By Katie Keith, Jack Hoadley, and Kevin Lucia

On July 1, 2021—just in time to meet a statutory deadline set by Congress—the Departments of Health and Human Services (HHS), Labor, and Treasury, and the Office of Personnel Management (OPM) issued an interim final rule (IFR) to implement key parts of the No Surprises Act (NSA). The NSA—which was adopted as part of a broader legislative package in December 2020 and builds on parts of the Affordable Care Act (ACA)—includes comprehensive new patient protections against surprise medical bills. The IFR was issued alongside a press release, two fact sheets, and other new materials.

Out-of-network surprise medical bills (also known as balance bills) arise when a consumer inadvertently or unknowingly receives care from a provider (such as a physician) or at a facility (such as a hospital) that is not within their insurance plan’s network. This might occur when a patient is taken to the closest emergency room, which happens to be in an out-of-network facility—or where the patient seeks care at an in-network hospital and with an in-network surgeon but is treated by an out-of-network anesthesiologist. Out-of-network providers and facilities typically charge a higher rate to insurers than an in-network provider, leading to higher cost sharing for consumers. And, if the insurer refuses to pay the out-of-network provider’s billed charge, the provider may seek to recover the “balance” by billing the patient.

This “balance billing” exists in both emergency and non-emergency situations and can lead to extremely high surprise out-of-pocket costs for patients. The prevalence of surprise bills is well-documented. Balance billing also has implications for negotiations between payers and providers, and some providers use the threat of balance billing to obtain higher in-network reimbursement from payers. The preamble to the IFR—in a section titled “surprise billing and the need for greater consumer protection” and the economic impact analysis—includes an excellent summary of these issues. The preamble also documents just some of the harrowing stories from consumers who have received surprise medical bills and describes the harmful impact that balance bills (and resulting medical debt) can have on lower-income Americans, people of color, rural residents, and other underserved and minority communities.

The historic NSA aims to protect patients from the most pervasive types of balance bills for emergency services (including by air ambulances, although not ground ambulances), including some services after the patient is stabilized, and non-emergency services at in-network facilities (unless a patient consents to treatment by an out-of-network provider). Patients treated by an out-of-network provider will only be responsible for the same amount of cost-sharing that they would have paid if the service had been provided by an in-network provider. And providers and facilities are banned from sending balance bills to patients to collect a higher amount.

By significantly reducing out-of-network surprise bills, the NSA will reduce out-of-pocket costs which will, in turn, reduce anxiety, financial stress, and medical debt. By reducing these stressors, and removing financial barriers to care, the NSA has the potential to improve access to care and potentially health outcomes as well. The NSA also establishes a process to resolve payment disputes between insurers and out-of-network providers—this includes an open negotiation process with independent dispute resolution (IDR) if negotiations fail. The law incorporates several guardrails to prevent abuse of this process.

The NSA’s protections go into effect beginning on January 1, 2022, and the federal government is racing to issue new rules and guidance so that stakeholders understand their rights and responsibilities under the new law. This IFR addresses only parts of the NSA, including areas where Congress set a specific statutory rulemaking deadline of July 1. Topics in this IFR include patient cost-sharing protections, notice and consent standards for waivers, rules for calculating the qualifying payment amount (QPA), disclosure requirements, and complaints processes, among other standards. The agencies will accept public comment on the IFR for 60 days after publication in the Federal Register (comments can be made on related materials for 30 days), but the IFR is expected to go into effect as written.

Additional rulemaking is coming for the remaining parts of the legislation, such as the IDR process, additional transparency measures, and price comparison tools. The recent unified agenda suggests that at least two more rules should be expected: another IFR focused on the IDR process and a proposed rule focused on air ambulances and enforcement. While this IFR includes many strong consumer and patient protections, the agencies acknowledge that the true impact of the NSA on overall market dynamics—such as premiums and network negotiations—cannot be assessed until we have rules on the IDR process. The IFR and these forthcoming rules are “interrelated,” and the agencies expect to include additional analysis of the NSA’s broader market impacts in future regulations.

Beyond those immediate topics, there are many other provisions in the NSA that will require further rulemaking but where the agencies may not be able to issue rules before these provisions go into effect on January 1, 2022. These topics include transparency in insurance ID cards, continuity of care, accurate information on provider networks, a ban on gag clauses, and pharmacy benefit and drug cost reporting requirements. Even without implementing rules, those provisions of the statute will still go into effect, and regulated entities are expected to adopt a good faith, reasonable interpretation of the NSA. Any future rulemaking will ensure that regulated entities have time to come into compliance with new rules.

The NSA has multiple parts and can be confusing. This post generally divides the topics included in the IFR into two sections. The first section covers topics that directly affect patients (such as new consumer protections, how to calculate cost sharing, and the complaints process). The second section covers topics that have a more indirect effect on patients and are more directed towards regulated entities (such as how to calculate the QPA, disclosure requirements, and communication between insurers and providers).

Why An IFR?

Federal agencies must typically issue a notice of proposed rulemaking, solicit public comment on their proposal, review and respond to public comment, and then issue a final rule. But federal agencies can forgo the public comment process when they have “good cause” to do so. Here, the agencies cite explicit authority to issue IFRs to implement parts of Employee Retirement Income Security Act (ERISA) and the Public Health Service Act and note that it would be impracticable and contrary to the public interest to delay implementation of the NSA. Even if the agencies technically had time to undertake full notice and comment rulemaking throughout 2021, this would not have given stakeholders—whether regulated entities or state officials—enough time to come into compliance with the new rules. By issuing an IFR, regulated entities and other stakeholders will have more time to adjust rates, billing practices, and materials (such as notices) ahead of the law’s 2022 effective date.

