The No Surprises Act went into effect in January 2022. Four years later, practices are still getting it wrong — mostly around Good Faith Estimates, consent documentation, and what happens when an out-of-network dispute actually goes to arbitration. Here's a straight read on where the law stands in 2026 and what your billing operation needs to have in place.
The No Surprises Act has three main protections that affect your billing workflows directly. It's worth being specific about each one because they apply differently depending on your setting and payer mix.
For emergency services at any facility — in-network or out-of-network — patients can't be billed more than their in-network cost-sharing. This applies regardless of whether the treating provider or the facility is in-network with the patient's plan. It also applies regardless of whether the patient consented to out-of-network treatment, because consent isn't meaningful in an emergency.
The practical billing implication: if you're an out-of-network ER physician group, you're collecting in-network cost-sharing from the patient and then billing the payer through either a negotiated rate or the IDR process. You don't get to balance bill the patient for the difference.
This is where most of the confusion sits. If a patient goes to an in-network hospital for a scheduled procedure and one of the treating providers — an anesthesiologist, an assistant surgeon, a radiologist — is out-of-network, that provider can't balance bill the patient beyond in-network cost-sharing without specific advance consent.
The consent requirements are strict. The provider has to give the patient written notice at least 72 hours before a scheduled service (or as soon as practicable for services scheduled within 72 hours), explaining that they're out-of-network and what the patient's estimated cost-sharing will be. And the patient has to sign a consent acknowledging this — which, critically, waives their NSA protections for that specific service.
Out-of-network air ambulance services are covered similarly to emergency services — patients pay in-network cost-sharing, and providers must bill the plan directly. Ground ambulance is notably excluded from the NSA's provisions and is still subject to state law.
The Good Faith Estimate requirement applies to uninsured and self-pay patients — and since January 2022, it's been a mandatory part of scheduling for any service that can be scheduled at least 3 business days in advance.
A GFE has to be provided:
The GFE has to include your expected charges, your NPI and TIN, the diagnosis codes and service codes you expect to bill, the facility where the service will be provided, and any co-providers who will bill separately (like anesthesia or labs).
When an out-of-network provider disagrees with what the payer is paying — and consent-based balance billing isn't an option — the IDR process is the mechanism. Here's how it actually works in 2026.
Both the provider and the payer submit their offers to a certified IDR entity. The arbitrator selects one offer — it's baseball-style arbitration, meaning they pick the number they think is closest to the Qualified Payment Amount benchmark, not a middle-ground figure. The losing party pays the administrative fee.
In practice, the IDR process has been heavily skewed toward providers in most specialties — particularly anesthesia, emergency medicine, and radiology. Providers who submit offers close to their median contracted rate for a given market tend to win more often than those who submit inflated numbers far from market benchmarks.
The practices that are managing NSA compliance well in 2026 have built it into their workflows, not their checklists. The difference is meaningful. A checklist gets skipped; a workflow either completes or fails visibly.
At scheduling, your team should flag every self-pay or uninsured patient and trigger a GFE generation. Your PM system should produce the draft based on the scheduled codes — your team reviews it, adds any anticipated co-providers, and sends it to the patient via your portal or by mail. Document the send date and the patient's acknowledgment. This is not optional.
If you have out-of-network providers treating patients at in-network facilities, your front desk needs a workflow to identify those situations before the 72-hour window closes. The notice and consent form has to be CMS-approved language — you can't write your own. CMS publishes the model notice on its website; download it, have your attorney review the implementation, and make it part of your intake packet for applicable cases.
You have 30 business days from receiving the payer's payment or denial of a claim to initiate the open negotiation period (the first step before formal IDR). After open negotiation fails, you have 4 business days to initiate formal IDR. Miss those windows and you've waived your right to dispute. Track these dates in your billing system with hard alerts — calendar reminders are not enough for a billing operation of any size.
CMS can receive complaints from patients who believe they were balance billed in violation of the NSA. Substantiated complaints can result in civil monetary penalties of up to $10,000 per violation. That's per violation — not a single fine. A practice that incorrectly balance billed 30 patients in a year is looking at potential exposure of $300,000.
Most practices that get this wrong aren't doing it intentionally. They're using billing workflows from before 2022 that never got updated. The out-of-network billing process that worked fine for years now needs an NSA compliance layer on top of it. If your billing team hasn't been formally trained on the NSA requirements in the last 12 months, that's the first thing to fix.
Compliance gaps, denial patterns, and the billing issues most practices don't catch until it's expensive. Get the checklist — free, no spam.
✓ On its way — check your inbox within the hour.
We don't share your info. Unsubscribe any time.
We audit out-of-network billing workflows, GFE documentation, and IDR tracking as part of our full RCM review. Find the gaps before a patient complaint does.
Request a Free Compliance Audit