Time for Hospitals to Get Their Provider-Based Compliance in Order

Medicare reimbursement for off-campus hospital outpatient departments is once again under attack.

Effective January 1, 2028, Section 6225 of the Consolidated Appropriations Act, 2026 ("CAA") will prohibit Medicare payment for items and services furnished at off-campus hospital outpatient departments unless:

1. The hospital has submitted a provider-based status attestation; and
2. The department has been assigned a National Provider Identifier ("NPI") that is separate from the hospital's main NPI.

Section 6225 amends Section 1833(t) of the Social Security Act to impose the new attestation requirements as conditions of Medicare payment.

Section 6225 Requirements in Depth

• Hospitals must obtain NPIs for each hospital off-campus outpatient department. As part of this undertaking, hospitals must also submit the filings necessary to Medicare, Medicaid, and other payers to use the NPIs for billing.
• Hospitals must submit an initial provider-based attestation between January 1, 2026, and December 31, 2027, for each off-campus outpatient department that is held out and billed as a provider-based department of the hospital. If a hospital fails to submit an attestation for any such department by January 1, 2028, Medicare payments for hospital services furnished by the off-campus department may cease.
• Hospitals must submit subsequent provider-based attestations for each off-campus outpatient department on a periodic basis (possibly every two years), meaning that the attestation is no longer voluntary nor a one-time endeavor.

Section 6225 also requires CMS to develop new regulations to establish:

• A process for submission and review of provider-based attestations;
• A schedule for hospitals to submit subsequent periodic attestations; and
• Mechanisms for CMS to conduct compliance reviews, which may include site visits, audits, denials, recoupment of overpayments, etc.

How Did We Get Here?

An attestation of provider-based compliance is a formal certification that a hospital submits to CMS (usually through its Medicare Administrative Contractor, or MAC) stating that a particular off-campus or on-campus department meets all the requirements to be treated as a "provider-based department" under 42 CFR § 413.65. In practical terms, it is how a hospital attests to CMS that a department is not an independent facility but is part of the hospital, allowing the hospital to bill for services provided at the location as hospital services.

Historically, "provider-based" status garnered higher Medicare reimbursement for hospitals. Recently, however, this payment differential has been diminished due to changes in the Medicare statute and guidance.

Until now, submitting attestations of provider-based compliance has been voluntary for most hospitals. However, Section 6225 of the CAA will require attestations for off-campus hospital outpatient departments to continue to receive Medicare payment for their facility claims. Because submission of a provider-based attestation is labor intensive and invites CMS to scrutinize hospital operations, many hospitals have historically chosen not to submit a voluntary attestation unless confronted with provider-based reimbursement issues. Similarly, hospitals can currently choose whether or not to obtain separate NPIs for off-campus outpatient departments.

Provider-Based Arrangements—Requirements and Challenges

Now is the time for hospitals to conduct internal audits and reviews to ensure that all their off-campus departments are compliant with provider-based requirements. These requirements are listed in their entirety at 42 CFR § 413.65.

Ongoing compliance with the provider-based rule is challenging. Some of the compliance problems we commonly see include:

• Improper naming conventions and signage. The rule requires that the provider-based location be held out to the public as part of the hospital, and use of acronyms or system names can be a problem.
• Governance and control issues. Failure to demonstrate that the provider-based location and the hospital have the same governing body and that the provider-based location is under the control of the hospital. Nurses, for instance, must have the same reporting structure as on-campus departments.
• Lack of financial integration. Inadequate documentation demonstrating financial integration between the provider-based location and the hospital.
• Improper modifier usage. In identifying the status of the off-campus department (i.e., PO versus PN).
• Inconsistencies with Licensure. When required by state law, inclusion of the provider-based location on the hospital's license.
• Beneficiary Disclosures. Improper language in the notice provided to Medicare beneficiaries that they are receiving services at a hospital location.

Submission of a provider-based attestation is only the first step, and final approval can be protracted. CMS and the MACs can request additional information, which can result in multiple rounds of review. In some instances, regulators request substantive changes to the attestation and to the operations of the location.

340B Program Implications

This new statutory provider-based attestation requirement also has potential implications for hospital departments registered as 340B program child sites. If a hospital does not comply with the new attestation requirements, the child site could also be removed for 340B purposes, even if it has historically been registered and treated as eligible. The new law does not directly speak to 340B implications, but it stands to reason that HRSA will consider compliance with attestation requirements when determining whether a hospital department should remain an eligible 340B child site.

Practical Takeaways

1. Keep an eye on notice and comment rulemaking which will establish the rules of the road for provider-based attestations and attestation lookback periods.
2. Review compliance with provider-based rules and addresses issues now. Promptly address corrective action when opportunities for improvement are identified.
3. Prepare a checklist and playbook for drafting provider-based attestations.
4. Apply for NPIs for each off-campus outpatient location and submit the associated federal and state filings and internal updates to use the NPIs for billing.
5. Create systems for tracking submissions of provider-based attestations (similar to tracking Medicare enrollment revalidations).
6. Documentation will matter. CMS is expressly authorized and funded to conduct active enforcement, including audits and site visits.

DWT regularly advises hospitals and health systems about provider-based compliance, provider-based audits, and CMS enrollment and reimbursement issues. We routinely support clients with submitting attestations, in particular cancer centers who have had to submit attestations for new provider-based departments since 2017. We have represented clients in appealing provider-based denials after submission of attestations and have disclosed noncompliance with provider-based requirements to address overpayment risks. Please contact us with questions or for help with your provider-based compliance attestation efforts.