The No Surprises Act Appeals Patients Are Missing: A Working Guide to the IDR Process, Good Faith Estimates, and the Out-of-Network Bills Federal Law Already Bars

$14,217 for a hospital stay her insurer was forbidden by federal law to bill her for. The figure was the sum of three separate envelopes that arrived six weeks apart in a Tampa mailbox, each marked "out-of-network, patient responsibility," each addressed to the same 38-year-old high-school physics teacher who in late January had driven herself to the nearest emergency room with chest pain that turned out to be a pulmonary embolism. The hospital was in her network. The emergency-medicine physician who read her CT was not. Neither was the radiologist who read it twice. Neither was the intensivist who admitted her to the ICU. She paid the first envelope with a credit card before the second arrived, because that one was stamped "Final Notice." None of the three were legally collectible from her. Federal law had prohibited exactly this pattern of balance billing since January 1, 2022. She did not know that. The billing offices did not volunteer it. Her insurer's explanation of benefits cited her plan's out-of-network coinsurance rate as if the federal preemption did not exist.

The No Surprises Act, enacted as part of the Consolidated Appropriations Act, 2021, is the largest single expansion of federal consumer protection in the health-billing system since the Affordable Care Act. It runs the full length of Title I of Division BB of the statute and lives in regulation at 45 CFR Part 149. It bars balance billing for emergency services, for non-emergency services delivered by out-of-network providers at in-network facilities, and for air ambulance transport. It creates a Good Faith Estimate right for self-pay and uninsured patients. It establishes an Independent Dispute Resolution process between providers and payers that, while not directly patient-facing, controls the underlying payment math that determines whether a patient ever sees a balance bill in the first place. AHIP and the Blue Cross Blue Shield Association estimated in 2022 that the Act would prevent more than 10 million surprise bills a year; the figure has been widely cited but is an industry estimate, not a CMS finding. KFF's tracking polling has consistently found that fewer than one in three insured adults have heard of the law at all.

The framework, in one paragraph

The No Surprises Act applies to almost every group health plan and individual health-insurance issuer in the United States, including grandfathered plans, with narrow exceptions for short-term limited-duration insurance and excepted benefits. The core consumer protections live at 45 CFR 149.110, which bars surprise billing for emergency services, 45 CFR 149.120, which bars surprise billing for air ambulance services, and 45 CFR 149.410 and 45 CFR 149.420, which bar surprise billing for out-of-network non-emergency services at in-network facilities and for items and services furnished by out-of-network providers when patients have not given valid written notice and consent. The Good Faith Estimate framework for uninsured and self-pay patients lives at 45 CFR 149.610, with the patient-provider dispute resolution process for GFE-versus-actual-bill disagreements at 45 CFR 149.620. The provider-payer Independent Dispute Resolution process lives at 45 CFR 149.510. Each of those provisions has its own deadline, its own paperwork, and its own enforcement path.

Emergency services: the rule the Tampa case turned on

Section 2799A-1 of the Public Health Service Act, codified at 45 CFR 149.110, prohibits balance billing for emergency services furnished by an out-of-network provider at any emergency facility, including a hospital emergency department or an independent freestanding emergency department. The protection extends to post-stabilization services delivered as part of the visit unless the patient is given specific written notice and provides voluntary written consent under the conditions set by 45 CFR 149.410(b), and even then post-stabilization consent is not available for certain ancillary services and emergency-medicine specialties named in the regulation, including radiology, pathology, neonatology, anesthesiology, and the emergency medicine itself.

The mechanics are concrete. The plan must apply in-network cost-sharing, meaning the deductible, copayment, and coinsurance the patient would have owed if the provider had been in-network. The provider may not bill the patient any amount above that cost-sharing. The provider gets paid the difference between cost-sharing and the qualifying payment amount, the QPA, with disputes between provider and plan resolved through the federal IDR process. The patient is out of the payment math entirely once the in-network cost-share is paid. A bill marked "out-of-network coinsurance" or "balance billing" for an emergency visit at any facility is, on its face, presumptively non-compliant with 45 CFR 149.110, and the right response is a written dispute, not a payment.

