American Billing Association — Compliance Guide
No Surprises Act
Compliance Checklist
Interactive on-page checklist — no file download required.
The No Surprises Act (effective January 1, 2022, with ongoing rulemaking through 2026) prohibits surprise billing for emergency services, air ambulance services, and certain non-emergency services at in-network facilities. Violations carry penalties up to $10,000 per incident and have generated over 39,999 patient complaints since enactment, resulting in $30 million+ in regulatory relief. This checklist helps you verify your practice is fully compliant.
Why Compliance Matters — Enforcement Numbers
Max Penalty Per Violation
$10,000
Per incident, per individual. Civil Monetary Penalty per 45 CFR §149.610.
Patient Complaints Filed
39,999+
Filed with CMS/HHS since NSA took effect. 55% relate to balance billing; 30% relate to cost estimates.
Relief Obtained for Patients
$30M+
In refunds and corrective actions from providers and plans found in violation.
IDR Cases Filed
738,000+
Independent Dispute Resolution cases filed through 2025. The IDR system significantly exceeded initial volume projections.
PPDR Threshold
$400
Patient-Provider Dispute Resolution threshold: patients can use PPDR when billed >$400 above GFE. Provider limited to GFE amount.
IDR Filing Fee
$115
Per-party fee to initiate IDR (2025). Prevailing party may receive fee reimbursement from losing party.
CMS enforcement ramp-up (2025–2026): CMS shifted from a complaint-driven to a systematic audit approach in late 2024. Practices in high-complaint specialties (emergency medicine, anesthesiology, radiology, and out-of-network surgery) face higher audit probability. Practices with $0 Good Faith Estimates on file are at maximum penalty risk.
Section 1: What the No Surprises Act Covers
| Service Type | NSA Prohibition | Who It Applies To |
|---|---|---|
| Emergency Services | Cannot balance-bill patients for emergency services at any facility, regardless of whether the provider is in-network. Cannot charge more than in-network cost-sharing. | All providers treating patients in emergency departments. Applies to: physicians, surgeons, anesthesiologists, radiologists, labs, and all providers who render care in the emergency context. |
| Non-Emergency Services at In-Network Facilities | Out-of-network providers at in-network hospitals/facilities cannot balance-bill unless patient provides written consent (with exceptions). | Applies to ancillary providers (anesthesiology, radiology, pathology, neonatology, assistant surgeons) at in-network facilities. Some specialties can obtain patient consent — see Section 4. |
| Air Ambulance Services | Out-of-network air ambulance providers cannot balance-bill beyond in-network cost-sharing amount. | All air ambulance providers covered under group health plans or individual health insurance coverage. Ground ambulance excluded (still subject to state law). |
| Uninsured / Self-Pay Patients | Must provide Good Faith Estimate (GFE) before services. If actual bill exceeds GFE by >$400, patient can initiate PPDR. | All providers who schedule services for uninsured or self-pay patients — regardless of whether NSA's balance billing rules apply to insured patients in that context. |
Section 2: Good Faith Estimate (GFE) Requirements
Timeline rule: For scheduled services: GFE must be provided at least 1 business day before the scheduled service if scheduled 3–9 days out; at least 3 business days before if scheduled 10+ days out. For unscheduled services or self-pay patients: within 3 business days of request.
The 9 Required Elements of a Valid Good Faith Estimate
- Element 1: Patient's name and date of birth
- Element 2: Description of primary item or service in plain language
- Element 3: List of items and services in reasonable and good faith estimated cost (itemized)
- Element 4: Applicable diagnosis codes (ICD-10), expected CPT/HCPCS procedure codes, and expected date(s) of service
- Element 5: Name, NPI, and TIN of each provider or facility expected to provide an item or service included in the GFE
- Element 6: Name and location of each facility where items or services will be provided
- Element 7: Notice that the GFE is not a contract and the actual charges may differThis disclaimer must be clear, conspicuous, and not buried in fine print.
