How a bed-count fine repriced hospital price secrecy

The week

On July 19, 2021, the Centers for Medicare & Medicaid Services (CMS), the federal agency that runs Medicare, released its proposed Hospital Outpatient Prospective Payment System rule for calendar year 2022. This is the yearly rule that sets how Medicare pays hospitals for outpatient care, and CMS often uses it to carry other policy changes. Tucked inside was a proposal to raise the civil monetary penalties, the government’s word for fines, for hospitals that did not comply with the hospital price transparency rule.

The proposal changed a calculation large hospital systems had been making all year. Since January 1, a federal rule had required them to publish their prices online, including the confidential rates negotiated with each insurance company. Managed care teams worried that publishing those numbers would let every competitor and every insurer see exactly what they charged. The penalty for not complying was at most $300 a day. Some hospitals looked at that number and decided silence was cheaper.

The penalty change was one item in a very long document. The same proposal carried unrelated policies, such as halting a planned multi-year phase-out of the inpatient-only list, which names procedures Medicare pays for only when performed on hospital inpatients. Price transparency took a few pages of a rule that most hospital finance teams read for its payment rates. Teams that read only the payment sections could miss it.

The rule had a contested history. CMS finalized it in November 2019. Hospital associations and several hospitals sued, arguing that the agency lacked authority to require disclosure of negotiated rates and that the requirement violated the First Amendment. A federal district court upheld the rule in June 2020, and the D.C. Circuit affirmed in December 2020, days before the rule took effect.

That rule asked for two things. First, each hospital had to post a machine-readable file of its standard charges, including payer-specific negotiated rates. A machine-readable file is a data file built for computers to process, not a web page for people to read. Second, hospitals had to offer a consumer-friendly display of shoppable services, meaning care a patient can schedule in advance, or a price estimator tool.

The rule was not going well. Reviews by researchers and journalists in the first half of 2021 had found widespread non-compliance. Part of the reason was plain: the maximum penalty was $300 a day, whatever the hospital’s size. For a small rural hospital that is real money. For a large academic medical center it is a rounding error.

So CMS proposed to scale the fine to the hospital. Hospitals with 30 or fewer beds would keep the $300-a-day maximum. Larger hospitals would pay $10 per bed per day, up to $5,500 a day. Over a full year, that range runs from $109,500 for the smallest hospitals to just over $2 million for the largest. The idea was simple and pointed: put the pressure on the institutions whose prices mattered most to the market.

The proposal also went after a second tactic. CMS described hospitals that had posted files but made them hard to reach: blocking automated searches, demanding that users create an account, or putting the link where nobody would look. It proposed to require that the file be accessible without such barriers, including to automated searches and direct downloads through a public link.

The penalty sat on top of an enforcement process that was already in place. CMS could act on complaints or its own reviews. A hospital found out of compliance received a warning notice, then a request for a corrective action plan, and only then a penalty if it failed to act. The proposal did not change those steps. It changed what lay at the end of them.

The same month brought related moves elsewhere in federal health pricing. On July 1, 2021, the agencies issued the first interim final rule implementing the No Surprises Act. From January 2022, that law protected patients from many surprise out-of-network bills and required good faith estimates for uninsured and self-pay patients. A few weeks after the price transparency proposal, the departments delayed enforcement of the health plan side of transparency, the Transparency in Coverage files, to July 2022.

CMS finalized the higher penalties and the access requirement in November 2021, and they took effect on January 1, 2022. The final rule also exempted state forensic hospitals, which serve people in the criminal justice system and do not sell services to the public. A compliance question that had been easy to defer became, for large systems, a seven-figure line item.

A fine of $300 a day comes to about $110,000 a year. For a large hospital, that was small next to what executives feared from publishing negotiated rates: competitors seeing their prices and payers using them at the bargaining table. Some hospitals made that trade openly in 2021, posting incomplete files or none at all. It was, in a narrow sense, a rational business decision. The July proposal was designed to make it irrational for the hospitals where it mattered most.

