Price transparency files: mandated, massive and hard to read

The week

On October 29, 2020, the Departments of Health and Human Services, Labor and the Treasury issued the Transparency in Coverage final rule. It was published in the Federal Register on November 12. The rule applied to most non-grandfathered group health plans and to insurers selling non-grandfathered individual and group coverage. Grandfathered plans, those largely unchanged since before the Affordable Care Act, were outside it.

At its center were three machine-readable files. A machine-readable file is data laid out for computers rather than people, more like a giant spreadsheet in a standard format than a brochure. The rule required:

• An in-network rate file, listing the rates the plan or insurer has negotiated with each in-network provider for every covered item and service.
• An allowed amount file, showing historical payments to out-of-network providers alongside what those providers billed.
• A prescription drug file, showing in-network negotiated rates and historical net prices for covered drugs, down to the pharmacy location.

The files had to sit on a public website, free of charge, with no account, password or personal information needed to reach them. They had to be refreshed monthly and show the date of the latest update. The allowed amount file covered a 90-day window beginning 180 days before publication. Plans had to leave out any item and provider with fewer than 20 different claims, a threshold meant to protect patient privacy.

Ask what a knee MRI costs in the United States and the honest answer for decades has been: it depends, and nobody will tell you in advance. The price a health plan actually pays a hospital or doctor is set in private contracts, and those contracts were treated as trade secrets. The rule ordered them into the open.

It had a second, more personal part. Plans had to give members an online tool, with a paper version on request, showing estimated cost-sharing before care: what the patient would owe out of pocket, and the negotiated rate behind it. A third provision let insurers count “shared savings” payments, made to members who chose lower-cost providers, toward their medical loss ratio. That ratio is the share of premium spent on care and quality improvement, and insurers that fall below the federal minimum owe rebates.

The timeline stretched over several years. The files applied to plan years beginning on or after January 1, 2022. In August 2021 the departments said they would enforce the two rate files from July 1, 2022, and deferred the prescription drug file while they reconsidered it. The member tool was phased in, starting with an initial list of 500 items and services for plan years beginning in 2023 and covering all covered items and services from 2024.

Responsibility followed the type of plan. An insured group plan could require its insurer, through a written agreement, to publish the files, and then only the insurer would be in violation if they were wrong or missing. A plan that contracted the work out any other way, which describes most self-funded employer plans, stayed responsible if its service provider failed.

The rule did not arrive alone. It grew out of an executive order on price and quality transparency signed in June 2019, and the departments had proposed it in November 2019. That same month, CMS finalized a separate hospital price transparency rule, due to take effect on January 1, 2021. It required hospitals to publish their standard charges, including the rates they had negotiated with each payer.

Hospital groups led by the American Hospital Association had sued to stop that rule. A federal district court upheld it in June 2020, and the appeal was still pending in the last week of October. The D.C. Circuit upheld the rule on December 29, 2020, clearing the way for it to take effect two days later.

The surrounding moment shaped how the rule was received. It landed five days before a presidential election, while plans and hospitals were absorbing the pandemic. Congress was also nearing agreement on surprise billing legislation, which passed in December 2020 as the No Surprises Act, with its own overlapping requirements for price comparison tools.

Together, the two rules aimed to turn health care prices, long hidden, into something anyone could look up. The ambition was easy to explain and widely welcomed in principle. The hard part, as plans, employers and hospitals were about to find out, was that publishing a price and making it useful are two very different jobs.

The policy debate around Transparency in Coverage concerned consumers and competition. Would patients shop for care? Would prices fall once everyone could see them? For health plans, health systems, employers and analysts, the operational reality was something else: a data engineering problem of unusual size.

The rule required publication; it did not and could not require that the files be usable. Their value depended on three things the regulation specified only partly: the volume of data, the meaning of each rate, and accountability for its accuracy. Each needs a different kind of investment, from a different owner, and the argument applies to any mandated public dataset.

