Buried in a piece of federal legislation signed into law at the beginning of February is a provision that many hospitals have long dreaded: the requirement to attest to compliance with Medicare’s provider-based regulation. The law at issue, the Consolidated Appropriations Act, 2026 (CAA), will require hospitals to submit attestations of compliance on behalf of their off-campus, provider-based departments.
These departments will also be required to obtain their own National Provider Identifier (NPI), and to bill for services they provide under that NPI (which is separate from the hospital’s NPI). These requirements will become effective as of January 1, 2028. However, because of the way the CAA is written, hospitals will need to submit their initial attestations of compliance with the provider-based regulation during 2026 or 2027. Failure to comply will pose significant reimbursement implications.
Why Do This Now?
The provider-based regulation is a series of operational requirements intended to establish a particular degree of integration between the hospital (the “provider” in Medicare’s parlance) and certain categories of facilities, including hospital departments, that purport to be part of the hospital. The classic example is a hospital located in a busy city with outpatient facilities located in a separate building a few blocks away. Structured appropriately, the outpatient facilities have traditionally been able to be treated, for reimbursement purposes, as part of the hospital itself. This is important for a variety of reasons, including the historic payment differential between services rendered in hospital-based, as compared to freestanding, settings.
The Centers for Medicare & Medicaid Services (CMS) has strived to ensure that if Medicare is paying for a service at higher hospital reimbursement rates, the facility where the service is provided needs to truly be a component of the hospital. Meanwhile, CMS has also taken a number of steps in recent years to impose payment neutrality so that reimbursement for outpatient services is aligned across sites of service. The CAA change is a logical extension of these efforts.
What Is an Attestation and Why Would Someone Submit One?
The concept of “attestation” refers to a written document and accompanying materials, submitted by the hospital, that provide evidence to CMS and its Medicare Administrative Contractors (MACs) that the hospital has met the requirements of the provider-based regulation. Attestation had been mandatory in the past, but that changed when the process became voluntary on October 1, 2002. After that date, facilities that wanted to be treated as provider-based needed to meet applicable regulatory requirements, but they were not required to affirmatively seek approval as a condition of receiving that status.
In some circumstances, however, submitting an attestation remained a smart strategy. A central advantage is that hospitals that attested to compliance would essentially be subject to reduced financial exposure (through limitations on potential overpayment recoveries) if they failed to meet the requirements of the provider-based regulation. If an attestation was not provided (and the hospital failed to comply with the regulation), CMS would have a larger period of time for which it could seek to recover an overpayment, which effectively increased the hospital’s financial exposure.
Many facilities elected not to file attestations, however. Reasons varied, but one common line of thinking is that because the hospital needed to meet the underlying compliance requirements anyway, there was really no reason to draw the regulators’ attention. In addition, submitting an attestation can be very burdensome and time-consuming because the hospital needs to demonstrate compliance with an expansive array of regulatory requirements.
New Requirements Under the CAA
There are three significant developments in the new legislation of which hospitals with “off-campus” departments need to be aware:
- Each off-campus, provider-based hospital department will need to have its own NPI and be prepared to bill for services under that NPI after January 1, 2028.
- Hospitals are required to submit attestations within the two-year period ending on January 1, 2028. That means they have the rest of 2026 and 2027 to take this step. The CAA further provides that follow-up attestations will also be required, though the specifics of that process are not yet known. Note that an attestation will be required for each off-campus, provider-based location.
- The exact process by which attestations will be submitted and evaluated is presently unclear. However, the CAA directs the U.S. Department of Health and Human Services to engage in notice and comment rulemaking to develop the process. In addition, Congress appropriated $20 million to CMS for purposes of carrying out its responsibilities under this part of the CAA. There is currently a process for submitting and evaluating voluntary attestations, and the CAA provides that this process can be used until such time as a new method is adopted. Paying attention to what CMS and the MACs have to say on this subject in the coming months will be important.
The meaning of “off campus” is critical. The term generally means a location that is not “on campus.” To be “on campus”, a facility needs to be located within 250 yards of the hospital’s main buildings (though CMS’ regional offices have discretion to grant exceptions to this distance requirement). Consequences of noncompliance are significant. A hospital’s failure to submit the required attestation would mean the loss of reimbursement under the Outpatient Prospective Payment System.
What Am I Attesting To … Exactly?
Hospitals have been required to comply with the provider-based rule for decades, so the substance of the underlying requirements should not be new. Nevertheless, the regulation itself is complex and is layered with a variety of detailed and highly technical requirements. Meeting those requirements is not always straightforward. Issues that have vexed many facilities include the following:
- Whether it is possible to operate “part time” provider-based facilities and, even if the answer is no, understanding available options for sharing space or co-locating freestanding offices within hospital space without jeopardizing compliance.
- Hospitals and off-campus facilities are held to specific standards of alignment on how they obtain the services of certain categories of administrative personnel involved in activities like billing, records, employee benefits, salary structure, purchasing and human resources. Using multiple organizations to structure staffing in these and certain other areas can prove challenging.
- Additional restrictions on employment of clinical personnel involved in the direct delivery of patient care apply to off-campus facilities that are operated under management agreements.
- Ensuring direct supervision is in place between the hospital and the off-campus department.
- Demonstrating financial integration between the hospital and provider-based location.
- Providing appropriate notices of beneficiary co-insurance at off-campus locations so that patients are aware they are receiving services from a hospital location.
- The provider-based regulation permits the off-campus site to obtain some, but not all, patient care services under arrangement. However, drawing the line at the appropriate level of services without violating this aspect of the regulation can be complex.
The CAA will impose compliance obligations for all hospitals with off-campus, provider-based departments. Hospitals that have attested to compliance in the past may face less difficulty meeting the CAA’s expectations because they are familiar with the attestation process in principle. However, they will still need to update existing information and re-attest by the statutory deadline. Hospitals that have not gone through the attestation process will face more of a burden, simply due to the organizational and document management efforts associated with the process. For example, attestations will require compiling and submitting company documents, policies, procedures and other materials. Assembling all of this can take a long time and be labor-intensive, especially for hospitals that operate numerous off-campus locations. In addition, the most critical part of all of this – ensuring compliance with the underlying regulatory requirements – will of course need to be addressed. Facilities that have not focused as heavily on the nuances of the provider-based regulation in recent years may want to refresh their analysis as soon as they can. There will likely be cascading requirements too, including updates that hospitals will need to make to their Medicare enrollment records.
If you have questions about the CAA’s requirements or the provider-based regulation, please contact Jesse Berg or your regular Lathrop GPM attorney.