Overview
All hospitals that are paid under the Medicare Outpatient Prospective Payment System and operate off-campus outpatient departments should prepare for submission of mandatory provider-based attestations (PBAs), even if they have submitted them in the past. The Consolidated Appropriations Act, 2026 includes a requirement that the Centers for Medicare & Medicaid Services (CMS) stop paying for Medicare services at existing off-campus hospital outpatient departments beginning January 1, 2028, unless the hospital has satisfied the following requirements:
- Obtained a location-specific national provider identifier (NPI) for the off-campus outpatient department.
- Submitted a PBA between January 1, 2026, and December 31, 2027.
These new requirements are not one-time obligations. To continue to receive payments from Medicare for services at off-campus outpatient locations on a going-forward basis, hospitals must submit subsequent PBAs for each existing off-campus hospital outpatient location on a periodic basis to be determined by CMS (possibly every two years). The new law, as drafted, does not address if or how off-campus hospital outpatient departments opening on or after January 1, 2028, will be paid by Medicare.
In Depth
While all hospital locations and services paid by Medicare as hospital services must meet the provider-based requirements at 42 CFR 413.65, submission of PBAs to obtain CMS confirmation of compliance with the PBAs has been voluntary for most hospitals until now. As a result, few hospitals have prepared and submitted PBAs for their off-campus provider-based locations.
In addition to the immediate imposition of requirements to obtain NPIs and submit PBAs, the Consolidated Appropriations Act, 2026 requires CMS to promulgate notice-and-comment rules to establish a process for the ongoing submission of PBAs and regulatory reviews to confirm compliance, which may include site visits, remote audits, and “other means” to be determined by CMS.
Because PBAs to date have been voluntary for most hospitals and were often not viewed as a high-risk compliance concern, many hospitals may not have been routinely conducting the necessary compliance reviews to ensure ongoing compliance with the provider-based rules and may not have all of the materials necessary to complete a PBA. Even hospitals that have previously approved PBAs must submit new PBAs prior to January 1, 2028, requiring updates to old information.
What should hospitals do now?
- Hospitals should start compiling PBAs for all of their off-campus outpatient departments as soon as possible and be prepared to submit them as soon as possible (and no later than December 31, 2027).
- PBAs are detailed documents and entail the submission of specific hospital information and attachments, including policies and procedures, among other things. It is not uncommon for PBAs to be hundreds of pages long.
- PBAs will be required even for off-campus locations that have submitted and received approval of PBAs in the past.
- PBAs take considerable time and resources to compile and submit. Hospitals should not expect to be able to compile the required PBAs in a matter of weeks. It is not uncommon for the preparation of PBAs to take months.
- Many hospitals likely will discover gaps in compliance and will require time to engage in corrective actions.
- Locations that are not in compliance with the provider-based rules should not be billed as provider-based.
- Some locations currently operating as off-campus hospital outpatient locations likely will be unable to comply with the requirements of 42 CFR 413.65 and will need to convert to another type of healthcare provider to continue to receive Medicare payments.
- These changes may require updates to CMS enrollments, licensing, and other aspects of the location’s operations.
- Hospitals should be aware of the risks of overpayments, retained overpayments, and False Claims Act liability that noncompliance with the provider-based rules can cause.
- Any evaluation of off-campus provider-based locations that reveals noncompliance (whether recent or long-standing) requires an analysis of potential overpayments and risk of false claims.
The eventual release of notice-and-comment rulemaking will provide further specifications on the hospital’s obligation to submit the initial and subsequent PBAs for each off-campus provider-based location. As the Consolidated Appropriations Act, 2026 is written, there appears to be a strong likelihood that any hospital that has not filed the necessary PBAs prior to January 1, 2028, will experience a gap in Medicare payments for off-campus provider-based locations until the PBAs are submitted.
Even without clear rules in place, hospitals should allocate additional staff and administrative resources to undertake the regular preparation and submission of PBAs for their off-campus provider-based locations. The PBA review process often involves follow-up questions and requests for additional documents and information, requiring time and attention to fully resolve, and the to-be-determined review process could involve onsite or paper-based surveys and inquiries that require staff time to resolve. More immediately, the potential exigencies involved in preparing and submitting “initial” PBAs for all off-campus locations to preserve payment as of January 1, 2028, will require significant staff and internal resources.
Hospitals should take immediate steps to understand the requirements of Consolidated Appropriations Act, 2026 and the risks and penalties associated with past noncompliance with the provider-based rules. Because of the significance of these new statutory requirements and potential for discovery of past noncompliance, hospitals should consider seeking guidance from legal counsel experienced in the provider-based rules and plan for immediate action.
The McDermott Difference
We have resources available to help hospitals understand the requirements of the provider-based rules, preparing attestations, and, where necessary, coming into compliance with the provider-based rules. Our recent article and webinar may help provide context for provider-based rule compliance, which is now subject to the these new statutory requirements.