What Federal Billing Transparency Rules Actually Require, What Patients Can Really Do Before a Bill Hits Collections, and Where the No Surprises Act and Price Transparency Rules Have Quietly Failed
Video Preview
🎧 Part I Podcast free on Spotify.
🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Abstract
Why the chargemaster produces a thousand dollar doxycycline pill
What HIPAA actually says about sending a bill to collections
The rule with real teeth that almost nobody cites
Price transparency after the 2026 rewrite
The No Surprises Act worked for patients and broke for everybody else
The good faith estimate gap and the advanced EOB that never showed up
The credit reporting rule that died and the state laws that may die next
Cash pay arbitrage and what the subsidy cliff did to the self pay population
What is actually investable in all of this
Table of Contents
Viral billing posts are usually right about the outrage and wrong about the mechanism. The legal protections people cite (HIPAA consent before collections) mostly do not exist, and the ones that do exist (Section 501(r) reasonable efforts, amounts generally billed, FDCPA validation, state notice periods) almost never get cited.
Hospital price transparency was materially rewritten in the CY 2026 OPPS final rule: the estimated allowed amount placeholder is gone, hospitals must now encode actual dollar amounts derived from 12 to 15 months of claims history, a named senior executive must attest the file is true, accurate and complete, and CMS began enforcing on April 1, 2026. CMS declined to shield that attestation from False Claims Act theories.
The No Surprises Act is a genuine consumer win and a spectacular administrative failure. Roughly 2.6 million disputes were initiated in 2025, providers collected close to $15 billion through IDR versus about $4.1 billion in 2024, the top ten initiating parties drove roughly 70 percent of volume, and about 42 percent of disputes got challenged as ineligible.
The advanced explanation of benefits for insured patients still does not exist. The good faith estimate only protects self pay patients, and the dispute path only opens at a $400 variance.
The CFPB medical debt rule was vacated in July 2025 in the Eastern District of Texas, on a joint request from the plaintiffs and the Bureau itself. The same opinion held that FCRA preempts state medical debt reporting bans, which puts roughly 15 state statutes on shaky ground.
Enhanced premium tax credits expired December 31, 2025. Marketplace enrollment fell to about 23 million from 24.2 million, average net premiums rose 58 percent, and a lot of people just left. The self pay population is growing, and cash prices are frequently below negotiated commercial rates.
Investable surface area: transparency data normalization, denial and appeal automation, cash pay routing, and 501(r) eligibility screening. The moat is data quality, not data access.
Why the chargemaster produces a thousand dollar doxycycline pill
Start with the viral one, because it is a perfect teaching case. Guy is far from a VA, gets a tick bite, goes to a hospital, walks out with a bill he describes as a thousand dollars for one doxycycline pill and a glass of water. Everyone in the replies concludes the hospital marked up a generic antibiotic by roughly four thousand percent, which is a reasonable read and also not what happened. What almost certainly happened is that the emergency department billed a facility fee, probably a level three or level four visit under the 99283 or 99284 evaluation and management codes, and that facility fee lives in revenue codes in the 045x range with a gross charge that routinely lands anywhere from eight hundred to two thousand dollars depending on the hospital. The physician bills separately under a professional fee, often through a staffing group the patient has never heard of. The doxycycline itself shows up on a 025x pharmacy line at maybe thirty to eighty dollars against an acquisition cost of well under a dollar. The pill is a rounding error. The room was the product.
The reason the gross charge exists at all is a fossil from cost based reimbursement, when hospitals got paid a percentage of charges and the charge master was the actual price list. Prospective payment killed that for Medicare in 1983 and commercial contracts moved to case rates and fee schedules over the following two decades, but the charge master never went away, because charges still drive money in four places that matter. Medicare outlier payments are computed by running billed charges through a facility specific cost to charge ratio, so inflating charges pulls more cases over the fixed loss threshold until CMS reconciles the ratio, which happens on a lag. Percent of charge contracts survive in workers compensation, auto medical payments, some out of state Medicaid, and a nontrivial share of smaller commercial plans. Out of network billing keys off charges. And 340B spread economics are computed against charge based benchmarks in some contract structures. The national average charge to cost ratio sits somewhere around four to one, with a long right tail of investor owned facilities running eight to one and up. Nobody sat in a room and decided doxycycline should cost a thousand dollars. A dozen unrelated reimbursement mechanics each rewarded charge inflation a little, for forty years, and this is the sediment.