The consequences came in three parts, in the order hospitals met them: the arithmetic of the new penalty and whom it changed, the build of a file that turned out to be a data engineering problem, and the readers who actually used what hospitals published. Before those, the rule’s own requirements need a plain account. After them come a monthly routine, the board’s view and the setup that served hospitals best.

What the rule actually asked for

Most people never see a hospital’s prices, because there is not really one price. A hospital keeps a master list of its list prices, called the chargemaster. It is a little like the rack rate on the back of a hotel room door: an official number that almost nobody actually pays. What hospitals really get paid is set in separate contracts with each insurance company, or payer, and those negotiated rates have traditionally been kept confidential.

The price transparency rule asked hospitals to make both visible. The machine-readable file had to list standard charges, including what the hospital had negotiated with each payer for each item or service. “Machine-readable” matters here. The file was not meant for a patient to scroll through; it was meant to be downloaded and processed by software.

Five kinds of standard charge

The rule defined “standard charges” broadly, as five separate figures for each item or service. The first is the gross charge, the chargemaster price. The second is the discounted cash price, what the hospital charges a patient who pays directly. The third is the payer-specific negotiated charge, listed for each payer and plan. The last two are the de-identified minimum and maximum negotiated charges: the lowest and highest rates the hospital has agreed with any payer, without naming which.

Each figure tells a reader something different. The gross charge shows the starting point that uninsured patients and out-of-network bills often run from. The cash price shows what the hospital will accept without an insurer involved. The negotiated charges, payer by payer, show how much bargaining power each insurer has. The minimum and maximum show the spread, which on its own reveals how differently the hospital treats its best and worst-paying contracts.

Publishing all five side by side created comparisons hospitals had never had to explain. For some services, the discounted cash price turned out to be lower than rates negotiated with some insurers. A patient with a high-deductible plan who would pay the negotiated rate out of pocket could, in those cases, pay less by skipping insurance for that service. Hospitals had to decide whether to accept that, to change their cash prices, or to revisit the contracts. Each choice had consequences for revenue and for how the hospital looked to patients and to payers reading the same file.

Shoppable services and the estimator option

The second requirement was the consumer-facing piece: a display of shoppable services, such as a scheduled MRI or a knee replacement, or an online price estimator where a patient could enter details and get a rough figure. The display had to cover 300 shoppable services, 70 of them specified by CMS and the rest chosen by the hospital, with ancillary services grouped alongside the primary one.

A hospital that offered a price estimator meeting the rule’s conditions was treated as meeting the display requirement. Many chose that route, because estimators were already on sale from revenue cycle vendors. One requirement fed computers; the other fed people. As it turned out, the first one mattered far more than anyone advertised.

Who the rule covered

The rule applied to hospitals operating in the United States, including critical access hospitals and hospitals that do not take Medicare. Federally owned hospitals, such as those of the Department of Veterans Affairs and the Indian Health Service, were treated as meeting it. Ambulatory surgery centers, imaging centers and physician practices were outside its scope, even when they competed with hospitals for the same procedures. A health system that owned all of these had to publish prices for some of its sites and not others.

The arithmetic: a penalty sized to the hospitals that held out

Under the proposal, a hospital with more than 550 beds would face the maximum of $5,500 a day, just over $2 million a year. A 300-bed hospital would face $3,000 a day. Small and critical access hospitals stayed at $300. Penalties apply per hospital, so a system with a dozen large campuses faced exposure in the tens of millions of dollars a year.

The scaling was deliberate. A flat fine is a rounding error for a large academic medical center and a real cost for a rural hospital. Tying the penalty to beds put the pressure on the large urban systems whose negotiated rates were most commercially sensitive and most valuable to the market.

Suppose a regional system runs four hospitals of roughly 400 beds each. Under the old regime its worst case was about $440,000 a year across all four campuses, a sum easily absorbed and arguably worth paying to keep rates private. Under the new formula each campus faces $4,000 a day, and the system’s annual exposure climbs to nearly $6 million. The system’s competitive worries were the same as before; what changed was the price of keeping its rates private.