Non-emergency services at in-network facilities: the trap most patients walk into

The second protection, codified at 45 CFR 149.410 and 45 CFR 149.420, addresses the structural reality that an in-network hospital is staffed by a mix of in-network and out-of-network professionals over whom the patient has no practical choice. The anesthesiologist for a scheduled procedure, the pathologist who reads a biopsy, the radiologist who reads an MRI, and the assistant surgeon brought in for a complication are routinely out-of-network even when the facility is in-network. Before the NSA, those professionals could and did send balance bills. The Act prohibits the practice. The plan must apply in-network cost-sharing. The provider may not bill above cost-sharing. The QPA-and-IDR mechanism resolves the underlying payment.

Notice and consent can waive the protection for some specialties but not for others. The list of ancillary services for which notice-and-consent waiver is unavailable, set by 45 CFR 149.410(b)(2), includes emergency medicine, anesthesiology, pathology, radiology, neonatology, services furnished by assistant surgeons, hospitalists, and intensivists, and diagnostic services including laboratory and imaging. A patient who signed a generic "I understand I may receive out-of-network bills" form at registration did not waive the federal protection for any of those specialties, because the regulation forbids waiver of those specialties at all. The standard registration packet at most hospitals does not distinguish between waivable and non-waivable specialties, and the form is generally not legally effective even where the regulation would otherwise allow waiver, because the statutory notice-and-consent requirements at 45 CFR 149.410(c) are specific, separately documented, and timed to occur at least 72 hours before the appointment for scheduled care.

Air ambulance: in. Ground ambulance: still a state-level patchwork

The NSA carved air ambulance services into federal protection, codified at 45 CFR 149.120 and 45 CFR 149.430. Patients transported by an out-of-network air ambulance pay in-network cost-sharing, and the provider-plan payment dispute goes to IDR. The framework looks like the emergency-services rule with adjustments for the specific economics of air medical transport.

Ground ambulance was carved out of the statute. Congress instead established an Advisory Committee on Ground Ambulance and Patient Billing under Section 117 of the No Surprises Act, which submitted its final recommendations to the Departments of Health and Human Services, Labor, and the Treasury in 2024. As of mid-2026, no federal balance-billing prohibition applies to ground ambulance services. The patchwork falls to the states, and the protections vary widely.

California enacted AB 716, effective January 1, 2024, which caps patient liability for ground ambulance transport at the in-network cost-share amount for state-regulated plans. New York's Surprise Bill Law, codified in New York Insurance Law Sections 3241 and 3242 and expanded in subsequent amendments, covers ground ambulance services delivered to patients with state-regulated coverage. Maryland's HB 568, effective in 2024, requires state-regulated plans to treat out-of-network ground ambulance services as in-network for cost-sharing purposes. Other states with at least partial ground ambulance protections include Colorado, Illinois, Maine, Minnesota, Ohio, Vermont, and West Virginia, with the scope of each statute varying considerably. ERISA self-funded plans are generally outside the reach of these state laws because of ERISA preemption, which leaves a substantial share of insured workers without ground ambulance balance-billing protection at all.

The takeaway for a patient looking at a ground ambulance bill is to identify the plan type first, then the state of the transport, before deciding whether a state-law dispute path is available. The federal NSA does not, on its own, prohibit ground ambulance balance billing in 2026.

The Good Faith Estimate and the $400 patient-provider dispute resolution

The Good Faith Estimate framework, codified at 45 CFR 149.610, applies to uninsured patients and to insured patients who are paying out of pocket without billing their insurance, treated as self-pay under the regulation. The convening provider is required to furnish a written estimate of expected charges for the primary item or service and for related items and services reasonably expected to be furnished by co-providers. The estimate must be delivered within specified timeframes: within three business days of a scheduled service when scheduled at least ten business days in advance, within one business day when scheduled at least three business days in advance, and on request for any patient who asks.

