Updates

2027 OPPS Proposed Rule: Mandatory Provider-Based Attestations Signal a New Compliance Era

Download Publication as a PDF

Last week, the Centers for Medicare & Medicaid Services (CMS) published proposed rules mandating the submission of provider-based attestations for off-campus hospital outpatient departments as part of the 2027 Outpatient Prospective Payment System (OPPS) Proposed Rule (Proposed Rule). These proposed rules implement the mandatory attestation requirement stated within Section 6225 of the Consolidated Appropriations Act, 2026 (the Act). Read our prior article summarizing the requirements in the Act here.

Key Takeaways

  • Hospitals should begin their provider-based attestation readiness efforts immediately. Hospitals that have not yet gathered a comprehensive inventory of all off-campus outpatient departments, initiated an analysis of compliance of those departments with the provider-based regulations and started gathering supporting documents evidencing compliance will face significant operational challenges meeting the Jan. 1, 2028, statutory deadline.
  • The Proposed Rule offers an initial regulatory framework and updated attestation form that conceptually outline what the provider-based attestation process could look like in the future but lacks detail, so CMS needs input from providers. Comments are due by Aug. 31, 2026.
  • The documents required for submission and the attestation form itself are still in flux, but CMS’s new proposed form discussed below should not be viewed as reducing provider compliance obligations. Compliance with all core provider-based elements has not changed and is still required. Hospitals should treat CMS’s proposed regulations and framework as an enterprise readiness project, not a form-filing exercise.

Under the Act, as of Jan. 1, 2028, the main provider (i.e., hospital) that bills for services provided at off-campus hospital outpatient departments (HOPD) must have submitted an initial provider-based attestation for each off-campus HOPD within the two-year period before furnishing services to continue receiving payment. For existing off-campus HOPDs, this means hospitals must submit their attestations by no later than Dec. 31, 2027, in order to continue receiving payment for services furnished in those HOPDs. After the initial submission, CMS proposes to require a subsequent attestation every five years.

The mandatory attestations only apply to the extent CMS will issue a determination. CMS does not render provider-based determinations for a narrow list of sites, such as PT/OT/SLP facilities, ASCs, ESRD facilities, hospices and home health agencies. See 42 C.F.R. § 413.65(a)(1)(ii) for the full list.

While CMS does suggest easing the filing burden on providers in a few areas, the Proposed Rule as written should not be read as a reduction in provider-based compliance obligations. The Proposed Rule proposes many processes that may not be practical for hospitals or that may cause more harm than good. It is likely that the action items identified below will remain relevant once CMS issues its final rule, so providers should invest the time and effort now to prepare for the inevitable statutorily-mandated provider-based attestations and billing changes needed to adapt to the new proposals, including the separate NPI requirement.

