Medical Billing Protections

If you’ve ever opened a medical bill and felt like you were reading a different language—prices that don’t match what you were told, mysterious “facility” add-ons, financing offers that look like lifelines but feel like traps—you’re not alone. U.S. medical billing is a system of rules braided together: federal protections like the No Surprises Act (NSA), insurer transparency rules, hospital charity-care obligations, and a fast-moving market for “patient financing.” The protections are real, but they’re scattered. This guide pulls them into one place and, more importantly, shows you how to use them—before, during, and after care—so you aren’t paying for errors, junk fees, or avoidable interest.

What you can demand before care: estimates you can hold providers to

There are two parallel estimate regimes in the U.S. The first is aimed at people who are uninsured or choosing not to use insurance. Under the NSA, you’re entitled to a Good Faith Estimate (GFE) of expected charges if you schedule care at least three business days in advance or if you simply ask for an estimate before scheduling. When you schedule 3–9 business days ahead, the provider must deliver the estimate within 1 business day; for 10+ business days ahead, they get 3 business days. If you ask without scheduling, it’s still 3 business days. These time boxes are not “nice-to-have”—they’re required. (CMS)

Those estimates aren’t just numbers; they’re leverage. If the actual bill from any one provider or facility comes in at least $400 higher than the GFE for that same provider or facility, you can launch the Patient–Provider Dispute Resolution (PPDR) process. It’s a formal, time-boxed review by an independent entity, and you generally have 120 calendar days from the date of the initial bill to start it. While that review is underway, the dispute itself becomes the issue—not your ability to pay immediately—so you’re not forced to swallow an obvious mismatch. (CMS)

If you are using insurance, you still have pre-service tools. Your plan must provide a self-service price comparison tool that returns your projected out-of-pocket costs for covered services. Plans were required to stand up these tools for 500 common “shoppable” services by 2023 and for all items and services by 2024, so you can comparison-shop within network before you book. This is separate from the provider GFE rule and applies even when you’re fully insured. (CMS)

Hospitals themselves must publish prices in two ways: a machine-readable file that includes gross charges and negotiated rates, and a consumer-friendly display of shoppable services. As of 2024, CMS tightened the screws: hospitals must use CMS’s standardized template and affirm the accuracy and completeness of their files, with a clearly labeled “Price Transparency” footer link. When you can’t get a straight answer from a scheduling desk, pull the posted data and use it to triangulate what’s reasonable. (CMS)

A final nuance: the NSA also envisioned an Advanced Explanation of Benefits (AEOB)—a pre-service EOB insurers would send showing your expected costs once a provider shares a GFE with the plan. Regulators have been moving toward implementation but haven’t fully switched it on yet. That means today your best practical combo is the plan’s price tool plus the provider’s GFE, documented together. (CMS)

Reading and challenging the bill: coding, documentation, and what “error” really means

People throw around stats that “most medical bills are wrong.” The truth is more technical. CMS’s Comprehensive Error Rate Testing (CERT) program—an audit of Medicare fee-for-service claims—puts the improper payment rate around 7–8% in recent years. That’s not a consumer-bill statistic, but it signals how often documentation or coding doesn’t line up with what was billed. In practical terms, the same classes of mistakes show up on consumer bills: wrong patient details, wrong quantities, wrong CPT (procedure) or HCPCS (supplies/drugs) codes, or diagnosis (ICD-10-CM) codes that don’t support what was done. Keep your claim numbers straight and compare the bill to your insurer’s EOB line by line; mismatches are red flags. (CMS)

Some errors are patterns, not typos. The HHS Inspector General has repeatedly flagged upcoding—billing as if a service was more complex than it was. One example is misuse of Modifier 25 to add a separate evaluation-and-management charge on the same day as a procedure when the circumstances don’t justify it. Another: hospitals overusing severe malnutrition diagnosis codes, which change payment tiers. When you see unusually high “evaluation and management” levels for a short visit, or diagnoses that don’t sound like you, ask the provider to show the clinical notes that support those codes. (Office of Inspector General, Oversight.gov)

If your insurer denies or underpays because of coding, you have appeal rights. Under the Affordable Care Act, non-grandfathered health plans must offer an internal appeal followed by external review by an independent reviewer if the plan sticks to its denial. Strict timing applies, and you generally have 180 days to start the internal appeal. When the denial involves medical judgment—or the plan says a service is experimental—you can often take it to external review after the internal round. Use the model notices and timing rules to your advantage; plans must tell you why they denied and how to appeal. (DOL, HealthCare.gov)