The sections below start with what the files contain, then take the three problems in turn. They then follow the work from raw file to negotiating table and weigh who gained and who carried the burden. The last two set out the habits and checks that separated organizations that got value from those that only complied.

What these files actually are

When a health plan builds a network, it signs contracts with hospitals, clinics and doctors. Each contract sets what the plan will pay for each service. Services are identified by billing codes, standardized numbers that describe a procedure, test or visit. A large plan may have contracts with tens of thousands of providers, each covering thousands of codes, often with different terms for different plan products.

The rule asked plans to publish all of this in a common structure, called a schema. A schema is the agreed layout of the data: which fields exist, what each one is called and what kind of value goes in it. A shared schema means a computer can read files from different plans without a person reformatting each one. CMS published the technical schema and its revisions in an open public repository, along with a validator that plans could use to test their files.

What a single rate record holds

Each entry in the in-network file ties together several pieces of information. Read one line in order and the structure of a health care contract emerges:

• The code and the coding system it comes from. Physician services generally use CPT and HCPCS codes, inpatient stays use diagnosis-related groups, and facility services can carry revenue codes.
• The provider group, listed by National Provider Identifier and by tax identification number. One tax number can cover hundreds of individual clinicians.
• The negotiated type: a flat negotiated amount, a percentage, a per diem, a fee schedule, or a “derived” amount the plan calculated after the fact.
• The billing class, separating professional fees, such as the surgeon’s, from institutional fees, such as the hospital’s.
• The setting and the expiration date, since rates can differ by place of service and contracts end.

Plans also had to identify which plan or plans each file covered. A national insurer administers thousands of employer plans that share the same networks. Reporting by plan meant the same contracted rates could appear again and again across files, which mattered a great deal for volume.

The out-of-network file

The second file covers a different situation. When a patient sees a provider outside the plan’s network, there is no negotiated contract. The “allowed amount” is what the plan decided it would recognize for that service, which may differ from what the provider charged. Publishing historical allowed amounts was meant to show patients and employers what out-of-network care has actually cost, rather than leaving them to guess.

The 20-claim floor shaped what that file could show. Smaller plans, and most specialized services, rarely produced 20 claims for one code and one provider in a 90-day window. Many allowed amount files from small and mid-sized plans were therefore sparse or nearly empty. The rule worked as designed; the privacy floor and the analytical value pulled in opposite directions.

Public by design

All of these files answer the question that patients, employers and competitors had long asked and could rarely get answered: what is actually being paid, to whom, for what. The files are posted publicly on the web and refreshed monthly. In principle, anyone can download them. “Anyone” turned out to mean anyone with serious computing resources.

Volume: a terabyte nobody can open

A negotiated rate file has to express every combination of plan, provider, billing code and rate arrangement. For a large insurer with broad networks that is an enormous number of rows, refreshed monthly. When the files began appearing in July 2022, observers widely reported individual payers publishing many terabytes, with some single files too large to open on an ordinary workstation.

A terabyte is roughly a thousand gigabytes. A typical office laptop could not even store some of these files, let alone open them in a spreadsheet program. The information was technically all there, in a form almost nobody could read.

Why the files grew so large

Several features of contracts and of the rule multiplied each other.

• Whole fee schedules. Many professional contracts pay a percentage of a published fee schedule for every code on it. A plan reporting faithfully would list a rate for every code the schedule covers, whether or not the provider ever bills it.
• Large provider groups. A group practice or health system can bill under one tax number for hundreds or thousands of clinicians. Each rate attached to that group can apply to every name on the roster.
• Plan-level reporting. Identical networks repeated across many employer plans produced near-identical rate sets, published again and again.
• Monthly refresh. Every month brought a new full set of files, whether or not the contracts had changed.

The rule penalized leaving things out, not putting too much in. A plan unsure whether a combination was required had every reason to include it. Defensive completeness was a rational response to the incentives, and it made the files bigger and harder to use.

