The No Surprises Act for Medical Practices, What You Need to Know in 2026

Cut through the legal language. Here is what the No Surprises Act actually requires from your practice.

Quick Answer

The No Surprises Act (effective January 1, 2022) prohibits out-of-network providers from balance billing patients beyond in-network cost-sharing in most emergency and certain non-emergency situations. Medical practices must provide Good Faith Estimates (GFEs) to uninsured and self-pay patients before services are delivered, post required notices at all patient contact points, and follow the federal Independent Dispute Resolution (IDR) process when payment disputes arise. Violations can trigger civil monetary penalties up to $10,000 per incident.The No Surprises Act (effective January 1, 2022) prohibits out-of-network providers from balance billing patients beyond in-network cost-sharing in most emergency and certain non-emergency situations. Medical practices must provide Good Faith Estimates (GFEs) to uninsured and self-pay patients before services are delivered, post required notices at all patient contact points, and follow the federal Independent Dispute Resolution (IDR) process when payment disputes arise. Violations can trigger civil monetary penalties up to $10,000 per incident.

In this guide, we will cover:

1. What the No Surprises Act actually covers
2. The five compliance mandates for medical practices
3. Good Faith Estimate timing and content requirements
4. Violations and penalties
5. The IDR process: what practices need to know
6. How real-time eligibility verification supports compliance
7. Frequently asked questions

Surprise medical bills have been a thorn in American healthcare for decades. A patient goes to an in-network hospital for knee surgery, and weeks later they get a separate bill from an anesthesiologist they never chose and never knew was out-of-network. The No Surprises Act was designed to stop exactly that.

For patients, the law is straightforward: fewer unexpected bills. For medical practices, the compliance picture is more complicated. There are notice obligations, estimate deadlines, documentation requirements, a federal dispute resolution process, and real financial penalties when things go wrong.

This guide breaks down what the law actually requires, where practices tend to fall short, and how the right operational systems can keep you on the right side of CMS.

What the No Surprises Act Actually Covers

Congress passed the No Surprises Act as part of the Consolidated Appropriations Act, 2021. Most provisions took effect January 1, 2022. The law was built around one central problem: patients receiving services from out-of-network providers at in-network facilities, often without any warning, and then facing bills they couldn’t have anticipated or planned for.

The core protections cover three broad scenarios:

• Emergency services at any facility, regardless of whether the provider is in-network.
• Patients can only be charged in-network cost-sharing amounts.
• Non-emergency services from out-of-network providers at in-network hospitals, ambulatory surgery centers, or other facilities.
• Balance billing is prohibited unless the patient gives voluntary informed consent to use an out-of-network provider and waives their protections.
• Air ambulance services from out-of-network providers covered by most types of insurance plans.

One important exclusion worth knowing: ground ambulance services are not covered by the No Surprises Act. Ground ambulance balance billing remains one of the most significant unresolved surprise billing problems in US healthcare, and federal legislation to address it is still in development.

The law applies broadly. If your practice is licensed or certified and provides healthcare services to patients with group or individual health insurance coverage, you are almost certainly subject to its requirements.

The Five Compliance Mandates for Medical Practices

The Department of Health and Human Services has defined five specific obligations for medical practices. Each one carries documentation and process requirements that front office and billing teams need to own.

1. Display consumer rights notices in the right places

Practices are required to inform patients of their rights under the No Surprises Act. That notice has to be posted on your website, in any facility where patients schedule appointments, and at locations where patients approach staff with questions about costs. A notice buried in a patient intake packet doesn’t satisfy this requirement on its own.

CMS provides a model notice you can use. Using it isn’t mandatory, but it signals good-faith compliance if a complaint arises.

2. Confirm insurance status before care is delivered

Practices must determine whether patients have active health insurance coverage. If they do, you need to find out whether the patient intends to file a claim with their insurer. This is the eligibility check that most billing workflows already include, but the law adds a specific purpose: identifying which patients are self-pay or uninsured, because those patients have separate rights under the act.

Good Faith Estimate Timing and Content Requirements

The GFE mandate applies to all providers and facilities that require state licensing or certification. The timing rules differ depending on how far in advance the appointment is scheduled.

ScenarioWhen GFE Must Be ProvidedService scheduled at least 10 business days in advanceWithin 3 business days of schedulingService scheduled at least 3 business days in advanceWithin 1 business day of schedulingPatient requests a GFE (not yet scheduled)Within 3 business days of the requestRecurring or ongoing servicesAt least every 12 months, covering the next 12 months of planned services

The GFE itself needs to include more than just the primary service fee. CMS requires that it cover all reasonably expected charges associated with that encounter, including labs, imaging, anesthesia, and any co-provider services you expect to be involved in the patient’s care. A GFE that quotes only your facility fee and ignores the anesthesiologist isn’t compliant.