How the formula played out in the first cases

The first penalties showed the formula at work. In June 2022, CMS fined two hospitals in the same Georgia system: Northside Hospital Atlanta, assessed $883,180, and Northside Hospital Cherokee, assessed $214,320. According to the notices as summarized by law firms, both had received warnings and requests for corrective action plans and had not responded.

The Cherokee figure shows how the two regimes combined. The hospital was charged $300 a day for 114 days of non-compliance in 2021, under the old flat cap. It was then charged $10 per bed for its 114 beds for 158 days in 2022, under the new formula. The 2022 portion was more than five times the 2021 portion despite covering fewer than half again as many days. The notices also said penalties would keep accruing until CMS found the hospitals compliant.

Who decides once the fine is real

The new figure also changed internal politics. While non-compliance was cheap, the decision belonged to managed care and strategy leaders weighing competitive risk. Once it carried a seven-figure annual price and a credible enforcement signal, it moved to the chief financial officer and the board as a compliance exposure, and the argument became how to comply well. CMS backed the signal with action when it issued those first penalties.

This is a pattern worth recognizing beyond health care. When a regulator’s penalty is smaller than the commercial value of ignoring a rule, some organizations will ignore it, and the decision stays with whoever owns the commercial value. When the penalty is resized, ownership shifts to finance, risk and the board. Leaders who notice that shift early get to shape the response instead of inheriting it.

Who the formula spared, and what it did not fix

The formula had a fairness logic, but it left one problem untouched. Small and rural hospitals kept the low cap, which protected them from ruinous fines. They also had the fewest analysts, the oldest systems and the least bargaining power with vendors, so building a compliant file cost them proportionally more. The penalty structure eased their downside without helping them comply.

For a critical access hospital, the sensible course was usually to buy a file and estimator from a revenue cycle vendor and to check its output carefully, rather than build. For a large system, building in-house often made more sense, because the same data had commercial uses. The rule was identical for both. The economics were not.

States raised the stakes further

Some states attached their own consequences to the federal rule. Colorado enacted a law in 2022 that bars hospitals from pursuing collection actions against patients for debts incurred while the hospital was not in material compliance with federal price transparency requirements. It also gave patients a right to sue. For a hospital in such a state, an incomplete file could put patient receivables at risk as well as invite a federal fine. Other states passed price transparency laws of their own, so multi-state systems need counsel to track each one.

The build: a file that is really a pipeline

A machine-readable file of all standard charges sounds like an export: press a button, download a spreadsheet, post it. In reality, negotiated rates live in payer contracts and contract management systems, often expressed as percentages of charges, per diems, case rates, carve-outs and fee schedules tied to a payer’s own codes. A per diem is a flat payment per day in the hospital. A case rate is one price for an entire episode, such as a delivery. A carve-out is a service pulled out of the general deal and paid separately. Many of these do not reduce to one dollar figure for an item or service.

Converting them into a consistent file for every payer and plan meant interpreting contract language, joining the chargemaster with contract terms, and making judgment calls that someone had to own. “Joining” is a database term for lining up two lists by a shared key. If the key is recorded differently in each list, the match breaks, and someone has to decide which version is right.

Why a contract term resists a single number

Consider a contract that pays a percentage of billed charges for outpatient imaging. The negotiated rate for a scan is that percentage applied to the chargemaster price, which is a dollar figure the hospital can compute. Now consider an inpatient contract that pays by diagnosis-related group, a fixed amount per category of admission adjusted for the patient’s condition. The negotiated rate for a single item within that stay, such as a day of nursing care or an implant, does not exist on its own. The hospital must decide how to represent it, and whatever it decides will be compared with other hospitals that decided differently.

Plans multiply the problem. One payer may hold several products, such as a commercial PPO, an HMO, a Medicare Advantage plan and a Medicaid managed care plan, each with different rates. A file that lists every item for every plan grows very large very quickly. That combinatorial growth, not careless engineering, is the main reason early files were so big.