Even though the agencies issued an IFR, they request a significant amount of comment to help inform future rulemaking. Those requests for comment are not summarized here but touch on a range of issues, including the scope of the IFR, the process for obtaining notice and consent, data on urgent care centers, the impact of health care consolidation on reimbursement rates, how to improve the billing process to identify NSA-related claims, and whether to set a minimum initial payment rate, among other topics. Comment on these and other topics are due in 60 days.

Building On The ACA: Banning Insurer Practices On Emergency Services

Before we get to the balance billing-related provisions of the NSA, the IFR includes additional patient protections that build on the ACA and prohibit restrictive coverage practices for emergency services by insurers. The NSA readopts Section 2719A of the Public Health Service Act (which was added by the ACA) and extends the scope of this protection to grandfathered plans beginning in 2022. HHS estimates that there are about 1.8 million non-federal government plan policyholders and nearly 838,000 policyholders with grandfathered individual market policies.

Section 2719A has, since 2010, required plans and insurers that cover emergency services to do so without requiring prior authorization and regardless of whether a provider participates in the plan’s network. The IFR includes additional clarity on how emergency services must be covered—and the restrictions that plans and insurers cannot place on emergency care. Plans and insurers cannot:

• Limit the coverage of emergency services based on plan terms or conditions (other than the exclusion or coordination of benefits), waiting periods, or cost-sharing requirements;
• Impose limits on out-of-network providers that are more restrictive than those for in-network emergency care;
• Deny coverage for care received in an emergency setting based solely on diagnostic codes;
• Deny coverage for emergency care without first applying a prudent layperson standard (i.e., whether a prudent person would reasonably seek emergency care based on their symptoms);
• Require a time limit between the onset of symptoms and when the patient sought emergency care or deny coverage simply because symptoms were not sudden; or
• Deny emergency services based on general plan exclusions (e.g., denying emergency coverage for pregnant dependents because a plan excludes dependent maternity care, an exclusion that advocates argue discriminates on the basis of sex).

These clarifications will help ensure that patients’ emergency care is covered and that they will not face a different type of surprise bill when they thought they were having an emergency only to be told by their insurer that they were not (and that their care would thus not be covered). These important clarifications will help limit aggressive attempts by insurers—UnitedHealthcare most recently but there are others—to refuse to cover emergency services that the companies later deem non-urgent.

How The NSA Applies

On to the NSA itself, which applies to both payers and providers. In general, the provisions that apply to payers are promulgated jointly by HHS, Labor, Treasury, and OPM. The provisions that apply to providers are promulgated by HHS.

Payers

The NSA applies to group health plans as well as health insurers offering group or individual health insurance coverage with plan or policy years beginning on or after January 1, 2022. This includes coverage in the individual, small group, and large group markets and extends to self-funded plans, non-federal governmental plans (such as state and local employee benefit plans), church plans, grandfathered plans, grandmothered plans, student health insurance, and insurers that offer coverage through the Federal Employees Health Benefits Program (FEHBP) (which is why OPM is included in the rulemaking). OPM generally adopts the same provisions, with some clarifications to integrate with the FEHBP. The IFR also generally applies to traditional indemnity plans, although these types of plans may have unique benefit designs (i.e., no networks) that make parts of the IFR irrelevant.

The NSA does not mandate that all plans or insurers cover the relevant emergency or non-emergency care covered that falls under the scope of the NSA. But if plans and insurers cover this care, then the NSA applies. With respect to the individual market, the NSA extends only to individual health insurance coverage, meaning products that are exempt from this definition (such as short-term limited duration insurance) do not have to comply with the NSA. The IFR also does not apply to excepted benefits, health reimbursement arrangements (or other account-based plans), or retiree-only plans.

Providers, Facilities, And Air Ambulances

With respect to providers, the NSA applies to physicians and health care providers, health care facilities, and air ambulances. As discussed below, certain providers and facilities must also comply with new disclosure requirements to inform patients of surprise billing protections.

In general, the NSA prohibits providers and facilities from sending balance bills to patients or otherwise holding patients liable for cost sharing beyond what they would have paid for in-network care. These protections apply when a patient receives emergency services from an out-of-network provider or facility, when a patient receives non-emergency services from an out-of-network provider at an in-network facility, and when a patient receives out-of-network air ambulance services.

While the NSA bans the most common types of balance bills, it does not prohibit balance bills in every circumstance. As discussed more below, the protections do not apply if a patient consents to treatment (and thus higher out-of-pocket costs) by an out-of-network provider. The NSA also only applies to certain types of items and services, meaning balance bills can still be sent by providers or facilities that provide non-emergency care that is not covered under the definitions included in the NSA (e.g. outpatient mental health providers or services delivered in a physician’s office).

To help ensure compliance with this ban, HHS cautions providers, facilities, and air ambulances against sending bills directly to an individual (as many do now, leaving the patient responsible for submitting a bill to their plan or insurer for reimbursement) before first working with plans and insurers to determine whether the care provided falls under the NSA. This is consistent with Congress’ goals of preventing patients from being put in the middle between insurers and providers.

If a provider still sends a balance bill that violates the NSA, HHS can impose civil monetary penalties of up to $10,000 per violation. These penalties can be waived but only if 1) the provider did not knowingly violate and should not have reasonably known it violated the NSA; and 2) the provider withdraws the bill and reimburses the plan or individual plus interest. As noted above, HHS intends to undertake additional rulemaking on NSA-related enforcement requirements.

Emergency Services

Patients will be protected from surprise medical bills for emergency services from the point of evaluation and treatment until they are stabilized and can consent to being transferred to an in-network facility. Protections will apply whether the emergency services are received at an out-of-network facility (including any facility fees) or provided by an out-of-network emergency physician or other provider at either an in-network or out-of-network facility. Patients cannot waive the NSA’s protections for emergency services, except in limited circumstances for post-stabilization services (as discussed below).

