The rule directly threatens revenue streams for thousands of outpatient sites and forces health systems to invest significant resources in compliance, reshaping financial planning and operational oversight.
The 2026 Consolidated Appropriations Act expands Medicare’s provider‑based oversight by targeting off‑campus hospital outpatient departments. By requiring unique National Provider Identifiers and two attestations—an initial filing and a follow‑up—CMS aims to tighten site‑neutral payment enforcement and gain granular data on services delivered outside main campuses. While the policy supports uniform reimbursement standards, it also introduces a new administrative layer that many health systems have historically overlooked, creating a compliance gap that could affect a sizable portion of outpatient revenue.
For hospitals, the practical fallout is immediate and costly. Preparing attestations often means compiling 200‑page dossiers per location, covering governance, licensing, financial integration, and modifier usage. Organizations lacking prior attestations must now conduct a comprehensive inventory, assess each site against provider‑based criteria, and allocate legal, compliance, and revenue‑cycle resources to the effort. The financial stakes are high: non‑compliant HOPDs face Medicare payment bans, mandatory over‑payment returns within 60 days, and potential historic liability that could surface during the attestation process. Moreover, reclassifying a HOPD to avoid penalties may jeopardize 340B drug‑discount eligibility, further eroding margins.
Strategically, the data harvested from unique NPIs will give CMS unprecedented insight into off‑campus service patterns, likely informing future site‑neutral payment expansions. Health systems should therefore treat the attestation requirement as a catalyst for broader operational alignment—standardizing documentation workflows, integrating compliance checks into revenue cycle management, and establishing cross‑functional governance. Early action not only mitigates immediate payment risks but also positions organizations to adapt swiftly to any subsequent regulatory tweaks, preserving both cash flow and community service commitments.
Many hospitals and health systems are facing costly work in preparation for 2028 documentation requirements to avoid off-campus HOPD revenue losses. And some could see a big financial hit, even if they successfully meet those requirements.
The Consolidated Appropriations Act of 2026, enacted Feb. 3, created new documentation requirements for off-campus hospital outpatient departments (HOPDs). These include:
Obtaining and using separate National Provider Identifiers (NPIs) for each off-campus HOPD
Submitting provider-based attestations for each off-campus HOPD
Completing those actions by Jan. 1, 2028
Barring Medicare payment under the Outpatient Prospective Payment System (OPPS) for noncompliant HOPDs
Ultimately CMS will require two attestations:
An initial attestation
A subsequent attestation submitted within a timeframe to be specified by HHS
CMS was expected to issue rules specifying the time frame for the second attestation, as well as a process for reviewing attestations and verifying compliance.
The new law creates real financial consequences for noncompliance, said Travis Lloyd, a partner at Bass, Berry & Sims.
“You always have to comply with the provider-based rules in order to bill in this way,” Lloyd said. “But now you have to actually submit an attestation to be paid in that manner.”
Some health systems previously completed voluntary attestations of off-campus HOPDs but many have not.
“It’s uncommon for a hospital system to have completed attestations for all of its off-campus facilities,” he said. “Many hospitals have not gone that extra step because it just hasn’t been viewed as necessary.”
Some of those organizations undertook attestations after a 2015 federal law implemented some site-neutral payment changes for new off-campus HOPDs. Other organizations have done so for sites subject to additional regulatory burdens, like those operated under management contracts.
“If I were helping a large system triage their efforts or determine priority for the facilities for which they should submit attestations, I would probably start with those sites first,” he said.
Although national estimates for off-campus HOPD documentation don’t exist for the cost of meeting the new requirements, larger organizations may attain some economies of scale by developing a clear, consistent process across all their sites, he said.
Lloyd added that provider-based attestations can run as long as 200 pages for each site.
Complicating factors include individual requirements Medicare administrative contracts have added to attestations, Lloyd said.
It’s also possible that CMS will amend attestation requirements or roll them into the existing enrollment process, given its own resource limitations to review extensive filing from sites across the country.
Despite the implementation uncertainty, Lloyd said that hospitals should begin preparing now. Key steps include:
Conducting a comprehensive inventory of all off-campus provider-based locations
Assessing each location’s compliance with the provider-based requirements
Beginning to assemble documentation to support attestations
“It’s a compliance exercise where you’re making sure that, ‘Yes, we in fact comply and we can prove it. Here’s the documentation to support it,’” Lloyd said. “That’s ultimately what the attestation is.”
Leadership of the process will be key and is sometimes shared in hospitals between a revenue cycle or reimbursement department, along with compliance and legal representatives.
It also is possible that organizations will discover over the process of completing an attestation that a given site did not comply with all the provider-based requirements.
“Then you may very well have not just a problem to fix going forward, but potentially some historical liability that needs to be addressed,” Lloyd said.
That’s because HOPDs garner higher payments than those operating as a freestanding facility or as a non-grandfathered facility.
A 2016 Office of Inspector General report found that more than three-quarters of a sample of 50 hospitals that had not voluntarily attested for all their off-campus facilities had one that did not meet at least one provider-based requirement.
Additionally, hospitals and health systems have an affirmative duty to report and return identified overpayments within 60 days.
“That can’t be put off, even if the noncompliance has been going on for decades,” Lloyd said. “This is going to, in some cases, dredge up some noncompliance issues that turn into real dollars, so that we’re not just talking about future payment streams.”
Some organizations may need to restructure a location that had been operating as an off-campus HOPD as a different type of provider to maintain their Medicare payments.
However, that decision could be complicated if the existing off-campus HOPD is 340B-eligible. A status change could remove 340B revenue from the organization.
Previous compliance issues with the 15 discrete requirements for off-campus HOPD documentation have been raised in previous subregulatory guidance, enforcement actions or as an allegation in a lawsuit.
Examples of compliance problems at off-campus HOPDs can include:
Improper naming conventions and signage
Governance and control issues
Lack of financial integration
Improper modifier usage
Inconsistencies with licensure
Beneficiary disclosures
The information that CMS collects through unique NPIs will provide much more detail about services furnished at off-campus locations.
That information could inform future rulemaking extending site-neutral payment, Lloyd said.
“So that puts hospitals in a difficult position, and it forces them to make the strong story about the importance of these facilities to their communities and the need for them to have appropriate financial support,” Lloyd said.
The post Big financial impacts from off-campus HOPD rule change appeared first on HFMA.
Comments
Want to join the conversation?
Loading comments...