Hospitals Face 2028 Deadline for Mandatory Off-Campus NPI and Attestations
Key Takeaways
- The Consolidated Appropriations Act of 2026 mandates that all off-campus hospital outpatient departments (HOPDs) obtain unique National Provider Identifiers and submit formal compliance attestations.
- Hospitals must meet these new transparency requirements by January 1, 2028, to maintain eligibility for Medicare payments under the Outpatient Prospective Payment System.
Mentioned
Key Intelligence
Key Facts
- 1The Consolidated Appropriations Act of 2026 (HR 7148) was signed into law on February 3, 2026.
- 2Mandatory NPI and provider-based attestations are required for all off-campus HOPDs by January 1, 2028.
- 3Off-campus departments are generally defined as facilities more than 250 yards from the main hospital campus.
- 4Failure to comply will result in the loss of Medicare payments under the Outpatient Prospective Payment System (OPPS).
- 5Initial attestations must be submitted to CMS no later than December 31, 2027.
Who's Affected
Analysis
The enactment of the Consolidated Appropriations Act of 2026 (HR 7148) marks a definitive end to the "honor system" that has long characterized hospital provider-based billing. Signed into law on February 3, 2026, the Act introduces Section 6225, which mandates that all off-campus hospital outpatient departments (HOPDs) obtain a unique National Provider Identifier (NPI) and submit formal attestations of compliance to the Centers for Medicare and Medicaid Services (CMS). With a hard deadline of January 1, 2028, the healthcare industry is facing a significant regulatory shift that prioritizes transparency and site-specific accountability over administrative convenience.
Historically, hospitals have enjoyed a degree of flexibility regarding provider-based status. While the 42 C.F.R. § 413.65 regulations defined what constituted an "off-campus" department—generally any facility located more than 250 yards from the main hospital campus—the process of proving compliance was largely voluntary. Hospitals could choose to submit attestations to their Medicare Administrative Contractors (MACs) to mitigate the risk of future overpayment recoveries, but many opted out to avoid the administrative burden. The new law eliminates this optionality, effectively turning a risk-mitigation strategy into a prerequisite for reimbursement.
Hospitals could choose to submit attestations to their Medicare Administrative Contractors (MACs) to mitigate the risk of future overpayment recoveries, but many opted out to avoid the administrative burden.
The implications for hospital systems are profound. To maintain eligibility for payments under the Outpatient Prospective Payment System (OPPS), facilities must now ensure every off-campus site is individually identifiable through its own NPI. This move is widely viewed by industry analysts as a precursor to more aggressive "site-neutral" payment reforms. By forcing hospitals to distinguish between services provided on-campus versus off-campus at a granular level, the federal government is building the data infrastructure necessary to align reimbursement rates across different care settings. If CMS can track exactly where a service was performed via a unique NPI, it becomes much easier to justify paying the same rate for a procedure regardless of whether it happened in a hospital-owned clinic or an independent physician's office.
The compliance burden will be particularly heavy for large, integrated delivery networks that have expanded rapidly through acquisitions. These organizations must now conduct comprehensive audits of their real estate portfolios to determine which sites meet the 250-yard threshold. Furthermore, the Act requires not just an initial attestation by December 31, 2027, but also subsequent attestations on a schedule yet to be determined by the Secretary of the Department of Health and Human Services (HHS). This suggests that provider-based status will become a recurring compliance hurdle rather than a one-time registration.
What to Watch
Legal and compliance departments should also brace for increased audit activity. The mandatory nature of these filings provides CMS and the Office of Inspector General (OIG) with a roadmap for enforcement. Discrepancies between an NPI's registered location and the actual physical site of service could trigger automatic denials or investigations into "upcoding" where off-campus sites are billed at higher on-campus rates. As the January 2028 deadline approaches, the priority for RegTech providers will be developing automated solutions that can track NPI registrations against geographic data and Medicare enrollment records to ensure continuous compliance.
Looking forward, this regulatory shift signals a broader trend toward transparency in healthcare billing. While the immediate focus is on HOPDs, the underlying logic—that the location of service should be transparent and verified—is likely to expand to other areas of Medicare billing. Hospitals that fail to modernize their provider enrollment and credentialing processes now risk not only the loss of OPPS payments but also significant reputational and legal exposure in an era of heightened federal oversight.
Timeline
Timeline
Legislation Enacted
President signs the Consolidated Appropriations Act of 2026, ending the voluntary attestation era.
Attestation Deadline
Final date for hospitals to submit initial provider-based attestations for existing off-campus sites.
Enforcement Begins
Mandatory NPI and attestation requirements take full effect for Medicare reimbursement eligibility.
Sources
Sources
Based on 2 source articles- National Law ReviewHospitals Face New Attestation and NPI Requirements for Off-Campus Outpatient Locations by January 1, 2028Feb 25, 2026
- National Law ReviewNew Provider-Based Requirements for Off-Campus Hospital Outpatient DepartmentsFeb 24, 2026