Summary of CMS’ Key Proposals

  1. Hospitals are Required to Obtain Unique NPIs for Off-Campus Locations.  The Act explicitly requires unique NPIs for payment. The Proposed Rule reiterates this requirement and moreover, CMS proposes requiring the NPI be updated in PECOS prior to submission of the attestation to continue billing. As proposed, hospitals will need to obtain unique NPI for every off-campus HOPD, update their current Medicare enrollment in PECOS to include that NPI and bill Medicare fee-for-service using that unique NPI for every off-campus HOPD. While new NPIs can be acquired quickly, it will take significant time and resources to develop system processes and edits to ensure that the NPI is applied to bills correctly and that bills precisely match each HOPD location and its specified NPI as reported in PECOS. This also may raise concerns regarding application beyond traditional Medicare, including, for example, whether commercial plans and Medicaid will follow suit and weighing impacts to 340B compliance programs (e.g., 340B duplicate discount risks increase and satisfaction of corresponding 340B deadlines). Further, hospitals will need to address other non-Medicare payor policies and existing contracts to determine whether additional credentialing actions are needed relative to the new NPIs. We recommend engaging billing and payor contracting teams early on.
  2. CMS Proposed a Standardized Form to Certify Compliance with the Provider-Based Regulation to Replace the MAC-specific Forms.
    • CMS proposes that hospitals and MACs use this form for attestations moving forward. The form requires hospitals to certify compliance with all key elements of the existing provider-based regulation, including § 413.65(d), (e), (g) and (h). Until the form is finalized (likely with the OPPS final rule expected in November), hospitals may continue using the current § 413.65(b)(3)(ii) process through their MAC. This current process involves submitting voluminous documentation with the attestation.
    • Certifying compliance using the proposed form does not currently include any requirements to attach documents that support each compliance statement. It is clear that CMS reserves the right to request any documentation it deems necessary to demonstrate compliance, but it is not clear whether CMS will require the submission of those documents with the initial attestation as is currently required.
    • The new form is required to be signed by an Authorized Official of the main provider and collects site-specific information, including when the site became a provider-based location. The certification statement can lead to heightened overpayment and False Claims Act risk if sites are not reviewed for compliance prior to submitting the certification statement.
  3. CMS proposes giving MACs the authority to review and approve attestations instead of making recommendations for CMS to finalize. This is intended to ensure that all attestations are reviewed in an efficient manner. As proposed, hospitals will use the standardized form and submit that along with any other required documentation to the MAC and continue working with the MAC when additional information is requested. The concept suggests that provider-based approvals may happen more quickly than they do today due to elimination of a second level review by CMS. However, hospitals should be aware that MACs have inconsistently applied the provider-based regulations across the various jurisdictions. Ultimately, providers may appeal a MAC’s provider-based denial to an administrative law judge pursuant to 42 C.F.R. § 498.3(b)(2).
  4. CMS proposes to implement a risk-based and targeted two-stage review process (initial and extended) for attestations.
    • For the initial review stage, MACS will be using “automated validation” processes that will cross-reference other data sources such as PECOS enrollment records for initial review of the attestation. If the attestation is deemed to be incomplete or have any inconsistencies, or is deemed as “elevated compliance risk,” then it will be flagged for the second stage (the extended review stage) for further review. CMS does not provide many details, and it is unclear what “automated validation” will be used or what may trigger an attestation to be deemed incomplete, inconsistent or as “elevated compliance risk.”
    • For the extended review stage, CMS proposes that a sample of attestations will be selected based on “operational guidance” and intended to target hospitals and off-campus HOPDs that present the highest risk of noncompliance. These attestations would be subject to a more thorough compliance review. CMS proposes utilizing additional oversight methods such as site visits, audits or investigations. Additionally, CMS proposes being able to deem providers as noncompliant with the provider-based regulation if information requested is not produced to the requesting party within 30 days.

What Hospitals with Existing Off-Campus HOPDs Should be Doing Now

Providers that render services at an off-campus HOPD prior to Jan. 1, 2028, are required to submit an attestation no later than Dec. 31, 2027, and they should start assessing compliance and preparing supporting documentation immediately. This is particularly important given heightened visibility into provider-based operations resulting from the mandatory attestations and inevitable enforcement activity. Here are a few things that hospitals should be doing now to avoid last-minute attempts to document compliance.

  • Identify an operational and compliance team working under direction of counsel to gather data to inventory all off-campus HOPDs, confirm each location’s compliance with the provider-based regulations and implement any necessary corrective action. We recommend creating a data room/binder to archive all documentation that confirms compliance with all provider-based standards. Checklists, form policies and procedures and other tools will be useful, particularly for health systems with many off-campus HOPDs. This is a time-critical matter that needs attention now.
  • Ensure current Medicare enrollment records in PECOS accurately reflect all provider-based HOPDs operated by the hospital, whether on- or off-campus, and the current list of authorized officials who will sign any new attestations.
  • Obtain a unique NPI for each off-campus provider-based HOPD.
  • Once the Proposed Rule is finalized, begin to update Medicare enrollment records in PECOS to add newly obtained unique NPIs for each off-campus HOPD. This is a good time to validate that other components of the CMS-855A are up to date.

