Hospital-Based Billing: New Hoops to Jump Through

Key Takeaways

• Two new outpatient department billing requirements for Medicare-enrolled hospitals were embedded in the Consolidated Appropriations Act of 2026 (“CAA 2026”) passed on February 3. Specifically, hospitals must now:
  • Register every off-campus hospital outpatient department with its own unique National Provider Identifier (“NPI”); and
  • Submit a—previously voluntary—attestation confirming compliance with the provider-based requirements at 42 CFR § 413.65 for these facilities.
• These new requirements are cumbersome and largely regarded as a precursor to further action in the push for site neutral reimbursement.

The History and Significance of Provider-Based Billing

What is it?

To receive hospital-level reimbursement and corresponding benefits such as 340B, hospital outpatient departments (“HOPDs”) have long been required to comply with the “provider-based rules” found at 42 C.F.R. § 413.65. To qualify as provider‑based, the outpatient facility must demonstrate that it operates as an integrated component of the hospital, including by being under common ownership and control as the hospital, sharing the hospital’s state licensure and achieving sufficient clinical, administrative and financial integration with the hospital.

Why does it matter?

The consequences of provider‑based status are substantial. When an outpatient location qualifies as provider‑based, the hospital may continue to bill for services furnished at that location under the Medicare Outpatient Prospective Payment System (“OPPS”), rather than under the Medicare Physician Fee Schedule (“MPFS”). Provider‑based status, however, carries implications far beyond Medicare payment rates. It affects beneficiary cost‑sharing obligations, state licensure requirements, Medicare enrollment status and the applicability of extensive Conditions of Participation to each Medicare‑enrolled location.

What are the penalties for non-compliance?

Billing a facility as provider-based without meeting applicable regulatory requirements carries significant financial risk. When a hospital improperly treats a facility as provider-based, it may receive higher reimbursement than permitted, creating overpayment liability. The longer the facility has operated under an improper provider-based designation, the greater the potential exposure. In addition to repayment obligations, hospitals may also face liability under the False Claims Act if the government determines that the improper claims were knowingly submitted.

What was the previously established process for hospitals to mitigate the risk associated with non-compliance?

Due to the significant financial risk associated with noncompliance, the Centers for Medicare and Medicaid Services (“CMS”) created a voluntary pathway to validate compliance with these rules: the submission of a provider-based attestation. Through this pathway, hospitals may submit a provider-based attestation to CMS for review and approval.

Submitting an attestation is no small undertaking. The submission typically includes hundreds of pages of supporting documentation and requires extensive follow-up with the applicable Medicare Administrative Contractor and, in some cases, the CMS regional office. The process takes months, not weeks. However, the benefit is often perceived as worth the cost because an approved attestation meaningfully reduces the risk that CMS will attempt to recoup overpayments resulting from future findings of noncompliance with the provider-based rules.

Why is Congress now changing requirements?

Although the provider-based rules have been in place for years, CMS has historically devoted limited resources to monitoring and enforcement. While CMS can identify hospitals that voluntarily submitted provider-based attestations, many hospitals chose not to participate. Meanwhile, in Congress, a debate has raged over whether to reduce reimbursement for off-campus HOPDs by applying lower physician office rates to certain services on the rationale that hospitals may be billing hospital-level rates at facilities that are not really operating as an integrated component of a hospital (policies often referred to as “site-neutral” payment cuts).

Against this backdrop, Congress ultimately declined to pursue additional site neutral payment cuts in the CAA 2026. However, it moved forward with a companion provision: making the provider-based attestation process mandatory—rather than voluntary—for off-campus HOPDs and increase enforcement. In addition, Congress required off-campus HOPDs to obtain NPIs that are distinct from the main hospital’s NPI. The Congressional Budget Office’s decision to score this provision as yielding savings to CMS reflects an expectation that certain off-campus HOPDs will no longer be permitted to bill as provider-based.

The New Requirements

Beginning January 1, 2028, compliance with the provider‑based rules will no longer be presumed for off‑campus HOPDs when a claim is submitted without the following requirements being met:

1. Mandatory Attestations: Hospitals operating off‑campus HOPDs must submit an “initial” provider‑based attestation for each off-campus HOPD during a defined two-year lookback period in advance of January 1, 2028. Thus, to qualify for provider‑based status and bill accordingly on January 1, 2028, an off‑campus HOPD must have submitted an attestation at some point between January 1, 2026 and December 31, 2027.

This requirement is not a one‑time exercise. CAA 2026 further mandates that the Secretary of the U.S. Department of Health and Human Services (“HHS”) establish a timeframe for submitting subsequent attestations after the initial one.

2. Separate Provider Identification Numbers: In addition, CAA 2026 requires off‑campus HOPDs to obtain and use separate NPIs for each off‑campus department. Historically, many hospitals have billed services furnished at off‑campus HOPDs under a single hospital‑level NPI. Mandating distinct NPIs at the individual facility level enables CMS to directly link Medicare claims and enrollment locations to specific off‑campus locations, rather than to the hospital as a whole.

In addition to these requirements, Congress has allocated resources under the CAA 2026 for increased monitoring and enforcement, directing the Secretary to establish a process for assessing compliance with these requirements through “site visits, remote audits or other means.”

Outstanding Questions

Hospitals that previously undertook the resource‑intensive process of submitting a voluntary provider‑based attestation may wonder what their obligations are. Unfortunately, the legislation appears to require submission of an attestation during the two‑year lookback period preceding January 1, 2028, even where a hospital has already obtained prior CMS approval. It remains to be seen whether CMS will create efficiencies by allowing hospitals to rely, in whole or in part, on previously submitted materials. The statute also leaves unanswered questions about the frequency of future attestations. As noted, the attestation process imposes significant administrative burdens, and repeated submissions could meaningfully strain hospital compliance and operational resources. Also uncertain is the scope and intensity of CMS’s anticipated monitoring and enforcement activities.

Finally, Congress directed the Secretary to ensure compliance with 42 C.F.R. § 413.65 “or a successor regulation.” The reference to a successor regulation could signal that CMS intends to revisit not only the procedural requirements for submitting an attestation, but the substantive requirements for provider‑based status themselves.

Next Steps

First, hospitals should begin reviewing their compliance with the provider-based requirements now. Submitting an attestation takes months—not weeks—and this assumes that no potential gaps in compliance have been identified, and there are no ambiguities in regulatory interpretation to work through. In order to ensure continuity in hospital-based billing on January 1, 2028, hospitals need to have their ducks in a row well in advance. Particular attention should be paid to legacy determinations that have not been revisited as staffing models, financial integration, clinical services or governance structures have evolved. Hospitals should also begin planning for the operational impact of location‑specific NPIs, including necessary updates to billing, revenue cycle and compliance procedures.

Second, stay tuned for this year’s annual rulemaking process where requirements will be defined in greater detail. While the legislation targeted off-campus HOPDs (and the OPPS proposed rule is typically released in early July); provider-based rules are also applicable to certain inpatient facilities, and CMS could choose to address as early as the Inpatient Prospective Payment System (“IPPS”) rulemaking this spring.  

Hospitals that move quickly and take a proactive, enterprise‑wide approach to reassessing provider‑based compliance for all off-campus HOPDs will be best positioned to preserve hospital‑level payment and avoid disruptive reimbursement and enforcement consequences in 2028 and beyond.

In addition to HOPDs, provider-based rules also apply to inpatient remote locations and satellite facilities.