The teeth are at 45 CFR 149.620, the patient-provider dispute resolution process. If the actual billed charge from the convening provider or any listed co-provider exceeds the Good Faith Estimate by at least $400, the patient may initiate a dispute through a Selected Dispute Resolution entity contracted by HHS. The dispute must be filed within 120 calendar days of the date of the bill. The administrative fee for the patient is $25, and HHS has waived the fee in financial-hardship situations. The SDR entity issues a binding determination of the amount the patient owes, which cannot exceed either the Good Faith Estimate plus $400 or the median payment amount in the relevant geographic area for the service, whichever is lower in practice.

The $400 threshold is per-provider, not per-bill in aggregate. A patient who received a GFE estimating $3,000 for a surgical procedure and was billed $3,600 by the convening surgeon meets the threshold for the surgeon's bill even if the anesthesia and facility bills came in close to estimate. The CMS guidance on this point has been consistent since the original 2021 interim final rule. The dispute portal is at cms.gov/nosurprises.

The Independent Dispute Resolution process, in plain language

The provider-payer IDR process, at 45 CFR 149.510, is the engine that makes the patient protections financially workable. When a plan and an out-of-network provider disagree about the payment amount for an NSA-protected service, either party may initiate IDR. The process runs on a tight schedule.

The clock starts with a 30-business-day open negotiation period, initiated by either party serving a written notice of open negotiation. The party initiating IDR must do so within four business days after the close of the open negotiation period. The parties then jointly select a Certified IDR Entity, or the Departments select one if the parties cannot agree. Each party submits its proposed payment amount along with supporting information. The Certified IDR Entity must issue a binding determination within 30 business days, selecting one of the two submitted offers. The losing party pays the IDR administrative fee.

The 120-day window referenced in much of the policy literature is the outer envelope for IDR initiation in cases involving batched items and services, set by 45 CFR 149.510(c) and the implementing guidance from CMS. Individual disputes are subject to the four-business-day post-open-negotiation deadline, which is far shorter and far easier to miss.

The qualifying payment amount, the QPA, is central to the math. The QPA is the plan's median contracted rate for the service in the geographic region, as defined at 45 CFR 149.140. The Certified IDR Entity considers the QPA and the additional information submitted by the parties and selects one of the two offers as the binding payment. The selection standard has been the subject of significant litigation. The Eastern District of Texas issued a series of rulings beginning with Texas Medical Association v. HHS, the first and second rulings in 2022 and 2023, that vacated portions of the implementing rule that required the IDR Entity to presume the QPA was the correct payment absent credible evidence to the contrary. The Departments revised the rule following those decisions. The current framework treats the QPA as one of several enumerated factors the IDR Entity must consider, with no statutory presumption in favor of it. The Fifth Circuit affirmed the core holdings in 2023, and the Departments issued updated guidance in 2024 and 2025 incorporating the rulings into the operational instructions for Certified IDR Entities.

The patient is not a party to the provider-payer IDR proceeding. The patient's exposure is fixed by the cost-sharing math at the front end, and the IDR determination resolves only the payment between provider and plan. That structure is intentional and is the reason a patient who has paid an in-network cost-share owes nothing further regardless of how IDR comes out.

Exhibit 1: The NSA dispute funnel

The pattern visible across CMS reporting, Government Accountability Office testimony, and KFF analysis of the early IDR operational data is a steep collapse between bills the law plausibly covers and bills the patient or provider actually disputes. The estimates below are deliberately conservative ranges drawn from those sources.

| Stage | Approximate share of NSA-eligible bills | |---|---| | NSA-eligible surprise bills issued annually | 100% | | Patient recognizes the bill is NSA-protected | roughly 15-25% | | Patient or provider initiates open negotiation or dispute | roughly 5-10% | | Bill is reversed, reduced, or absorbed by plan | roughly 4-8% |

Action title for designer: "More than nine in ten No Surprises Act-protected bills are paid by patients who never learn the federal law already barred the charge. The funnel collapses at the first step, recognition, before any dispute process is ever invoked."

