change in the operations or location of the facility? Or will CMS require hospitals to re-attest only if there is a “material change” in the provider-based facility, as currently contemplated in the existing regulation 42 CFR 413.65(c).

The rulemaking process will provide additional detail on submission procedures, review protocols and attestation timing. In the interim, hospitals should develop their compliance strategy to get ahead of the 2028 filing deadline.

Foley is here to help you address the short and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Foley relationship partner, or to our Health Care Practice Group and Health Care & Life Sciences Sector with any questions.