4.4 The No Surprises Act & Transparency in Coverage

Key Takeaways

  • The No Surprises Act (NSA) strictly prohibits out-of-network balance billing for emergency services, non-emergency services provided by out-of-network clinicians at in-network facilities, and out-of-network air ambulance transportation.
  • Patient cost-sharing under the NSA must be calculated using the Qualifying Payment Amount (QPA)—the median in-network contracted rate for the specific item/service and geographic market—and must count toward in-network deductibles and OOPMs.
  • Payment disputes between payers and out-of-network providers are resolved through a mandatory 30-day open negotiation period followed by binding, baseball-style Federal Independent Dispute Resolution (IDR) arbitration with loser-pays fee shifting.
  • The Transparency in Coverage (TiC) Final Rules require group health plans to publish machine-readable JSON files (MRFs) of in-network rates and out-of-network allowed amounts, alongside an internet-based self-service price comparison tool for all covered items and services.
  • The Consolidated Appropriations Act (CAA 2021) prohibits contractual 'gag clauses' that restrict access to price and quality data, mandating an annual Gag Clause Prohibition Compliance Attestation (GCPCA) submitted to the federal government by December 31.
Last updated: September 2026

The No Surprises Act & Transparency in Coverage

Quick Answer: Enacted under the Consolidated Appropriations Act of 2021 (CAA 2021, P.L. 116-260), the No Surprises Act (NSA) and the Transparency in Coverage (TiC) final rules eliminate surprise out-of-network balance billing across emergency services, non-emergency care at in-network facilities, and air ambulance transports. Patient cost-sharing is pegged to the Qualifying Payment Amount (QPA), reimbursement disputes are adjudicated through baseball-style Federal Independent Dispute Resolution (IDR), and plans must publish public Machine-Readable Files (MRFs), deliver self-service price comparison tools, and submit an annual Gag Clause Prohibition Compliance Attestation (GCPCA).


1. The No Surprises Act: Statutory Scope & Core Protections

Historically, when insured patients received care from out-of-network providers—often involuntarily during medical emergencies or when treated by non-network hospital-based physicians (e.g., anesthesiologists, pathologists, radiologists)—the non-participating providers billed the patient for the difference between the provider's full billed gross charges and the insurer's allowed amount. This practice, known as balance billing, exposed participants to catastrophic financial liabilities.

Effective January 1, 2022, the No Surprises Act (NSA) (codified in ERISA §716–§717, IRC §9816–§9817, and PHSA §2799A-1–§2799A-2) established comprehensive federal consumer protections across three core clinical scenarios:

┌────────────────────────────────────────────────────────────────────────┐
│                     NSA CORE STATUTORY PROTECTIONS                     │
├───────────────────────────────────┬────────────────────────────────────┤
│ 1. Emergency Services             │ In-network cost-sharing; zero      │
│                                   │ prior auth; covers EDs & air amb.  │
├───────────────────────────────────┼────────────────────────────────────┤
│ 2. Non-Emergency Care at          │ Zero balance billing for out-of-   │
│    In-Network Facilities          │ network ancillary specialists      │
├───────────────────────────────────┼────────────────────────────────────┤
│ 3. Air Ambulance Services         │ Balance billing banned; in-network │
│                                   │ deductible & OOPM rules apply      │
├───────────────────────────────────┼────────────────────────────────────┤
│ Patient Cost-Sharing Basis        │ Calculated strictly on the         │
│                                   │ Qualifying Payment Amount (QPA)    │
└───────────────────────────────────┴────────────────────────────────────┘