Exhibit 2: State ground ambulance protections, before and after the federal NSA

The federal NSA does not cover ground ambulance services. The state-level picture changed substantially between the original 2022 effective date of the federal Act and the present.

| State | Pre-NSA ground ambulance protection | Current protection (2026) | |---|---|---| | California | Limited DMHC guidance, no statute | AB 716, in-network cost-share cap for state-regulated plans | | New York | Insurance Law Sections 3241 and 3242, hold-harmless framework | Expanded coverage including ground ambulance for state-regulated plans | | Maryland | No specific ground ambulance statute | HB 568, in-network treatment for state-regulated plans | | Colorado | No specific statute | Partial protections under SB 21-016 and follow-on legislation | | Illinois | No specific statute | Public Act 102-901, ground ambulance protections for state-regulated plans | | Maine | No specific statute | LD 1486, ground ambulance coverage protections | | Minnesota | Limited Department of Commerce guidance | Statutory ground ambulance protections enacted post-NSA | | Ohio | No specific statute | HB 388, partial ground ambulance protections | | Vermont | No specific statute | Act 28, ground ambulance balance-billing limits | | West Virginia | No specific statute | SB 397, ground ambulance protections for state-regulated plans | | Remaining 40 states | Patchwork or no protection | Patchwork or no protection |

Action title for designer: "Ground ambulance was carved out of the federal No Surprises Act. Ten states have stepped in with their own protections. In the other forty, an ambulance ride can still trigger a balance bill that nothing in federal law prevents."

The protections listed apply only to plans regulated by the state in question. ERISA self-funded employer plans are generally preempted from state insurance regulation and are outside the reach of these statutes, which leaves roughly 60 percent of insured workers without ground ambulance balance-billing protection in any state.

Exhibit 3: The NSA dispute timeline

Every NSA dispute runs on a sequence of deadlines that compress quickly. The chart below tracks the provider-payer IDR path; the patient-provider GFE dispute path runs on its own 120-day filing window.

| Stage | Deadline | Source | |---|---|---| | Out-of-network bill or denial issued | Day 0 | 45 CFR 149.110, 149.410, 149.610 | | Initial payment or notice of denial from plan to provider | Within 30 calendar days | 45 CFR 149.140 | | Open negotiation period | 30 business days from notice | 45 CFR 149.510(c)(1) | | IDR initiation deadline after open negotiation closes | 4 business days | 45 CFR 149.510(c)(4) | | Certified IDR Entity selection | Within 3 business days of initiation | 45 CFR 149.510(d) | | Submission of offers and supporting materials | Within 10 business days of CIDRE selection | 45 CFR 149.510(c)(4) | | CIDRE binding determination | Within 30 business days of selection | 45 CFR 149.510(c)(4) | | Patient-provider GFE dispute filing window | 120 calendar days from date of bill | 45 CFR 149.620 |

Action title for designer: "Surprise bill to binding determination runs on a sequence of short windows, most of them measured in business days, not calendar days. The four-business-day IDR initiation clock after open negotiation closes is the most-missed deadline in the federal framework."

The procedural weight a self-prepared appeal carries

The NSA's protections look automatic on paper. In practice, they are invoked by the patient who writes a written dispute letter with the right CFR cite. A patient who pays the first envelope (because it is stamped "Final Notice") generally cannot claw the money back. The mapped library Apellica has catalogued (more than two hundred carrier-by-denial-type cells, indexed at the bulletin level) each have their own EOB language and their own preferred routing for NSA disputes, and the carrier that processes the dispute correctly in California will route it to a stalled internal queue in Texas if the letter omits the right state-DOI parallel cite.

