Return of Provider-Based Attestations – What It Means and How to Prepare

On February 3, 2026, the federal government signed the Consolidated Appropriations Act of 2026 (the “Act”) into law.  Section 6225 of the Act amends the Social Security Act to bring back the mandatory provider-based attestation (“Attestation”) requirements for off-campus outpatient departments (“Departments”) by the end of 2027.  These Attestation requirements remained optional for nearly 25 years but will now be mandatory for providers and their respective Departments.  To avoid the risk of losing federal reimbursement funding, providers should be aware of what these Attestations entail and how to prepare for their mandatory implementation.

For each currently-operating Department, the provider must submit an Attestation and accompanying documentation to CMS showing it meets certain provider-based requirements.  The requirements include licensure details, financial integration with its parent provider, and the ability to meet certain service requirements, among others.  It must also show that the Department is owned by its parent provider, that the provider exhibits sufficient supervision and control of the Department, and that the Department meets certain location requirements.  These Attestations are a substantial administrative burden and will require significant time for the provider to gather and compile sufficient information.

Critically, section 6225 of the Act creates an obligation that Departments obtain separate, distinct National Provider Identifiers (“NPIs”) for each Department.  Departments cannot operate under a single, blanket NPI for purposes of Medicare reimbursement, such as operating under the parent provider’s NPI; rather, each and every location must apply for and obtain an NPI.  Large providers with multiple Departments must understand and prepare for the greater administrative burden resulting from this requirement.

If a Department fails to adhere to these requirements by January 1, 2028, CMS will refuse to remit applicable Medicare payments to said Department.  Departments must collect and file the required information above by December 31, 2027, or risk the loss of Medicare reimbursement, meaning providers with Departments should begin the preparation process as soon as reasonably possible.

To prepare for these changes to take effect, a provider should consider the following steps:

1. Conduct an overall compliance review to determine if the specific Department’s billing practices are currently in compliance with applicable law. Providers should identify and correct any noncompliance before applying for NPIs and developing Attestations. 
2. Begin applying for and obtaining NPIs for each Department, knowing that providers with multiple Departments should begin this process sooner, due to the administrative burden.
3. Develop Attestations for each Department. Providers should feel free to utilize existing CMS attestation forms to begin this process, as CMS has not yet released new forms or detailed a new process. 

As long as a Department obtains an NPI and properly submits an Attestation by December 31, 2027, it should not see an impact to its Medicare reimbursement.