- Element 8: Notice that the patient has the right to initiate PPDR if billed more than $400 above the GFEMust include instructions on how to initiate the PPDR process — not just that the right exists.
- Element 9: Disclosure that the estimate is specific to the anticipated care at that time — additional items and services may be requiredAlso include: expected dates of service, estimated length of stay if applicable, and whether the service is a one-time or recurring service.
Convening provider responsibility: When multiple providers are involved (e.g., surgeon + anesthesiologist + facility), the "convening provider" (typically the scheduling physician) is responsible for requesting GFE information from all "co-providers" and incorporating it into the patient's single GFE. Each co-provider must respond within 1 business day of request.
Section 3: Out-of-Network Consent — When It Is and Isn't Allowed
No consent exception for emergency services: Patients cannot waive NSA balance billing protections for emergency services — ever. No consent form can override NSA balance billing prohibitions in an emergency context.
For non-emergency services at in-network facilities, some out-of-network providers may obtain patient consent to balance-bill, but only under very specific conditions:
- Consent is given by the patient voluntarily — not as a condition of receiving care at the facilityREQUIRED
- Consent is provided at least 72 hours before the service (3 business days) — or 3 hours before if same-day schedulingREQUIRED
- Patient is given a list of in-network providers who could provide the service so they understand the alternativeREQUIRED
- Consent notice clearly states what the estimated out-of-network cost-sharing will beREQUIRED
- Service falls within the categories where consent is permitted (not: emergency care; post-stabilization care where consent is not valid; services by ancillary providers like anesthesiology, radiology, pathology, neonatology, or labs in most contexts)REQUIRED
- Consent is documented and retained in the patient's file with timestampREQUIRED
- Consent notice is on the approved CMS model consent form (or equivalent that contains all required elements)REQUIRED
Prohibited from providing consent: Even with proper notice, patients CANNOT consent to waive NSA protections for: (1) emergency services, (2) services provided by ancillary providers who are part of the facility's care team (radiology, anesthesiology, pathology, neonatology, labs) when the patient didn't choose those providers, or (3) any service where the patient couldn't have realistically chosen an in-network alternative.
Section 4: Independent Dispute Resolution (IDR) — Provider Side
When payers and out-of-network providers cannot agree on payment, either party can initiate the IDR process. The IDR arbitrator selects one of the two payment offers — the payer's Qualifying Payment Amount (QPA) or the provider's offer — based on which is closer to the appropriate market rate.
1
Open Negotiation Period (30 business days)
Provider and payer attempt to resolve payment through direct negotiation. Either party can start this clock after the initial payment is made or denied. Must exhaust 30-day period before filing for IDR.
2
IDR Filing Window (4 business days after negotiation period closes)
Either party files with a certified IDR entity. Pay the $115/party fee. Submit your offer and supporting documentation. Your offer should be above the payer's Qualifying Payment Amount (QPA) but supported by evidence.
3
Arbitrator Selection (3 business days)
Both parties jointly select a certified IDR entity from the CMS list, or CMS assigns one if no agreement. The arbitrator cannot consider prior IDR outcomes as primary evidence for setting rates.
4
Submission of Offers (10 business days from arbitrator selection)
Submit your final offer and supporting documentation. Include: provider specialty credentials, complexity of services, case-mix, practice costs, market factors. The QPA (80th-percentile in-network rate) is the default starting point — your evidence must justify why your offer is more appropriate.
5
IDR Decision (30 business days)
Arbitrator issues a final binding decision. Prevailing party may receive the $115 filing fee back from the losing party. Payment must be made within 30 calendar days of the determination.
IDR win rate note: Through 2025, providers won a significant majority of IDR cases where disputes were fully resolved, largely because payers' QPAs were set below market rates in many markets. However, the volume of IDR filings (738,000+) has created administrative bottlenecks — cases can take 4–6 months to resolve.