Who could handle the volume

Volume decided who could use the data. Individual consumers could not. Employers, researchers, brokers, data companies and providers with engineering capacity could, after building pipelines to download, parse, deduplicate and index the files. A data pipeline is an automated series of steps that collects raw data, cleans it and loads it somewhere it can be searched.

The engineering itself was unusual. Files of this size cannot be loaded into memory, so they have to be read as a stream, one record at a time. They often arrive compressed, and expand many times over when decompressed. Storage, network transfer and computing costs recur monthly. Teams learned to keep only the slices they needed and to discard the rest quickly.

In effect the rule created a market for intermediaries: firms whose business is turning the raw files into searchable products. That may have been unavoidable, but it was not the outcome most public commentary expected in 2020.

Different organizations, different volume problems

The volume problem looked different depending on where an organization stood.

• National insurers faced the largest publication job, with monthly generation, validation and hosting of enormous file sets. Their engineering teams could manage it, but every schema change meant a new release.
• Regional plans and third-party administrators published smaller files but had thinner teams. Many relied on vendors for generation and hosting, which moved the volume problem into a contract.
• Health systems faced the consumer side: whether to ingest payer and competitor data for contract negotiation. That meant storage and pipeline costs that sat in no existing budget line.
• Employers rarely needed the whole files. They needed the slice for their own plan and region, usually delivered by a broker, consultant or data vendor.

For health systems in particular, the question was who would maintain the pipeline when file formats changed, as they did several times through schema updates. Every schema update can break a pipeline that worked the month before, so the cost is ongoing rather than a one-time project.

Meaning: rates are not prices

The deeper problem was semantic: it concerned what the numbers actually mean. Health care contracts do not always state a dollar amount per service. Rates can be:

• A percentage of billed charges, where the plan pays a share of whatever the hospital lists as its charge.
• A case rate, a single payment for a bundle of services, such as everything involved in a delivery.
• A per diem, a fixed amount per day in the hospital, regardless of what happens that day.
• A reference to a fee schedule, such as paying a set multiple of a published price list.

Translating these into a common schema loses context, and different payers made different translation choices. Comparing them is like comparing restaurants when one menu lists dishes, another says “20 percent above market price,” a third offers a set price per table and a fourth charges by the hour. All are accurate, and none are directly comparable.

Rates that will never be paid

The same procedure at the same hospital could appear with several rates, each technically correct and practically confusing. Some files listed rates for provider and code combinations that would rarely or never be billed, because contracts covered whole fee schedules. A pediatrician’s contract might technically include a rate for a procedure only a cardiac surgeon would perform. Analysts came to call these ghost or zombie rates.

Without knowing which arrangements actually drove payment, an analyst could not tell a meaningful rate from an artifact of contract structure. The files said nothing about volume. A rate paid ten thousand times a year and a rate never paid at all looked identical.

What the contract says that the file does not

Real payment depends on terms the schema had no place for. Some contracts pay the lesser of billed charges or the contract rate. Others include outlier provisions, where a very expensive case switches to a different payment method above a threshold. Some carve out implants, high-cost drugs or particular services and pay them separately.

A patient’s actual bill also combines several rates. A knee replacement involves a facility fee, a surgeon’s fee, an anesthesia fee and often others, each from a different line in a different file. Inpatient rates based on diagnosis-related groups need a weighting factor before they turn into dollars. A single number in the file was rarely the price anyone paid for an episode of care.

How teams turned rates into comparisons

Data and AI work runs into this trap all the time. A schema can guarantee structure without guaranteeing meaning, and any model or comparison built on the files inherited their ambiguity. Teams that extracted value spent most of their effort on interpretation:

• Matching provider identifiers to real practice locations, so a rate could be tied to an actual clinic.
• Filtering implausible combinations, such as specialists listed for services outside their field.
• Converting percentage-based rates using assumed charge levels, which introduces an estimate into every result.
• Checking results against actual claims, the records of what was really paid.

The two transparency rules helped each other here. Hospital files under the separate 2021 rule published gross charges, the list prices that percentage-of-charge contracts refer to. An analyst could use a hospital’s own published charges to convert a payer’s percentage rate into dollars. The result was an estimate, but a better one than a guess.

