CMS Finalizes Separate NPI and Provider-Based Attestation Requirements for Off-Campus Hospital Outpatient Departments

November 6, 2026

At a Glance

On November 6, 2026, CMS will publish the CY 2027 OPPS/ASC final rule, which implements Section 6225 of the Consolidated Appropriations Act, 2026 (CAA 2026).
Starting January 1, 2028, Medicare will not pay under the OPPS (or under the PFS-equivalent “applicable payment system” for non-excepted departments) for items or services furnished by an off-campus outpatient department of a hospital unless: (1) the department has its own National Provider Identifier (NPI); (2) the hospital has submitted an initial provider-based attestation for the department; and (3) the hospital later submits a subsequent attestation on time.
For every off-campus department already furnishing services on or before January 1, 2028, the initial attestation must be submitted between January 1, 2026 and December 31, 2027. That window is open now.
Prior CMS provider-based determinations are not grandfathered. Departments approved before January 1, 2026 must submit a new attestation.
Noncompliance affects payment only for the specific off-campus department that fails the requirements, not all of the hospital’s OPPS payments.

Background

Hospitals have long been required to comply with the provider-based rules at 42 CFR 413.65, but since 2000 a hospital has had to submit an attestation only if it wanted a CMS determination of provider-based status. Payment was never conditioned on verifying compliance. Section 6225 changes that by adding new paragraph (23) to Section 1833(t) of the Social Security Act. It ties OPPS payment for off-campus departments to a separate NPI and a provider-based attestation, and it directs CMS to set up an attestation process with review through site visits, remote audits, or other means.

Summary of the Final Rule

1. Which departments are covered

An “off-campus outpatient department of a provider” is a department of a provider that is not on the main provider’s campus or within 250 yards of a remote location of a hospital (new definition at 42 CFR 413.65(a)(2)). Departments within 250 yards of a remote location are not subject to the NPI or attestation requirements.
Distance from a remote location is measured with straight-line measurements, generally from any point of the remote location facility that provides patient care. Non-structural features such as awnings or walkway overhangs are not acceptable measuring points.
A “department” is defined by its physical address as listed in PECOS, including suite or floor number where applicable. One off-campus address equals one department and needs one NPI, even if it offers multiple service lines (for example, laboratory and radiology).
Facilities listed at 42 CFR 413.65(a)(1)(ii), for which CMS historically has not made provider-based determinations, are covered if they meet the definition. CMS said it may look for ways to reduce burden for these facilities in subregulatory guidance.
There is no de minimis exception. A department that does not seek payment under the OPPS or the applicable payment system, however, is not required to comply.

2. Who is excluded

Critical Access Hospitals (excluded from the OPPS; the regulation text expressly excludes them).
Provider-based Rural Health Clinics, which are “provider-based entities,” not “departments of a provider.”
Hospitals in the AHEAD Model (such as Maryland hospitals), which are not paid under Section 1833(t).
Indian Health Service and Tribal facilities (42 CFR 413.65(m)) and certain FQHCs and look-alikes (42 CFR 413.65(n)).
Remote locations of a hospital themselves, which provide inpatient services and are not off-campus outpatient departments.

3. Separate NPI requirement (new 42 CFR 419.23)

Each off-campus department must obtain its own NPI by January 1, 2028, and its items and services must be billed under it.
Before submitting an attestation, the hospital must obtain the department NPI and update its enrollment record in PECOS.
CMS is changing claims processing so that a claim can carry multiple NPIs: the hospital’s claim-level NPI plus service-line NPIs for services furnished during the day. Detailed billing guidance is still to come.

4. Attestation requirement and timing (new 42 CFR 413.65(b)(6))

Department status	Initial attestation deadline
Furnishing services on or before January 1, 2028	Submit between January 1, 2026 and December 31, 2027
Begins furnishing services after January 1, 2028	Submit within the 2 years before furnishing billed services
Subsequent attestation	Interval set by CMS, no more than 5 years after the date the prior attestation was submitted; details to be set in 2028 rulemaking

A timely initial attestation satisfies the requirement even if CMS has not issued a provider-based determination before the department starts furnishing services (new 42 CFR 419.23(c)).
CMS will use a standardized national attestation form submitted through a centralized electronic system, replacing MAC-specific templates. Until that system is live, hospitals may submit attestations to their MAC under the current process at 42 CFR 413.65(b)(3), and those submissions count toward Section 6225.
Supporting documentation does not have to be submitted with the attestation, but hospitals must keep it and produce it on request, generally within a period not to exceed 60 days.
A department must be added to the hospital’s enrollment record through the Form CMS-855A process before attesting, and CMS urged hospitals to build that time into their planning.