Codes that do not line up

The join itself is harder than it sounds. A chargemaster lists items by the hospital’s own internal charge codes, each mapped to a revenue code and, where one applies, a billing code from the CPT or HCPCS code sets. Payers pay on different units: billing codes for many outpatient services, diagnosis-related groups for inpatient stays, revenue codes for some facility charges, and drug codes for some medications.

Each mapping is a place where the file can go wrong. A drug listed under one code in the chargemaster and another in the contract will not match. A service bundled into a payer’s package rate has no line of its own. The team building the file must keep a maintained crosswalk between these code sets and assign someone to update it when codes change each year.

What the early files looked like

The early files showed the strain. Some were so large that ordinary tools could not open them. Others omitted payers, used inconsistent column names or mixed formats within the same file. Without a standard template, comparing hospitals was slow even for experts.

Running the file as a data product

Hospitals that handled this well treated the file as a data product. A data product is a dataset run like a product rather than a one-off report. It has:

• A defined schema. A schema is the agreed layout of the data: which columns exist, what each one means and what format the values take. It is the blueprint.
• An automated pipeline from source systems. A pipeline is a set of scheduled steps that pull data from where it lives, reshape it and deliver it, without someone copying and pasting by hand.
• Validation rules. These are automatic checks, such as confirming that every active payer contract appears and that rates fall within plausible ranges. They catch the error before the public does.
• Version control. A record of every past version, so the hospital can show what it published and when.
• A documented refresh schedule and a named owner. Someone is accountable, and everyone knows when the next update is due.

The work required data engineers, revenue cycle analysts and contract managers together, and it did not end. Contracts renew, plans are added, chargemasters change. A one-time compliance project decays within a year.

The same foundation also served the second requirement. The consumer-facing display or estimator depends on the same negotiated rates, combined with a patient’s benefit details. Hospitals that bought an estimator tool without fixing the underlying contract data paid twice and still produced unreliable estimates. Those that built one governed source of negotiated rates fed both from it. “Governed” simply means that the data has rules about who can change it, how changes are checked and who signs off.

Build, buy or both

Hospitals faced a familiar choice. Revenue cycle and transparency vendors offered to produce the file from contract data the hospital supplied. Buying was faster and cheaper at the start. It did not remove the hardest work, which is translating contract terms into structured rules, because only the hospital’s contract team knows what its contracts mean.

The trade-off ran deeper than cost. A vendor-built file can comply without leaving the hospital with any reusable asset. An in-house pipeline costs more, but the same structured contract data supports underpayment detection, contract modeling and patient estimates. Systems that bought the file and built the underlying contract model in-house often got the best of both.

One system’s monthly routine

Take the same four-hospital system once it decides to do the job properly.

The contract management team keeps the payer contracts and, for the first time, has to express every reimbursement term in a structured form a computer can read. A clause that says “inpatient stays paid at a per diem of a fixed amount, with implants carved out at cost plus a percentage” has to become rows and columns. Someone in revenue cycle, the department that handles billing and collections, has to decide how to represent the carve-out when no single dollar figure exists. That decision is written down so it is made the same way next quarter.

The data engineering team builds the pipeline. Each month it pulls the current chargemaster, pulls contract terms, joins them, applies the agreed rules and produces the file. Before anything is posted, validation runs. Is every payer present? Did any rate move by more than a set percentage since last month? Are there blank fields where values should be? Anything that fails goes to a named analyst rather than onto the website.

Compliance reviews a summary of the checks and signs off. The file is posted, the old version is archived, and the date of the next refresh is already on the calendar. The estimator on the patient website draws from the same store of negotiated rates, so the number a patient sees and the number in the file agree.

The people around the table

The routine works best with a short standing meeting after each refresh. The contract lead reports new or renegotiated contracts and how their terms were encoded. The data lead reports validation results and any held-back changes. The revenue cycle lead reports gaps between estimates and final bills. The compliance lead records sign-off. A managed care analyst brings one observation from competitors’ files. Half an hour a month keeps five departments working from the same facts.

