Off-Campus Outpatient Departments: CMS’ Proposed Rule for the New Mandatory Attestation Process

The Centers for Medicare & Medicaid (CMS) issued proposed regulations implementing Section 6225 of the Consolidated Appropriations Act, 2026 (CAA), codified at 42 U.S.C. § 1395l(t)(23), as part of the proposed Calendar Year (CY) 2027 Hospital Outpatient Prospective Payment (OPPS) rule. As previously discussed in our earlier blog post “Medicare’s New NPI and Attestation Rules for Hospital Off-Campus Departments: Preparation Starts Now,” beginning January 1, 2028, Medicare will not pay under the OPPS for services furnished by an off‑campus hospital outpatient provider-based departments (PBDs) unless: (1) each off-campus PBD has its own National Provider Identifier (NPI), separate from the NPI of the main provider, (2) within two years before services are billed, the main provider provides an initial attestation that the off-campus PBD meets existing provider-based requirements as described in 42 C.F.R. § 413.65, and (3) the main provider submits subsequent attestations. The proposed rule, if finalized, will standardize the attestation and documentation submission process for off-campus PBDs.

Hospitals and other interested parties have until August 31, 2026, to submit comments.

The Proposals

CMS plans to implement Section 6225’s attestation requirements in the following ways:

Addition of a New Regulation: CMS proposes to add Section 419.23 to codify the requirements prohibiting Medicare payment for items and services furnished by an off-campus outpatient department of a provider that does not meet the criteria specified in Section 6225.
Attestation Timeline: For initial attestations, CMS proposes that main providers with off-campus PBDs furnishing services on or before January 1, 2028, must submit the required information between January 1, 2026, and December 31, 2027. CMS further proposes that the main provider must receive the new location-specific NPI for the off-campus PBD prior to submitting an attestation. An off-campus PBD that begins providing services after January 1, 2028, must have an initial attestation submitted within the two years before billed services are furnished. CMS also proposes that main providers submit subsequent attestations at an interval to be specified by CMS, but not to exceed every five years thereafter.
Potential Abbreviated Treatment of Prior Approved PBDs: CMS is considering an abbreviated process for PBDs that previously received a CMS determination of provider-based status, with a simple letter from an authorized hospital official attesting to continued compliance and attaching documentation of the prior determination.
Effect of Submission of an Initial Attestation: Addressing a provider concern that CMS may not be able to process and respond to all initial attestations submitted within this two-year period, CMS proposes that timely submission of the initial attestation would meet the attestation requirements of Section 6225 of the CAA even if the main provider has not received a provider-based status determination from CMS by January 1, 2028. This interpretation is consistent with the language of the CAA and provides welcome relief for both providers and agency staff and contractors.
Standardized Attestation Form: CMS proposes a standardized attestation form that main providers would submit, with the goal of ensuring consistency. CMS published a sample Off-Campus Provider-Based Attestation Form, the terms of which are available for comment. CMS anticipates a substantial influx in the number of attestations submitted, and this streamlined attestation form may simplify at least part of this process.
Centralized Documentation Submission Process: CMS proposes that attestations be submitted via a centralized electronic system. Until the new centralized process is operational, providers may continue to submit attestations through the current Medicare Administrative Contractor (MAC) process. Under the proposed rules, main providers would have to acquire an NPI for each applicable off-campus PBD before submitting an attestation. They would also have to update the Provider Enrollment, Chain, and Ownership System (PECOS). In the initial attestation, a main provider would need to submit identifying information for itself and for each applicable off-campus PBD. Main providers may submit supporting documentation along with the attestations. Following submission, CMS and its contractors may identify attestations requiring additional information. A main provider would have up to 60 days to produce requested supporting documentation.
Documentation Requirements: CMS anticipates that it will employ risk-based screening to request additional documentation in support of an attestation of provider-based status. CMS indicates that not all attestations will receive a detailed review, with initial submissions receiving an automated review for an initial determination. Under the proposed rule, main providers will not be required to provide evidence of compliance with the provider-based status rules when the attestation is submitted, but must maintain documentation demonstrating compliance and, upon request, furnish that documentation to CMS and its contractors. We note that more recent MAC PBD attestation processes have often resulted in significant information requests following submission. CMS signals that this process will continue and identifies categories of documents that may be requested under the new risk-based review process that are similar to the categories often requested by the MACs.
Review and Determination Process; “Extended Review” Risk: CMS proposes to introduce a standardized review process and validation activities for CMS’s contractors to use in making an initial determination of compliance with Section 413.65. Such activities may include data analysis, risk-based screening methodologies, and targeted documentation review, among others. As noted above, initial attestations are proposed to be processed in an automated fashion, but attestations “that present indicators of incompleteness, inconsistency, or elevated compliance risk” would be flagged for additional review, including documentation requests and potential site visits. The Proposed Rule identifies seven sections of the provider-based regulations that are likely to be targets of additional review. These include: (1) location; (2) licensure; (3) clinical services integration; (4) financial integration; (5) public awareness; (6) obligations of hospital outpatient departments; and (7) ownership, control, administration, and supervision. Failure to submit requested documentation within the applicable timeframe, which may be as short as 60 days, “may result in a determination of non-compliance and recovery” of prior OPPS payments. CMS may also use site visits, remote audits, investigations, or additional documentation to evaluate compliance.
Clarification of Definition: CMS proposes to add a definition of an “off-campus outpatient department of a provider” to Section 413.65 to distinguish off-campus requirements from those for hospital outpatient departments located near a remote location of the main provider. An “off-campus outpatient department of a provider” would be defined as a department of a provider that is not located on the campus of the main provider or within 250 yards of a remote location of a hospital.
CMS Verification and Oversight: CMS proposes that, during the initial review stage, it would review and screen submitted attestations to verify completeness and consistency, along with the presence of all elements required for attestation. Potentially incomplete or inconsistent attestations would be targeted for further review. CMS would then use risk-based methodologies to identify attestations presenting a higher risk of non-compliance for more extensive review.

CMS has requested public comment on subsequent attestation deadlines, initial mandatory attestations for PBDs that received a determination of provider-based status before 2026, the appropriate scope of documentation requirements, and the proposed attestation form.

What You Can Do

We encourage hospitals and other interested parties to submit comments on the proposed rule prior to August 31. Some of the proposals, particularly the documentation requirements, could increase the administrative burden that hospitals face when submitting attestations. Sharing concerns with CMS now may help shape the scope of documentation required by the final rule.

In parallel, we encourage hospitals to review and maintain their records in anticipation of the proposed documentation requirements. There are no proposed material changes to the underlying provider-based requirements. Consequently, hospitals should now be assessing their current inventory of off-campus PBDs to ensure that each PBD complies with Section 413.65 and that documentation supports that compliance – particularly in the seven areas of special interest to CMS noted above. This information should be readily available so that a hospital can submit requested documentation within the 60-day timeframe. In addition to obtaining a separate NPI for each applicable off-campus PBD, hospitals will also need to update PECOS accordingly. Finally, hospitals should anticipate potential extended review, including site visits and remote audits, if selected during the extended review stage.

Foley is here to help you address the short and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Foley relationship partner, or to our Health Care Practice Group and Health Care & Life Sciences Sector with any questions.

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.