Section 5: Patient-Provider Dispute Resolution (PPDR)
| PPDR Element | Details |
|---|---|
| When PPDR applies | Uninsured or self-pay patients who receive a bill more than $400 above their Good Faith Estimate. Note: $400 is the threshold to initiate PPDR — any overage triggers the right, but the arbitrator's decision is binding. |
| Who initiates | The patient (or their authorized representative) files through the CMS PPDR portal within 120 calendar days of receiving the final bill. |
| Provider response | Provider must respond to the PPDR entity within 10 business days with documentation supporting the bill amount. |
| PPDR decision | If the arbitrator determines the actual bill was not justified by circumstances outside the GFE scope, the provider is limited to the GFE amount. No further billing above GFE amount. |
| Provider protection | If services required were not reasonably anticipatable at GFE time (new diagnosis discovered, clinical complexity), bill above GFE may be justified. Document the clinical reason thoroughly in the record. |
| Penalty for non-participation | Refusing to participate in PPDR or failing to respond within 10 business days results in automatic decision in the patient's favor and potential $10,000 CMP. |
Section 6: Full Practice Compliance Checklist
Notice & Disclosure Requirements
- NSA Patient Notice posted conspicuously at each physical location and on your website — must inform patients of their right to a GFE and balance billing protectionsHIGH
- Notice available in the top 15 languages spoken in your service area (HHS requirement for providers in areas with significant non-English populations)MED
- Provider directory information is current — payers must be notified within 30 days of network status changesMED
- Practice website includes current information on accepted insurance plans and network participation statusMED
GFE Process for Uninsured / Self-Pay Patients
- Workflow in place to identify uninsured and self-pay patients at schedulingHIGH
- GFE template created and used for all 9 required elements — reviewed for compliance in 2025-2026HIGH
- GFE delivery timeline tracked: 1 business day before service if 3–9 days out; 3 business days before if 10+ days outHIGH
- GFEs are retained in patient records for at least 7 years (same as medical record retention standard)MED
- Process to update GFE if anticipated services change significantly before deliveryMED
- PPDR rights explained in GFE — not just that the right exists but how to invoke itHIGH
Insured Patient Balance Billing
- Clear policy: no balance billing for emergency services — regardless of in-network/out-of-network statusHIGH
- Policy confirmed: patients are only charged the applicable in-network cost-sharing for all NSA-protected servicesHIGH
- EOB review process: confirm any patient bills issued after EOB receipt reflect correct in-network cost-sharing, not billed chargesHIGH
- Collections policy: any collection action on an NSA-protected service amount has been reviewed for compliance before referral to collectionsHIGH
Training & Monitoring
- Front desk and billing staff trained on NSA requirements — training documented with date and staff signaturesMED
- Monthly review of any patient billing complaints that could indicate NSA violationsMED
- Designated compliance contact identified for NSA complaints and CMS audit responsesMED
- Annual NSA compliance review scheduled — rules continue to evolve through 2026 rulemakingMED
Civil Monetary Penalties — Summary
Maximum Penalty Per Violation
$10,000
Per incident, per individual. Violations can compound rapidly — a single provider billing 100 patients above the GFE threshold creates up to $1,000,000 in potential liability.
| Violation Type | Penalty Risk | Who Is Penalized |
|---|---|---|
| Balance billing a protected patient for covered services | Up to $10,000 per patient | The billing provider and/or practice entity |
| Failing to provide GFE to uninsured/self-pay patient | Up to $10,000 per failure | The convening provider (scheduling physician) |
| Providing an incomplete or inaccurate GFE | Up to $10,000 per patient complaint | Provider who issued the GFE |
| Failing to respond to PPDR within 10 business days | Automatic adverse decision + potential CMP | The billed provider |
| Obtaining invalid consent (improperly obtained) | Same as balance billing | Provider who obtained consent |
| Sending protected service to collections at billed rate | Up to $10,000 per account | Provider and/or collection agency |
Unsure Whether Your Practice Is NSA-Compliant?
Our billing compliance specialists review your GFE processes, patient notice requirements, and consent documentation — and identify gaps before CMS does.
Get Your Free RCM Audit