Gross charge
Chargemaster
- Must match the current chargemaster, not a prior version
Home / White papers / Hospital
White paper · Hospital compliance and revenue integrity
Hospital price transparency in 2027: a self-audit of the machine-readable file
Short answer: CMS now tests the encoded fields, not the web page. Seven blocks a hospital can be tested on after the 2026 changes: access, standard charges, the allowed-amount fields, the attestation and CEO line, the consumer display, enforcement math, and the 2027 standardization RFI. Written for the person who has to sign the attestation.
45 CFR 180.50 · 180.60 · 180.904 allowed-amount fields · 835 source3-part attestation · CEO named35% reduction · hearing waiver
Edition
1 · 2027
Focus
Price transparency
Audience
Compliance · CEO signer
Framework
45 CFR 180
Effective date
Apr 1, 2026 enforcement
Length
13 min read
Apr 1, 2026enforcement
Date CMS began enforcing the 2026 machine-readable file requirements [1]
12 to 15months
Required lookback for the median and percentile allowed amounts [1]
200+reviews a month
Comprehensive hospital reviews CMS says it performs every month [2]
$5,500per day
Maximum daily penalty for a hospital with more than 550 beds, before inflation adjustment [3]
The compliance calendar behind the checklist
CMS reviews at least 200 hospitals a month, finds them through a web scraper and public complaints, and checks the encoded fields rather than whether a page exists [2]. The 2026 build is the floor, not the finish.
- 1Jan 1, 2021Original rule: MRF plus consumer-friendly shoppable services display
- 2Jan 1, 2024CMS template, cms-hpt.txt file and footer link required
- 3Jan 1, 2026Allowed-amount fields, attestation, CEO name and Type 2 NPIs take effect [1]
- 4Apr 1, 2026CMS begins enforcing the 2026 requirements [1]
- 5Jul 7, 2026CY2027 OPPS proposed rule publishes a standardization RFI [4]
- 6Aug 31, 2026RFI comments close; final rule expected November 2026
Posting exercise
A page exists, a file is linked
Dataset
Encoded fields tested by machine; attestation signed
Next floor
Standardization asked, not yet required
PostingEncoded fieldsRFI
Takeaway
The 2026 enforcement wave reached hospitals of every size. If your file has a structural defect, a quiet state is not protection. Our enforcement brief covers the letters; this paper covers the fix.
Can CMS find and open the file? From 45 CFR 180.50
Run these checks from outside your network. A footer link that only renders behind a CMS login, or a text file pointing at last year's file name, is the defect a scraper flags before a human reads the file [3].
| Check | Requirement | Evidence to keep |
|---|---|---|
| File name | Naming convention <ein>_<hospital-name>_standardcharges.[json|csv] | Screenshot of the hosted file name and the EIN it carries |
| cms-hpt.txt | Text file in the website root with the location name, source page URL, direct MRF URL and point of contact (since January 1, 2024) | The file itself, dated, with every URL tested |
| Footer link | A link labeled "Price Transparency" in the footer, including the homepage, to the page that hosts the MRF link | Crawl of every template footer, not only the homepage |
| Open access | No fee, no account or password, no personal information, available to automated searches and direct download | A download from a browser with no cookies and from a script |
| Searchable | The file and its standard charge information must be digitally searchable | Validator output showing the file parses |
| Update frequency | Standard charge information updated at least once annually | The date of most recent update encoded in the file |
Six charge types the MRF must carry
The attestation now says the file is complete, so a missing payer or a blank column is a statement you signed [2].
Discounted cash price
Self-pay
- Matches the financial assistance and self-pay policy in force
Payer-specific negotiated charge
By payer and plan
- Plans grouped (such as all PPO plans) only where the same charge applies to each
De-identified minimum
Lowest
- Lowest negotiated charge across payers for the item
De-identified maximum
Highest
- Highest negotiated charge across payers for the item
Method used to establish the charge
Required
- Drives the 2026 allowed-amount rules in Block C
Reconcile the payer listTo the contract management system; every active contract should appear
Trace 25 itemsHigh-volume items: gross charge, cash price and three negotiated charges back to source
General elementsHospital name, licensed locations including inpatient facilities and stand-alone EDs, template version, date of last update
Where most 2026 files fail: four elements and their rules
When a payer-specific negotiated charge is based on a percentage or an algorithm, the hospital must encode the median, 10th and 90th percentile allowed amounts in dollars plus the count. The estimated allowed amount is gone [1].
| Element | Rule in the CY2026 final rule |
|---|---|
| Median allowed amount | Median of the allowed amounts the hospital received from the payer for the item; if the calculation falls between two observed values, use the next highest observed value |
| 10th percentile allowed amount | Same lookback and same next-highest-observed-value rule |
| 90th percentile allowed amount | Same lookback and same next-highest-observed-value rule |
| Count of allowed amounts | The number of allowed amounts used to calculate the three figures; a count of one is a flag, not a statistic |
| Data source | EDI 835 electronic remittance advice, or an alternative, equivalent source of remittance data |
| Lookback period | No less than 12 months and no longer than 15 months before the MRF is posted |
Pull the 835 file
One payer, one high-volume code
Allowed amounts for a 12 to 15 month window before the posting date.