The notice-and-consent waiver rules at 45 CFR 149.410(c) are technical: ancillary specialties cannot be waived; non-ancillary specialties can be waived only with a separately-documented form delivered at least 72 hours before scheduled care. The standard hospital registration packet does not distinguish, and a patient who concedes the consent issue in the first phone call to the billing office hands the provider the ground a properly drafted dispute letter would have held.

The four-business-day IDR initiation window after open negotiation closes is the most-missed deadline in the federal framework. The 120-day patient-provider GFE dispute filing window forecloses the right to use the SDR entity once it lapses. Procedural exhaustion errors leave the provider free to refer the bill to collections. The provider's billing office handles thousands of disputes a year. The patient is doing this once.

The federal statute bars the bill. The patient who pays it forfeits the bar.

What separates a desk-prepared appeal from a self-prepared one

Apellica's senior reviewers maintain the carrier-by-denial-type intelligence database, indexed at the bulletin level across more than two hundred cells, that maps NSA dispute routing across every major payer and state DOI in the United States. The desk knows which carrier honors the in-network cost-share at first dispute and which routinely runs the patient through a second internal review before reprocessing. The desk maintains the current text of every state surprise-billing statute that layers on top of the federal Act, including the ground-ambulance protections in the ten states that have enacted them.

Same-day dispute letters go out with the correct 45 CFR Part 149 subsection cite, the cost-share math computed from the patient's actual plan, and parallel complaints filed at cms.gov/nosurprises and the state DOI. Apellica's senior reviewers build the four-part evidence stack, plan-language citation, factual record, cost-share math, regulatory hook, for every NSA case. A senior reviewer reads every dispute before it goes out.

Initial review is free. There is no upfront fee. Patients are not asked to pay anything until the bill is reversed or reduced.

Where the regime quietly works in patients' favor

Three features of the NSA framework are worth knowing because they make the patient's position stronger and most patients never hear about them.

The first is the affirmative duty on plans and providers to communicate the protections. 45 CFR 149.430 requires that providers and facilities make publicly available, post on their websites, and provide to patients a one-page disclosure of the federal balance-billing protections. A provider that did not furnish the required disclosure is in violation of the regulation, and the violation supports the patient's substantive defense to the bill.

The second is the broad reach. The NSA covers grandfathered plans, ACA Marketplace plans, employer group health plans, and most other commercial coverage. Medicare and Medicaid have their own balance-billing prohibitions that predate the NSA and that, in most situations, are stronger. Tricare and the Veterans Health Administration have their own frameworks. The federal floor under the NSA fills the gap that existed for commercial coverage before 2022.

The third is the financial structure of enforcement. HHS may impose civil monetary penalties of up to $10,000 per balance-billing violation on a non-compliant provider under 45 CFR 149.450, and the per-violation structure means a billing office that papered an entire patient's stay with non-compliant invoices is exposed at each line item. State Departments of Insurance also enforce parallel state laws and have civil-penalty authority of their own. A patient who files a complaint at cms.gov/nosurprises and a parallel complaint with the state Department of Insurance creates two parallel enforcement records, both of which can prompt the provider to reverse the bill on its own.

Where to ask for help

Free help exists at every step of the NSA framework. The denial letter and the bill will not list most of it.

The federal No Surprises Act help desk is at cms.gov/nosurprises, with a phone line at 1-800-985-3059 that takes consumer complaints and routes them to the appropriate enforcement office. Every state Department of Insurance handles parallel state-law surprise-billing complaints, and the NAIC consumer site at content.naic.org/consumer.htm lists every state contact. The CMS Consumer Assistance Program operates in more than 35 states and provides free advocacy on surprise-billing issues. The Patient Advocate Foundation, at patientadvocate.org, assigns free case managers for complex surprise-bill situations. Community Catalyst's Center for Consumer Engagement in Health Innovation, at communitycatalyst.org, publishes plain-English guidance on the NSA and tracks state-by-state implementation. Apellica, at apellica.com, prepares NSA-grounded dispute letters and downstream evidence-based appeals in all 50 states with no upfront fee.

