Hospitals Face Mandatory NPI and Attestation Rules for Off-Campus Departments
Key Takeaways
- The Consolidated Appropriations Act of 2026 mandates that all off-campus hospital outpatient departments (HOPDs) obtain unique National Provider Identifiers and submit formal provider-based attestations.
- This regulatory shift ends the long-standing voluntary compliance system and sets a hard enforcement deadline of January 1, 2028.
Mentioned
Key Intelligence
Key Facts
- 1The Consolidated Appropriations Act of 2026 (HR 7148) was signed into law on February 3, 2026.
- 2Hospitals must obtain a separate National Provider Identifier (NPI) for every off-campus outpatient department.
- 3Mandatory provider-based attestations must be submitted to CMS by January 1, 2028.
- 4Off-campus sites are generally defined as locations more than 250 yards from the main hospital campus.
- 5Non-compliance will result in the loss of Medicare payments under the Outpatient Prospective Payment System (OPPS).
- 6The new law ends the previous 'honor system' where attestations were voluntary for Medicare enrollment.
Analysis
The enactment of the Consolidated Appropriations Act of 2026 (HR 7148) marks a pivotal shift in the regulatory oversight of hospital billing practices. While much of the initial industry attention focused on the extension of telehealth flexibilities, Section 6225 of the Act introduces a rigorous new compliance framework for off-campus hospital outpatient departments (HOPDs). By mandating both unique National Provider Identifiers (NPIs) and formal provider-based attestations, the federal government is effectively dismantling the 'honor system' that has governed hospital-based billing for decades. This move is not merely an administrative adjustment; it is a strategic effort by the Centers for Medicare & Medicaid Services (CMS) and Congress to gain granular visibility into where hospital services are actually delivered.
Historically, hospitals have enjoyed the ability to bill at higher facility rates for services provided at off-campus locations, provided those sites met specific 'provider-based' criteria. These criteria include clinical and financial integration with the main hospital and a location typically more than 250 yards from the main campus. Until now, submitting an attestation to CMS to prove this status was voluntary. Many hospitals chose to do so to mitigate the risk of future overpayment audits, but others operated under a self-certification model. Under the new law, this optionality disappears. By January 1, 2028, every off-campus HOPD must have its own NPI and a validated attestation on file, or it will face a total suspension of Medicare payments under the Outpatient Prospective Payment System (OPPS).
This move is not merely an administrative adjustment; it is a strategic effort by the Centers for Medicare & Medicaid Services (CMS) and Congress to gain granular visibility into where hospital services are actually delivered.
The implications for hospital systems are significant and multi-layered. Operationally, large integrated delivery networks (IDNs) with dozens or hundreds of satellite clinics face a massive data-gathering and filing exercise. Each site must be audited to ensure it meets the strict definition of 'off-campus' and complies with the 42 C.F.R. § 413.65 requirements. The administrative burden of managing a fleet of unique NPIs—rather than billing under a single hospital-wide identifier—will require updates to credentialing systems, billing software, and internal compliance monitoring. Furthermore, the Secretary of Health and Human Services (HHS) has been granted the authority to determine the frequency of subsequent attestations, suggesting that this will become a recurring compliance cycle rather than a one-time event.
What to Watch
From a broader market perspective, this legislation is a clear precursor to more aggressive 'site-neutral' payment reforms. For years, Medicare watchdogs and private insurers have argued that the government pays significantly more for the same service (such as a routine office visit or a basic scan) when it is performed in a hospital-owned department versus an independent physician's office. By forcing hospitals to uniquely identify every off-campus site, the government is building the data infrastructure necessary to implement site-neutral cuts. Once CMS can see exactly which services are being performed at which specific off-campus NPI, it becomes much easier to align those payment rates with non-hospital settings.
Industry leaders should view this as a 'transparency first' mandate. The two-year window before the 2028 deadline provides a buffer, but the complexity of the task should not be underestimated. Hospitals must begin by mapping their entire real estate footprint against their Medicare enrollment records. Any discrepancies found during this internal audit could lead to self-disclosure requirements or the need to restructure certain service lines. As CMS begins the formal rulemaking process to establish the submission portal and specific attestation forms, stakeholders should prepare for increased scrutiny of their 'provider-based' status and the potential for these requirements to expand to other facility types in the future.
Timeline
Timeline
Legislation Enacted
President signs the Consolidated Appropriations Act of 2026 into law.
CMS Rulemaking
CMS expected to establish the formal process and portal for NPI and attestation submissions.
Initial Filing Deadline
Final day for hospitals to submit initial attestations for all existing off-campus departments.
Enforcement Begins
Medicare payments will be withheld from off-campus HOPDs that lack a unique NPI and valid attestation.