- The No Surprises Act bars balance billing for OON emergency care, most OON services at in-network facilities, and air ambulance transports.
- Every uninsured or self-pay patient who schedules care must receive a Good Faith Estimate (GFE) — routine visits included.
- A bill exceeding the GFE by $400+ lets the patient open a federal dispute within 120 days.
- A June 2026 final rule cut the IDR administrative fee from $115 to $15 per party, with new procedures from August 3, 2026.
- Notice-and-consent never applies to emergency or ancillary services (anesthesiology, radiology, pathology).
- Penalties run up to $10,000 per violation, with states as first-line enforcers.
Five years in, the No Surprises Act (NSA) is settled, actively enforced law — and 2026 brought its biggest shake-up yet: a June 2026 final rule that rebuilt the dispute resolution process and slashed its fees. The compliance surface is wider than most owners assume — even a practice that never treats emergencies owes a Good Faith Estimate to every uninsured and self-pay patient it schedules. This guide covers the provider side: where balance billing is prohibited, how GFEs work, what the QPA and IDR mean for out-of-network payment, and the checklist that keeps a small practice out of the penalty conversation.
What the No Surprises Act covers
Effective January 1, 2022, the NSA protects insured patients from surprise out-of-network bills where they could not reasonably choose an in-network provider, and guarantees uninsured and self-pay patients an upfront estimate. For protected services the patient owes only in-network cost-sharing; any shortfall is resolved with the plan, never by billing the patient. Disciplined eligibility verification at intake is step one in classifying who is protected.
Where balance billing is prohibited
| Scenario | Balance billing allowed? | Notes |
|---|---|---|
| Emergency services, OON facility or clinician | No | Includes post-stabilization care; no consent exception |
| OON ancillary clinicians at in-network facility (anesthesiology, radiology, pathology, neonatology, assistant surgeons, hospitalists, intensivists, diagnostics) | No | Consent exception expressly unavailable |
| Other OON clinicians at in-network facility | Only with valid notice and consent | Standard-form written notice with estimate, ahead of service |
| Air ambulance | No | Ground ambulance is outside the federal law; state rules may apply |
| OON care the patient knowingly chose | Generally yes | Standard network rules; state law may add limits |
Good Faith Estimates: the rule touching every practice
Any provider scheduling a service for an uninsured or self-pay patient — including insured patients declining to use coverage — must furnish a written GFE: within 3 business days of scheduling for services 10+ business days out, within 1 business day for services 3–9 days out, and within 3 business days of any request. A compliant GFE includes patient identifiers, a service description, diagnosis and service codes, itemized expected charges, the provider’s name, NPI, and TIN, and required disclaimers, including dispute rights.
Those rights have teeth. If the final bill exceeds the GFE by $400 or more, the patient has 120 days to open the federal patient-provider dispute (PPDR) for a $25 fee, and the provider must justify the overage as medically necessary care that could not reasonably have been anticipated; collections pause during review. One mercy: HHS has exercised enforcement discretion on including co-provider charges in a single comprehensive GFE pending further rulemaking — but the convening provider’s own obligation is fully enforceable.
The QPA: the out-of-network benchmark
The Qualifying Payment Amount is the plan’s median contracted rate for the same or similar service in the same region and specialty, indexed forward from January 2019. It generally sets the protected patient’s cost-sharing and anchors payment disputes: plans pay an initial amount informed by the QPA, and arbitrators must consider it alongside other permitted factors. Providers have long argued the methodology depresses payment, and litigation has forced recalculations — treat any quoted QPA as checkable; plans must disclose, on request, how it was calculated.
The IDR process in 2026: cheaper, faster, stricter
When a provider disputes a plan’s payment on an NSA-protected claim, federal IDR is the remedy: (1) initiate open negotiation within 30 business days of the payment or denial, negotiating up to 30 business days; (2) if unresolved, either party may initiate IDR within 4 business days; (3) each side submits one offer with support to a certified IDR entity; (4) the arbitrator picks one offer — baseball-style — and the loser generally bears the IDR entity fee.
The June 2026 final rule changed the economics: the per-party administrative fee dropped from $115 to $15 effective June 11, 2026, and revised procedures covering IDR entity fees, batching, and eligibility review apply to disputes initiated on or after August 3, 2026. All fees are due by the offer deadline or the offer is not considered. Entity fees still run to several hundred dollars, so batch eligible claims where permitted and reserve IDR for gaps that justify the fee. Tracking these deadlines is a revenue cycle management function, not a legal afterthought.
The notice-and-consent exception: narrow by design
Certain OON providers at in-network facilities may balance bill only if the patient receives the standard HHS notice — with a cost estimate and in-network alternatives — and consents at least 72 hours ahead (3 hours for same-day service). Consent must be voluntary and retained, generally for seven years. The exception is unavailable where choice is illusory: never for emergencies, the ancillary specialties above, or unforeseen services arising mid-visit. Regulators read consent forms skeptically; they are a safety valve, not a business model.
How state law interacts with the federal floor
The NSA is a federal floor, not a ceiling. Where a state’s own surprise-billing law sets payment amounts or dispute processes for state-regulated plans, the state scheme governs those claims; federal IDR handles the rest, notably self-funded ERISA plans. Over half the states run balance-billing protections, several stricter than federal — map each claim to the right process before initiating a dispute.