Two practical moves make these rights real. First, get an itemized bill with CPT/HCPCS and ICD-10-CM codes rather than a lump-sum “statement.” Second, request the clinical notes or operative report that justify those codes. The AMA maintains the CPT code set, and CMS publishes code system overviews; you don’t need to be a coder, but you should be able to see that what’s coded matches what happened. If it doesn’t, you’re not nitpicking—you’re enforcing the same documentation rules CMS uses. (American Medical Association, CMS)

The “facility fee” problem: why prices jump when clinics live inside hospitals

A common source of sticker shock is the facility fee—a separate charge hospitals add on outpatient bills to cover the costs of running a hospital’s infrastructure. If your doctor’s office is “provider-based” (affiliated with a hospital), you might see a professional fee for the clinician and a facility fee, even for a routine off-campus visit or a telehealth check-in. Whether that’s allowed depends on where you live and what kind of visit it was. States have begun to intervene. Connecticut now bans facility fees for basic evaluation and management visits and certain telehealth services, with specific effective dates and carve-outs. Colorado enacted HB23-1215, tasking the state to quantify these fees and limiting when they can be charged; other states like Minnesota require prominent facility-fee notices and are considering outright prohibitions for non-emergency clinic services and telehealth. If you see “G0463” (hospital clinic visit) or a location-based “facility” line on your bill for a simple checkup, check your state’s rules and the visit location’s status. (CT.gov, coleg.gov, MN Revisor's Office, Senate Assets)

Hospitals argue these fees fund 24/7 capacity and cross-subsidize underpaid services; insurers and consumer groups counter that routine clinic care shouldn’t inherit hospital overhead, especially when delivered off-campus or over video. The policy trend is moving toward disclosure, advance notice, and service-specific bans. In Texas, for example, proposals would require 10-day patient notice before any outpatient service that will trigger a facility fee and would prohibit fees for telehealth and preventive care; even where bills stall, public guidance from hospital associations makes clear that “facility fees” are a distinct revenue stream—not a rounding error. Understanding that politics explains why the same doctor’s visit can cost dramatically more after a practice is purchased by a hospital system. (Texas Association of Health Plans -, Texas Hospital Assn)

Surprise bills, balance billing, and where the federal shield stops

Since January 2022, the No Surprises Act shields most people with employer or individual coverage from surprise out-of-network bills in emergencies, for out-of-network clinicians at in-network facilities, and for air ambulance transport. You pay only your in-network cost-sharing for those services; the insurer and provider settle payments in the background. You cannot be forced to waive those protections for emergency care, and the consent exception (where you agree to see an out-of-network clinician and pay more) is narrow. If you’re billed anyway, flag the claim as an NSA violation and point the provider to the rules. The gap to remember: ground ambulance rides are not covered under the federal law, though some states have their own protections. (CMS, KFF)

For uninsured or self-pay patients, the NSA’s protection is that GFE + PPDR combination described earlier. If a provider sends you to collections while a PPDR is pending, that can violate the federal framework—HHS tells providers to refrain from extraordinary collection actions when a consumer elects PPDR. That instruction is there precisely because the billing friction is foreseeable. (CMS)

Charity care and billing conduct at nonprofit hospitals

If a hospital is tax-exempt, IRS section 501(r) requires it to have a Financial Assistance Policy (FAP), to limit charges for eligible patients to Amounts Generally Billed (AGB) to insured patients, and to make reasonable efforts to determine eligibility before using aggressive collections. If you qualify for financial assistance and the hospital posts a gross charge or moves quickly to sue or garnish, those are red flags. Ask for the FAP in writing, apply, and cite 501(r) when you ask for collections to pause. State attorneys general and reporters have shown how easily patients miss benefits they qualify for; the law gives you vocabulary and leverage. (IRS)

Payment plans, medical cards, and the new credit-reporting reality

When a bill is too big to pay at once, providers often steer patients to medical credit cards or “installment plans.” Read the fine print carefully. Some products use deferred interest structures where missing a promo deadline retroactively applies interest to the entire original balance. Regulators have taken a hard look at these products, and there’s a second, quieter shift that matters for your strategy: as of April 2023, the three big credit bureaus removed paid medical collections and all medical collections under $500 from credit reports, and in January 2025 the CFPB finalized a rule to ban medical bills from credit reports used by lenders altogether. That means the threat of “this will wreck your credit” is far less potent than it used to be—especially for modest balances—so you can prioritize no-interest, in-house plans or charity-care screening over high-APR cards. (TransUnion Newsroom, Consumer Financial Protection Bureau)

If you do enter a plan, keep it boring. Get the terms in writing, avoid products that capitalize interest or layer on “program fees,” and confirm that enrolling in a payment plan does not forfeit your rights to appeal, charity-care review, or PPDR. When in doubt, ask the provider to set up a zero-interest internal plan while you pursue your protections; many will, especially for balances tied to coding corrections or pending insurance reprocessing.

