Here is what changed, and when. CMS finalized upgraded Hospital Price Transparency requirements in the CY 2026 OPPS/ASC final rule (CMS-1834-F), effective January 1, 2026, with enforcement beginning April 1, 2026. In roughly ten weeks of active enforcement, CMS issued 519 noncompliance letters, a volume disclosed in the HHS/CMS enforcement announcement of June 9, 2026. That announcement made two things clear: the agency is auditing the machine-readable file itself, not just whether a page exists, and the geographic sweep is national. Only Alaska has no hospital on the list.

For audit and enforcement teams, the operative question is no longer "are we roughly compliant." It is "would our machine-readable file survive an automated CMS validation pass today." The 519 letters say most hospitals cannot answer yes with confidence.

The enforcement wave in numbers

Each number carries a message. The letter count shows throughput: CMS is reviewing at scale, which points to automated validation of file structure and encoded fields rather than manual spot checks. The 2025 penalty history shows the ceiling is real money. And the 35 percent reduction has an exception that surprises hospitals at the worst possible moment, covered below.

Where the letters landed

The geography matters for one reason: it removes the "CMS only chases big systems in big states" excuse. Rural critical access archetypes, mid-size community hospitals, and multi-state systems all appear in the same enforcement stream. If your machine-readable file has a structural defect, your state being quiet so far is not protection.

How we got here: the 2026 enforcement timeline

1. JAN 01 2026
   Upgraded requirements take effect. The CY 2026 OPPS/ASC final rule (CMS-1834-F) requirements for the Hospital Price Transparency machine-readable file become effective, including the upgraded encoded payer-rate fields.
2. APR 01 2026
   Enforcement begins. CMS starts enforcing the upgraded machine-readable file requirements. This is the date after which a defective file is an enforcement exposure, not a to-do item.
3. APR to EARLY JUN 2026
   519 noncompliance letters go out. In roughly ten weeks, letters reach hospitals in every state except Alaska.
4. JUN 09 2026
   HHS and CMS announce the numbers. The enforcement announcement publicizes the letter volume and signals that the agency intends to keep the pressure on.

What noncompliance actually costs

Civil monetary penalties for Hospital Price Transparency violations are governed by the CMP provisions of 45 CFR Part 180. In 2025, before this enforcement wave, CMS imposed 10 CMPs. The range tells you the stakes:

Read together with the 519 letters, the math is straightforward. The letter is the cheap stage. The CMP stage is six figures at the top of the observed 2025 range, and the escalation pipeline from letter to corrective action to penalty is now visibly moving.

Why the encoded payer-rate fields are the pressure point

The upgraded requirements CMS began enforcing on April 1, 2026 are about the contents of the machine-readable file, especially the encoded payer-specific rate fields. A file that renders fine to a human browser can still fail machine validation: blank encoded fields, malformed values, rates that do not parse against the required schema. Because CMS can check these fields programmatically, this is exactly the kind of defect that scales to 519 letters in ten weeks. Assume your file will be read by a script, not a person, and audit it the same way.

The operator to-do list

1. Confirm the file exists and is reachable. Verify the machine-readable file is posted, publicly accessible, and discoverable. A missing MRF forfeits the 35 percent hearing-waiver reduction under 45 CFR Part 180, so existence is step zero.
2. Validate every encoded payer-rate field. Run the current file against the CMS-1834-F requirements. Check for blank, malformed, or non-parsing encoded values across all payers and plans, not a sample.
3. Re-test after every chargemaster or contract load. Files drift. A file that validated in January can fail in August after a payer contract update. Put MRF validation into the change-control checklist for any pricing data change.
4. Build the letter-response playbook now. Decide today who owns a CMS noncompliance letter, what the corrective-action timeline looks like, and who signs the response. Ten weeks of letters means the odds of receiving one are no longer remote.
5. Document remediation as you go. If a letter arrives, a dated record showing when defects were found and fixed is your strongest position in any 45 CFR Part 180 proceeding.
6. Assign a named owner with a standing cadence. Quarterly full-file validation at minimum, with results reported to the compliance committee. Enforcement is now continuous, so monitoring has to be too.