The competitive value lay in that interpretation work. Two organizations with the same raw files could reach different conclusions about the same market, depending on how they filtered and validated. For a health system’s managed care team, the group that negotiates contracts with insurers, the quality of that interpretation mattered more in negotiations than access to the files themselves.

Why models make the problem larger

Machine learning raised the stakes. A model trained to predict fair rates, flag outliers or estimate a patient’s cost learns whatever patterns the data contains, including ghost rates and mistranslated percentages. It does so at scale, and it hides the error inside a confident-looking number.

Simple checks catch much of this before modeling starts. Teams compared each payer’s rate for a common code with the Medicare rate for the same service, and flagged rates far outside a plausible multiple. They dropped combinations of provider specialty and code that made no clinical sense. They kept a record of every filter, so a later reader could see what had been removed and why.

Those records matter when results are challenged. A health system presenting a rate comparison to an insurer, or an employer presenting one to its board, should expect to be asked how the figures were built. An answer that names the filters, the conversions and the validation sample carries weight. An answer that points to a model’s output does not.

The case that the raw files were good enough

Some analysts argued that the noise mattered less than critics claimed. For common, high-volume services, such as office visits, imaging and standard lab tests, rates were usually flat dollar amounts. Comparisons across plans and providers for those codes were reasonably reliable from the start.

That argument has merit for a narrow set of services and for relative rather than absolute comparisons. It weakens quickly for inpatient care, complex procedures and anything paid by percentage or bundle, which is where most of the money in hospital contracts lies. A comparison built on the easy codes can mislead about the contract as a whole.

Accountability: who answers for the number

Plans could use third parties, such as administrators or vendors, to produce files, but the rule placed the obligation carefully. An insured group plan could shift legal responsibility to its insurer through a written agreement. Any other arrangement left the plan itself on the hook if the vendor failed. That sounds like a technicality, and it has real consequences.

The self-funded employer

Many large employers are self-funded: instead of buying insurance, they pay employees’ medical claims themselves and hire an insurer or administrator to run the network and process claims. For self-funded employer plans, the rule meant an employer was legally responsible for a file it had probably never opened, generated from network contracts it did not negotiate.

Consider a manufacturer with 3,000 employees and a self-funded plan run by a large administrator. Its benefits director learns, from a broker, that the company is the legal publisher of a file that may run to many gigabytes and that she has never seen. She does not know which vendor generates it, how it is checked or where it is posted. If the file is wrong or missing, the obligation is still the manufacturer’s.

Who enforces against whom

Enforcement was split, which added to the confusion. The Department of Labor oversees private employer plans under ERISA. The Treasury reaches group health plans through an excise tax provision in the tax code. HHS oversees insurers, generally alongside state insurance regulators, and covers non-federal governmental plans, such as those of states, counties and school districts.

That split mattered for the public sector. A county or a state university that self-funds its employee plan is a plan sponsor like any manufacturer, with the same publication duty. Public employers often run benefits through small human resources teams, procure administrators through formal solicitations and renew contracts on long cycles. Adding publication terms to those contracts could take a full procurement round.

Health systems on both sides

Health systems faced an unusual double role. As providers, their negotiated rates appeared in every payer’s files. As large employers, many self-fund their own employee health plans. A health system could be the legal publisher of one set of files and the subject of many others in the same month.

Providers had a stake in the payer files without control over them. A health system whose rates appeared in a payer’s file had an interest in whether they were represented correctly, since errors could surface in negotiations, research and the press. It had no direct way to correct the publication. Comparing payer files with its own contract terms lets a system spot misrepresentation before others do.

Writing it into the contract

The arrangement put a premium on documentation. An employer needed to know which vendor produced which file, how it was validated, where it was posted, and how errors would be found and corrected. Many service agreements with administrators were silent on these points in 2020. Renewals were the natural moment to add terms such as:

• Which party generates, hosts and links each file, and where the plan’s own website points to it.
• How the vendor validates files against the current schema before posting, and what evidence it gives the plan each month.
• How quickly the vendor must correct an error once found, and how it tells the plan.
• Who pays for generation, hosting and future schema changes, and how liability is allocated if files are late or wrong.

