The 16,488 Signatures Medicare Wants Before 2028

If you run off-campus outpatient departments, you have 499 days to sign something. Nine somethings, on CMS's own average.

Section 6225 of the Consolidated Appropriations Act, 2026 took two ordinary administrative facts and made them conditions of payment.

Each off-campus department bills under its own NPI. The main provider has attested that the department meets the provider-based rules at 42 CFR 413.65.

Neither is new work. Provider-based compliance has been mandatory as long as the rules have existed, and the attestation has been sitting on MAC websites since BIPA.

What changes is what happens when nobody does it.

"What does an off-campus department get paid when no one signed for it?"

Nothing. Proposed 42 CFR 419.23, in the CY 2027 OPPS proposed rule (CMS-1850-P, 91 FR 41734, comments close August 31), says no payment may be made for items and services furnished on or after January 1, 2028 by an off-campus outpatient department that misses any of three conditions.

What Payment Turns On Now

The three conditions, in the order the rule imposes them:

1. The department has obtained an NPI separate from the main provider's, and the items and services are billed under it.
2. The main provider submitted an initial provider-based status attestation during the two-year period ending on the date those services are furnished.
3. The main provider submitted a subsequent attestation inside the interval CMS specifies. Proposed 413.65(b)(6) caps that at five years, and CMS says it will settle the details "in the 2028 rulemaking cycle."

The sequencing carries more weight than it looks. CMS proposes that a main provider obtain the NPI for each department and update PECOS before submitting an attestation, which puts enrollment upstream of the paperwork rather than beside it.

And the old regime is worth stating plainly, because it is the thing being repealed. CMS describes it this way: "provider compliance with provider-based rules is mandatory, but since the passage of [BIPA] a provider has needed to submit an attestation only if it wishes to obtain a CMS determination of provider-based status."

Compliance was always required. Proof of it was optional.