Fonteum Research · No Surprises Act
Quarterly compliance scores derived from CMS IDR filing data (provider-side) and the CMS MRF non-compliant issuer list (payer-side). All data is federal public domain.
First issuance pending — the quarterly cron runs on the 15th of March, June, September, and December.
Operator can trigger manually via the Inngest dashboard (function: nsa-compliance-quarterly).
Scores derived from CMS public data under the No Surprises Act (Pub. L. 116-260). Provider-side: IDR filing rates from CMS quarterly IDR data. Payer-side: MRF publication status from CMS non-compliant issuer list. Both are federal public domain (US-Government-Works).
Full methodology → · Version: nsa-compliance/v1
Limitations: IDR filing data is aggregate and may not reflect individual dispute outcomes. MRF compliance is based on the CMS non-compliant issuer list; absence from the list does not guarantee full compliance. This index is a research tool, not a legal determination.
For most of the last two decades, a patient who did everything right — going to an in-network hospital, choosing an in-network surgeon — could still receive a large bill from an out-of-network clinician they never knowingly selected: the anesthesiologist, the radiologist, the pathologist, the assistant surgeon. Because that clinician had no contract with the patient's health plan, they could bill the patient for the gap between their charge and whatever the plan paid, a practice known as balance billing. Emergencies were worse still, since a patient in crisis has no opportunity to check network status at all. Surprise bills of thousands of dollars were common, and the disputes that produced them were, in effect, pushed onto the patient as the party with the least information and the least leverage.
The No Surprises Act, enacted as Division BB of the Consolidated Appropriations Act, 2021 (Pub. L. 116-260) and effective January 1, 2022, changed the default. For emergency services, for non-emergency services delivered by out-of-network clinicians at in-network facilities, and for air-ambulance transport, the patient is now responsible only for the cost-sharing they would have owed in network. The payment disagreement that remains does not disappear — it moves off the patient's ledger and into a structured process between the provider and the health plan. The implementing rules are spread across three agencies: 29 CFR §2590.716 for the Department of Labor, 45 CFR §149.140 for the Department of Health and Human Services, and 26 CFR §54.9816 for the Internal Revenue Service. That tri-agency structure is why compliance signals for the Act are scattered across multiple federal data releases rather than living in one register.
The mechanism that resolves the remaining dispute is the federal Independent Dispute Resolution process. After a 30-business-day open-negotiation window, either the provider or the plan can escalate to IDR, where a certified IDR entity reviews a single payment offer from each side and selects one of the two as binding. This baseball-style arbitration is deliberate: by forcing each party to name one number that the arbiter must either accept or reject in full, it discourages extreme offers and pulls both sides toward a defensible figure. The qualifying payment amount — roughly, the plan's median contracted rate for the service — is one of the factors the arbiter weighs. CMS publishes the volume of disputes initiated each quarter, and those volumes have run substantially higher than federal agencies projected when the program launched, which is itself a signal that out-of-network payment friction remains widespread.
On the payer side, a parallel set of transparency rules requires health plans and issuers to publish machine-readable files disclosing their negotiated in-network rates and out-of-network allowed amounts in a standardized, automation-friendly format. The intent is to let researchers, employers, and competitors see the price structure that was previously opaque. CMS tracks issuers that fail to publish conforming files, and that non-compliant issuer list is the federal source this leaderboard uses to score MRF compliance. It is important to read that list correctly: it records observed non-compliance, so an issuer's absence from it means no recorded violation for the period rather than an audited attestation of full conformance.
The leaderboard combines the two federal signals into a single composite under a pinned methodology version, so that any figure shown here can be reproduced and any change to the method is explicit rather than silent. The provider-side IDR-rate score normalizes dispute volume against claim volume: it is one minus the clamped ratio of average IDR filings per 1,000 claims to a ceiling of 50. An entity at or above 50 filings per 1,000 claims receives a score of 0, and a very low filing rate approaches 1. Normalizing by claim volume is what makes a small group comparable to a large one; without it, raw dispute counts would simply rank entities by size.
The payer-side MRF score is the fraction of an entity's issuers that are in compliance per the CMS non-compliant issuer list. When both an IDR score and an MRF score are available for an entity, the composite is their average; when only one signal exists, the composite is that single score, so an entity is never penalized for the absence of a signal that does not apply to it. The composite then maps to a letter grade — A at 0.90 and above, B at 0.75, C at 0.60, D at 0.45, and F below — purely as a reading aid; the underlying numeric score is the authoritative value and is always shown alongside.
Two data-hygiene rules matter for interpretation. First, entities with fewer than 50 NPIs are flagged as insufficient sample when IDR is their only signal, because a small denominator makes a normalized rate volatile; pure payer entities scored on MRF data alone are not flagged. Second, CMS suppresses small cells in its IDR data using the sentinels "*" and "DS"; the model converts those to null and drops them from averages rather than misreading a suppressed cell as a zero, and MRF rows with no compliance status are excluded from the denominator entirely. These choices are the difference between a score that reflects the data and one that quietly invents it. As stated in the limitations above, the result is a research instrument, not a legal determination: a low score is a prompt to look closer, not a finding of fault.
Hospital financial performance from CMS HCRIS cost reports — the federal filing behind most commercial hospital-finance products.
How often payer provider directories diverge from the federal NPPES record, measured against the primary source.
A field-by-field read of the federal NPI registry that underpins provider identity across Fonteum's datasets.
BibTeX
@dataset{fonteum_nsa_tbd,
author = {Fonteum},
title = {NSA Compliance Leaderboard},
year = {2026},
publisher = {Fonteum},
url = {https://fonteum.com/research/nsa-compliance},
note = {Derived from CMS public data. Methodology: nsa-compliance/v1}
}APA
Fonteum. (2026). NSA Compliance Leaderboard. https://fonteum.com/research/nsa-compliance
Chicago
Fonteum. "NSA Compliance Leaderboard." https://fonteum.com/research/nsa-compliance, 2026.