CMS’s New Medicare Attestation Requirement: What RCM Teams Need to Do Now

Most hospitals and health systems rely on a third-party clearinghouse or eligibility vendor to verify Medicare eligibility. CMS refers to these organizations as “trading partners” and a new mandate requires that your relationship with them be formally documented. If yours is one of them, this requires your direct attention and your direct action — and the clock is ticking.

What Changed

The Centers for Medicare & Medicaid Services has implemented new attestation requirements for accessing Medicare eligibility data through the HIPAA Eligibility Transaction System (HETS). Under this mandate, healthcare providers must now explicitly authorize the trading partners that perform Medicare eligibility verification on their behalf. This isn’t a vendor-specific policy. It applies across all Medicare eligibility verification vendors and affects every hospital and health system using a third party to query Medicare data.

On May 11, 2026, CMS will transition to a new HETS trading partner management system. After that date, any NPI without an active enrollment will have its eligibility requests rejected outright. There is no grace period.

Why This Matters for Revenue Cycle

Eligibility verification is the foundation of a clean revenue cycle. When Medicare eligibility queries are interrupted or unauthorized, downstream effects are immediate: claim denials rise, patient liability estimates become unreliable and staff are forced into manual workarounds that slow the entire front-end process.

The attestation requirement means that any trading partner, regardless of how long they’ve been querying Medicare data on your behalf, now needs explicit documented authorization tied to your organization’s National Provider Identifier(s). Without it, Medicare eligibility verification cannot be performed.

What the Process Looks Like

The good news is that the attestation process itself is straightforward. For most organizations, it requires approximately 10 to 15 minutes per NPI and is typically completed within one to two business days, though RCM leaders should plan for up to five business days to account for CMS processing time.

The process involves three core steps:

1. Coordinate with your Revenue Cycle, IT and Compliance teams to align on scope and prepare the necessary information.

2. Complete the CMS attestation through your vendor’s portal by providing facility information, applicable NPIs and formal confirmation of authorization.

3. Receive confirmation that Medicare eligibility verification has been activated for your attested NPIs.

Non-Medicare eligibility services including commercial, Medicaid and others are unaffected and can continue without interruption.

What RCM Leaders Should Do Now

With the May 11, 2026 deadline quickly approaching, RCM directors and managers should move quickly on three fronts: identify all NPIs in use across your organization, confirm which trading partners are performing Medicare eligibility queries on your behalf and initiate the attestation process without delay. For larger health systems with multiple facilities and NPIs, coordinating this across sites will require more lead time than the process itself suggests.

This is a one-time attestation, but it needs to happen before Medicare eligibility verification can continue uninterrupted. Getting ahead of it now protects your organization’s cash flow and keeps your front-end revenue cycle running without disruption.

Talk to Our Experts

Whether you’re already verifying Medicare eligibility through Office Ally or looking to start, the CMS trading partner attestation requirement affects you directly. We understand the process and are ready to guide your team through it. Reach out today and let’s get your attestation completed.

‍