New CMS Proposal Raises the Stakes for Off-Campus Provider-Based Status

Hospitals with off-campus outpatient departments should pay close attention to the CY 2027 OPPS/ASC Proposed Rule, which includes plans the Centers for Medicare & Medicaid Services (CMS) has developed to implement Section 6225 of the Consolidated Appropriations Act, 2026. These plans include new requirements that raise the compliance stakes for hospitals that operate off-campus outpatient departments. CMS will accept public comments until August 31.

Key Takeaways

The proposed rule would codify Section 6225's prohibition on Medicare paying for items and services furnished at off-campus outpatient departments unless (1) the hospital has obtained a unique National Provider Identifier (NPI) for the department that is separate from the hospital's main NPI, and (2) the hospital has submitted an attestation confirming that the department complies with the provider-based status regulations at 42 C.F.R. § 413.65. Our analysis of this legislation and its implications for hospitals can be found here.

CMS is now proposing to adopt policies that govern submission of the required attestations and CMS review of those attestations. If finalized, these proposals would create a new operational and compliance framework for off-campus outpatient departments by requiring hospitals to:

• Submit an initial provider-based attestation for each off-campus outpatient department using a CMS-issued standardized attestation form;
• Maintain documentation sufficient to support the department's compliance with the provider-based status regulations; and
• Prepare for CMS or contractor review, which could include documentation requests, site visits, audits, and potential payment consequences for noncompliance.

The proposed rule would also make a targeted change to CMS's treatment of provider-based facilities located off the main hospital's campus but within 250 yards of a remote hospital location by no longer requiring these departments to comply with the off-campus requirements at 42 C.F.R. § 413.65(e).

The proposal also leaves several important questions unanswered, including the specific documentation hospitals must maintain to demonstrate compliance and what criteria CMS and its contractors will use to evaluate the initial attestations. Those details matter because preparing the initial attestations will be time-consuming, and noncompliance with the provider-based status regulations can create significant legal exposure, including potential overpayment obligations and False Claims Act risk.

When Would the Proposed Rule Take Effect?

If finalized, the changes in the proposed rule would take effect starting on January 1, 2027. We encourage hospitals to review the proposals in their entirety and consider submitting comments. Davis Wright Tremaine has the resources to help you understand how the proposed rule will affect your hospital and to assist with your preparation and submission of comments. Please reach out to the authors of this client alert, or to any attorney in the Healthcare Law Practice Group.

Hospitals do not need to wait for CMS to finalize the proposed rule before getting ready. The core work required to comply with Section 6225 is already clear enough to support meaningful action now: hospitals can inventory their off-campus outpatient departments, assess provider-based compliance for each location, obtain separate NPIs where needed, confirm their Provider Enrollment, Chain, and Ownership System (PECOS) records are accurate, and begin planning the billing, EHR, and revenue cycle changes necessary to use those NPIs by 2028. Starting that work now will put hospitals in a stronger position to submit timely and accurate attestations, respond to CMS or contractor review, and reduce the risk of payment disruption once the new requirements take effect.

Which Provider-Based Facilities Would be Impacted?

The proposed rule would apply to each off-campus outpatient department of a provider, a new regulatory term that would be defined as "a department of a provider that is not located on the main hospital's campus…or within 250 yards of a remote location of a hospital…."

Indian Health Service and Tribal facilities, as well as certain Federally Qualified Health Centers (FQHCs) and "look-alikes" described in 42 C.F.R. § 413.65(n), would be excluded from the new attestation requirements because these facilities are not subject to CMS review of provider-based status.

The proposed rule would also impact all provider-based facilities (not just off-campus outpatient departments) located within 250 yards of a remote location of a hospital by reducing the number of provider-based requirements they must meet.

What New Requirements Would the Proposed Rule Impose?

Hospitals must obtain a unique NPI for each off-campus outpatient department prior to submitting their initial attestations.

• Hospitals would have to add these NPIs to their PECOS records and report them in their required initial attestations, but they would not have to begin using these NPIs for billing purposes until January 1, 2028.
• As a practical matter, incorporating the NPIs into billing may require coordination across compliance, revenue cycle, and IT.

Hospitals must submit an initial attestation for all off-campus outpatient departments before January 1, 2028.

• If the off-campus outpatient department provides services on or before January 1, 2028, the hospital must submit the initial attestation between January 1, 2026 and December 31, 2027.
• If the off-campus outpatient department begins providing services after January 1, 2028, the hospital must submit the initial attestation within the 2-year period prior to when the services are provided. Hospitals should pay particular attention to this proposal, as it would require future off-campus outpatient departments to comply with the provider-based status regulations before they open their doors.
• CMS is seeking public comment on a streamlined approach for off-campus outpatient departments that obtained a CMS approval prior to January 1, 2026. Under this approach, these departments would be permitted to attest by submitting a copy of the prior CMS approval and a letter affirming their continued compliance with the provider-based status regulations.