Documentation note: The GFE must be included in the patient’s medical record, including the date and method of delivery. Patients must be able to request a copy for up to six years after the initial estimate was provided. Automate delivery via email or patient portal where possible to create an audit trail automatically.

What happens when the actual bill significantly exceeds the estimate?

If the final charges exceed the GFE by more than $400, the patient may dispute the bill through the patient-provider dispute resolution (PPDR) process. They have 120 days from the date of the unexpected bill to initiate a dispute. A CMS-certified dispute resolution entity reviews the case. Practices that consistently issue GFEs that don’t hold up generate a higher volume of PPDR filings, which creates administrative burden and increased CMS scrutiny. Out-of-network patients receiving services at an in-network facility may also qualify for specific protections. Your intake and scheduling workflows need to flag these situations reliably.

3. Notify eligible patients of their right to a Good Faith Estimate

Every uninsured or self-pay patient must be told, before scheduling, that they are entitled to a Good Faith Estimate. This notification applies whether or not the patient ultimately books the service.

Insured patients who choose not to use their insurance, or who are expected to have costs not covered by their plan, are also entitled to a GFE in many circumstances. The notice requirement extends to these patients as well.

4. Comply with balance billing restrictions

The law prohibits balance billing for emergency services regardless of network status, and for non-emergency services from out-of-network physicians at in-network facilities. This means patients in these situations cannot receive direct bills for the gap between the out-of-network rate and what insurance paid.

Voluntary informed consent waivers exist, but they come with strict requirements. A waiver is only valid if the patient had a genuine choice to receive care from an in-network provider, was notified of their rights in writing, and signed the waiver before services were scheduled. Waivers cannot be used for services where an in-network provider was not available, and they cannot be used for emergency situations.

5. Provide accurate Good Faith Estimates on time

This is where most compliance failures happen. The GFE requirements are specific and have hard deadlines. See the detailed breakdown in the next section.

Good Faith Estimate Timing and Content Requirements

The GFE mandate applies to all providers and facilities that require state licensing or certification. The timing rules differ depending on how far in advance the appointment is scheduled.

• Service scheduled at least 10 business days in advance You have 3 business days from the scheduling date to deliver the GFE.

• Service scheduled at least 3 business days in advance You have 1 business day from the scheduling date to deliver the GFE.

• Patient requests a GFE before scheduling You have 3 business days from the date of the request.

• Recurring or ongoing services Provide a fresh GFE at least every 12 months, covering the next 12 months of planned care.

The GFE itself needs to include more than just the primary service fee. CMS requires that it cover all reasonably expected charges associated with that encounter, including labs, imaging, anesthesia, and any co-provider services you expect to be involved in the patient’s care. A GFE that quotes only your facility fee and ignores the anesthesiologist isn’t compliant.

Documentation note: The GFE must be included in the patient’s medical record, including the date and method of delivery. Patients must be able to request a copy for up to six years after the initial estimate was provided. Automate delivery via email or patient portal where possible to create an audit trail automatically.

What happens when the actual bill significantly exceeds the estimate?

If the final charges exceed the GFE by more than $400, the patient may dispute the bill through the patient-provider dispute resolution (PPDR) process. They have 120 days from the date of the unexpected bill to initiate a dispute. A CMS-certified dispute resolution entity reviews the case. Practices that consistently issue GFEs that don’t hold up generate a higher volume of PPDR filings, which creates administrative burden and increased CMS scrutiny.

Violations and Penalties

The No Surprises Act is enforced primarily by CMS, with a referral pathway to state insurance commissioners where state-level laws apply. The HHS Office of Inspector General also has enforcement authority in certain contexts.

Civil monetary penalties can reach $10,000 per violation. Each instance of balance billing a protected patient, failing to provide a required GFE, or failing to post required notices is a separate violation. A practice that does this repeatedly across multiple patients is not looking at a single fine.

HHS receives complaints through CMS and investigates based on patient reports, pattern analysis, and coordination with state agencies. As of mid-2024, CMS had received over 16,000 complaints related to the act. The agency uses complaint volume to identify which providers and practice types are generating disproportionate issues, which means your complaint history matters for determining audit risk.

Practices that self-identify compliance gaps and correct them proactively are treated more favorably than those caught in reactive enforcement situations. If your GFE workflow has gaps, fixing them before a complaint arrives is the much better outcome.

The IDR Process: What Medical Practices Need to Know

The Independent Dispute Resolution (IDR) process is the federal mechanism for resolving payment disputes between providers and insurers over out-of-network services. It’s separate from the patient-provider dispute resolution process, which handles disagreements between patients and providers over bill amounts.

Under IDR, either the provider or the insurer can initiate a dispute after a 30-business-day open negotiation period fails to produce agreement. A certified independent entity reviews both parties’ offers and selects one of them, taking into account the Qualifying Payment Amount (QPA) as a reference point, along with other factors like the provider’s training, experience, and market rates.

