Hospitals Beware – Mandatory Provider-Based Attestations Are Back
On Feb. 3, 2026, President Trump signed into law the Consolidated Budget Act of 2026. One small but mighty provision included in the Act will create a compliance burden on hospitals that provide outpatient off-campus provider-based services to their patients in compliance with 42 C.F.R. § 413.65. Pursuant to Section 6225 of the Act, effective Jan. 1, 2028, no payment under the Medicare Outpatient Prospective Payment System (OPPS), including the site-neutral OPPS payment rate, will be made for items or services furnished by an off-campus provider-based department of a hospital unless:
- The provider-based department has obtained, and such items and services are billed under, an NPI that is separate from the main provider’s NPI, and
- The provider has submitted an initial provider-based attestation (PBA) between Jan. 1, 2026, and Dec. 31, 2027
The new law also imposes ongoing obligations on hospitals, requiring the submission of subsequent PBAs for existing off-campus provider-based departments within periodic timeframes to be specified by the Secretary of HHS. In addition, hospitals will be subject to regulatory reviews to confirm compliance with the provider-based regulations, which may include site visits, remote audits and other means to be determined by the Centers for Medicare & Medicaid Services (CMS).
The last time CMS required mandatory PBAs was when CMS first issued the new provider-based regulations at 42 C.F.R. 413.65, in the April 7, 2000, OPPS Final Rule. Mandatory PBAs were required until 2002 when CMS shifted to voluntary PBAs, in most situations. Unlike the voluntary attestation process that has been in place for the past 24 years, submission of these initial and subsequent PBAs will be required in order to continue to receive OPPS payment for provider-based departments.
To whom does Section 6225 apply?
Section 6225 applies to Medicare-certified hospitals that operate off-campus provider‑based departments that are paid under OPPS.
When does Section 6225 take effect?
Section 6225 takes effect immediately, but payment consequences will not occur until Jan. 1, 2028.
Will CMS issue guidance on how this will be implemented?
Yes, the Act directs CMS to establish a process, through notice and comment rulemaking, for each provider with an off-campus outpatient department to submit an initial and subsequent PBA, and for the Secretary to review each such PBA and determine, through site visits, remote audits, or other means (as determined appropriate by the Secretary), whether such department is compliant with the requirements described under 42 C.F.R. § 413.65.
Are both on‑campus and off‑campus departments effected?
No, Section 6225 only applies to off-campus provider-based departments.
What if you already submitted a provider-based attestation and your attestation was approved by CMS?
At this time, it does not appear that the hospital’s submission of a PBA before Jan. 1, 2026, will satisfy this new law. At the very least, it is likely that a hospital will be required to submit an update to its prior approved PBA, attesting that the off-campus provider-based department continues to comply with 42 C.F.R. § 413.65.
What is the attestation process for new off-campus provider-based departments created on or after Jan. 1, 2028?
The Act is silent with respect to new off-campus provider-based departments that are created on and after Jan. 1, 2028.
What should hospitals be doing now?
Hospitals should:
- Inventory all their off-campus provider‑based departments and perform a compliance risk assessment against 42 C.F.R. § 413.65
- Obtain separate NPIs for each off-campus provider-based location if they do not already have separate NPIs
- Begin to prepare the documentation that they will be required to submit along with the hospital’s PBAs
- Monitor CMS guidance issued in connection with this new statutory mandate
The Stevens & Lee Health Care Group is available to answer any questions you may have about this new law and its implications for your facility. We have significant experience performing compliance assessments of provider-based departments and submitting provider-based attestations. We are ready to assist you with any concerns about past non-compliance that may come to light as a result of compliance assessments.