How responsibility is split in a particular plan’s agreements is a question for its lawyers. The broader point for employers came from other laws passed soon after. The Consolidated Appropriations Act, 2021, signed that December, banned contract clauses that kept plans from seeing their own claims data and required annual attestations of compliance. An employer that could see its own claims could test the published rates against them.

A mandated public dataset is also a public statement. Errors in it can appear in a reporter’s story, a competitor’s pitch or an enforcement action. Quality checks that would be optional for internal reporting become necessary when the data is published under legal obligation.

From raw file to negotiating table

Suppose a health system decides to use payer files to prepare for contract negotiations. The work typically unfolds like this.

1. Find the files. Each plan posts an index, often called a table of contents file, pointing to its rate files. Locating the right ones for the right plan products is itself a small research task, and the links change.
2. Download and store them. Because of their size, this needs cloud storage and automated download jobs rather than a staff member clicking links. Storage costs accumulate every month as new versions arrive.
3. Parse and reduce. Parsing means reading the raw format and breaking it into usable pieces. Most of the content is irrelevant to any one health system, so the pipeline keeps only rates for the relevant region, providers and codes.
4. Match and clean. Provider identifiers are matched to real hospitals and clinics. Duplicate rows are removed. Implausible combinations are flagged.
5. Interpret. Percentage-based and bundled rates are converted, with assumptions written down, into numbers that can be compared.
6. Validate. A sample of results is checked against the system’s own contracts and payments. If the system’s own rates look wrong in the file, that is a warning about everything else in it.
7. Present. Only then does the managed care team see a comparison it can use at the table.

Steps one to four are engineering. Steps five and six need people who understand health care contracts. Step seven is what leadership sees. Most of the cost and most of the risk lie in the parts leadership does not see, which is why ownership matters so much.

The details that decide quality

Each step hides choices that change the answer. Matching provider identifiers depends on the national registry of provider numbers, which records a practice address that may be years out of date. A health system with dozens of sites has to decide which identifiers belong to which campus before any comparison makes sense.

Validation works best against remittance data, the electronic payment advice that payers send with each payment. Remittances show what was actually paid for each claim. A team that samples its own top codes by volume and compares file rates with remittance amounts learns quickly how far to trust each payer’s file.

Presentation also involves judgment. Comparing single codes invites cherry-picking by both sides. A more defensible approach builds a market basket: the system’s most common services, weighted by its own volume, priced at each competitor’s published rates. The basket turns thousands of rates into a handful of figures a negotiator can use and defend.

Governance and counsel

Using competitors’ rates raises its own questions. The data is public, which lowers the concern that would attach to rival hospitals exchanging prices directly. How an organization shares, discusses or acts on its analysis can still raise competition issues. Health systems built these analyses with counsel involved in how results were used, especially where affiliated groups or joint ventures were involved.

The member tool draws on the same data

The same pattern applies to the hospital files under the separate 2021 rule, and to the cost-estimate tool plans had to build for members. That tool draws on the same underlying contract data, so errors in one place tend to show up in the other. A member who receives an estimate far from the eventual bill does not care which file was wrong; they remember the plan that gave them the number.

Building the tool also forced plans to confront the meaning problem directly. To give a member an estimate, a plan has to decide which rate applies, combine facility and professional fees, and apply the member’s deductible and coinsurance as they stand that day. Every ambiguity in the files becomes a visible error in an estimate.

Who gained, who carried the burden

Read together, the three problems explain the uneven results. The rule assumed that once data was public, markets would use it. Use required engineering capacity for volume, domain expertise for meaning and clear ownership for quality, and those were spread very unevenly across plans, employers and providers.