Why monthly, and what happens when a check fails

The rule required hospitals to update the file at least once a year. A monthly refresh is a choice, made because contracts change during the year and an annual file drifts out of date within weeks of posting. The cost of a monthly cycle is mostly automation. Once the pipeline runs unattended, extra refreshes cost little.

A harder call is what to do when validation fails on posting day. A disciplined team leaves last month’s file in place, fixes the error and posts a day or two late, rather than publishing a file it knows is wrong. That rule should be written down in advance, with the compliance lead’s agreement, so nobody makes it up under pressure.

The technology is not exotic: this is ordinary data discipline applied to a dataset that suddenly carried legal and commercial weight. The hard part is organizational: getting three departments that rarely work together to share one source of truth and one schedule.

The readers: payers, employers and competitors

The rule was presented as a way to help patients shop. As it turned out, few patients opened machine-readable files, and use of consumer tools was uneven. The heaviest users were organizations: health plans checking whether they paid more than rivals, employers and their benefits advisers preparing for negotiations, data companies aggregating prices into products, researchers, journalists and competing hospitals.

That shifted the economics of the files. Published rates narrow the information gap in hospital-payer negotiations. For years, a hospital might know what each insurer paid it, and an insurer might know what it paid each hospital, but neither could easily see the whole market. Now both could. A hospital priced well above its peers for common services should expect that comparison to appear across the table. A hospital priced below peers has evidence for a rate increase. Either way, the data that compliance teams publish is market intelligence, and the managed care team should read competitors’ files as carefully as payers read theirs.

At a contract renewal, a regional insurer sits down with the system and slides across a chart comparing its negotiated rate for a common imaging scan with the rates three nearby systems have published. The hospital’s team either recognizes the chart, because it built the same one last month, or sees it for the first time in the room. The first kind of team negotiates; the second reacts.

Employers as a new kind of reader

Self-insured employers pay their employees’ claims directly, with an insurer or administrator handling the network. For years many of them could not see what their plans paid each hospital. The Consolidated Appropriations Act, 2021 barred contract clauses that stop plans from accessing cost and quality data, and hospital files gave employers and their advisers an outside view as well.

An employer that learns its network pays one local hospital far more than another for the same services can steer employees, redesign benefits or press its administrator. Some employees also sued their employers’ plans over what the plans paid for health benefits and prescription drugs, which drew attention to price data even where courts dismissed the claims. Hospitals should expect large employers in their market to read their files as closely as insurers do.

Data companies and researchers

A further class of reader turned the files into products. Data companies downloaded hospital files at scale, cleaned and normalized them, and sold the results to payers, employers, consultants and hospitals themselves. Researchers used the same files to document how widely prices vary, between hospitals in the same market and even between payers at the same hospital.

Those intermediaries changed who could use the data. A small employer or a rural hospital could not process thousands of files. It could buy an analysis built from them. A hospital’s numbers therefore reached readers it never dealt with directly, filtered through someone else’s cleaning choices. If a vendor misread a hospital’s file, the error could spread to every customer of that vendor.

The counter-argument: transparency can soften competition

Economists have long warned that publishing prices does not always lower them. A widely cited study of Denmark’s ready-mixed concrete market in the 1990s found that prices rose after the competition authority began publishing firms’ transaction prices. The concern is that sellers who can see each other’s prices can avoid undercutting one another.

Hospital prices could follow either path. Payers armed with data may push high-priced hospitals down. Low-priced hospitals, seeing that they sit well below peers, may push their rates up. Which effect dominates depends on the market, and the evidence so far is mixed. A hospital should use competitors’ published files for its own analysis, and should ask antitrust counsel before discussing prices with competitors or acting in ways that look coordinated.

Quality matters here in a second way. An error in a published file is more than a compliance defect: it is a number a payer or employer may quote back in a negotiation, or a journalist may cite. If a misplaced decimal makes a routine procedure look ten times more expensive than it is, the correction rarely travels as far as the original. Validation before publication protects the hospital’s position as well as its compliance record.

