Mandatory Provider-Based Attestations Make A Comeback

After a nearly 24-year hiatus from the mandatory provider-based attestation requirement, the Consolidated Appropriations Act of 2026 (Act, signed into law on Feb. 3, 2026), mandates (again) that hospitals file attestations of compliance with the provider-based regulations for all off-campus provider-based locations. Attestations must be filed before Jan. 1, 2028, with more specific timing to be further defined by CMS. Failure to do so by that date will result in payment reduction under the Hospital Outpatient Prospective Payment System (OPPS).

Key Takeaways

• Hospitals must file attestations for all off-campus provider-based locations pursuant to either (a) the existing attestation regulations at 42 C.F.R. § 413.65(b)(3) or (b) new regulations that CMS must establish under the Act.
• All initial attestations must be filed within the 2-year period from now through Dec. 31, 2027.
• Hospitals must obtain separate/unique NPIs for each off-campus provider-based location.
• The attestation process for existing provider-based locations will undoubtedly unearth current or past compliance issues as the provider-based regulations are cumbersome and lengthy.
  • Identifying compliance gaps and the potential overpayment impact have consequences not only for payment for services and fraud and abuse issues, but also potentially for other Medicare payments (DSH, for example) and 340B eligibility.
• The attestation process is very time-consuming for even a single location- for those providers with many off-campus locations, an attestation must be completed for each one. Allowances for batched attestations have not been expressly stated but may be possible under the existing provider-based guidance. Hospital systems that have undergone significant expansion of provider-based departments need to work quickly given the heavy lift associated with preparing documents that support an attestation.
• Under the current provider-based regulations, the MACs/CMS may deny an attestation for failing to demonstrate compliance with the regulations. This denial can create significant confusion regarding the payment impact and introduce a lengthy appeal process.

Preparing Now

• Establish a Legal Review Framework. Hospitals should establish a compliance review process and include in-house or outside counsel to determine the impact of any suspected noncompliance on prior payments, current billing, False Claims Act liability and eligibility for other programs. This process should be developed and established before the attestation process begins.
• Use Existing Attestation Forms as a Starting Point. While CMS may develop new attestation processes or forms for this new attestation requirement, hospitals should use existing MAC/CMS attestation forms to begin compiling information and documents to establish compliance for all existing off-campus provider-based locations.¹ The new attestation requirement only applies to off-campus locations. It does not apply to on-campus locations (all those within 250-yards of either the main hospital or any remote location of the main hospital).
• Consider Current Payment Methods and Alternative Enrollments. The Act applies to all off-campus provider-based locations, including those that are already subject to site-neutrality payment under Section 603 of the Bipartisan Budget Act of 2015 (Section 603). As a result, hospitals should conduct a review of OPPS payments versus site-neutral payments in all current off-campus provider-based locations to understand the current role of these payments in the hospital's revenue profile. For example, some off-campus provider-based locations may be fully subject to site neutral payments, have little or no 340B drug revenue, be largely non-Medicare clinics or have other attributes that may counsel a hospital to treat the location as free-standing going forward and avoid compliance risks and the cost and difficulty of the attestation process. Changes in state licensure and Medicare/Medicaid enrollment status must also be considered.

The Act amends the OPPS payment statute, much like the site-neutral payment provisions enacted under Section 603. The placement of the Act's attestation requirement in the OPPS payment provisions makes clear that the attestation requirement has a direct payment impact.

The Act further states that CMS, through rulemaking, must establish a process for ongoing attestations (perhaps similar to the enrollment revalidation process) and regulatory reviews to determine compliance which could include site visits, remote audits or other means. The Act allocates $20 million in funding to CMS to carry out the attestation review process as well as the subsequent compliance reviews, though this sum appears insufficient to cover that significant costs for CMS to meet its obligations given the thousands of off-campus provider-based locations throughout the country.

Footnote

1. CMS's current guidance regarding provider-based attestations is in Transmittal A-03-030, Change Request 2400, April 18, 2003, available here. CMS also publishes a "Provider-Based Designation Checklist," here, that tracks the provider-based regulations and specific content that CMS and the MACs require in the attestation. Finally, the MACs publish attestation forms that hospitals may use for submission. For example, see Palmetto GBA's attestation, here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.