For each group, the business stakes were different:

• Health plans faced compliance risk, publishing costs and the prospect of competitors and providers reading their negotiated rates.
• Employers gained a potential tool for judging whether their administrator negotiated well, along with a legal obligation many did not know they carried.
• Health systems could, for the first time, see what rival hospitals were paid by the same insurers, provided they invested in the analysis. They also faced the reputational risk of their prices being misread in public.
• Analysts and data firms found a new raw material, and a business in refining it.

Large and small, rich and thin

The divide ran within groups as well as between them. A large academic health system with a data science team could build a pipeline in months. A rural hospital or a small physician group could not, and depended on whatever its association, its consultants or a vendor provided.

Employers split the same way. The largest self-funded employers, with benefits analytics staff and strong advisors, could commission studies of their administrator’s rates. A credit union or regional bank with a few hundred employees, often in a fully insured plan, had little reason or capacity to look. For the smaller employer, the practical benefit came secondhand, through brokers and consultants who used the files across many clients.

The argument that transparency could raise prices

A serious counter-argument came from economics. When sellers can see each other’s prices, lower-priced sellers may ask for more rather than higher-priced ones offering less. A much-cited study of Denmark’s ready-mixed concrete market in the 1990s found that prices rose after the government published them. Some economists raised the same concern about hospital rates.

The concern deserves weight. A hospital that learns it is paid well below its neighbors has an obvious negotiating point, and the files gave it one. Insurers gain the same information, though, and can use it to resist the highest rates. Evidence on the net effect in health care remains contested. For any single organization the practical point holds either way: the side with better interpretation goes into the negotiation better armed.

The pattern reaches far beyond health care. Governments increasingly require organizations to publish data, about prices, emissions, payments or performance. Each mandate raises the same three questions: whether anyone can handle the volume, whether the data means what readers think it means, and who is accountable when it is wrong.

Owners, pipelines and validation

Organizations that handled the files well tended to share some habits. They gave the data a named owner and a funded, maintained pipeline, rather than a one-off project. They treated schema updates as routine maintenance and budgeted for them. They invested in interpretation before modeling, validating rates against their own claims or contracts. And they wrote publication duties into vendor agreements so that responsibility was clear before anything went wrong.

Roles and measures

Ownership worked best when split by skill and joined by one accountable person. A data engineering lead kept the pipeline running. A contracting or reimbursement analyst owned interpretation and the documented assumptions. A business owner, often the head of managed care or the benefits director, owned the decisions the data supported.

A few simple measures kept the program honest:

• Freshness: whether this month’s files were collected and processed on schedule.
• Parse success: the share of files and records that loaded without error.
• Match rate: the share of provider identifiers tied confidently to a real location.
• Validation coverage: the share of the organization’s own volume checked against remittances or contracts.

These measures are simple. They tell leadership when a comparison rests on stale, partial or unmatched data, before it reaches a negotiation.

Writing down the assumptions

Interpretation choices change results, so they need to be recorded like any other business rule. The log should say which charge level was assumed when converting each percentage rate, and which codes were treated as ghost rates and removed. A short assumptions log, versioned alongside the pipeline, lets a new analyst reproduce last quarter’s figures and lets a negotiator defend them.

Build, buy or both

Many organizations faced a choice between building their own pipeline and buying processed data. Buying is faster and spreads the engineering cost across many customers. It also means accepting someone else’s interpretation choices, which may not fit a particular market or contract style.

The stronger approach was often a mix: buy the heavy processing, then validate the vendor’s output against the organization’s own contracts and remittances. An organization that cannot check a vendor’s numbers is relying on them blindly, however polished the product.

The payoff, and the alternative

The payoff can be seen in a regional health system whose managed care team builds a modest pipeline for the files of its three largest payers, matches rates to real competitor locations and checks a sample against its own remittances. Going into a renewal, it can show, with evidence it trusts, how its rates for common procedures compare with nearby hospitals. The insurer’s negotiators have the same files, and the conversation turns on the numbers rather than on who knows more.