The Three Protected Clinical Domains

  1. Emergency Medical Services:
    • Applies to emergency services provided in hospital emergency departments, independent freestanding emergency departments, and urgent care centers licensed to deliver emergency care.
    • Services must be covered without prior authorization, without retrospective clinical denial, and regardless of whether the facility or treating physician is in-network.
    • Patient cost sharing cannot exceed in-network levels and must count toward in-network deductibles and out-of-pocket maximums (OOPMs).
  2. Non-Emergency Services Performed by Out-of-Network Providers at In-Network Facilities:
    • When an enrollee receives surgical or medical treatment at an in-network hospital or ambulatory surgical center (ASC), non-network clinicians delivering care at that facility cannot balance bill the patient.
    • Ban on Notice & Consent Waivers for Ancillary Services: While non-ancillary out-of-network providers (e.g., elective cosmetic surgeons) may obtain patient consent to balance bill by providing a written disclosure 72 hours in advance, the statute strictly prohibits notice and consent waivers for ancillary services (emergency medicine, anesthesiology, pathology, radiology, neonatology, diagnostic imaging, and hospitalist services).
  3. Out-of-Network Air Ambulance Services:
    • Prohibits out-of-network providers of air ambulance transportation (fixed-wing and rotary-wing aircraft) from balance billing enrollees. Cost sharing must be equal to in-network rates and accrue to in-network accumulation accumulators. (Note: Ground ambulance services were excluded from the NSA but remain subject to ongoing federal study).

2. Qualifying Payment Amount (QPA) & Cost-Sharing Mechanics

Under the NSA, the patient's out-of-pocket cost sharing (deductible, copayment, or coinsurance) is legally uncoupled from the provider's billed charge and is calculated strictly against the Recognized Amount.

In states without a statutory All-Payer Model Agreement or state specified balance-billing law, the Recognized Amount is the Qualifying Payment Amount (QPA):

┌────────────────────────────────────────────────────────────────────────┐
│                     QUALIFYING PAYMENT AMOUNT (QPA)                    │
├────────────────────────────────────────────────────────────────────────┤
│  QPA = Median contracted rate for the same or similar item/service     │
│        in the same geographic region across the same provider specialty│
│        as of January 31, 2019, indexed annually by the CPI-U.          │
└────────────────────────────────────────────────────────────────────────┘

QPA Calculation Methodology (45 CFR §149.140)

  1. Base Year Rate: The plan identifies its median contracted rate across all commercial network contracts for that specific clinical service code (CPT code) in the relevant geographic region as of January 31, 2019.
  2. Annual Indexing: The base rate is multiplied by the annual consumer price index inflation factor (CPI-U) published by the IRS to establish the applicable QPA for the current plan year.
  3. Patient Liability Application: If a patient has a 20% coinsurance obligation, and an out-of-network anesthesiologist submits a $4,000 billed charge at an in-network surgical hospital where the QPA is $1,000, the patient's liability is $200 (20% of $1,000), not 20% of $4,000. The remaining balance is resolved entirely between the plan and the provider.

3. Federal Independent Dispute Resolution (IDR) Process

When a group health plan and an out-of-network provider or facility disagree on the total reimbursement amount for NSA-covered claims, the dispute is resolved through a structured, multi-step statutory negotiation and arbitration workflow:

┌─────────────────────────────────────────────────────────────────────────┐
│                       FEDERAL IDR DISPUTE RESOLUTION FLOW               │
├─────────────────────────────────────────────────────────────────────────┤
│ 1. Initial Payment or Notice of Denial ──► Within 30 business days      │
│                                                                         │
│ 2. Open Negotiation Period ──────────────► 30 business days             │
│                                                                         │
│ 3. IDR Initiation ───────────────────────► Within 4 business days of    │
│                                            negotiation close            │
│                                                                         │
│ 4. Certified IDR Entity Selection ───────► Within 3 business days       │
│                                                                         │
│ 5. Submission of Final Offers ───────────► Within 10 business days      │
│                                                                         │
│ 6. Binding Arbitrator Determination ─────► Within 30 business days      │
│                                            (Baseball-Style: Pick 1)     │
│                                                                         │
│ 7. Fee-Shifting ("Loser Pays") ──────────► Non-prevailing party pays fee│
└─────────────────────────────────────────────────────────────────────────┘

