Protecting Medicare Payment in 2028

In the CY 2027 OPPS/ASC Final Rule, the Centers for Medicare & Medicaid Services (CMS) finalized new requirements for hospitals with off-campus outpatient departments, largely adopting its proposed approach to implementing Section 6225 of the Consolidated Appropriations Act, 2026.

CMS deferred many details to future rulemaking or subregulatory guidance, but the deadline is firm. Before January 1, 2028, hospitals must obtain a location-specific National Provider Identifier (NPI) for each off-campus outpatient department and, through a new centralized electronic attestation system, confirm that each department meets the provider-based requirements.

Key Takeaways

• Beginning January 1, 2028, Section 6225 bars Medicare payment for items and services furnished at an off-campus outpatient department unless the hospital has (1) obtained a unique NPI for the department, separate from the hospital's main NPI, and (2) attested that the department complies with the provider-based status rules at 42 C.F.R. § 413.65. Read our analysis of the legislation and its implications for hospitals.
• Using a standardized CMS form, hospitals must submit an initial attestation for each off-campus outpatient department through a centralized electronic system. Although supporting documentation is not required at the time of submission, hospitals must be prepared to provide it if requested.
• Before attesting, hospitals must obtain an NPI for each off-campus outpatient department and update their enrollment records in the Provider Enrollment, Chain, and Ownership System (PECOS). CMS identifies departments by their PECOS address, including suite or floor.
• Attestations will be subject to CMS or contractor review, which may include documentation requests, site visits, or audits. Noncompliance could lead to payment adjustments or recoupment, and unsupported attestations may carry overpayment and potential False Claims Act exposure.
• Significant questions remain, including how hospitals should integrate new NPIs into billing systems, what documentation will establish compliance, and what criteria CMS will use to verify initial attestations.

The Final Rule in Detail

Timing Considerations

Many commenters objected to the NPI and attestation requirements, citing administrative burden and potential payment disruption, and asked CMS to extend the timeline beyond what Section 6225 requires. CMS declined, explaining that the statute sets the timeline and that it has tried to minimize the compliance burden. Hospitals must meet the following deadlines for initial and subsequent attestations:

• Departments furnishing billed services on or before January 1, 2028, must attest between January 1, 2026, and December 31, 2027. This timeframe also applies to departments that received an affirmative provider-based determination before January 1, 2026. CMS signaled that it may address a streamlined process for those departments in future rulemaking or subregulatory guidance.
• Departments that begin furnishing billed services after January 1, 2028 must attest within the two-year period before they furnish those services.
• Subsequent attestations will be due at least every five years. CMS stated that the clock runs from the date the attestation is submitted, not from the date CMS determines whether the attestation is compliant. CMS deferred other details on subsequent attestations to the 2028 rulemaking cycle.

Meeting these deadlines will take planning. Hospitals must inventory their off-campus outpatient departments, assess whether each location complies with the provider-based status rules, obtain a unique NPI for each location where needed, update their PECOS enrollment records, and make any necessary changes to their billing, electronic health record (EHR), and revenue cycle systems.

Hospitals opening new departments should build enrollment and attestation into the opening schedule. The deadline runs from the first date services billed to Medicare are furnished, not from enrollment activation, so hospitals should allow time to obtain the NPI, complete enrollment updates, and submit the attestation before furnishing services. CMS acknowledged comments that requiring an attestation before the effective date of Medicare enrollment is impractical but offered no solution in the final rule.

Hospitals considering an early submission through the existing Medicare Administrative Contractor (MAC) process should weigh the benefit of meeting the deadline sooner against that process's documentation burden and the efficiency of the standardized system CMS expects to launch in 2027.

Scope of the New Requirements

The final rule defines an "off-campus outpatient department of a provider" as a department of a provider that is neither on the main provider's campus nor within 250 yards of a remote location of a hospital. Consistent with its current approach to on-campus determinations, CMS will generally measure the straight line distance between any point of the remote location that provides patient care and the nearest point of the department, informed by satellite mapping or other survey information if necessary.

The final rule also confirms that several categories of facilities fall outside the new requirements: Indian Health Service and Tribal facilities described in 42 C.F.R. § 413.65(m); certain federally qualified health centers (FQHCs) and FQHC look-alikes described in 42 C.F.R. § 413.65(n); departments of critical access hospitals (CAHs); provider-based rural health clinics (RHCs); and AHEAD Model hospitals.

CMS also concluded that facilities described in 42 C.F.R. § 413.65(a)(1)(ii) that meet the definition of "off-campus outpatient department of a provider" are subject to the new requirements. That subsection has been in place for decades and describes facilities that do not receive a different payment amount from Medicare depending on whether they are provider-based or freestanding. Most of these facilities, such as a separately certified ambulatory surgery center, would not meet the definition of off-campus outpatient department of a provider. In a single sentence, however, CMS implied that facilities furnishing only therapy services would not meet the exclusion criteria, even though Medicare pays the same amount for a provider-based therapy location and a freestanding one. If a hospital operates off-campus locations dedicated to therapy services, the NPI and attestation requirements may therefore apply. CMS indicated that it will consider ways to reduce the burden on facilities for which it does not make provider-based determinations in subregulatory guidance.