The initial attestation process would be standardized for all hospitals.

• CMS would establish a standardized attestation form for purposes of Section 6225, which would replace the current patchwork of templates used by the Medicare Administrative Contractors (MACs) and ensure nationwide consistency. The proposed form can be viewed here.
• Hospitals would submit the initial attestations through a centralized electronic system, which CMS believes will reduce the compliance burden and promote a more efficient review process.
• To complete the standardized attestation form, hospitals would provide identifying information, answer "Yes," "No," or "N/A" for each applicable requirement in 42 C.F.R. § 413.65, and have an authorized official certify the accuracy of the responses with an original ink signature.
• Hospitals would indicate that their submissions are complete when they have submitted attestations for all their off-campus outpatient departments.
• It appears that the proposed new attestation process would only be available for purposes of submitting Section 6225 initial attestations. Hospitals seeking a provider-based determination for other provider-based facilities would continue to use the current attestation process and MAC-specific templates.

Hospitals should not have to submit supporting documentation with the initial attestations, but they must maintain documentation demonstrating compliance with all applicable provider-based status requirements.

• The proposed rule appears to eliminate the requirement that hospitals submit supporting documentation with the initial attestation, although it is not entirely clear on this point. CMS and its contractors intend to use risk-based screening and targeted documentation review to identify attestations that warrant closer review.
• CMS suggests that a sample-based approach to document review may be sufficient because hospitals generally manage their provider-based departments consistently, allowing CMS to assess whether compliance standards are being maintained across the hospital's broader universe of off-campus outpatient departments while reducing provider burden.
• Hospitals would have up to 60 days to respond to a request for documentation. If the hospital does not respond timely, CMS could initiate an action to recoup payments made to the off-campus outpatient department.
• The proposed rule gives very little guidance on what documentation is necessary to show compliance, referencing only general ledgers, trial balances, and an organizational chart reflecting the reporting relationship between the hospital and the department.
• CMS "anticipates" that the electronic attestation system will be capable of measuring the distance between the hospital and the off-campus outpatient department. If the system cannot verify the distance or if the distance exceeds 35 miles, hospitals must submit documentation showing compliance with the location requirement at 42 C.F.R. § 413.65(e)(3).
• CMS is seeking comment on whether to adopt a streamlined documentation requirement for hospitals that submit initial attestations for more than one off-campus outpatient department.

Hospitals can submit attestations before CMS finalizes a standardized attestation form, and hospitals can bill for services provided by off-campus outpatient departments in 2028 even if they have not received CMS approval.

• CMS will deem attestations submitted between January 1, 2026 and the date CMS finalizes the standardized attestation form to satisfy the Section 6225 attestation requirement. Those attestations must comply with the current process, which requires hospitals to use their MAC-specific template and submit supporting documentation along with the attestation.
• However, we expect the proposed updated attestation process, if finalized, will be less burdensome to complete and recommend that hospitals carefully consider the value of submitting any attestations through the current MAC framework.

CMS and its contractors would review the initial attestations and conduct other verification and oversight activities.

• For purposes of the Section 6225 attestations, CMS would eliminate the MAC preliminary review and recommendation process. CMS or its contractors, including MACs, would instead conduct the full review and issue approvals or denials.
• There would be two stages of review. Initial review would consist of automated screening and validation to verify completeness, consistency with PECOS records, and required attestation elements. Attestations that pass would be processed for initial determination, and those that fail would be flagged for targeted document review.
• Attestations selected for extended review would be looked at more closely and could prompt CMS or its contractors to conduct remote audits, site visits, or other investigations.
• CMS plans to issue operational guidance describing the specific review criteria, validation protocols, and documentation standards that would be used.

Hospitals would have to submit at least one subsequent attestation at an interval no later than five years after the initial attestation.

• CMS anticipates addressing this requirement in more detail in the CY 2028 OPPS/ASC proposed rule but is seeking comment on this issue now.

Implications and Next Steps

Taken as a whole, the proposed rule would significantly raise the stakes for provider-based compliance. A missed NPI, late attestation submission, inaccurate PECOS record, or unsupported provider-based status requirement could jeopardize Medicare reimbursement for an entire off-campus outpatient department beginning in 2028.

We expect that CMS will issue the CY 2027 OPPS/ASC final rule around November 1, and it will be important for hospitals to review the policies CMS finalizes in that rule. Hospitals should also be on the lookout for additional proposals in 2028.

+++

Marci Love is counsel in DWT's Washington, D.C. office, Darby Allen is a partner in the firm's Seattle office and chair of the healthcare law practice, and Christine Parkins Johnson is counsel in our Los Angeles office. For any questions you might have about the proposed rule or for assistance with preparing comments before the August 31 deadline, please contact one of the authors or another member of our healthcare team. To stay informed, sign up for our alerts.