Four exposures for the board

For a chief executive or board, the July 2021 proposal touched four things at once.

• Money. The direct exposure was the fine, now large enough to notice. The indirect exposure was larger: negotiated rates are the hospital’s revenue, and published rates change how those rates get negotiated.
• Risk. A non-compliant or inaccurate file is a regulatory finding waiting to happen, and CMS showed it would act.
• Customers. Patients may not have opened the files, but they could use estimators, and an estimate that disagrees with the final bill damages trust in a way that is hard to repair.
• Reputation. Researchers and journalists read the files. A hospital that looks evasive, or whose data looks careless, becomes a story.

How the exposures differ by type of hospital

The weight of each exposure varies. A large academic medical center with high negotiated rates faces the largest fine and the sharpest negotiating risk, because its rates are the ones payers most want to compare. A critical access hospital faces a small fine but a real reputational risk in a community where everyone knows the hospital. A children’s hospital often has a payer mix dominated by Medicaid, so commercial rate comparisons matter less than the accuracy of its estimates for families. A multi-state system faces the fine per campus, plus state laws that differ from one market to the next.

The customer exposure grew in January 2022, when the No Surprises Act began requiring good faith estimates for uninsured and self-pay patients. If the final bill exceeds the estimate by $400 or more, the patient can use a federal dispute process. An estimate built from the same governed rates as the public file is easier to defend in that process than one assembled by hand.

Nonprofit hospitals add one more consideration. Their tax exemption depends partly on community benefit, and their charity care and billing practices draw scrutiny. A price file that shows high charges to uninsured patients, next to aggressive collections, can become part of that wider story.

The three parts connect. The scaled penalty made non-compliance costly for the hospitals with the most sensitive rates. The build turned compliance into a permanent data function. The readers turned that function’s output into a negotiating input. A hospital that saw only the first part paid for compliance and got nothing else from it.

One governed source of rates

The strongest setup is a single, governed source of negotiated rates that feeds the public file, the patient estimator and the managed care team’s own analysis. It has an owner with a name and a budget. It refreshes on a schedule, passes automated checks before anything goes public and keeps a history. Managed care treats the market’s published files as a regular input to strategy, not a curiosity.

It also needs clear roles. Contract managers own the meaning of each reimbursement term. Data engineers own the pipeline and its checks. Revenue cycle owns how the numbers flow into estimates and bills. Compliance owns the sign-off. Managed care owns what the organization learns from the market. When each of those owners knows their part, the file stops being a scramble every time a rule changes and becomes a routine piece of operations.

Evidence a reviewer would want

A CMS reviewer, an auditor or the board’s compliance committee should be able to see the same short set of evidence. It includes the current file and its posting date, the archive of earlier versions and the validation results for each refresh. It also includes the list of active payer contracts reconciled to the payers in the file, and a record of who signed off. It also includes the written rules for representing contract terms that do not reduce to a single dollar figure. A hospital that keeps those in one place can answer a warning notice in days rather than weeks.

Two measures tell a board whether the setup works. One is coverage: the share of active payer contracts and plans that appear in the file. The other is agreement: how often the estimator’s figure for a scheduled service matches the amount the patient was eventually billed, within a tolerance the hospital sets. Both can be reported quarterly on one page.

The case for minimal compliance, and its limits

Some executives argued for the minimum: post a file that meets the letter of the rule, buy a basic estimator, and spend nothing more. That position has some logic. The data is used against the hospital in negotiations, and making it easier to read does the payer’s work for it.

The flaw is that the minimum keeps rising. Each later rule demanded more structure and more accuracy, and each round of minimal compliance had to be redone. The commercial use of the data, meanwhile, goes to whichever side analyzes it first. A hospital that builds the pipeline once can meet each new requirement by changing the output, and can read the market as well as its payers do.