The NSA defines emergency services to include the items and services needed to screen, treat, and stabilize a patient with an emergency medical condition. An emergency medical condition occurs when someone has acute symptoms that are sufficiently severe that a prudent layperson—someone with an average knowledge of health and medicine (i.e., not a medical professional)—could reasonably expect that immediate medical attention is needed. The definition of emergency services includes a medical screening exam (including routine ancillary services needed to evaluate someone’s condition), further treatment to stabilize the individual, and post-stabilization services.

Under the NSA, the definition of emergency services includes items or services provided in emergency departments of hospitals and in independent freestanding emergency departments. The IFR concludes that emergency services provided at an urgent care center also fall under the NSA if that urgent care center is appropriately licensed by the state to provide emergency care.

Post-Stabilization Services

As noted above, the NSA defines emergency services to include post-stabilization services, except under certain conditions. This means that patients are generally protected from balance bills for post-stabilization services. Post-stabilization services are what they sound like. This includes additional care that the plan or insurer would otherwise cover that is, in this case, delivered by an out-of-network provider or at an out-of-network facility after a patient is stabilized. These services fall under the NSA regardless of where in a hospital such services are furnished; they may be provided as part of outpatient observation or an inpatient or outpatient stay if provided together with emergency services.

Post-stabilization services are not treated as emergency services under the NSA (meaning a patient could be legally balance billed) if certain conditions are met. Patients could face balance bills for post-stabilization services if 1) the patient’s attending emergency physician or treating provider determines that the patient can travel to an in-network facility using nonmedical or nonemergency transportation (but the patient opts to stay at the out-of-network facility); 2) the patient gives informed consent to the out-of-network care (and agrees to be balance billed for this care); and 3) the provider or facility satisfies any other conditions laid out by the agencies. Providers and facilities must also comply with relevant state laws (including, for instance, state laws that prohibit patients from waiving balance bill protections).

The agencies include additional patient protections in interpreting these conditions and emphasize that post-stabilization notice and consent procedures should be used sparingly and in limited circumstances. For instance, a receiving in-network facility must be within a reasonable travel distance. A patient simply cannot give consent when they are far away from any in-network providers and unable to use nonmedical transportation. The same is true if an individual faces unreasonable travel burdens (such as being unable to afford transport or not well enough to take public transit). These limitations prevent them from giving consent. When a patient cannot consent, the NSA’s protections continue to apply to post-stabilization services and the patient cannot be balance billed.

Air Ambulance Services

The NSA applies to air ambulance providers, which have a history of sending extremely high surprise medical bills to patients with critical medical situations. These protections apply to medical transport by a rotary-wing air ambulance (e.g., a helicopter), a fixed-wing air ambulance, and inter-facility transports. The NSA confirms that its provisions apply to plans or coverage that cover air ambulance benefits (even if there are no current in-network air ambulance providers). This protection is important because many air ambulance providers have opted not to join plan networks, instead using balance billing as a business strategy.

Nonemergency Services

The NSA protects patients from being balance billed for nonemergency services provided by an out-of-network provider at an in-network health care facility. Health care facilities include hospitals, hospital outpatient departments, critical access hospitals, and ambulatory surgical centers. The agencies have discretion to identify additional types of health care facilities and are particularly interested in whether urgent care centers or retail clinics should receive this designation.

For purposes of this provision of the NSA, an in-network facility must have a direct or indirect contractual relationship with a plan or insurer that covers nonemergency care. This may include a “single case agreement” where a facility and plan or insurer contract for purposes of treating a single patient. A single case agreement may be needed if, say, the patient needs a certain type of specialty care (e.g., pediatric neurosurgery) and the insurer or plan contracts with a particular facility to obtain this care. In those instances, the facility will be treated as an in-network facility for purposes of the NSA and that patient cannot be balance billed for care under the single case agreement, either by the facility or any out-of-network provider at the facility.

The NSA also bans balance bills for care provided during the “visit” to an in-network health facility for nonemergency services. The visit may include equipment and devices, telemedicine services, imaging services, laboratory services, and preoperative and postoperative services. This means that, in addition to the services provided at the in-network facility, patients generally cannot be balance billed for these services. This protection applies even if the provider that furnished those items or services is not physically located at the in-network facility. This key protection means that a patient who, say, just had surgery does not have to worry about whether their in-network hospital is sending their labs to an off-site, out-of-network lab that will lead to a balance bill or that their scans will be read by an off-site, out-of-network radiologist. Those lab or radiology services would be part of the individual’s visit to the in-network facility and thus fall under the NSA’s protections.

Notice And Consent

Some of the most common surprise medical bills are sent by nonemergency out-of-network providers that furnish ancillary services (such as those delivered by a radiologist, anesthesiologist, or pathologist) or specialty services needed to respond to unexpected complications (such as those delivered by a neonatologist or cardiologist).

The NSA will prohibit these surprise bills. However, in limited circumstances, a patient can knowingly and voluntarily agree to use certain types of out-of-network providers. For instance, if a patient wants to select an out-of-network orthopedist for a knee replacement or an out-of-network obstetrician for a scheduled delivery, the patient can waive the NSA’s protections (and thus agree to be charged a balance bill). Because the patient is knowingly choosing to see an out-of-network provider, the additional cost is no longer a “surprise” to the patient.

The NSA allows these agreements but also limits the opportunity for many providers to ask a patient to sign a consent waiver. First, the notice and consent exception only applies in nonemergency situations. Thus, patients cannot be asked to sign a consent waiver for emergency services (other than post-stabilization services when certain conditions are met) or air ambulance services. Second, even in nonemergency settings, providers cannot request a consent waiver 1) if there is no in-network provider available in the facility; 2) for care for unforeseen, urgent medical needs (whether for nonemergency care or post-stabilization services); or 3) if the provider furnishes ancillary services that a patient typically does not select.