One more thing about the tick bite specifically, since the veteran angle got lost in the replies. Emergency care at a non VA facility for an enrolled veteran can be covered under the community care rules, but unauthorized emergency treatment claims run through a separate statutory pathway with a filing window that closes fast, in some cases ninety days from the date of care. Missing that window is not a billing error, it is a jurisdictional problem, and it is one of the more common ways a veteran ends up personally holding a bill that a federal program would have paid two weeks earlier.
What HIPAA actually says about sending a bill to collections
The claim circulating right now is that a provider needs signed HIPAA authorization before it can send an account to a collection agency, and that absent that signature the placement is a privacy violation the patient can leverage into a write off. This is wrong in the way that a lot of confidently repeated legal advice is wrong, which is that it takes something real and files off the qualifiers until it becomes useful and false.
The Privacy Rule permits covered entities to use and disclose protected health information for treatment, payment, and health care operations without authorization. The definition of payment in the regulation explicitly includes collection activities. So a hospital placing a delinquent balance with an agency is doing something the rule contemplates by name. The agency becomes a business associate, needs an agreement, and inherits the same obligations. No signature required, no leverage there.
Where the kernel of truth lives is the minimum necessary standard. A collector working a medical account needs identifying information, dates of service, and the amount owed. It does not need diagnosis codes, procedure detail, medication names, or clinical notes, and there are plenty of real cases where the placement file carried far more than that, or where a dunning letter listed a procedure description that told a mail carrier something about a patient’s body. That is an actual violation, it is enforced by the Office for Civil Rights rather than by private lawsuit, and it is worth complaining about. There is also a genuinely underused right in the same part of the regulation: a patient who pays in full out of pocket for a service can require the provider not to disclose that encounter to their health plan. For anyone doing cash pay for anything sensitive, that restriction is mandatory on request, not discretionary, and almost nobody asks for it.
The protections that do the actual work are elsewhere and are boring. Third party collectors are covered by the Fair Debt Collection Practices Act, which the hospital itself generally is not, and Regulation F requires a validation notice with an itemization date and a set of specific disclosures, caps call frequency, and gives a thirty day window in which a written dispute forces verification before collection resumes. Several states layer on top of that. Texas requires an itemized bill in plain language before an account can be placed at all, and separately requires providers to bill within eleven months of service. A number of states have added notice periods running sixty days or more before collection activity can begin. None of this is as satisfying as a magic HIPAA sentence, and all of it works better.
The rule with real teeth that almost nobody cites
If a nonprofit hospital sends someone to collections, the single most useful thing that patient can know is Section 501(r) of the Internal Revenue Code, and it is remarkable how rarely it appears in the discourse given that roughly sixty percent of community hospitals are nonprofits.
The structure is straightforward. A tax exempt hospital must maintain a written financial assistance policy and publicize it. It cannot charge anyone eligible under that policy more than amounts generally billed for emergency or medically necessary care, which in practice means something close to what commercial insurers and Medicare actually pay rather than the gross charge, computed either by a look back method or prospectively. And before taking what the regulation calls extraordinary collection actions, the hospital must make reasonable efforts to determine whether the patient is eligible for assistance. Extraordinary collection actions is a defined term that covers reporting to credit bureaus, selling the debt, filing suit, garnishing wages, placing a lien, and denying or deferring care because of an unpaid prior bill.
The timing is the part worth memorizing. The notification period runs 120 days from the first post discharge billing statement, during which no extraordinary collection action is permitted. The application period runs 240 days from that same statement, during which the hospital must accept and process a financial assistance application, and if someone applies on day 239 after already being sued, the hospital has to unwind what it can, including reversing credit reporting and refunding overpayments above the amounts generally billed figure. A patient who knows the phrase reasonable efforts and the number 240 has more practical leverage than a patient who knows the entire Privacy Rule.