The IDR system has seen an extraordinary volume of disputes since launch. By the end of 2023, more than 700,000 disputes had been filed with the federal IDR portal. Emergency medicine providers accounted for roughly 60 percent of those filings, with radiology making up about 15 percent.

Provider win rate: In 2024, providers won approximately 85 percent of resolved IDR cases, frequently receiving reimbursement well above the insurer’s initial QPA offer. Private equity-backed groups have been especially active in the system, winning close to 90 percent of their disputes.

The practical implication for medical practices: if you’re an emergency medicine or specialty practice that regularly treats patients at in-network facilities, learning the IDR process and building it into your revenue cycle operations has real financial upside. Most disputes are resolved in favor of providers when submitted correctly.

One ongoing complication: the IDR system has been paused multiple times due to legal challenges. The Texas Medical Association has brought multiple successful lawsuits challenging how the QPA is weighted in arbitration decisions. Practices should monitor CMS guidance updates regularly, as IDR rules have changed several times since 2022.

How Real-Time Eligibility Verification Supports Compliance

A lot of what the No Surprises Act requires hinges on knowing the patient’s insurance status before the appointment. You can’t identify self-pay and uninsured patients who need GFEs if you’re relying on manual eligibility checks or end-of-day batch processing. By the time the information arrives, the window to act on it has often passed.

Real-time eligibility verification changes the workflow. When a patient calls to schedule, the front desk can instantly confirm active coverage, network status, in-network vs. out-of-network classification, and applicable benefits. That information does three things for No Surprises Act compliance:

-** Flags GFE obligations immediately.** Uninsured and self-pay patients are identified at the point of scheduling, not after the fact.

• Catches out-of-network situations before care is delivered. If an out-of-network provider is involved, the practice knows in time to either resolve it or obtain a valid consent waiver.
• Generates documentation. Real-time verification creates a timestamped record of the patient’s insurance status at the time of scheduling, which matters if a compliance question arises later.

Practices that rely on calling payers manually, or on batch eligibility runs the night before, are introducing unnecessary compliance risk. The gap between when the patient schedules and when eligibility information is available is exactly where GFE deadline violations happen.

Veritable provides real-time insurance eligibility verification built for medical practices. You get instant payer responses, benefit details, and network status at the point of scheduling, so your team has what it needs to fulfill GFE obligations on time and with accurate information.

Book a demo to see how it works

Frequently Asked Questions

1. What is the No Surprises Act?

The No Surprises Act is a federal law that took effect January 1, 2022. It protects patients from unexpected out-of-network medical bills by limiting what providers can charge and requiring transparent cost estimates for uninsured and self-pay patients. It applies to most healthcare providers, facilities, and health insurance plans.

2. Who does the No Surprises Act apply to?

The law applies to most licensed healthcare providers and facilities, including physician practices, hospitals, freestanding emergency departments, and ambulatory surgery centers. It covers emergency services regardless of network status, and non-emergency services provided by out-of-network providers at in-network facilities.

3. What is a Good Faith Estimate under the No Surprises Act?

A Good Faith Estimate (GFE) is a written document listing the expected costs for a scheduled healthcare service. Providers must give GFEs to uninsured and self-pay patients before services are rendered. The GFE must cover all anticipated charges for the primary service plus related items like labs, anesthesia, or imaging. If the final bill exceeds the GFE by more than $400, the patient may dispute it through a federal dispute resolution process.

4. What are the penalties for violating the No Surprises Act?

Civil monetary penalties can reach $10,000 per violation. HHS enforces compliance through CMS, and state insurance commissioners may apply additional state-level penalties where applicable. Each individual instance of balance billing a protected patient, failing to provide a required GFE, or failing to post required consumer notices is a separate violation.

5. What is the IDR process under the No Surprises Act?

The Independent Dispute Resolution (IDR) process is a federal mechanism for resolving payment disputes between providers and insurers for out-of-network services. After a 30-day negotiation period fails, either party can initiate IDR. A certified entity reviews both offers and selects one based on the Qualifying Payment Amount and other factors. In 2024, providers won roughly 85 percent of resolved IDR cases.

6. Does the No Surprises Act cover ground ambulance services?

No. Ground ambulance services are explicitly excluded from the No Surprises Act’s balance billing protections. Ground ambulance balance billing remains unregulated at the federal level, though some states have enacted their own protections.

7. How does real-time eligibility verification help with No Surprises Act compliance?

Real-time eligibility verification allows practices to instantly confirm a patient’s insurance coverage, network status, and benefit details at the point of scheduling. This makes it straightforward to identify uninsured and self-pay patients who need Good Faith Estimates, flag out-of-network situations before care is delivered, and generate documentation of the patient’s insurance status at the time of scheduling.