All three of these requirements are important, but it is worth emphasizing the third category since ancillary providers have been a significant source of surprise out-of-network bills. Ancillary services are defined under the NSA to include care related to emergency medicine, anesthesiology, pathology, radiology, and neonatology; care provided by assistant surgeons, hospitalists, and intensivists; and diagnostic services (including radiology and laboratory services). This means these types of providers—or, in some instances, the providers that offer these types of care—can never ask a patient to sign a consent waiver to be balance billed for services covered by the NSA.

The NSA allows HHS to identify additional providers that may not ask for a consent waiver. Federal officials considered doing so for providers furnishing inpatient mental health services, cardiology services, and rehabilitative services. But those providers were not ultimately included under the IFR, and the agencies instead ask for comment on which, if any, additional ancillary services should be included. HHS also declines, for now, to identify a list of advanced diagnostic lab tests that would not be considered ancillary services (and, thus, for which a patient could be balance billed if the patient consented to a waiver of the NSA’s protections).

Content Of The Notice And Consent Forms

In the limited situations when a patient can waive the NSA’s protections, consent can be given only after the patient (or an authorized representative acting in the patient’s best interest) has received a written notice that fully informs the patient of the consequences of waiving these protections. (We find it hard to believe that many patients will want to willingly waive the NSA’s strong protections and agree to pay higher balance bills and thus out-of-pocket costs, other than in occasional situations where they elect an out-of-network specialist, surgeon, or obstetrician.)

Providers and facilities must use the standard written notice and consent forms created by HHS; copies are available here and stakeholders can comment on these materials for the next 30 days. Although the standard notice must be used, providers and facilities must tailor the document to each individual patient by filling in information about the provider/facility, a good-faith cost estimate of the patient’s estimated charges (including a breakout of separate services), and whether prior authorization or other care management requirements may need to be satisfied. The notice must also inform the patient that consent is not required and that they have the option to seek (or request a referral for) in-network care, and it must provide a list of in-network providers at the facility. The consent form must reflect similar tailored information.

An in-network facility (e.g., hospital) may provide the notice and consent forms on behalf of an out-of-network provider (e.g., physician). The IFR also allows multiple out-of-network providers to join on a single notice so that the patient can consent to waiving NSA protections for multiple providers all at once. This can only be done if the notice identifies each provider by name, identifies the care that each provider will be furnishing, provides a good faith estimate for each provider’s costs, and gives the option to consent to waive NSA protections separately for each provider. (Note again that this single notice may not include providers of ancillary services, who are not allowed to request a consent waiver at all.)

With respect to asking for consent to balance bill for post-stabilization services, out-of-network emergency facilities must provide a good faith estimate of costs on behalf of both the facility itself and any out-of-network providers at that facility. If the facility fails to include all the providers in the good faith estimate, the notice and consent criteria will not be met for those providers (and the NSA’s protections will still apply, meaning the patient may not be balance billed).

Notice and consent forms must be translated into the 15 most common languages in the facility’s geographic region, which HHS interprets to be the 15 most common languages spoken in the state. Recognizing, however, that common languages can vary significantly (i.e., the 15 most common languages spoken in a state may not be the most common languages of those served in a specific facility), providers and facilities have flexibility to select the 15 most common languages applicable to the specific geographic region.

A patient cannot give consent if they cannot understand any of the 15 languages. A patient may not be able to comprehend the notice because their self-reported preferred language is not among those 15 languages or because they report that they cannot understand the language in which the forms are provided. If the provider or facility still wants to obtain consent, they must provide a qualified interpreter who can translate in the patient’s self-reported preferred language for both oral and written communication. Providers and facilities must also comply with other language access (and disability) requirements, including Section 1557 of the ACA.

When The Notice Must Be Provided

Consent must be provided voluntarily without undue influence, fraud, or duress. To ensure that patients (or their authorized representative) are truly giving voluntary consent to pay higher out-of-pocket costs, HHS adopts several specific procedural requirements for providing notices and obtaining consent.

The notice and consent forms cannot be buried among other documents and must be given to the patient separately from other documents. The forms may be provided on paper or electronically (based on the patient’s preference), and the consent document must be signed by the patient or their representative. A copy of the signed forms must be given to the patient, and the forms must reflect the date the notice was provided and the date and time that the consent form was signed. As noted above, each notice must name a specific provider (or multiple providers) to be valid; a patient cannot agree to waive the NSA’s protections for an unnamed provider. Written notice and consent documents must be retained for at least seven years.

Notice and consent must be given at least 72 hours in advance of a scheduled appointment. If the appointment occurs less than 72 hours after scheduling, notice and consent can be given on the same day as the appointment was made and must be given at least 3 hours in advance of the appointment itself. The 3-hour restriction is designed to help ensure that consent is truly voluntary and help avoid a patient feeling pressure to sign away their rights under the NSA when, say, an out-of-network specialist simply shows up for a consult during a hospital stay or when a patient is in a hospital gown awaiting a procedure.

Keep In Mind

Nothing requires a provider or facility to seek consent from a patient to waive the NSA’s protections. This is entirely up to the providers and facilities, and stakeholders will be watching to see if and how often providers and facilities ask patients to waive their rights.

The agencies expect that at least some providers and facilities will use notice and consent waivers: they estimate a cost of more than $99 million annually in time spent by patients and their families to read and understand these forms, and annual costs to providers and facilities of more than $117 million annually beginning in 2022 to comply with notice and consent requirements.