Because the definition of off-campus outpatient department of a provider excludes departments within 250 yards of a remote location, the final rule also relieves those departments from the provider-based requirements for off-campus facilities in 42 C.F.R. § 413.65, which reduces their compliance burden. The remote location itself is not an off-campus outpatient department and is not subject to the separate NPI and attestation requirements. Hospitals should still assess departments near remote locations to confirm whether they are on-campus or off-campus and document the measurement.

Each Department's NPI Must Be Linked to Its PECOS Address

The final rule clarifies that, for purposes of Section 6225, an off-campus outpatient department is identified by the physical address listed in PECOS, including the street address and any suite or floor. Accordingly, a single address needs only one NPI regardless of how many types of services are furnished within the hospital department at the location. For example, CMS explained that a single street address at which a hospital furnishes both laboratory and radiology services needs only one NPI, not a separate NPI for each service line.

Commenters also raised concerns that separate department NPIs could conflict with CMS requirements to bill same-day outpatient services on a single claim, trigger new prior authorization requirements for Medicare Advantage patients, disrupt coordination of benefits, and cause supplemental insurance claim denials due to NPI mismatches. CMS responded that it is taking steps to allow multiple NPIs on a single claim for same-day services furnished at multiple locations and expects to address other operational challenges in future subregulatory guidance.

Because enrollment accuracy is central to implementation, hospitals should review how their off-campus outpatient departments are listed in PECOS, including street addresses, suites, and floors, before obtaining NPIs or preparing attestations. If a hospital finds address problems, such as an incorrect suite designation or a change to any element of the address after November 2, 2015, it should address them carefully. A department's address also bears on whether it qualifies as an "excepted" outpatient department paid in full under the OPPS.

Streamlined Attestations Do Not Reduce Compliance Burdens

Under the final rule, hospitals must use a standardized attestation form to identify each off-campus outpatient department and certify its compliance with each applicable provider-based requirement. CMS released a draft of the form with the proposed rule but did not finalize it in the final rule. In response to public comments, CMS plans to revise the form, including to let hospitals designate a contact and delegate submission authority.

Hospitals will initially submit attestations through a centralized electronic system without supporting documentation. If supporting documentation is requested, CMS intends to allow hospitals to submit that documentation using the same system to minimize duplicative submissions. CMS anticipates generally giving hospitals up to 60 days to respond to documentation requests.

The streamlined attestation is an improvement over the current MAC process, but hospitals must still meet every applicable requirement in the provider-based rule. Before the attestation is signed, hospitals should compare how each off-campus outpatient department actually operates against each requirement. They should also put systems in place to maintain supporting documentation for each department in case it is selected for targeted review. An inaccurate attestation may create overpayment exposure and, depending on the facts, potential False Claims Act exposure.

Hospitals will need to coordinate among compliance, revenue cycle, IT, and operational stakeholders to complete the work required under Section 6225. Hospitals should identify affected Medicare revenue by department, assess necessary system changes, and leave time for testing billing practices using the new NPIs. They should also consider whether the new NPIs will require updates with Medicare Advantage plans, other payors, and clearinghouses.

CMS Verification and Oversight

CMS finalized a layered, risk-based approach to verification and oversight. Every attestation will first go through automated validation and screening for completeness, consistency with PECOS enrollment records, and the presence of required attestation elements. Attestations that are incomplete or present an elevated compliance risk will be flagged for targeted documentation review. Extended review may include remote audits, site visits, and other investigations. CMS expects to perform extended reviews of hospitals with a single off-campus department and to target hospitals with multiple off-campus departments for extended reviews by selecting a random sample of submissions.

If CMS or a contractor determines that an attestation complies with the provider-based requirements, the hospital will receive an approval notice. If an attestation does not demonstrate compliance, or if a hospital fails to attest to all applicable requirements or submit all requested information, the hospital will receive a denial notice that explains the basis for the adverse determination and describes applicable appeal rights. CMS may also give hospitals an informal opportunity to correct minor attestation deficiencies when the department otherwise satisfies the requirements.

Issues CMS Left Unresolved

CMS left many questions unanswered, including the final attestation form and electronic system instructions; billing mechanics; precise documentation expectations for each provider-based requirement; review criteria and oversight protocols; the timing, frequency, and circumstances of subsequent attestations; and how much flexibility hospitals will have to correct minor deficiencies before a determination is issued. We will continue to monitor subregulatory guidance and future rulemaking on these topics.

What Hospitals Should Do Now

The final rule sets the core conditions hospitals must meet to protect Medicare payment for off-campus outpatient services beginning January 1, 2028. Initial attestations for existing departments are due by December 31, 2027. Hospitals should reconcile department inventories with PECOS enrollment records at the address level, secure NPIs where needed, assess their current provider-based compliance and close any gaps, and compile the supporting documentation for each attestation.

+++

Darby Allen is a partner in DWT's Seattle office and Marci Love is of counsel in the firm's Washington, D.C., office. DWT is helping hospitals prepare for these requirements and address compliance gaps identified along the way. If you have questions about how the final rule affects your organization, please contact the authors or another member of our healthcare team. To stay informed, sign up for our alerts.