5. Review, documentation, and oversight

CMS and its contractors, including MACs, will screen every attestation for completeness and consistency with PECOS. Flagged attestations will receive targeted documentation review.
CMS expects to prioritize extended reviews for hospitals with a single off-campus department and to review a random sample for hospitals with multiple departments. A deficiency found in the sample may lead CMS to expand that review to the hospital’s other departments.
Hospitals should be ready to document location (distance), licensure, clinical integration, financial integration, public awareness, hospital outpatient department obligations under 42 CFR 413.65(g) (including EMTALA, site-of-service billing, and beneficiary notice of coinsurance liability), ownership and control (100% ownership), administrative integration (including an organizational chart), and management contract requirements.
CMS will issue written notice of the outcome, with the basis for any adverse determination and appeal rights. Hospitals with minor deficiencies may get an informal chance to correct them. Failure to provide requested documentation on time may lead to a noncompliance finding and payment recovery under 42 CFR 413.65(k).

What Hospitals Should Do Now

The attestation window is already open and closes December 31, 2027. The steps below are grouped into three phases. Because the rule was finalized in November 2026, “groundwork” that ideally would have been done in 2024 and 2025 is now catch-up work and should be finished right away.

Phase 1: Groundwork (2024–25 work; complete immediately if not done)

Build a department inventory. List every outpatient location by the exact address in PECOS, including suite and floor. Mark each as on-campus, within 250 yards of a remote location, or off-campus. Confirm distances with straight-line measurements from patient-care buildings.
Check enrollment. Make sure every off-campus department appears correctly on the hospital’s Form CMS-855A enrollment. File any missing locations now, because the department must be enrolled before you can attest.
Run a provider-based gap assessment. Test each department against 42 CFR 413.65(d), (e), (g), and (h): licensure, clinical, financial, and administrative integration, public signage and identification, 100% ownership and control, EMTALA, beneficiary notices, and any management contracts. Fix gaps before you sign.
Assemble the documentation file. Gather organizational charts, privileging records, general ledger and cost report support, licenses, signage photos, notices, and management contracts so you can respond within the roughly 60-day window if CMS asks.

Phase 2: Attestations (January 1, 2026 – December 31, 2027)

Get the NPIs. Obtain one organizational NPI for each off-campus address and update PECOS before attesting.
Plan and make the filing. Decide whether to file with your MAC under the current process or wait for the centralized system. Waiting carries deadline risk; do not let the December 31, 2027 date slip. Confirm who your authorized official in PECOS is, and line up written authorization for any consultant acting for you.
Re-attest departments that already have CMS determinations. Prior approvals do not count, and attestations submitted before January 1, 2026 do not satisfy the requirement.
Prepare billing systems. Work with revenue cycle and clearinghouse vendors to report department NPIs on claims, and watch for CMS billing guidance. Test claims well before January 1, 2028.
Talk to commercial and Medicare Advantage payers. New NPIs can cause prior authorization, credentialing, coordination of benefits, and secondary claim problems. Load the new NPIs with payers in advance.

Phase 3: Go-live and ongoing compliance (January 1, 2028 and after)

Go live on department NPIs. Monitor early claims for denials tied to a specific department or NPI.
Run new departments through the process. Any department opening after January 1, 2028 must be assigned an NPI, enrolled, and attested within the 2 years before its first billed service.
Calendar the subsequent attestation. It is due no more than 5 years after each attestation submission date, and watch the CY 2028 rulemaking for the final cadence.
Expect audits.

What to Watch

Release of the final standardized attestation form and the centralized electronic submission system.
CMS billing and claims instructions for department NPIs.
CY 2028 OPPS rulemaking on the subsequent attestation.

If you have any questions or need further guidance regarding this matter, please contact Emily W. G. Towey at emily.towey@hancockdaniel.com.

Click here for a full PDF of the alert.

The information contained in this alert is for general educational purposes only. It is presented with the understanding that neither the author nor Hancock, Daniel & Johnson, LLC, is offering any legal or other professional services. Since the law in many areas is complex and can change rapidly, this information may not apply to a given factual situation and can become outdated. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice. Under no circumstances will the author or Hancock, Daniel & Johnson, LLC. be liable for any direct, indirect, or consequential damages resulting from the use of this material.