Recompute
Median, 10th, 90th, count
- Next-highest-observed-value rule, not an average
- Lookback no shorter than 12, no longer than 15 months
Compare to the encoded values
Pass or fail
If the vendor used an average, or 18 months because that is what the warehouse held, the field is wrong even though it is populated.
Takeaway
A populated field is not a compliant field. CMS wrote the calculation rule into the regulation, and the attestation says you followed it.
Three parts, a named official and the Type 2 NPIs
If a contract pays a percentage of a Medicare fee schedule, the free-text fields have to name the schedule and the components, in plain words, for every such contract [1].
Part one
Complete and accurate
- To the best of its knowledge and belief, all applicable standard charge information per section 180.50; true, accurate and complete as of the date in the file
Part two
Every dollar amount
- All applicable payer-specific negotiated charges that can be expressed as a dollar amount
Part three
Not knowable in advance
- The specific fee schedule or components a reader needs to derive the dollar amount; catches percentage-of-charge and formula contracts
Named official and NPIs
Identity
- CEO, president or designated senior official, spelled as in the organization's records
- Every Type 2 NPI with primary taxonomy 28 or 27, active as of the most recent update
Shoppable services or an estimator
Test an estimator as a patient would: no login, a real plan, a real service, and an estimate that reflects the negotiated charge rather than the gross charge. Keep the test log.
70
CMS-specifiedEvery one of the 70 you provide must appear; document any you do not provide [3]
300
ServicesOr as many as the hospital provides if fewer; select by how often you provide and bill each
Deemed
EstimatorCompliant if it covers the same services and gives the consumer an estimate of what they would owe at the time they use it
RFI
ExposureCMS asked in July 2026 whether to modify or eliminate deemed compliance [4]
Warning, corrective action plan, civil monetary penalty
Warning notice
Step 1
CMS identifies the deficiency and a deadline; respond in writing with evidence.
Corrective action plan
Step 2
Required for material violations; names the actions and completion dates, subject to CMS approval.
Civil monetary penalty
Step 3
Imposed when the hospital fails to respond or to comply with the plan; published on a CMS website. Daily, scaled by bed count.
Maximum daily penalty by bed count, dollars per day, before the annual inflation adjustment (45 CFR 180.90(c))
Bed count comes from the most recent finalized Medicare cost report [3].
More than 550 beds$5,500 per day
$5,500$2,007,500 a year
300 beds$10 per bed per day
$3,000$1,095,000 a year
100 beds$10 per bed per day
$1,000$365,000 a year
30 beds or fewer$300 per day
$300$109,500 a year
$0$2,000$4,000$6,000
LargestPer bedSmallest
35 percentSince January 1, 2026 a hospital that waives its right to an administrative law judge hearing can receive a 35 percent reduction in the penalty. Not available where the penalty stems from failing to make the MRF public at all, or failing to post the shoppable services display [1].
Takeaway
The 35 percent reduction only helps a hospital whose file exists but is wrong. It does nothing for a hospital whose file cannot be found. Block A protects the discount.
RFI topics and the audit question to ask now
Comments closed August 31, 2026, and nothing in the RFI applies until CMS proposes and finalizes it [4] [6]. The contract inventory it implies is the same inventory Block D part three already needs; our RFI insight goes through the questions one by one.