The catch is enforcement, which is close to theoretical. The excise tax for community health needs assessment failures is fifty thousand dollars per facility, which is not a deterrent for a system doing four billion in net patient revenue, and revocation of exempt status has happened approximately never. The Providence episode remains the cleanest illustration of what weak enforcement produces: internal collection scripting that pushed staff to seek payment from patients who qualified for free care, followed by a state attorney general action and a settlement north of $150 million in refunds and forgiveness. That outcome came from a state consumer protection statute and a newspaper, not from the IRS. North Carolina got roughly $6.5 billion in debt cleared for about two million residents by attaching conditions to enhanced hospital directed payments, which is to say by paying for it. Neither of those is a federal enforcement mechanism. They are workarounds for the absence of one.
Price transparency after the 2026 rewrite
The hospital price transparency rule has been in effect since January 2021 and for most of that time the honest assessment was that hospitals had learned to comply with the letter while producing files that were useless for comparison. Everyone in the data business knows the specific dodges: posting an estimated allowed amount instead of a negotiated dollar figure, burying rates in free text fields, using payer and plan naming conventions that match nothing, omitting the algorithm behind percentage based arrangements, and publishing files large enough to be technically available and practically unparseable. Compliance statistics diverged wildly depending on methodology, with vendor analyses reporting posting rates in the high eighties and above while advocacy groups measuring completeness reported full compliance in the twenties.
Executive Order 14221 in February 2025 told the agencies to require disclosure of actual prices rather than estimates, to standardize the output, and to update enforcement. The CY 2026 OPPS final rule, published November 21, 2025, delivered the substance. The estimated allowed amount placeholder is eliminated. Hospitals must now encode allowed amounts data elements derived from 12 to 15 months of actual claims history, along with a count of the underlying claims, which means percentage based and algorithm based arrangements finally resolve into dollars a person can compare. The file must name the chief executive, president, or other senior official responsible for oversight of the data, and that individual must attest the information is true, accurate, and complete. The requirements took effect January 1, 2026, with enforcement beginning April 1, 2026.
The attestation is the interesting part and the reason general counsel offices have been unhappy. Commenters asked CMS to explain why a defective attestation could not support a False Claims Act theory, or to coordinate with the Department of Justice on a policy of dismissing such cases. CMS declined both, restating that the False Claims Act is outside the scope of the rulemaking. That is not a denial. A named executive signing a completeness attestation on a data file that a relator can independently download and analyze is a fairly novel exposure surface, and the first qui tam built on a demonstrably incomplete machine readable file is going to be an event. CMS has since issued a request for information in the CY 2027 proposed rule seeking comment on further standardization, free text field cleanup, and the consumer facing display, so the ratchet is still turning.
Whether any of this changes prices is a separate question. Transparency assumes a shoppable moment, and the guy with the tick bite did not have one. It matters most for employers, benefits advisors, and the small set of genuinely elective services where a patient has weeks to decide.
The No Surprises Act worked for patients and broke for everybody else
Give the law its due. Balance billing for emergency services, for out of network clinicians at in network facilities, and for air ambulance transport is substantially gone, and the anesthesiologist ambush that generated a decade of local news segments has mostly stopped generating them. Patients are held to in network cost sharing and the fight moves behind them. That is the design working.
Behind them, the fight has been carnage. Congressional Budget Office era projections contemplated something on the order of seventeen thousand disputes a year through independent dispute resolution. In the first half of 2025 alone, providers and payers initiated close to 1.2 million. In the back half, close to 1.4 million. Certified entities closed roughly 1.35 million in the first half and about 1.45 million in the second, which finally outpaced initiations and cleared most of a backlog that stood around 430,000 cases in June 2025. Speed improved too, with about 62 percent of payment determinations rendered inside thirty business days in the second half of 2025 versus 37 percent in the first half.
The economics tell the real story. Providers collected close to $15 billion through the process across 2025, up from roughly $4.1 billion in 2024. In the fourth quarter of 2025, payment determinations were made in 532,548 disputes, and in 462,973 of them the determination came in above the qualifying payment amount the plan had proposed. Read that ratio again. Baseball style arbitration with a batting average like that is not a neutral mechanism, it is an arbitrage, and the volume distribution confirms it: the top ten initiating parties accounted for roughly 70 percent of disputes in the first half of 2025, most of them private equity backed staffing and specialty groups with the operational infrastructure to file at industrial scale. Meanwhile about 42 percent of disputes were challenged as ineligible in the back half of the year, which means a huge share of the administrative burden is spent adjudicating whether the fight is even in the right building.
