The Consolidated Appropriations Act (CAA) of 2026 introduces a major change for hospitals. Starting January 1, 2028, the Centers for Medicare & Medicaid Services (CMS) may stop reimbursing services delivered in off-campus provider-based departments (PBDs) unless organizations complete Provider-Based Attestations (PBAs) and assign a unique National Provider Identifier (NPI) to each site.
For health system leaders, this is more than a filing requirement. It can affect reimbursement, network expansion, service line distribution, and value-based care models.
Why this Matters
Mandatory PBAs can create operational work and financial exposure that executive teams should plan for now:
- Revenue exposure: If PBAs are not completed by 2028, payments for affected sites may be discontinued.
- Program implications: Provider-based status can affect eligibility for 340B, disproportionate share hospital (DSH) payments, uncompensated care pools, and cost-based reimbursement methodologies.
- Site-neutral pressure: CMS continues to pursue payment parity approaches that increase scrutiny of off-campus locations and can add margin pressure.
- How sites are represented: Accurate public-facing representation, directory management, and payer alignment can affect patient experience and contracting.
In practice, PBAs tend to become a multi-year effort across operations, finance, compliance, and revenue cycle, not a one-time paperwork task.
Which Off‑Campus Locations Fall Under the Requirement
The requirement applies to off-campus PBDs that operate more than 250 yards from the main hospital building and are within 35 miles of the main campus or remote locations.
Sites generally need to be able to demonstrate compliance with 42 C.F.R. § 413.65, including:
- Integration with hospital governance and financial systems
- Clinical leadership oversight
- Appropriate licensure and public signage
- Consistent representation in digital and physical environments
For network planning, this can influence site strategy, expansion timelines, and capital planning.
What Changes Are Starting in 2028
- Unique NPIs for each off-campus department, which can require coordinated updates across the Provider Enrollment, Chain, and Ownership System (PECOS), payer files, directories, digital front door, billing platforms, and cost reporting.
- Initial PBAs are due December 31, 2027; the submission window runs from January 1, 2026, through December 31, 2027.
What Ongoing Compliance May Look Like
Reconfirmations may move to a new two-year CMS cycle.
What to Expect from CMS Oversight
- Organizations should be prepared for site visits, documentation reviews, audits, and validation of clinical and financial integration.
- As of now, CMS has not issued guidance for new site openings after January 1, 2028.
Immediate Priorities for Executive and Strategy Leaders
Given the scale of work and potential Medicare Administrative Contractor (MAC) review bottlenecks, many health systems are starting with these actions:
- Assign clear project leadership and dedicate resources.
- Build PBA requirements into capital planning, facility strategy, and network planning.
- Plan for increased administrative workload and payer-facing updates.
- Identify higher-risk sites where integration documentation is incomplete.
A Practical Way to Structure Provider‑Based Attestation Work
Phase 1: Program mobilization (now through Q2 2026)
- Set governance across compliance, legal, finance, operations, and revenue cycle.
- Build a complete inventory of off-campus locations.
- Conduct a gap analysis against 42 C.F.R. § 413.65, focusing on integration, signage, EMTALA, billing accuracy, and cost reporting alignment.
Phase 2: Operational alignment (Q3 2026 through Q1 2027)
- Obtain NPIs and update associated systems and directories.
- Centralize org charts, leases, integration documentation, signage evidence, and related workflows.
- Address gaps in clinical oversight, billing integrity, and cost reporting.
Phase 3: Attestation submission (Q1 2027 through Q4 2027)
- Prepare, review, and submit PBAs for each location.
- Consider a legal review as part of the process, based on your organization’s risk profile.
- Track submissions and plan for Medicare Administrative Contractor (MAC) follow-up.
Final deadline: December 31, 2027.
Phase 4: Ongoing readiness (2028 and beyond)
- Maintain documentation and update NPIs as services evolve.
- Put change-control processes in place for relocations and service expansions.
- Stay ready for audits and reconfirmation cycles.
Mandatory PBAs may require health systems to take a fresh look at how off-campus sites are governed, integrated, and represented. The earlier teams start, the more options they tend to have to prioritize work and address gaps before deadlines.
If you are assessing how provider‑based attestations could affect your off‑campus footprint, reimbursement, or long‑term network strategy, BDO can help. Schedule a meeting with us today.