| RFI topic | What it would change | What to prepare |
|---|---|---|
| Contract mechanisms | Structured fields for outliers, stop-loss, tiering and carve-outs instead of free text | An inventory of contracts with each mechanism, by payer |
| Free-text accuracy | Tighter rules on what the notes fields may contain | Review every free-text entry against the contract it describes |
| Price estimator policy | Modify or eliminate deemed compliance for estimator tools | Know whether you could post a 300-service display on short notice |
| Shoppable services list | An updated list of CMS-specified services | A process to add services to the display within one update cycle |
| Displayed prices | Clarify what ancillary and bundled services are included | Documentation of what each displayed price covers |
Score each block pass or fail, attach the evidence, date it
| Block | Items | Owner | Evidence | Cadence |
|---|---|---|---|---|
| A. Access | File name, cms-hpt.txt, footer link, open access, searchable | Web team | External crawl log | Monthly |
| B. Standard charges | Five charge types, payer list, method field, general elements | Revenue integrity | Contract reconciliation, 25-item trace | Quarterly |
| C. Allowed amounts | Median, 10th, 90th, count; 835 source; 12 to 15 month lookback | Finance analytics | Recomputation worksheet | At each update |
| D. Attestation | Three-part statement, CEO name, Type 2 NPIs | Compliance | Signed review memo | At each update |
| E. Consumer display | 300 services, 70 CMS, estimator test | Patient access | Patient-view test log | Quarterly |
| F. Enforcement readiness | Warning letter playbook, CAP template, bed count evidence | Compliance | Playbook on file | Annually |
| G. RFI watch | Contract mechanism inventory, free-text review | Managed care | Inventory workbook | Before the final rule |
- 1Week 1: outside-inCrawl the site for Block A and run the CMS validator on the posted file; log every defect
- 2Week 2: recomputePull 835 data for the top payers and codes, recompute the allowed-amount fields, trace 25 items for Block B
- 3Week 3: attest and displayReview the attestation text, the named official and the Type 2 NPIs; test the estimator or display as a patient
- 4Week 4: score and signComplete the scorecard, attach the evidence, brief the named official before the next attestation
Machine first
Scraper view, validator output
Sample second
835 recomputation, 25-item trace, patient-view test
Sign-off
Scorecard to the CEO whose name is in the file
MachineSampleSign-off
Three habits that keep the file defensible
Run the CMS validator before posting and keep the outputCMS says an alert can fire when a file meets form and manner but may not meet every requirement [5].
Keep every prior version with its dateThe penalty effective date can reach back to the last annual update.
Name one owner and one calendarA single accountable owner for the file and a single calendar for its updates. We audit MRFs the way CMS does, outside-in and by machine first, recomputing the allowed-amount fields from the 835s; findings go into the command center our hospital billing teams work from. Related: the 340B rebate model cash playbook and this month's Hospital Cash Cycle.
Frequently asked questions
What changed in the hospital price transparency rules for 2026?
The CY2026 OPPS final rule removed the estimated allowed amount and replaced it with the median, 10th percentile and 90th percentile allowed amounts and a count, calculated from 835 remittance data over a 12 to 15 month lookback. It replaced the affirmation with a three-part attestation, required the CEO or designated senior official's name and the hospital's Type 2 NPIs in the file, and allowed a 35 percent penalty reduction for hospitals that waive an ALJ hearing. The changes took effect January 1, 2026 and CMS began enforcing them April 1, 2026.
How much is the civil monetary penalty for a noncompliant MRF?
Under 45 CFR 180.90 the maximum daily amount is $300 for hospitals with 30 beds or fewer, $10 per bed per day for 31 to 550 beds, and $5,500 per day above 550 beds, adjusted annually for inflation. At those rates the annual maximum runs from $109,500 to $2,007,500. The 35 percent hearing-waiver reduction does not apply when the penalty is for failing to post the MRF or the shoppable services display.
Do we have to recalculate the allowed amounts every time we update the file?
Yes. The median, percentile and count fields must reference a lookback of no less than 12 and no more than 15 months before the file is posted, so each posting needs a fresh calculation from the remittance data for that window.
What does the CY2027 OPPS rule change for price transparency?
Nothing yet. The proposed rule contains a request for information on standardizing MRF data, reporting contract mechanisms such as outliers, stop-loss, tiering and carve-outs, free-text accuracy, the price estimator deemed-compliance policy and the shoppable services list. Comments closed August 31, 2026; any change would come through future rulemaking.
Who should sign off on the file?
The regulation requires the file to encode the name of the chief executive officer, president or the senior official designated to oversee the encoding of true, accurate and complete data. Whoever is named should see the audit scorecard and the evidence before each attestation.
- CMS fact sheet: CY 2026 OPPS/ASC Final Rule, Hospital Price Transparency Policy Changes (CMS-1834-FC, November 21, 2025)
- CMS MLN7215754, Hospital Price Transparency fact sheet (March 2026)
- eCFR: 45 CFR Part 180, Hospital Price Transparency (sections 180.50, 180.60, 180.80, 180.90)
- CMS fact sheet: CY 2027 Hospital OPPS and ASC Payment System Proposed Rule (CMS-1850-P), July 2, 2026
- CMS: Hospital Price Transparency (key initiatives page, updated September 16, 2026)
- Federal Register: CY 2027 OPPS and ASC proposed rule (CMS-1850-P), 91 FR 41733, July 7, 2026
Bed count comes from the most recent finalized Medicare cost report [3].
Want your machine-readable file audited before CMS does it?
We crawl the file from outside, recompute the allowed-amount fields from your 835s, check the attestation and the consumer display, and hand you the scorecard with the evidence attached.