Updates

Final Provider-Based Attestation Rule: Hospitals Have Until Dec. 31, 2027, to Prepare and File

Key Updates

  • CMS finalized new provider-based attestation requirements for off-campus hospital outpatient departments, requiring hospitals to obtain a unique NPI for each physical location, update their 855A enrollment records and submit attestations by Dec. 31, 2027.
  • Hospitals must complete new attestations even for previously approved provider-based departments. Although supporting documentation is not required with the initial submission, CMS may request it during extended reviews, audits or other compliance activities.

Why It Matters

  • Hospitals must prepare now to meet the Dec. 31, 2027, attestation deadline while CMS continues to develop the filing process and related guidance.

Next Steps

  • Hospitals should begin identifying all affected off-campus locations, assessing existing NPIs and Medicare enrollment records, gathering documentation supporting provider-based status and developing a coordinated work plan to complete the required enrollment updates and attestations by Dec. 31, 2027.

On Nov. 4, 2026, CMS published the final Outpatient Prospective Payment Rule, containing the provider-based attestation provisions (Final Rule) that are required under Section 6225 of the Consolidated Appropriations Act, 2026 (the Law), passed on Feb. 3, 2026. The Final Rule largely implements the proposed rule while offering a few additional insights. CMS frequently states that many aspects of implementation guidance will be provided through subsequent rulemaking and/or subregulatory guidance — particularly as CMS gains experience with the new attestation process.

Key Points

  • Timing. For all existing off-campus hospital outpatient departments (and any new departments planned to furnish services before Jan. 1, 2028), a hospital must (a) obtain a separate NPI, (b) update its 855A enrollment records to include the NPI and then (c) submit an attestation by Dec. 31, 2027.
    • Off-campus means everything that is not “on-campus.” “On-campus” means locations that are within 250 yards of the main hospital’s buildings or its remote locations.
    • All new hospital outpatient departments furnishing services beginning after Jan. 1, 2028, must submit an attestation within the two-year period before the first service date. This may predate 855A submissions, and hospitals should plan for these incongruent submissions.
  • Documentation. No documentation to support the attestation is required for the initial attestation submission, but hospitals must make supporting documentation available to CMS upon request and within the timeframe requested — generally not more than 60 days.
  • NPI Requirement. CMS implemented a per-location NPI requirement that applies to each physical location and address, not service lines. Every location in Section 4 of Form CMS-855A must have a street address and a suite/floor/room number (if applicable) and each of those must have a unique NPI. If one location furnishes multiple services (e.g., infusion, physical therapy and radiology), that location only requires one NPI and one attestation.
  • Extended Attestation Review. A random selection of hospitals will be identified for extended review, requiring those hospitals to submit documentation to support the attestation within the required timeframe.
  • Final Rule Application/Exemptions. CAHs are exempt from the attestation process as they are not paid under the OPPS, but, for the moment, other service lines identified under 42 C.F.R. 413.65(a)(1)(ii) (such as laboratories, ambulance suppliers, physical therapy suppliers) that do not otherwise require compliance with the provider-based rules are still subject to the attestation requirements. CMS continues to evaluate this thorny issue, so additional guidance may be forthcoming.
  • Provider-Based Determinations. CMS will acknowledge attestation compliance and make a determination of provider-based status in writing. It expects that minor attestation completion errors will not be deemed noncompliant and hospitals will have a specified timeframe to correct the attestation form.

Other Interesting Points

  • CMS will develop an electronic portal to file all standard form attestations and that should allow multiple submissions for a single hospital/health system. The standard form and the electronic portal are not yet available, and no timeframe was offered for their completion.
  • CMS stated it would continue its current methods of measuring the distance from the hospital’s main clinical buildings to the outpatient department but reiterated that measuring 250 yards from the hospital’s main buildings cannot include “non-structural” parts of buildings such as overhangs and awnings.
  • The new attestation requirements only apply to off-campus outpatient provider-based departments, not provider-based entities, such as IHS and Tribal facilities, FQHCs, RHCs or remote locations.
  • CMS intends to address the Law’s requirement for subsequent attestations (no more than 5 years following the previous attestation) in its FY 2028 rulemaking.
  • In response to comments raising concerns that separate department-level NPIs will trigger claim filing issues and potentially trigger additional pre-authorization requirements from MA plans, CMS stated that it is taking measures to allow for the entry of multiple NPIs within a claim — the claim-level NPI of the hospital plus the service line NPIs for the various services provided during a given day. Other concerns may be addressed in later rulemaking or other subregulatory guidance.
  • There will be no grandfathering for provider-based departments that submitted attestations in the years prior to the Law. A new attestation form will be required by Dec. 31, 2027, though it is unclear if CMS may afford these previously approved provider-based departments with other flexibilities through subregulatory guidance.
  • CMS intends to use a variety of program integrity tools to ensure compliance with the provider-based rules, aside from attestations, including site visits, remote audits, investigations or required submission of additional documentation as may be necessary to make a determination of compliance with the provider-based requirements, as well as the use of current or future Medicare program integrity contractors.

For questions about the final provider-based attestation rule, its requirements for off-campus hospital outpatient departments or preparing for the Dec. 31, 2027, filing deadline, please contact Colleen Faddick, Sarah Kocher, Ross Sallade, Kyle Vasquez, Mary Canavan or your regular Polsinelli attorney.