The organizations that struggled made the opposite choices. Some treated publication as the finish line, meeting the legal requirement with no idea whether the file was accurate. Some took rates at face value and built comparisons or AI models on raw rows without filtering implausible combinations. Some built a pipeline once and let it break at the next format change. And some assumed the vendor had it covered, leaving duties unstated in administrator agreements while the legal obligation stayed with the plan.

Checks for any mandated dataset

• Which mandated public files are we legally responsible for, who produces each one, and when did anyone last open and check one?
• If a reporter or competitor quoted a wrong rate from our file, how would we know, and how would we fix it?
• Do our administrator or vendor agreements say who validates, posts and corrects these files, and who pays?
• Have we checked any conclusion from other organizations’ files against our own claims or contract data?
• For any mandated disclosure we use, what does the publisher actually guarantee, how often does the format change, and how are errors corrected?

The answers tend to differ by role. A plan sponsor answers the first three as a publisher. A health system answers the last two as a user, and often the first three as an employer. A public agency that self-funds its benefits answers all five, usually with fewer staff than either.

Price transparency files were an early, large-scale example of the gap between compliance data and analytical data. Organizations planning to use any mandated disclosure in analytics or AI should ask that last question first.

With hindsight

Researchers, employer coalitions and commercial data firms built products on the machine-readable files, and providers increasingly use them in contract talks; by 2026 they are an established if imperfect resource. The criticism that the files were too large and inconsistent for direct use held up. Much of their value reached decision-makers only after heavy processing by intermediaries.

That outcome deserves a pause. The rule did make prices public. It did not make them understandable to the people the public debate had in mind. The value flowed instead to organizations that could afford pipelines and interpretation, which is a reasonable result, but a different one from the one promised.

On the hospital side, enforcement tightened in steps. CMS raised the maximum penalties for larger hospitals in a rule issued in November 2021. In June 2022 it announced its first civil monetary penalties, against two Georgia hospitals in the Northside system that had not submitted corrective action plans. A later rule required hospitals to use a CMS template for their files from July 2024 and to affirm their accuracy.

A February 2025 executive order directed the departments to make disclosed prices more accurate and comparable and to strengthen enforcement. The hospital rules for 2026 replaced estimated allowed amounts with the median, 10th and 90th percentile of amounts actually allowed, drawn from remittance data. They also required a named official to attest to the file, with enforcement from April 2026.

For health plans, the departments proposed amendments to the Transparency in Coverage rules in December 2025 and finalized them in October 2026. The changes map closely onto the three original problems.

• Volume. In-network rates will be reported by provider network rather than by plan, which cuts duplication, and the main rate files move from monthly to quarterly updates.
• Meaning. The files gain product type and network identifiers, plus new taxonomy and utilization files, which should help analysts separate rates that are paid from rates that only exist on paper.
• Accountability. A new plain text file must list where the files live and whom to contact, which makes publishers easier to find and to hold to account.

The prescription drug file, deferred since 2021, finally has a timetable, with publication expected from December 2027. The revised rate files are due from April 2027. It took six years to reach changes aimed at the size and usability problems that were evident as soon as the first files appeared.

Employer accountability also became more concrete through other routes. The ban on contract clauses that blocked plans from their own claims data, and the annual attestations it required, gave employers both the access and the duty to look. Lawsuits by employees against large employers over health plan costs followed. A prominent one against Johnson & Johnson, over prescription drug costs, was dismissed on standing grounds in 2025. The cases still put plan sponsors on notice that the numbers can be scrutinized.

The consumer cost-estimate tools also arrived on schedule but did not become the main way most patients make decisions about care.

Mandated data tends to get more demanding over time. Requirements for accuracy and comparability rise once the first wave of files exists. An organization that built an owner, a pipeline and a quality check in the early years is now refining them; one that treated publication as a box to tick faces the work all at once, with quarterly network-level files, new reference files and named attestations arriving together.

The 2020 rule is best understood as the point when health care pricing turned into a public data asset, with all the engineering and governance that implies.