The Step-by-Step IDR Arbitration Workflow

  1. Initial Payment or Denial (30 Business Days): Within 30 business days of receiving a clean claim, the plan must issue either an initial reimbursement payment or a formal notice of claim denial.
  2. Open Negotiation Period (30 Business Days): If the provider disputes the payment, either party may initiate a mandatory 30-business-day open negotiation window to reach an agreed settlement.
  3. Federal IDR Initiation (4 Business Days): If negotiations fail to yield an agreement, either party can initiate the Federal IDR process within 4 business days after the close of the open negotiation period via the federal IDR portal.
  4. Baseball-Style Arbitration Mechanics:
    • Both parties submit a single final offer dollar amount along with supporting clinical and market documentation within 10 business days of IDR entity selection.
    • The certified IDR arbitrator operates under "baseball-style" arbitration: the arbitrator must select one of the two submitted offers. The arbitrator is legally prohibited from choosing any intermediate figure, splitting the difference, or creating a compromise payment.
  5. Statutory Evidentiary Factors:
    • Permissible Consideration Factors: The arbitrator considers the QPA, the provider's level of training and clinical experience, market share of both parties, the acuity and complexity of the patient's case, the facility's teaching/trauma status, and demonstration of good faith efforts to enter into network contracts.
    • Statutorily Prohibited Factors: The arbitrator is expressly prohibited from considering the provider's gross billed charges, usual and customary charges (UCR), or public reimbursement rates (Medicare, Medicaid, TRICARE).
  6. Fee Shifting ("Loser-Pays" Model): The non-prevailing party whose offer is rejected by the arbitrator must pay the entire certified IDR entity administrative fee, discouraging frivolous filings.

4. Transparency in Coverage (TiC) Final Rules: MRFs & Price Tools

Promulgated under the ACA and codified in 45 CFR Part 147, the Transparency in Coverage (TiC) final rules require group health plans and health insurance issuers to provide public pricing transparency and personalized consumer cost disclosures:

┌────────────────────────────────────────────────────────────────────────┐
│                     TRANSPARENCY IN COVERAGE (TiC) MANDATES            │
├───────────────────────────────────┬────────────────────────────────────┤
│ Machine-Readable Files (MRFs)     │ Monthly public JSON files:         │
│                                   │ 1. In-Network Rate File            │
│                                   │ 2. Out-of-Network Allowed File     │
├───────────────────────────────────┼────────────────────────────────────┤
│ Internet-Based Price Tool         │ Personalized, real-time consumer   │
│                                   │ cost-sharing tool for ALL items    │
│                                   │ and services (expanded Jan 2024)   │
├───────────────────────────────────┼────────────────────────────────────┤
│ Fiduciary Liability               │ Plan sponsors liable; must obtain  │
│                                   │ written indemnity agreements       │
└───────────────────────────────────┴────────────────────────────────────┘

Machine-Readable Files (MRFs)

Group health plans must publicly post two distinct, un-gated Machine-Readable Files (MRFs) in JSON format, updated on a monthly basis:

  1. In-Network Rate File: Discloses all negotiated in-network reimbursement rates for all covered items and services across all contracted providers.
  2. Out-of-Network Allowed Amount File: Discloses historical allowed amounts and billed charges for out-of-network services provided by out-of-network clinicians (subject to a minimum volume threshold of 20 claims per provider to protect patient privacy).

Technical Constraints: Files must be accessible freely on a public website without requiring user logins, personal identifying information, or paywalls.

Internet-Based Self-Service Price Comparison Tool

Plans must maintain an interactive, internet-based self-service tool (alongside paper formats upon request) that enables enrollees to obtain real-time, accurate estimates of their out-of-pocket financial liability for any covered health item or service:

  • Phase 1 (January 1, 2023): Covered an initial statutory list of 500 shoppable healthcare items and services (e.g., joint replacements, MRIs, colonoscopies, routine deliveries).
  • Phase 2 (January 1, 2024 onward): Expanded to cover all covered items, services, and prescription drugs.
  • Required Output: For any searched provider and service, the tool must calculate the member's remaining deductible, copayment, coinsurance, accumulated OOPM status, and estimated in-network/out-of-network negotiated rates.

