CMS proposes new 340B reporting and HOPD attestation requirements

Recently published editions of two annual Medicare proposed rules both included provisions creating new administrative tasks for hospitals.

CMS’s proposed rule for hospital outpatient care would formalize a system of required attestation for off-campus hospital sites starting in 2028, while the rule for physician payments would establish obligatory submission of 340B-related data to a centralized repository once the calendar turns to 2027.

CMS proposes mandatory 340B Part D data reporting

The 2027 proposed rule for the Medicare Physician Fee Schedule would set up a data repository to which 340B covered entities (i.e., providers) would submit 340B-related Medicare Part D claims data starting Jan. 1, 2027. CMS intends to assess whether the data can be used to exclude 340B claims from calculations of Part D inflation rebates.

Under the Inflation Reduction Act (IRA), manufacturers pay rebates to CMS when a Part B or Part D drug price increase exceeds inflation. But manufacturers do not owe rebates on drugs that also are subject to 340B discounts. In prior rulemaking, CMS estimated that between 10% and 35% of Part D claims therefore would be ineligible for inflation-based rebates.

To ensure manufacturers avoid paying what would amount to two discounts on the same drug, CMS has been estimating and subtracting the total number of 340B units for the Part D drugs that generate inflation rebates. To make the process more precise, the agency wants to test mandated use of a data repository.

Covered entities would submit claims data quarterly

Data submission to the repository by providers would take place quarterly and would entail the following elements for all 340B Part D claims, including for drugs dispensed by contract pharmacies:

• Date of service
• Prescription reference number
• Fill number
• National provider identifier for the dispensing pharmacy
• National Drug Code
• Claim record indicator

Third-party administrators can submit data on behalf of a covered entity, although CMS says the provider is responsible for ensuring accuracy. The repository is expected to launch in Fall 2026, and covered entities are encouraged to use it voluntarily prior to Jan. 1.

CMS clarified that the current system of 340B-unit estimates would, for the time being, remain as the mechanism for avoiding duplicate discounts. Before using the repository to make those determinations, the agency would issue a subsequent proposed rule with a comment period.

While data submission to a repository represents another administrative mandate for providers, advocates previously said use of such a clearinghouse would be preferable to data submission directly to manufacturers in the upcoming 340B rebate model. A goal of the rebate model, which also begins Jan. 1, 2027, is to ensure manufacturers avoid paying duplicate discounts if a drug is subject to both 340B and negotiated prices under the IRA.

If the data repository proves effective at preventing duplicate discounts between 340B and Part D inflation rebates, it theoretically could serve the same purpose with respect to 340B and Medicare-negotiated prices. The need for a rebate model potentially would be mitigated.

CMS published a companion guide with additional information on submitting data to the new repository.

Off-campus HOPDs would face mandatory attestations

The 2027 proposed rule for the Outpatient Prospective Payment System includes provisions implementing requirements relating to Medicare billing by off-campus hospital outpatient departments (HOPDs).

As legislated in the Consolidated Appropriations Act of 2026, the billing requirements take effect Jan. 1, 2028. The parent organization must obtain a separate national provider identifier (NPI) for each HOPD and make corresponding updates to Provider Enrollment, Chain and Ownership System (PECOS) records, according to the proposed rule.

Administratively, the most noteworthy requirement may be to attest that each HOPD complies with Medicare’s provider-based criteria. Attestation processes have been in place previously but were optional.

CMS outlines timing and enforcement for HOPD attestations

The attestation requirements apply to HOPDs that are not on the hospital’s main campus or within 250 yards of a remote hospital location. HOPDs operating as of Jan. 1, 2028, would need to submit their initial attestations by Dec. 31, 2027. New HOPDs would have to attest within two years before starting operations, with CMS likely completing its substantive review after the facility opens.

CMS is proposing a standardized electronic attestation form and centralized submission system. Providers can use the existing process if they want to attest before the new system is in place.

Subsequent attestations would be required at an interval to be determined, not to exceed five years. The agency seeks comment as to whether hospitals that already have an affirmative provider-based determination should receive a streamlined re-attestation process.

Enforcement would entail a risk-based review system starting with automated checks for completeness and consistency with CMS and PECOS data. Higher-risk or problematic submissions would be subject to documentation reviews, data analysis, remote audits and site visits.

As described in the rule, a noncompliance determination could lead to recovery of excess Medicare payments (based on the outpatient rate compared with the physician payment rate). Off-campus HOPDs that fail to demonstrate provider-based status also would lose 340B eligibility.

Hospitals may need extensive compliance documentation

Hospitals should prepare to document compliance in areas such as:

• Location requirements
• State/local licensure
• Clinical integration
• Financial integration
• Public awareness of the HOPD’s relationship to the hospital
• EMTALA and other applicable obligations
• Site-of-service billing and beneficiary financial notices
• Ownership, administrative integration, control and supervision

An HOPD could bill Medicare as provider-based after submitting its attestation, rather than waiting for CMS to complete its review, according to the proposed rule. CMS subsequently could audit the department or conduct a site visit.

The agency seeks comment as to whether hospitals that already have an affirmative provider-based determination should receive a streamlined re-attestation process.

Health systems can begin preparing for the requirements

As described in an analysis by attorneys with Dinsmore and Sholl, LLP, hospitals should act on the attestation requirements soon — even before the rule is finalized in November. Early steps can include inventorying all off-campus HOPDs, reviewing whether each satisfies the provider-based criteria, and determining which sites need separate NPIs.

Other steps include checking PECOS information, gathering documentation supporting each site’s provider-based status, and establishing processes for ongoing compliance and future attestations.

“Although the rule is not yet final, hospitals should begin evaluating the required information now,” according to the analysis. “Health systems with numerous off-campus departments may need significant time to assess compliance with the provider-based regulations, obtain separate organizational NPIs and assemble supporting documentation before the statutory deadline.”