The most recent final rule lowers the administrative fee from $115 to $15 per case, well below the $150 floated in the proposal, on the theory that access for smaller providers matters more than volume suppression. That is a defensible policy call and also a fairly bold one given that volume suppression is the entire unsolved problem. Plans are already modeling premium impact. The consumer protection is intact and paid for, and the bill is arriving through the premium rather than through the mailbox.
The good faith estimate gap and the advanced EOB that never showed up
Here is the part of the No Surprises Act that nobody talks about because it never happened. The statute contemplated an advanced explanation of benefits for insured patients: before scheduled care, the plan would tell the member what the service is expected to cost them, based on provider submitted estimates. That is the provision that would have made price transparency personal, and it has been sitting in enforcement discretion since the beginning, waiting on rulemaking and on an interoperability standard for passing estimates from provider to plan that the industry has not agreed on. It is the single largest unshipped feature in the entire package.
What did ship is the good faith estimate, and it only applies to uninsured and self pay patients. A provider must give a written estimate of expected charges for scheduled services, and if the final bill exceeds that estimate by four hundred dollars or more, the patient can initiate patient provider dispute resolution for a twenty five dollar administrative fee. The requirement that a convening provider gather and include estimates from co providers, which is the part that would have made the estimate resemble the actual episode rather than one line item of it, has also been under enforcement discretion. So the self pay patient gets an estimate covering the surgeon and not the anesthesiologist, the facility, the pathologist, or the implant.
For anyone building in this space, note what that combination produces. The insured patient, who has the most complex cost exposure because of deductible position, accumulator design, and network tiering, gets nothing. The self pay patient gets a partial estimate and a dispute right that only triggers above a fixed dollar threshold that has never been indexed. And the four hundred dollar threshold is high enough that ordinary outpatient variance sails under it. This is why the market keeps trying to build advanced explanation of benefits functionality privately, why real time benefits check vendors keep pitching it, and why it keeps failing on the same rock, which is that nobody can reliably predict deductible position at the moment of scheduling because claims are still in flight.
The credit reporting rule that died and the state laws that may die next
In January 2025 the Consumer Financial Protection Bureau finalized a rule removing medical debt from consumer credit reports and barring lenders from considering it, which the Bureau estimated would strip about $49 billion in reported debt from the files of roughly 15 million people. It never took effect. On July 11, 2025, the Eastern District of Texas vacated it in Cornerstone Credit Union League v. CFPB, holding it exceeded the Bureau’s authority and conflicted with the Fair Credit Reporting Act, and the striking procedural detail is that the Bureau joined the plaintiffs in asking for that result. Regulatory self defenestration is not common.
What survives is a patchwork. The three bureaus made voluntary changes in 2022 and 2023 that removed paid medical collections regardless of amount, excluded unpaid medical collections under five hundred dollars, and imposed a one year waiting period before new medical collections can be reported at all. Those policies are still in place and by the Bureau’s own estimate they already removed something like seventy percent of medical tradelines. VantageScore 4.0 excludes medical collections outright and FICO 9 weights them down, so much of the score impact was already neutralized before the rule was written. About fifteen states have enacted their own bans.
Which brings up the part that should worry anyone running revenue cycle across state lines. The same Texas opinion held that FCRA expressly preempts state laws regulating what appears on consumer reports. If that reasoning holds and travels, the Colorado, New York, California, Delaware and Virginia style statutes are all sitting on a fault line, and a provider organization that reconfigured its collection policies state by state may find the ground moving in both directions. Nobody should be building compliance architecture on the assumption that this is settled.
The underlying numbers have not moved much regardless of what the rules say. KFF’s analysis of federal survey data puts roughly 23 million adults holding medical debt above the two hundred fifty dollar threshold and at least $220 billion in total, with about 14 million owing more than a thousand and roughly 3 million owing more than ten thousand. Broader definitions that capture medical bills moved onto credit cards, installment plans with providers, and money borrowed from family push the affected population toward a hundred million. And the tell on face value is the secondary market. Charities buying medical receivables have historically paid around a penny on the dollar. A market that clears at one percent of face is telling you exactly what the number on the statement means.
