Short answer. States are the primary enforcers of the No Surprises Act, with federal enforcement as a backstop where a state does not or cannot act. Civil monetary penalties of up to $10,000 per violation have been associated with the federal provisions, and a provider who corrects the situation and refunds the patient within a set window may avoid penalty. Amounts and enforcement practice change — verify current figures before relying on them.
Who actually enforces
Enforcement is split. States are the primary enforcers of provider and facility obligations — the balance-billing prohibitions, notice-and-consent requirements, and disclosure rules. Where a state does not enforce or lacks authority, federal agencies step in. Plan-side obligations, including cost-sharing calculation and QPA methodology, sit with the federal Departments and state insurance regulators depending on plan type.
What draws attention
- Balance billing a protected patient. The most direct violation and the easiest for a patient to report.
- Misusing notice and consent. Using it for emergency services or ancillary services, presenting it too late, burying it in intake paperwork, or making it a condition of treatment.
- Failure to provide required disclosures. Public-facing notice of balance-billing protections on the website and in the office.
- Good faith estimate failures. Missing estimates for self-pay patients, or estimates missing required elements.
- Plan-side QPA problems. A separate exposure, on the payer side, where QPA calculation does not follow the methodology.
The correction path. A provider who identifies an improper bill, withdraws it, and refunds the patient with interest within the defined window can generally avoid a penalty. Self-correction is treated far better than being reported.
Where compliance and revenue meet
The same classification question drives both. Deciding whether a claim is protected tells you whether you may bill the patient — a compliance question — and whether you can dispute the plan through IDR — a revenue question. Groups that do this classification well are usually compliant and well-paid for the same reason: they know what each claim is.
Groups that do it badly tend to fail in one of two directions. Over-billing patients on protected claims creates enforcement risk. Writing off protected claims as unrecoverable leaves the IDR remedy unused, which is not a violation but is expensive.
Practical compliance checklist
- Public disclosure notice posted on the website and at the point of service.
- Notice-and-consent used only where permitted, delivered in the required timeframe, never for ancillary services.
- Good faith estimates issued to self-pay patients with all required elements.
- A documented process for classifying every out-of-network claim before it is billed.
- A route for patient complaints that reaches someone who can withdraw a bill quickly.
Penalty amounts, correction windows and enforcement allocation are set by federal regulation and state law and do change. This page is a starting point for a conversation with your compliance counsel, not a substitute for one.
Not legal advice. IDR Filings is a dispute-filing and revenue-recovery service, not a law firm. This page is general information about how the federal process works. It is not legal advice and does not create an attorney-client relationship. For advice on your specific situation, consult a licensed healthcare attorney in your state.