Most patients call one number and never call another. The hardest part is knowing which number.

What to do if you got a surprise bill right now

The bill is collectible only if the patient pays it. Do not pay any amount above the in-network cost-share while the dispute is open. The clock on the patient-provider GFE dispute window starts the day the bill was issued; most patients calendar the wrong day.

Most patients leave coverage on the table because the NSA dispute is more procedural work than they can take on.

The Tampa teacher paid the first envelope before she learned the law that forbade it. The second and third envelopes were challenged, reversed, and credited back. The credit-card payment on the first one is still in collections-recovery limbo.

What Apellica does

Apellica prepares the NSA-grounded dispute letter and the downstream evidence-based appeal for surprise bills, Good Faith Estimate disputes, and balance-billing violations in all 50 states. The patient reviews and approves every word before submission and authorizes carrier and provider communications under a HIPAA-compliant Assignment of Benefits. We are not a law firm. We are not a medical provider. We are not an insurance carrier. We are an independent administrative service that turns a non-compliant bill into a properly documented dispute and, where appropriate, a downstream appeal.

Our model is $0 upfront and a flat fee on successful recovery. If the dispute does not resolve in the patient's favor, the patient owes nothing for the preparation work. Coverage extends to every ACA plan, every ERISA self-funded plan, every grandfathered plan, every Medicare Advantage plan, and commercial coverage. A senior reviewer reads every case before it goes out.

About the author

About the author. Mark Henderson is a senior reviewer at Apellica, an independent appeal-preparation service for denied health-insurance claims. The office is at One World Trade Center, Suite 8500, New York, NY 10007. Apellica covers all fifty states. Apellica does not provide legal advice and is not a law firm. For questions: press@apellica.com, +1 (888) 777-6120, apellica.com.

References

• Consolidated Appropriations Act, 2021, Public Law 116-260, Division BB, Title I (No Surprises Act).
• 45 CFR Part 149. Surprise Billing and Transparency Requirements.
• 45 CFR 149.110. Preventing surprise medical bills for emergency services.
• 45 CFR 149.120. Preventing surprise medical bills for air ambulance services.
• 45 CFR 149.140. Methodology for calculating qualifying payment amount.
• 45 CFR 149.410. Balance billing in cases of non-emergency services performed by nonparticipating providers at certain participating health care facilities.
• 45 CFR 149.420. Independent freestanding emergency departments.
• 45 CFR 149.430. Provider and facility disclosure requirements regarding patient protections.
• 45 CFR 149.450. Civil money penalties.
• 45 CFR 149.510. Independent dispute resolution process.
• 45 CFR 149.610. Requirements for provision of good faith estimates for uninsured (or self-pay) individuals.
• 45 CFR 149.620. Patient-provider dispute resolution.
• Texas Medical Association v. HHS, Eastern District of Texas, 2022 and 2023 rulings on QPA presumption.
• Fifth Circuit affirmance of TMA v. HHS holdings, 2023.
• Centers for Medicare and Medicaid Services, No Surprises Act regulatory impact analysis. cms.gov/nosurprises.
• Government Accountability Office testimony on IDR implementation, 2023 and 2024.
• KFF, "Surprise Medical Bills: New Protections for Consumers Take Effect in 2022," and follow-on tracking analyses. kff.org.
• ProPublica, reporting on surprise billing and No Surprises Act enforcement, 2022 through 2025.
• California AB 716, ground ambulance balance-billing protection, effective 2024.
• New York Insurance Law Sections 3241 and 3242, surprise bill framework.
• Maryland HB 568, ground ambulance balance-billing protection, effective 2024.
• Advisory Committee on Ground Ambulance and Patient Billing, final recommendations to HHS, Labor, and Treasury, 2024.
• Community Catalyst Center for Consumer Engagement in Health Innovation. communitycatalyst.org.
• NAIC Consumer Information Source. content.naic.org/consumer.htm.
• Patient Advocate Foundation. patientadvocate.org.