A patient can refuse to provide (or revoke) consent to waive their NSA protections. A patient can also pick and choose the providers and type of care where they may be willing to waive the NSA’s protections—including some, none, or all providers or care listed on the notice. Revocation of consent must be given in writing before the care is provided. For patients who do not consent or who revoke their consent, the NSA’s protections remain in place. A provider or facility can refuse to treat the patient if they refuse to consent to being balance billed, but the patient cannot be charged a fee for an appointment that is cancelled because the patient will not consent (or revokes consent). Such a fee, the agencies note, would be considered a form of coercion.

The NSA’s standard is generally more protective of consumers than many state laws that allow for consent waivers. As a result, the NSA’s standards will serve as the minimum floor of protection, although states can impose requirements on providers and facilities that are more protective of consumers. Examples of more protective state laws include laws that require providers to send waivers further in advance (e.g., 10 business days as in Texas) or ban consent waivers altogether (e.g. Washington).

Complaints Processes

HHS must establish a complaints process for consumers who have been illegally balance billed. This process extends to all violations of the NSA by providers, facilities, and air ambulances. The agencies must also establish a process to receive complaints about NSA violations by plans and insurers. This extends to all NSA-related consumer protections and balance billing requirements that apply to plans and insurers, including violations of QPA requirements.

The agencies will establish one system for all complaints, recognizing that consumers typically do not know which agency has enforcement authority (whether HHS, the Department of Labor, state insurance departments, etc.) and the need for a seamless experience for filing complaints. They intend to ensure that the complaints process is accessible, that communication and language needs will be met, and that the information will be understandable to consumers.

A complaint can be filed verbally or in writing by an individual or their authorized representative as well as a regulated entity (such as a provider or plan). A complaint need only include enough information to process and investigate the issue. The agencies considered, but did not adopt, a standard for how quickly a complaint must be filed after the time of an alleged violation.

HHS must respond to a processed complaint within 60 business days of receipt. This response may be oral or written and will inform the complainant about their rights, obligations, and next steps (such as referring the complainant to another state or federal resolution process or regulatory entity). HHS may also request additional information to process a complaint and will make reasonable efforts to notify the complainant of the outcome of the investigation (including any resolution or corrective action).

HHS expects a total of 3,600 annual complaints about noncompliance with the NSA by providers, facilities, air ambulances, plans, and insurers. There is significant uncertainty about the degree to which consumers might file complaints, but this estimate seems low given the number of patients covered under the NSA. The complaint systems are expected to cost about $19 million to develop in 2021 with ongoing costs of about $1.6 million in 2021, $9.9 million in 2022, $10.1 million in 2023, and $10.3 million in 2024 and subsequent years.

Patient Cost-Sharing Protections

Beyond banning balance bills, the NSA limits patient cost sharing. Patients who receive out-of-network care will only have to pay the cost-sharing amount that they would have paid if the provider had been in-network. This applies to emergency services, nonemergency services, and air ambulance services as described above. (So, if a plan requires 20 percent coinsurance for in-network emergency room visits, the plan can impose a coinsurance rate of no more than 20 percent for an out-of-network emergency room visit.) This cost-sharing must also be counted towards a patient’s in-network deductible and annual out-of-pocket maximum.

Plans and insurers must calculate the relevant cost sharing as if the total amount that would have been charged by an in-network provider is equal to the “recognized amount” for the items and services, plan or coverage, and year. The recognized amount is based on the cost of the item or service as determined by a “specified state law” (more on that below). If there is no relevant state law (as is the case for many states and most self-funded group health plans), then cost sharing is based on the provider or facility’s qualifying payment amount (QPA). The QPA is generally the median of the plan or insurer’s contracted rates for the item or service in that geographic region. (The statute and IFR also include special rules that account for all-payer models in states like Maryland; those special rules are not detailed here.)

The IFR is consistent with the statute but clarifies that patient cost sharing is determined either by state law or the lesser of the QPA or the provider’s billed charge. This clarification ensures that patients do not face higher cost sharing when a provider bills less than the median in-network rate. In that instance, a patient’s cost-sharing amount will be based on the lower billed charges, not the higher QPA. The preamble also emphasizes that patient cost sharing will not be affected even if the plan or insurer ultimately pays a higher amount to the out-of-network provider or facility before, during, or after the IDR process.

The NSA’s cost-sharing protections apply equally to air ambulances but there is no recognized amount because there is no specified state law on air ambulances (since states are preempted from regulating these providers under the Airline Deregulation Act.) But, consistent with the other services, plans and insurers must base any coinsurance or deductible for air ambulance services on the lesser of the QPA or the provider’s billed charge.

Specified State Law

A “specified state law” is a state law that provides “a method for determining the total amount” that should be paid to an out-of-network provider by a plan or insurer to the extent that state law applies. In addition to the role of the recognized amount in defining patient cost sharing, state laws that set a payment standard, require IDR, or use a hybrid of both are not displaced by the NSA. A state with such a law can continue applying its method of determining payment to resolve disputes between insurers and out-of-network providers.

The agencies assert that 14 states have, to date, established a method for determining payment for emergency or nonemergency services. Those states are not listed or otherwise identified so it is unclear what basis the agencies used for making this determination; based on our analysis of state law, we would have expected a higher count of states. Setting that aside, the recognized amount will be determined using the law in those states for fully insured plans or policies (and for the limited number of self-funded opt-in programs). But most claims—an estimated two-thirds—will require calculation of the QPA (discussed in more detail below).

Deference to the recognized amount under a specified state law only extends as far as state law applies. If providers or facilities are not covered under state law, disputes with those providers will be resolved under the NSA. If certain services (e.g., nonemergency services) are not covered under state law or the provider and insurer are in different states, cost sharing will be based on the lesser of the QPA or provider’s billed charge, and payment disputes will be resolved under the federal IDR process.

