The Centers for Medicare & Medicaid Services (CMS) has released a proposed rule to implement Section 6225 of the Consolidated Appropriations Act of 2026, which was signed into law on February 03, 2026. The rule proposes significant changes to how hospitals attest to provider-based status for their off-campus outpatient departments, with key requirements taking effect January 01, 2028.

Key Proposed Changes

One of the first things the rule does is add a clear definition of what counts as an "off-campus outpatient department." Under the proposal, a department is considered off-campus if it is not located on the main hospital's campus or within 250 yards of a remote hospital location.

On the attestation timeline, starting January 01, 2028, all hospital outpatient departments (HOPDs) that were already providing services on or before that date must submit their initial attestations between January 01, 2026 and December 31, 2027. After that, follow-up attestations will be required at least once every five years. Providers who submit on time within that two-year window will be considered compliant even if CMS has not finished its review by the deadline. For HOPDs that start providing services after January 01, 2028, the initial attestation must be submitted within the two-year period before services begin.

CMS is also proposing to replace the various Medicare Administrative Contractor (MAC)-specific attestation forms currently in use with one standardized electronic form. A draft version of this form is already available on the CMS website for public feedback. Until the new system is officially in place, providers can continue using the existing process.

Before any attestation can be submitted, hospitals must first obtain a separate National Provider Identifier (NPI) for each provider-based department and update that information in the Provider Enrollment, Chain, and Ownership System (PECOS). This is a required step before attestation can proceed.

Not all documentation will need to be submitted upfront. CMS is proposing a risk-based review process that evaluates submissions across eight categories: attestation form completeness and authorization, location, licensure, clinical services integration, financial integration, public awareness, HOPD obligations including compliance with the Emergency Medical Treatment and Labor Act (EMTALA), and ownership and administrative structure including an organizational chart.

The review process itself will be layered. All attestations will go through automated validation first. Those flagged as incomplete or high-risk will then face a more targeted document review. A smaller subset may be subject to extended review including remote audits or site visits. Providers who fail to submit requested documentation within the required timeframe risk being found non-compliant and may have payments recovered.

Comments on the proposed rule are due by August 31, 2026, and the final rule is expected later this fall. Providers are encouraged to review their current provider-based arrangements, assess their existing documentation, and identify any potential compliance gaps before the new framework takes effect.