CMS has released proposed regulations implementing Section 6225 of the Consolidated Appropriations Act of 2026, proposing significant changes to the provider-based attestation process under 42 C.F.R. § 413.65. As a reminder, the Consolidated Appropriations Act, enacted on February 3, 2026, introduced mandatory provider-based attestations and a separate National Provider Identifier (NPI) requirement for off-campus hospital outpatient departments (HOPDs) effective January 1, 2028.
Key Proposed Changes
- New Definition of “Off-Campus Outpatient Department.” CMS proposes to add a definition clarifying that an “off-campus outpatient department of a provider” is one not: (1) located on the campus of the main provider; or (2) within 250 yards of a remote location of a hospital.
- Mandatory Attestation Timeline. CMS proposes that, beginning January 1, 2028, initial attestations for all HOPDs providing services on or before that date must be submitted between January 1, 2026 and December 31, 2027. Subsequent attestations would be required at an interval not to exceed five years. Providers who submit timely attestations within the two-year window will meet the statutory requirement even if CMS has not yet completed its review by January 1, 2028. For HOPDs that begin providing services after January 1, 2028, the initial attestation must be submitted within the two-year period prior to when billed services are delivered.
- Standardized Form and Centralized Electronic Submission. CMS proposes a uniform attestation form to replace the MAC-specific templates currently in use, along with a centralized electronic submission system. A draft form is available on the CMS website for public comment. Until the new system is finalized, providers may continue to use the existing attestation process.
- NPI Enrollment Required Before Attestation. Prior to submitting any attestation, main providers must obtain a separate NPI for each provider-based department and update the Provider Enrollment, Chain, and Ownership System (PECOS). This step is a prerequisite to attestation.
- Documentation Requirements. Not all documentation would be required at the time of initial submission. CMS proposes a risk-based review process, with documentation evaluated across eight categories: (1) attestation form completeness and authorization; (2) location; (3) licensure; (4) clinical services integration; (5) financial integration; (6) public awareness; (7) obligations of HOPDs, including compliance with EMTALA, antidumping rules, site-of-service billing requirements, and written beneficiary financial notice; and (8) ownership, control, administration, and supervision, including 100% ownership by the main provider, full administrative integration, and an organizational chart reflecting the reporting relationship between the department and the main provider.
- Risk-Based Verification and Oversight. CMS proposes a layered review process: automated validation of all submitted attestations, followed by targeted documentation review for those flagged as incomplete or high-risk, and extended review—including remote audits or site visits—for a subset of providers. Failure to provide requested documentation within the specified timeframe may result in a determination of non-compliance and recovery of payments.
Looking Ahead
Comments on the proposed rule are due by August 31, 2026, with the final rule expected this fall. Providers should consider reviewing their existing provider-based arrangements, evaluating the documentation currently maintained to support provider-based status, and identifying any potential compliance gaps that could become more visible under CMS’s proposed attestation and review framework.
Contact Us
Our attorneys at Husch Blackwell have extensive experience guiding clients through provider-based regulatory and compliance matters. For questions about how these changes may impact your organization, please contact Alison Hollender, John Gramlich, Neha Khan, and your Husch Blackwell attorney.