How to put it all together in the real world

The cleanest path is linear. Before care, combine your insurer’s price tool with a provider GFE and save both. If you rely on the GFE pathway, make sure your scheduling lead time meets the rule’s clock so the estimate is mandatory. During billing, get an itemized bill with codes and compare it to the EOB. When the math or codes don’t line up, dispute in writing and attach the documentation that proves your case: the hospital’s own posted price, the plan’s estimate, the CPT that should have been used, or the NSA GFE. If the total for any one provider or facility is $400 over the GFE, trigger PPDR; if your insurer denies based on coding or “not medically necessary,” trigger the ACA internal appeal and be ready for external review if you lose round one. If a facility fee appears on a routine clinic or telehealth visit, check your state’s rules; where bans or notice requirements exist, ask the provider to re-bill without the fee or to honor the notice failure with a write-off.

None of this requires a legal letterhead. The trick is to anchor every request to a specific rule and a specific document—“NSA GFE dated March 5,” “TiC price tool printout for CPT 45378,” “CT Public Act 23-171 facility fees section,” “ACA external review rights per 45 CFR 147.136.” The system responds to paperwork.

What to watch next so this advice doesn’t go stale

Two levers are moving. First, price transparency enforcement keeps tightening, which means the posted files and shoppable lists will get more standardized and accurate. That makes pre-service comparison shopping more realistic, even for complex episodes of care. Second, state-level facility fee reforms are spreading. Expect more bans for telehealth and routine office visits and stricter advance-notice mandates. Those changes turn today’s “gotcha” lines into tomorrow’s cancellable charges if notice wasn’t given. Keep an eye on your state legislature and on CMS FAQs; both change faster than hospital billing systems. (CMS)

Bottom line

Medical billing protection isn’t one switch; it’s a sequence. Use the estimate rights to set expectations before care, the coding and appeal rules to correct the record after care, the facility-fee reforms to resist overhead charges that don’t fit the service, and the new credit-reporting landscape to avoid high-cost medical cards when cheaper options exist. If you remember nothing else, remember this: never pay a confusing medical bill at face value. Make the system show its math, and make every request with a rule and a document in your hand.

Glossary (plain-English, with the exact terms you’ll see)

No Surprises Act (NSA). A federal law effective 2022 that protects insured patients from most surprise out-of-network bills in emergencies, at in-network facilities, and for air ambulance; it also gives uninsured/self-pay patients Good Faith Estimate and PPDR rights. (CMS)

Good Faith Estimate (GFE). A pre-service price estimate for uninsured or self-pay patients, delivered on a strict timeline if you schedule far enough ahead or ask for one; it becomes the benchmark for PPDR if the later bill overshoots by $400+ for the same provider/facility. (CMS)

Patient–Provider Dispute Resolution (PPDR). A process where an independent entity reviews a bill that is $400+ over the GFE for a given provider/facility. You generally have 120 days from the initial bill to start. (CMS)

Transparency in Coverage (TiC). Insurer rules requiring online cost tools that show your expected out-of-pocket for covered services; phased in through 2023–2024 to cover all items and services. (CMS)

Hospital Price Transparency. Hospital rules requiring a machine-readable file of standard charges and a consumer-friendly display of shoppable services; as of 2024, standardized templates and accuracy attestations are required with clear website links. (CMS)

EOB (Explanation of Benefits). A document from your insurer showing what was billed, what was allowed, and what you owe; not a bill, but the scorecard you compare against the provider’s invoice.

CPT / HCPCS / ICD-10-CM. The code sets on your bill. CPT describes medical procedures; HCPCS covers supplies, drugs, and some services; ICD-10-CM lists diagnoses. Codes must match the clinical notes; mismatches are a common source of denials and overcharges. (American Medical Association, CMS)

Upcoding. Billing a higher-complexity code than documentation supports—for example, adding Modifier 25 to claim a separate exam that wasn’t truly distinct from a procedure. Regulators watch for this. (Office of Inspector General)

Facility fee. An additional hospital charge on outpatient bills to cover hospital overhead, often appearing when a clinic is “provider-based.” Increasingly restricted by state law for routine visits and telehealth. (CT.gov)

Internal appeal / External review. The two-step path to challenge health plan denials; you usually have 180 days to start internally, and many medical-judgment denials qualify for independent external review if you lose the first round. (DOL, HealthCare.gov)

FAP / AGB / 501(r). Nonprofit hospital obligations: a Financial Assistance Policy (FAP), Amounts Generally Billed (a cap tied to what insured patients pay), and a duty to avoid aggressive collections before screening for aid—found in IRS 501(r) rules. (IRS)

Sources & further reading

CMS, Medical bill rights hub (consumer guides to GFEs and disputes, with timelines). https://www.cms.gov/medical-bill-rights (CMS)