The preamble includes several examples regarding specified state laws to help illustrate these distinctions. A state could, for instance, have a “specified state law” that does not include neonatologists in its definition of surgical and ancillary services. This is the case in Washington State. Because neonatologists are included under the NSA (but not state law), there would be no specified state law for purposes of the recognized amount or patient cost sharing. As such, the federal rules for cost-sharing and arbitration (rather than the state’s payment methodology or process) would apply to any disputes between fully insured plans and out-of-network neonatologists. The same is true if a state’s law only applied to emergency services as is the case in Nevada, among other states; the NSA would govern out-of-network disputes and cost sharing issues for nonemergency services. Disputes arising when care is delivered in a different state than where the insurer is based will be handled under the NSA process.

There are some potential state interactions with respect to FEHBP coverage. In general, FEHBP contract terms supersede and preempt state and local health insurance-related laws. As a result, the specified state law will not apply even if a federal employee or dependent lives in a state with balance billing protections. This specified state law will only apply if OPM and the carrier agree to apply state law for purposes of determining the amount payable. To the extent that these parties agree to do so, those terms will be made effective in OPM contracts with carriers. Without such an agreement, the recognized amount for cost sharing for FEHBP enrollees will be the lesser of the QPA or billed charges. This same principle—that state law can be incorporated by contract or not—extends equally to state IDR processes: if an FEHBP contract does not explicitly incorporate the state process, then the federal IDR process will apply.

State Opt-In Programs for Self-Funded Plans

The agencies take the position that ERISA does not prevent states from allowing self-funded ERISA-covered plans to choose to comply with state law. As such, specified state law applies for purposes of cost-sharing and payment standards for self-funded plans that have “opted in” to state balance billing protections. This is currently an option in only a handful of states—Maine, New Jersey, Nevada, Virginia, and Washington—and the scope of each state’s law varies. To date, 20 entities have opted into Nevada’s law (for emergency services only), 137 entities have opted into New Jersey’s law, 351 entities have opted into Virginia’s law, and 230 entities have opted into Washington’s law. It is not clear how many self-funded entities have opted into Maine’s relatively new law (for emergency services only).

Self-funded plans that opt in to state payment standards must do so for all items and services that fall under the state law (i.e., plans cannot pick and choose) and must prominently display this coverage in plan materials. This will be the only instance in which the specified state law applies to self-funded group health plans (which are not otherwise subject to state balance billing restrictions).

Disclosure Requirements

Plans, insurers, providers, and facilities must post a publicly available notice about the NSA’s patient protections and balance billing requirements on their websites. Plans and insurers must also include this disclosure on every explanation of benefits for items or services that fall under the NSA.

Most providers and facilities must additionally provide notice to patients. Because balance billing is generally prohibited under Medicare, Medicaid, and other public programs, the disclosure is not relevant for patients with those sources of coverage; as such, the disclosure need only be provided to those with commercial insurance. Notice must be received no later than the time when the provider or facility asks for payment (including cost sharing) or submits a claim. Given how late this often is in the process, it is unclear how effective such a notice will be (as opposed to, say, requiring the disclosure be provided when the patient schedules an appointment).

The one-page (double-sided) notice must specify how to contact the appropriate state or federal agency if a provider or facility violates the NSA. It can be provided in-person, by mail, or by email. Providers and facilities must also prominently display this information in a publicly accessible location, such as where patients schedule care, check-in, or pay bills. This, HHS believes, will make it easier for individuals to be aware of the NSA’s protections before an appointment or before they pay a bill. To help avoid multiple disclosures, this requirement is satisfied for providers if their facility agrees to provide this information (pursuant to a written agreement to do so).

The preamble lays out various requirements that regulated entities must meet to satisfy this disclosure requirement, including compliance with state and federal language access standards. HHS encourages the use of plain language and user testing when developing these notices and urges states to develop model language that reflects state-specific requirements that may be more protective than the NSA. That said, the agencies released a model disclosure notice that regulated entities can use; those that do will be considered to be in good faith compliance with this requirement.

Air ambulances do not have to make the same disclosure, but HHS encourages these companies to provide clear, understandable information about the NSA. Providers that do not furnish care in a health facility—such as primary care physicians—do not have to comply with the disclosure requirement. And disclosures are only required for actual patients who receive care in a health care facility (or in connection with a visit to a health care facility). These exceptions are to avoid confusing patients who are in circumstances where the NSA’s balance billing protections would never apply.

Calculating The Qualifying Payment Amount

The NSA refers repeatedly to the QPA, which is the median of all the plan or insurer’s contracted rates from January 31, 2019 for a given item or service in that geographic region, increased for inflation. As noted above, the QPA affects patient cost sharing in many instances and is a key factor for arbitrators to consider if and when payment disputes are resolved through the federal IDR process. Recognizing that it could be challenging to calculate the QPA, the agencies were directed to clarify and define several components of the QPA and to issue implementing regulations by July 1, 2021.

The QPA is calculated by taking the contracted rates of all plans or all coverage offered by the insurer in the same insurance market for the same or similar item or service, that is provided by a provider in the same or similar specialty or facility of the same or similar facility type, and provided in same the geographic region. Sounds simple, right? Not at all. The information below helps define some of these key phrases to help plans and insurers be prepared to calculate the QPA.

Once plans and insurers have identified their relevant contracted rates, these rates will be arranged from least to greatest. In general, each contract corresponds to a single number for this calculation, as detailed below. The plan or insurer will then select the middle number (the median). If there are an even number of contracts, the plan or insurer will average the two middle numbers.

The agencies estimate one-time costs of nearly $5 billion for insurers and third-party administrators to make system changes in 2021 to be prepared to calculate recognized amounts and the QPA. Each plan/third-party administrator and insurer will incur an estimated average of $2.8 million in one-time costs. This will be followed by total operational costs of about $2 billion in 2022 and $724 million annually in 2023 and beyond.