Comment Opportunities for Hospitals (Due by Aug. 31, 2026)

  • Documentation Requirements: As proposed, it is not clear what supporting documentation, if any, will be required with the initial submission. CMS indicated that it does not anticipate that all documentation that a hospital would historically submit in support of an attestation will be required under its new process, but CMS expects providers to have that support on hand. Clarity on specific documents that CMS may request would be helpful. Hospitals should advocate that the burden of obtaining all documentation and submitting for initial review is not reasonable given Congress’s Jan. 1, 2028, deadline.
  • Timing of Initial and Subsequent Submissions: The Act requires an attestation be submitted by Jan. 1, 2028, for all existing off-campus provider-based departments and requires that new provider-based departments submit an initial attestation but leaves timing for subsequent attestation filing requirements for CMS to decide. CMS proposes requiring an attestation be submitted no later than every five years and is asking for comments on the timing. Providers need to consider the resources it takes to complete the attestations and comment on whether that is reasonable. Providers should consider providing feedback to CMS on what subsequent attestations would entail as well.
    • Provider-based departments furnishing services prior to Jan. 1, 2028: Jan. 1, 2026 – Dec. 31, 2027, and then every five years after.
    • Provider-based departments furnishing services after Jan. 1, 2028: two years prior to when the billed services are delivered.
    • Ongoing regular submissions: every five years.
  • CMS Criteria for Evaluating Attestations
    • CMS uses several terms throughout the provider-based attestation discussion that are vague, so hospitals should consider submitting comments requesting clarification from CMS on when an attestation will be considered “inconsistent” or “elevated high risk.”
    • CMS also suggested that it expects hospitals to operate provider-based HOPDs consistently across the sites. The language CMS used suggests that it could apply certain documentation obtained in support of one attestation to other attestations by the same provider. This could result in efficiencies but could jeopardize provider-based status for several sites if CMS or the MAC determines that a particular document is inconsistent with the provider-based regulations. Providers should consider submitting comments clarifying that operations may vary to some extent from site-to-site, so there needs to be a mechanism by which MACs/CMS confirm whether particular support can be universally applied.
  • Hospitals Who Already Have Approved Provider-Based Determinations Should Have a More Streamlined Path: CMS acknowledges in the Proposed Rule that there are many providers who already submitted attestations previously and were approved. CMS is requesting comments on how it should handle these previously approved attestations.
  • Hospitals Should Seek Clarity on Scope: The Act and the Proposed Rule generically reference the definition of “department of provider” at 42 C.F.R. § 413.65(a)(2) to suggest that all off-campus departments of a provider must comply with the mandatory attestation requirements. However, CMS historically has not accepted or made determinations on attestations related to facilities listed at 42 C.F.R. § 413.65(a)(1)(ii). We recommend that hospitals comment to confirm attestations are not required for those sites. Further, we recommend a comment advocating that hospitals don’t need to attest for remote inpatient campuses. Workloads will be significantly impacted if the process now includes sites at 42 C.F.R. § 413.65(a)(1)(ii) and remote campuses due to definition discrepancies.

Key Dates

Polsinelli’s Reimbursement Team regularly conducts system-wide provider-based compliance reviews, assessments of payment impacts, analyses of eligibility for other programs such as 340B and determinations of alternative enrollment options. We assist hospitals through the entire provider-based process, including feasibility review, preparation of materials to achieve compliance with the provider-based regulations, supporting the entire attestation process (submission through approval) and, where necessary, appeals of provider-based attestation denials. We also defend providers during government investigations that pertain to provider-based and related payment matters. We are pleased to assist hospitals with this new requirement and all related analyses of legal and compliance considerations. For more information, contact the alert author or your preferred Polsinelli attorney.