CMS, What is a Good Faith Estimate? (eligibility and timing). https://www.cms.gov/medical-bill-rights/help/guides/good-faith-estimate (CMS)

CMS, Dispute a medical bill (PPDR eligibility, $400 threshold, 120-day window). https://www.cms.gov/medical-bill-rights/help/dispute-a-bill (CMS)

CMS, Decision Tree: GFE requirements (detailed timing). https://www.cms.gov/files/document/nsa-gfe-decision-tree.pdf (CMS)

CMS, Guidance for PPDR entities (process steps and timing). https://www.cms.gov/cciio/resources/regulations-and-guidance/downloads/guidance-selected-dispute-resolution-entities-required-steps-making-payment-determination-under-patient-provider-dispute-resolution-process.pdf (CMS)

CMS, Transparency in Coverage fact sheet & consumer page (price tools from plans, all items/services by 2024). https://www.cms.gov/newsroom/fact-sheets/transparency-coverage-final-rule-fact-sheet-cms-9915-f and https://www.cms.gov/priorities/healthplan-price-transparency/health-plan-price-transparency (CMS)

CMS, Hospital Price Transparency (requirements and 2024–2025 accuracy/attestation updates). https://www.cms.gov/priorities/key-initiatives/hospital-price-transparency and https://www.cms.gov/files/document/hospital-price-transparency-frequently-asked-questions.pdf and accuracy RFI page. (CMS)

CMS, No Surprises Act: Understand your rights (scope: emergencies, in-network facilities, air ambulance). https://www.cms.gov/newsroom/fact-sheets/no-surprises-understand-your-rights-against-surprise-medical-bills (CMS)

KFF, Resources for privately insured patients with surprise bills (plain-English NSA scope and exceptions). https://www.kff.org/health-costs/issue-brief/what-resources-are-available-for-privately-insured-patients-who-get-surprise-balance-bills/ (KFF)

DOL & CMS, Internal claims and external review (appeal rights and timing; 45 CFR 147.136). https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/affordable-care-act/for-employers-and-advisers/internal-claims-and-appeals and https://www.healthcare.gov/appeal-insurance-company-decision/internal-appeals/ and https://www.healthcare.gov/appeal-insurance-company-decision/external-review/ (DOL, HealthCare.gov)

CMS, CERT improper payment data (context for coding/documentation error rates). https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert/improper-payment-rates-and-additional-data (CMS)

HHS-OIG, Modifier 25 misuse; Malnutrition upcoding audit. https://oig.hhs.gov/compliance/physician-education/i-physician-relationships-with-payers/ and https://www.oversight.gov/sites/default/files/documents/reports/2020-07/A-03-17-00010.pdf (Office of Inspector General, Oversight.gov)

AMA & CMS, Code set basics (CPT; CMS coding overviews). https://www.ama-assn.org/topics/cpt-codes and https://www.cms.gov/cms-guide-medical-technology-companies-and-other-interested-parties/coding/overview-coding-classification-systems (American Medical Association, CMS)

Connecticut, Public Act 23-171 (facility fee limits and telehealth provisions). Governor’s summary: https://portal.ct.gov/governor/news/press-releases/2023/06-2023/governor-lamont-signs-legislation-on-health-care-affordability (CT.gov)

Colorado, HB23-1215 (facility fee limits/report). Legislative briefs referencing report and implementation. https://coleg.gov/sites/default/files/cy24_hcpsup1.pdf (coleg.gov)

Minnesota, facility fee disclosure and proposed prohibitions (provider-based clinics, including telehealth). https://www.revisor.mn.gov/statutes/cite/62j.824 and bill summaries for SF1503 (2025). (MN Revisor's Office, Senate Assets)

CFPB, Medical debt and credit reporting—industry changes and federal rule. https://www.consumerfinancial.gov/about-us/blog/medical-debt-anything-already-paid-or-under-500-should-no-longer-be-on-your-credit-report/ and Final rule (Jan 7, 2025): https://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-rule-to-remove-medical-bills-from-credit-reports/ (Consumer Financial Protection Bureau)

Credit bureaus, Removal of medical collections under $500. TransUnion newsroom announcement and Equifax explainer. https://newsroom.transunion.com/equifax-experian-and-transunion-remove-medical-collections-debt-under-500-from-us-credit-reports/ and https://www.equifax.com/personal/education/credit/score/articles/-/learn/can-medical-debt-impact-credit-scores/ (TransUnion Newsroom, Equifax)

IRS, 501(r) hospital obligations (FAP, AGB, collections). https://www.irs.gov/charities-non-profits/financial-assistance-policies-faps and https://www.irs.gov/charities-non-profits/billing-and-collections-section-501r6 (IRS)