Contracted Rates

The contracted rate is the total amount (including cost sharing) that the plan or insurer has contractually agreed to pay to an in-network provider, facility, or air ambulance provider for covered items and services. This includes direct or indirect payments, including through a third-party administrator or pharmacy benefit manager. The number of contracted rates is based on the number of contracts with individual providers. When a plan or insurer contracts with a provider group or facility, the negotiated rate is treated as a single contracted rate. And each contracted rate is counted once regardless of the number of claims paid at that contracted rate. If the plan or insurer has multiple contracts that pay the same amount, those amounts are each counted separately.

Rented networks from a third party will be treated as the plan’s or insurer’s contracted rates for calculating the QPA. Rates for single case agreements (or other ad hoc arrangements for individual patients) will not be.

Given some of the unique ways that payment amounts are calculated, the IFR includes specific guidance for determining the QPA for anesthesia services, air ambulance services, and alternative payment models (such as bundled and fully or partially capitated arrangements). These calculations are not detailed here. To the extent that alternative payment arrangements include incentives such as bonuses or penalties, those incentives must be excluded when calculating median contracted rates. There are also special rules for unit-based services where reimbursement is set by multiplying the contracted rate by a unit such as time or mileage.

The contracted rates included in a QPA must be for the “same or similar item or service,” which is based on items or services with the same or comparable CPT, HCPCS, or DRG codes. If the plan or insurer varies its contracted rates by specialty or facility (e.g., hospital ER versus freestanding ER), the QPA should be calculated separately for each type of provider specialty or facility. This does not, however, extend to characteristics such as whether a hospital is an academic medical center or teaching hospital. If these facilities had a separate QPA calculation, patients might face higher cost sharing simply because the nearest emergency department happened to be a teaching facility.

For air ambulances, all air ambulance service providers (including inter-facility transports) will be treated as a single provider specialty under the NSA. This is true regardless of the type of aircraft (e.g., fixed-wing versus rotary-wing) or revenue model (e.g., hospital-based air ambulance provider versus independent non-hospital-based air ambulance provider).

The QPA for items and services provided in a given year is based on the median contracted rate as determined on January 31, 2019 and inflated forward to that year. Specifically, the QPA for 2022 is increased by the percentage increased in the CPI-U (not medical price growth) for 2019, 2020, and 2021. The QPA for 2023 or subsequent years will then be adjusted annually according to the CPI-U. The IFR gives guidance on how plans and insurers should make this calculation each year.

Insurance Market

The QPA is based on the plan’s or insurer’s contracted rates in the same insurance market as where the out-of-network claim arises. The IFR defines the “insurance market” to be the individual market, small group market, or large group market as defined under federal law. Limited forms of coverage (such as short-term plans, excepted benefits, and health reimbursement arrangements or other account-based plans) and Medicare Advantage plans or Medicaid managed care plans generally do not fall under these market definitions so negotiated rates for these products (to the extent there are any) should not be included in the QPA calculation.

For self-funded group health plans, the relevant “insurance market” is all group health plans offered by that employer or plan sponsor. Alternatively, an employer or plan sponsor that uses a third-party entity can direct the third-party administrator to calculate the QPA on their behalf using all group health plans that are administered by that entity. By allowing this packaging of data, the agencies believe there will be few instances where a group health plan sponsor lacks information to calculate the relevant QPA.

Geographic Regions

In addition to the caveats and definitions noted above, the QPA reflects the contracted rates for care provided in same the geographic region. The NSA directed the agencies to consult with the National Association of Insurance Commissioners (NAIC) in defining the geographic regions for the QPA. The NAIC recommended geographic regions that correspond to those used in the individual and small group markets under the ACA (with flexibility). The agencies considered, but did not adopt, this approach, although it used broad principles suggested by the NAIC.

Instead, the IFR defines each metropolitan statistical area (MSA) in a state as a region and all other portions of the state as one region. When an MSA crosses a state boundary, it is divided between the respective states: all counties in a particular MSA in each state are counted as a geographic region. This definition of a geographic region applies to all items and services other than air ambulance services (where the geographic region is based on the point of pick-up and defined as one region that includes all MSAs in a state and one region with all other portions of the state).

Basing the definition on MSAs will result in larger geographic regions than the county-based regions used in some state rating areas. This, in turn, helps limit the impact of outlier rates in a smaller geographic region—and limits the instances when a plan or insurer would not have sufficient information to calculate the QPA.

Insufficient Information

The NSA lays out an alternative to the QPA if a plan or insurer lacks sufficient information to calculate the median of contracted rates in 2019 (or for newly covered items or services in future years). But the agencies make clear that this alternative method should be used sparingly.

The IFR first identifies what qualifies as sufficient information to calculate the QPA. An insurer or plan has sufficient information if it has at least three contracted rates in the insurance market on January 31, 2019. Having at least three rates reduces the possibility of outliers that could skew the QPA.

For years following 2019, plans and insurers must have at least three contracted rates for the prior year and those rates must account for at least 25 percent of the total claims volume (for the relevant item or service for that year for all plans or coverage in the same insurance market). The latter requirement is to prevent plans and insurers from manipulating the QPA by using selective contracting practices that artificially change the median contracted rate.

If a plan or insurer has insufficient information to calculate the median contracted rate in a given MSA, it must then consider all MSAs in the state to be a single region. All other parts of the state will still be treated as a different region. If there is still insufficient information, the geographic region will be based on Census divisions; this is true for all items and services (including air ambulance services), again treating MSAs and non-MSA areas separately.

Plans and insurers that may not initially have enough information to calculate the QPA can gain this information over time. Once they do, the QPA must be calculated using the median contracted rate for the first year when it has sufficient information; the rate is then inflated to future years by the CPI-U.