5. CAA 2021 Gag Clause Prohibitions & Annual Compliance Attestation

Under Section 201 of Title II of the Consolidated Appropriations Act of 2021 (codified in ERISA §724, IRC §9824, and PHSA §2799A-9), group health plans and health insurance issuers are strictly prohibited from entering into contracts with third parties that contain gag clauses.

┌────────────────────────────────────────────────────────────────────────┐
│                     GAG CLAUSE PROHIBITION ARCHITECTURE                │
├───────────────────────────────────┬────────────────────────────────────┤
│ Prohibited Contractual Clauses    │ Any clause restricting the plan    │
│                                   │ from sharing cost/quality data or  │
│                                   │ accessing participant claims data  │
├───────────────────────────────────┼────────────────────────────────────┤
│ Annual Attestation Mandate        │ Submit Gag Clause Prohibition      │
│ (GCPCA)                           │ Compliance Attestation annually    │
│                                   │ by December 31 via CMS HIOS portal │
├───────────────────────────────────┼────────────────────────────────────┤
│ Responsible Parties               │ Fully Insured: Carrier satisfies   │
│                                   │ Self-Funded: Sponsor liable        │
└───────────────────────────────────┴────────────────────────────────────┘

What Constitutes an Illegal Gag Clause?

A gag clause is any contractual term in an agreement between a group health plan and a healthcare provider, Third-Party Administrator (TPA), Pharmacy Benefit Manager (PBM), or provider network that directly or indirectly restricts the plan from:

  1. Disclosing provider-specific cost or clinical quality-of-care information to plan fiduciaries, participating providers, plan sponsors, or current/prospective enrollees;
  2. Electronically accessing de-identified claims and encounter data for each participant/beneficiary (including financial fields, service codes, and provider identifiers); and
  3. Sharing de-identified claims data with business associates (e.g., healthcare analytics firms, actuarial consultants) for healthcare management and plan auditing.

The Annual Gag Clause Prohibition Compliance Attestation (GCPCA)

  • Filing Deadline: Group health plans and health insurance issuers must submit an electronic Gag Clause Prohibition Compliance Attestation (GCPCA) annually by December 31 covering the prior 12-month period through the federal CMS Health Insurance Oversight System (HIOS) web portal.
  • Allocation of Fiduciary Responsibility:
    • Fully Insured Plans: If the health insurance issuer submits the attestation on behalf of the plan pursuant to a written agreement, the employer plan sponsor is legally relieved of liability.
    • Self-Funded Plans: While a self-insured plan sponsor may contractually delegate the technical submission of the GCPCA to its TPA or PBM, the plan sponsor remains legally liable under ERISA if the TPA fails to file the attestation on time.
Loading diagram...
No Surprises Act and TiC Compliance Architecture
Test Your Knowledge

An enrollee covered under a self-funded employer group PPO undergoes an elective, in-network knee replacement surgery at an in-network hospital. During the procedure, an out-of-network anesthesiologist provides general anesthesia. The anesthesiologist bills $3,500, whereas the plan's Qualifying Payment Amount (QPA) for the anesthesia service is $800. Under the No Surprises Act, how must the patient's cost sharing be determined?

A
B
C
D
Test Your Knowledge

During the Federal Independent Dispute Resolution (IDR) baseball-style arbitration process established under the No Surprises Act, which of the following factors is an arbitrator statutorily PROHIBITED from considering when selecting between the final payment offers submitted by the plan and the out-of-network provider?

A
B
C
D
Test Your Knowledge

Under the Consolidated Appropriations Act of 2021 (CAA 2021) Gag Clause Prohibition provisions, what is the annual compliance obligation imposed on group health plan sponsors, and what is the statutory deadline for fulfillment?

A
B
C
D