The failures are predictable:

• Treating it as a project rather than a function. A team assembles the file once, everyone moves on, and within a year the contracts have changed and the file is wrong.
• Buying the front end before fixing the back end. An attractive estimator tool built on messy contract data produces confident-looking wrong answers.
• Leaving it entirely to compliance. Compliance can confirm a file exists. It usually cannot interpret contract terms or build pipelines, and it is not positioned to use the data commercially.
• Ignoring competitors’ files. If payers and employers are reading them, the hospital’s own negotiators should be too.
• Posting without checking. Every number published is a number someone may quote back.

The broader point applies well beyond hospitals. Whenever a regulator requires an organization to publish data, the publication becomes an asset or a liability that outsiders will use. Building it well costs more at the start and far less over time.

A price file needs a named owner, full coverage and checked numbers

• Who owns our price transparency file by name, and is it in their objectives and budget?
• Does every active payer contract appear in it? How do we know?
• Do our public file and our patient estimator draw from the same source, and do their numbers agree?
• Has our managed care team analyzed competitors’ published files before our next major payer negotiation?
• If a journalist quoted a number from our file tomorrow, would we be confident it was right?

With hindsight

CMS issued its first price transparency penalties in June 2022, against two hospitals in a Georgia system, and more followed. The fines were no longer theoretical, and the July 2021 proposal turned out to be the start of a steady tightening. CMS began posting its enforcement actions publicly, which added a reputational cost to the financial one.

Later rules raised the bar on the file itself. The calendar year 2024 outpatient rule, finalized in November 2023, required a standard CMS file template from July 2024, which addressed the early problem of every hospital using its own layout. It required an attestation that files are true, accurate and complete, which puts a hospital’s name formally behind its numbers. It required a link in the footer of the hospital’s home page and a small text file on its website pointing to the price file, so automated tools could find it. And it required more specific data elements, phased in through January 2025. It also let CMS work with a health system’s leadership when several of its hospitals fell short.

Each change pushed further in the direction the 2021 build problem pointed: toward files that behave like well-run data products. Hospitals that had built a pipeline met the template by changing an output format. Hospitals that had assembled their files by hand had to start again.

A February 2025 executive order directed agencies to strengthen enforcement and move toward disclosure of actual prices. CMS followed in its calendar year 2026 outpatient rule, finalized in November 2025. Hospitals must now report median, 10th percentile and 90th percentile amounts actually allowed for services paid by percentage or formula, drawn from remittance data, along with the count of claims behind them. The attestation must name a senior official, and hospitals must list their organizational identifiers. The new requirements took effect in January 2026, with enforcement from April 2026. The same rule offered a 35 percent penalty reduction to hospitals that waive a hearing before an administrative law judge. The reduction does not apply where the hospital failed to publish a file or a shoppable services display at all. Requirements have kept moving, so hospitals should check current requirements rather than rely on what they built for an earlier version of the rule.

The shift to amounts actually paid closes a gap the 2021 files left open. A negotiated percentage of charges told a reader little. A median allowed amount, computed from real payments, tells a payer or competitor almost exactly what the hospital collects. That makes the source data, the remittance records, part of the compliance pipeline for the first time.

The picture also widened beyond hospitals. The parallel Transparency in Coverage rule required health plans to publish negotiated rates from July 2022, creating a second large dataset that researchers, employers and vendors combine with hospital files. The same prices can now be seen from both sides of the contract. Patients gained a separate tool through the No Surprises Act, whose good faith estimates for uninsured and self-pay patients began in January 2022.

Compliance improved after the penalty change, by CMS’s own account in its reviews, although outside groups continued to find files that were incomplete or hard to use. The formula set in 2021 still defines the size of the fine; what has changed is how much a file must contain to avoid one.

Patient shopping has stayed limited. Rate comparison in contract negotiations has become routine, which is where the files have had their clearest economic effect. That outcome was visible early to anyone who asked who would actually read the data.

The takeaway reaches beyond health care pricing. When a regulator resizes a penalty, the decision moves from the commercial team to the board, so it pays to be ready. When a rule requires publication, the real audience is often professional, not public. And a compliance obligation built as a durable data function tends to pay back twice: once in avoided penalties, and again in the commercial insight the same data provides.