Penalties and enforcement in 2026
Balance billing a protected patient or skipping a required GFE risks civil monetary penalties of up to $10,000 per violation — though penalties must be waived where the provider acted unknowingly and, within 30 days of discovery, withdraws the bill and reimburses the patient with interest. States enforce first, CMS steps in where a state does not, and complaints via the federal No Surprises Help Desk commonly trigger inquiries. An accidental violation corrected fast is survivable; a pattern of ignored GFEs draws penalties.
Worked example: a $600 GFE miss (illustrative)
Illustrative scenario. A self-pay patient schedules a diagnostic procedure two weeks out; the practice issues a timely GFE of $1,300. An added service mid-procedure pushes the final bill to $1,900 — $600 over the estimate, clearing the $400 threshold — and the patient files a PPDR dispute for $25. Because the added service was foreseeable for this presentation, the determination comes back at the GFE amount: the practice writes off $600 and pauses collections during review. Prevention was cheap — estimate the full expected code set, fold foreseeable contingencies into the GFE, and re-issue when the plan of care changes.
NSA compliance checklist for small practices
- Screen at scheduling: flag every uninsured or self-pay booking to auto-trigger the GFE workflow.
- Template the GFE: patient details, service description, codes, itemized charges, NPI/TIN, disclaimers.
- Post the disclosures: the balance-billing notice on your website, in office, and with billing communications.
- Classify OON encounters before billing and cap patient cost-sharing where NSA protections apply.
- Use notice-and-consent only where lawful: standard forms, correct timing, seven-year retention.
- Calendar the dispute clocks: 30 business days for open negotiation, 4 to initiate IDR, fees due with offers.
- Audit quarterly: sample self-pay encounters for GFE issuance; reconcile bills against estimates for $400+ variances.
Common compliance failures and fixes
| Failure | Risk | Fix |
|---|---|---|
| No GFE issued to a self-pay patient | CMP exposure up to $10,000 per violation; loss posture in PPDR | Hard-stop scheduling until the GFE exists |
| Final bill exceeds GFE by $400+ | PPDR dispute; likely write-down to estimate | Estimate the full code set; re-issue on plan changes |
| Balance billing a protected claim | Penalties, refund with interest, state enforcement | Classify protected claims at charge entry; cap patient share |
| Consent forms for ancillary specialties | Consent is void; billing above cost-sharing violates | Restrict notice-and-consent to eligible services |
| Missed IDR deadlines | Forfeited dispute; initial payment stands | Track negotiation and IDR windows with owners |
Quick Answers
What is the No Surprises Act? A federal law, effective January 2022, banning balance billing for OON emergency care, most OON services at in-network facilities, and air ambulance transport, and requiring GFEs for uninsured and self-pay patients.
Who must receive a Good Faith Estimate? Every uninsured or self-pay patient who schedules care — within 3 business days of scheduling (1 business day for near-term appointments) and on request.
How does the IDR process work in 2026? After a 30-business-day open negotiation, either party may initiate arbitration within 4 business days; each side submits one offer and the arbitrator picks one. The administrative fee fell from $115 to $15 per party in June 2026.
When can an out-of-network provider still balance bill? Only outside NSA-protected scenarios, or at an in-network facility with valid advance notice and consent — never for emergency or ancillary services.
What to check before billing
- Uninsured or self-pay patient? Confirm a timely, complete GFE before the visit.
- Emergency, facility-based OON, or air ambulance claim? Cap patient share at in-network cost-sharing.
- Does a valid notice-and-consent form cover this service — and is the service eligible for one?
- Does state law route the dispute to a state process instead of federal IDR?
- Is the final bill within $400 of the GFE? If not, reconcile before sending.
- Are negotiation and IDR deadlines calendared for every underpaid protected claim?
Related reading
NSA compliance sits on top of everyday billing hygiene. If your team is stretched, our medical billing services cover GFE workflows and out-of-network claim strategy end to end, and our clean claims guide covers submission quality. The same calendaring muscle behind timely filing limits keeps IDR windows from slipping.
Frequently asked questions
Every provider or facility that schedules an item or service for an uninsured or self-pay patient, including insured patients who decline to use their coverage. The GFE is due within 3 business days of scheduling (1 business day for appointments 3-9 business days out) and within 3 business days of any patient request, and it must include codes, itemized expected charges, and the provider's NPI and TIN.
The QPA is the health plan's median contracted in-network rate for the same or similar service in the same geographic area and specialty, indexed forward from January 2019. It generally sets the protected patient's cost-sharing for NSA-covered services and is one of the factors arbitrators must consider in the federal IDR process.
After a 30-business-day open negotiation period, either party can initiate IDR within 4 business days. Both sides submit a single payment offer and a certified IDR entity selects one, baseball-style. A June 2026 final rule cut the administrative fee from $115 to $15 per party and applies revised procedures to disputes initiated on or after August 3, 2026, with all fees due by the offer deadline.
Outside NSA-protected scenarios, standard network billing rules apply. Within an in-network facility, a non-ancillary out-of-network provider may balance bill only with the patient's advance written consent on the standard notice - given at least 72 hours before service (or 3 hours for same-day scheduling). The exception never applies to emergency services or ancillary specialties like anesthesiology, radiology, and pathology.
HHS may impose civil monetary penalties of up to $10,000 per violation on providers who balance bill protected patients or fail GFE requirements. Penalties must be waived where the provider acted unknowingly and, within 30 days of discovery, withdraws the bill and reimburses the patient with interest - so rapid self-correction matters. States handle first-line enforcement in most jurisdictions.