Cash pay arbitrage and what the subsidy cliff did to the self pay population
The third viral post in the set is the one worth the most attention from anyone building a company. A woman priced out of the individual market, quoted twenty one hundred a month with an eighteen thousand dollar deductible, decides to self insure, and then discovers that a cash pay ultrasound runs sixty dollars and a cash pay CT runs three hundred twenty eight. Her point is not that she found a hack. Her point is that the insured version of the same two scans, at a hospital outpatient department, would have generated a facility fee, a professional fee, and a follow up bill somewhere between two hundred and five hundred dollars, all of it applied against a deductible she was never going to meet.
The math is real and it is a site of service story before it is an insurance story. A freestanding imaging center running high volume on owned equipment has a marginal cost per study in the low double digits and prices cash accordingly. The identical study at a hospital outpatient department carries the facility overhead allocation, which is why site neutral payment reform keeps showing up in Medicare Payment Advisory Commission recommendations and keeps dying in committee. And the transparency files have made something visible that used to be folklore: for a meaningful share of shoppable services, the posted cash price is below the negotiated commercial rate. An insured patient in deductible is frequently paying more than the uninsured patient standing next to them, which is a sentence that should not be true and is.
Context matters here, and the context got worse. Enhanced premium tax credits expired December 31, 2025. Marketplace enrollment for 2026 came in around 23 million, down from 24.2 million, and average monthly premium payments net of credits rose 58 percent, from roughly $113 to $178. A lot of that increase was absorbed by people buying down into bronze plans with higher deductibles, and the people facing the steepest increases, those who lost credit eligibility entirely above 400 percent of the federal poverty level, left the market at disproportionate rates. A handful of states put money in, with New Mexico fully replacing the expired subsidies and Connecticut committing seventy million, and a few others used premium alignment tactics to redirect what federal subsidy remains. None of that scales.
So the self pay population is growing, it is skewing toward people who used to be insured and therefore have expectations about care access, and it is arriving with a smartphone and a price comparison habit. That is a different customer than the traditionally uninsured. Buying down into a bronze plan and functionally self funding everything below the deductible produces the same behavior. Both cohorts are shopping.
What is actually investable in all of this
The tempting read is that transparency data is now a commodity because the files are public and the 2026 rule standardizes them. That read is wrong for at least a few more years, because standardization of a schema is not standardization of semantics. Hospitals will encode allowed amounts data elements from claims history using different claim populations, different treatment of denied and partially paid claims, different handling of bundled services, and payer and plan naming that still resolves to nothing consistent across systems. Somebody has to build and maintain the crosswalk between what a file says and what a specific member under a specific plan would actually be charged. That is entity resolution work, it decays continuously, and it is a real moat. The executive attestation requirement also creates a new commercial category on the hospital side, which is data assurance before a named person signs, because that signature now carries exposure a compliance officer will pay to reduce.
The second area is denial and appeal automation, which is the largest under exploited surface in patient facing health tech. Marketplace issuers deny something like a fifth of in network claims and consumers appeal well under one percent of them. That is not a preference, it is a friction problem, and friction problems are what software is for. The interesting versions are not chatbots that write appeal letters. They are systems that parse the explanation of benefits, identify the denial reason code, retrieve the plan’s own medical policy document, and construct an appeal that cites the plan against itself, with the escalation path to external review already loaded. The same engine points at 501(r) eligibility screening, where the addressable population is enormous and the qualifying criteria are published by every nonprofit hospital in the country and read by almost nobody.
The third is cash pay routing, which is where the sixty dollar ultrasound lives. Marketplaces for cash priced services have existed for a decade and have generally struggled on supply density and trust. The subsidy cliff just changed the demand curve, the transparency files just made the supply side legible, and the mandatory right to restrict disclosure to a health plan when a patient pays in full gives the model a privacy story it did not have before. That combination is new.
What is not investable is anything that depends on federal enforcement escalating on a predictable schedule. The credit reporting rule died by joint motion. The advanced explanation of benefits has been pending since 2021. The independent dispute resolution fee just got cut to fifteen dollars in the middle of a volume crisis. Section 501(r) has been law since 2010 with an enforcement record that fits on an index card. Build for the rules that are already in force and already ignored, because that is where the gap between what patients are owed and what patients receive is widest, and gaps like that are the only durable thing in this market
.