Where a plan or insurer has insufficient information to calculate the median contracted rate, the plan or insurer can select a third-party database to calculate the QPA. The database must not present a conflict of interest and must have data about allowed amounts in the applicable geographic region. State all-payer claims databases can automatically be used; other databases can be used if they satisfy conditions outlined in the IFR (such as not being affiliated with a health care entity and having data on in-network amounts). The preamble includes specific instructions for how to use a database to calculate the QPA if needed and directs plans and insurers to use a consistent methodology when relying on a database.

These rules apply in the same way for plan sponsors or insurers that newly offer coverage in a geographic region. If a new service code is created (or service codes are significantly revised) after 2019, plans and insurers must look to reasonably related service codes from the prior year and use this as a benchmark for the QPA for the new code. This amount must then be adjusted based on the ratio of the Medicare rate for the new code to the Medicare rate for the related code. The preamble identifies alternatives if Medicare has not yet established a payment rate. Once the plan or insurer has experience with and thus sufficient information for the new code, the QPA process above will be used.

QPA Audits

The NSA requires an audit process to ensure that plans and insurers are complying with the QPA calculation and requirement. The audit may be performed by federal or state officials, depending on the entity enforcing the NSA, but the IFR does not include additional detail about this process or the agencies’ broader approach to enforcement. Enforcement will be addressed in a subsequent rule.

Communication Between Insurers and Providers

Initial Payment Amount

To help resolve out-of-network billing disputes in a timely manner, the NSA and IFR requires plans and insurers to make an initial payment (or send a notice of denial of payment) within 30 calendar days after the provider or facility submits a clean claim, as determined by the insurer. The initial payment should reflect the amount that the plan or insurer intends to be payment in full (not a first installment) and must be made even where the patient has not satisfied their deductible.

The agencies did not give guidance on the dollar amount of any initial payment, but they solicit comment on whether they should do so in the future and, if so, how to set the rate or methodology for initial payments (e.g., specific percentage of the Medicare rate or the QPA). Their goal with initial payments is to help resolve payment disputes before the IDR process.

If the provider or facility accepts the initial payment amount (plus the patient’s cost sharing), this amount will be treated as the “out-of-network rate.” The out-of-network rate is the total payment made by the plan or insurer to the out-of-network provider, facility, and air ambulance. This rate must be based on a specified state law; an agreed upon amount between the parties (if there is no specified state law); or the amount ultimately determined by the IDR entity. (Again, the statute and IFR include a special rule to reflect all-payer models.) An agreed-upon amount could be reached during negotiations ahead of the IDR process or even after the IDR process is initiated.

Notice And Consent

Out-of-network providers that perform nonemergency services at an in-network facility must inform plans and insurers, as part of their submission of a claim, that the item or service that they provided was furnished during a visit to an in-network facility. And all providers and facilities must inform plans and insurers when a patient consents to out-of-network care (and thus a potential balance bill). Plans and insurers need this information to accurately calculate cost sharing, apply this cost sharing to deductibles and out-of-pocket limits, and make an appropriate payment to the provider or facility.

In particular, the provider or facility must submit a signed copy of the written notice and consent forms to the plan or insurer. Plans and insurers can rely on the provider’s or facility’s representation (that the patient gave consent) unless it knows or reasonably should know otherwise. If the plan or insurer believes notice was not properly and timely given and received, it should apply cost sharing consistent with the rules outlined here under the NSA and file a complaint against the provider.

The QPA

Plans and insurers must share certain information about the QPA with out-of-network providers and facilities. To balance transparency with administrative burdens, the IFR requires plans and insurers to make certain disclosures with each initial payment or notice of denial of payment. They must disclose 1) the QPA for each item or service involved; 2) a statement certifying that the QPA is the recognized amount (for purposes of patient cost sharing) and was calculated in compliance with the methodology in the IFR; 3) a statement confirming the option for a 30-day open negotiation period to determine the total payment amount followed by initiation of the IDR process within 4 days of the end of the open negotiation period. The provider or facility can request additional information, which must be provided. Details on how negotiations and IDR will work will be addressed in a subsequent rule.

Cost Estimates

The agencies estimate that sharing this information will result in costs to insurers and third-party administrators of about $55 million annually beginning in 2022. These estimates are linked to other estimates of how prevalent out-of-network billing could be. The agencies expect plans and insurers to have to provide an initial payment or denial for nearly 4.8 million claims for emergency services, more than 222,000 claims for post-stabilization services, and nearly 60,000 claims for nonemergency services. This is a total of about 5.1 million claims annually.

The agencies also seem to expect many patients to consent to balance bills. For post-stabilization care, the agencies guess that consent cannot or will not be given in 50 percent of cases (but that it will in half of cases). For nonemergency services, the agencies expect that the patient will give consent in 95 percent of those cases. As noted above, we question whether consent will be given so frequently since 1) it will be available in such limited circumstances and 2) we find it hard to believe that many patients will want to willingly waive the NSA’s strong protections and agree to pay higher out-of-pocket costs.

A Good First Step

The NSA includes historic patient protections that will promote financial stability for millions of Americans who should, by and large, no longer need to worry about a surprise out-of-network bill. This initial IFR is a strong first step in making many of the new law’s consumer protections a reality. As noted above, additional rulemaking will be just as important to making sure that patients do not face higher premiums as a result of the NSA and to clarifying additional protections and provisions.

Katie Keith, Jack Hoadley, and Kevin Lucia, “Banning Surprise Bills: Biden Administration Issues First Rule on the No Surprises Act.” Health Affairs Blog, July 6, 2021, https://www.healthaffairs.org/do/10.1377/hblog20210706.903518/full/. Copyright © 2021 Health Affairs by Project HOPE – The People-to-People Health Foundation, Inc.