Provider-based compliance has long been one of the more complex areas of Medicare reimbursement. New attestation requirements now add another important responsibility for hospitals operating off-campus Hospital Outpatient Departments (HOPDs). Drawing on years of experience advising hospitals on provider-based compliance, this article explains what organizations need to know before the 2028 deadline.
Executive Summary – Key Takeaways
- Provider-based attestation required before the end of 2027
- Separate NPI required for each off-campus HOPD
- Miss the deadline, lose Medicare reimbursement
- Begin compliance review well before attestation opens
Table of contents
What Hospitals with Off-Campus HOPDs Need to Do Before 2028
New requirements for continuing Medicare payments for services rendered in Off-Campus Hospital Outpatient Departments (HOPDs) are on the horizon. Hospitals with off-campus HOPDs should begin preparing to meet these new requirements now. The new statutory requirements are based on Section 6225 of the Consolidated Appropriations Act of 2026 (CAA).
The requirements are simple to state:
(1) hospitals must submit a provider-based attestation that they are in compliance with the provisions of 42 CFR 413.65, and
(2) hospitals must have applied for, and be using, a distinct National Provider Identifier (NPI) for each off-campus hospital outpatient department which is providing services to Medicare patients.
For detailed guidance on obtaining and implementing the required identifier, see our article on off-campus HOPD NPI requirements.
The earliest a hospital can submit an initial attestation signifying its compliance with the regulations is January 1, 2027. The final deadline is December 31, 2027. If the attestation process is not completed by that date, Medicare reimbursement of claims for services will cease on January 1, 2028.
Simple to say, potentially complex in execution.
What is an Off-Campus HOPD?
Provider-based HOPDs come in two flavors: on campus and off-campus. On-campus hospital outpatient departments are those provider-based services that are provided in facilities that are within 250 feet of the hospital building itself. Off-campus outpatient departments must be within 35 miles of the hospital. They also must be integrated in specific ways with the hospital itself.
The purpose of the attestation process is to ensure hospital management is operating in compliance with the provisions of the regulations governing off-campus HOPDs, including the new requirement for a separate NPI.
What will Hospital Managers Attest to concerning their Off-Campus Outpatient Departments?
It is important to note that there is already a long list of provider-based requirements for both on-campus and off-campus hospital outpatient departments. These include requirements related to:
- Licensing, e.g., operating under the same license where permitted by state laws.
- Integrated clinical services, including medical staff credentialing and medical director accountability.
- Financial integration, including shared income and expenses and cost reporting integration.
- Public Awareness, including identifying the HOPD as a department of the hospital for contracting purposes.
In addition to the maximum distance requirement, off-campus hospital outpatient departments must meet several other requirements. Hospitals also must demonstrate and/or certify compliance with the following:
- The Off-Campus HOPD must be wholly-owned by the main provider (the hospital), and be subject to the same governing body.
- Management of the Off-Campus HOPD must be connected to, and supervised by, management of the hospital in the same way as other departments of the hospital.
- The Off-Campus HOPD must be integrated into the processes of the hospital, e.g., human resources, billing, medical records, and payor contracting.
- The patient population of the Off-Campus HOPD must overlap at a high level, e.g., 75%, with the hospital.
Medicare beneficiaries must be notified, in advance of receiving services, of the amount of financial liability they may incur by receiving services in provider-based off-campus hospital outpatient departments. This notification is required because the hospital bills the professional services and facility services separately.
How should Hospitals Prepare for the Attestation Process?
Section 6225 of the CAA of 2026 requires the Secretary of HHS to implement a process for initial and subsequent attestations. This implies such attestations may be required periodically over time. The first two steps are to be on the lookout for a proposed final rule describing the attestation review process and to track attestation submission deadlines.
Unless you are submitting original attestation documentation for an HOPD, look over prior attestation submissions. Review the documentation against your current reporting and integration processes.
Is your current on-campus HOPD meeting the current requirements for governance, clinical and financial integration, and public awareness? If you have off-campus outpatient departments, do they meet the additional documentation requirements for ownership, management supervision, overlapping patient populations, and beneficiary notifications?
There has always been a lot at stake in attesting to compliance with regulations that can affect reimbursement and expose a hospital to federal False Claims Act liability.
As consultants who have functioned as Compliance Officers for several hospitals, we are very familiar with provider-based compliance involving physicians and other professionals.
This can be a time-consuming activity. It is definitely one where you don’t want to just press on and ask for forgiveness later.
Noncompliance is not an option!
Off-Campus HOPD Attestation: Frequently Asked Questions
Yes. Each off-campus Hospital Outpatient Department (HOPD) must satisfy the provider-based attestation requirements applicable to that individual department.
The attestation demonstrates that the department complies with the provider-based regulations in 42 CFR § 413.65. Hospitals operating multiple off-campus HOPDs should inventory each location and verify that documentation supports compliance before submitting attestations.
Yes. For services furnished on or after January 1, 2028, each affected off-campus HOPD must have and bill under an NPI separate from the main provider’s NPI.
This requirement allows CMS to identify services provided at individual off-campus departments rather than under the hospital’s primary NPI. Hospitals should begin evaluating enrollment, billing, payer, and operational impacts well before the compliance deadline.
Hospitals should review documentation demonstrating compliance with the provider-based requirements in 42 CFR § 413.65.
This typically includes evidence of governance, clinical integration, financial integration, licensure, public awareness, ownership, management oversight, and other provider-based requirements applicable to the department. Our off-campus HOPD compliance checklist provides a structured framework hospitals can use to review these areas and identify gaps before attesting.
Beginning January 1, 2028, Medicare payment will not be available for services furnished by an affected off-campus HOPD unless both requirements are satisfied.
The hospital must submit the required provider-based attestation, and the department must have and use its own distinct NPI. Failure to satisfy either condition can place that department’s Medicare reimbursement at risk. Hospitals should identify and correct compliance, enrollment, billing, and documentation gaps before the deadline.
Provider-based attestation preparation should involve multiple operational and compliance stakeholders across the hospital.
Compliance, reimbursement, patient financial services, enrollment, legal counsel, operations, finance, and department leadership all may play important roles. Coordinating these teams early helps ensure supporting documentation, operational processes, and Medicare enrollment information are consistent before attestations are submitted.