Experience continuous third-party risk monitoring in action    Reserve your spot

Picture this: A surgery goes smoothly. The patient is discharged. Six weeks later, a bill arrives for $4,200 from a radiologist they never met, never selected, and had no way of knowing was out-of-network.

The facility was in-network. The surgeon was in-network. The radiologist, assigned automatically as part of the procedure, was not.

For health plans, that scenario carries more than a member service problem. It carries a cost-sharing obligation, a potential regulatory penalty, and a member who is now reconsidering their coverage at the next open enrollment.

Surprise billing is widely understood as a patient protection issue. What gets less attention is how much of it is preventable before any claim is ever filed, and how directly that prevention connects to the quality of a plan's provider data.

Here is what drives it, what the law requires, and where the operational fix actually lives.

What Surprise Billing Actually Is and How It Happens

A surprise medical bill is an unexpected charge from an out-of-network provider the patient had no reasonable opportunity to choose differently. It differs from a standard out-of-network charge, where the patient knowingly sought care outside their network. Surprise billing typically originates in one of four ways:

  1. An in-network facility assigns an out-of-network provider the patient did not select
  2. Emergency care is delivered at an out-of-network facility
  3. A member selects a provider listed as in-network whose status is actually incorrect
  4. An in-network referral leads downstream to an out-of-network specialist without the member realizing it.

The third scenario is where provider data quality becomes the direct driver of billing exposure, and the one plans have the most operational control over.

The Most Common Scenarios Health Plans Face

Scenario

How Exposure Is Created

Plan's Obligation

Out-of-network anesthesiologist at in-network facility

Member assumes in-network coverage

Cover at in-network cost-sharing; absorb the difference

Emergency care at out-of-network facility

Member had no alternative

Emergency services covered at in-network cost-sharing

Directory lists an out-of-network provider as in-network

Member relies on inaccurate data

Plan bears cost-sharing liability

In-network referral leads to out-of-network lab or specialist

Member unaware of the transition

Covered as in-network if no reasonable alternative existed

The directory inaccuracy scenario is the only one on this list that is entirely preventable before the member ever makes a call.

Why Surprise Bills Still Happen Four Years After the No Surprises Act

The No Surprises Act closed many billing pathways but did not fix the data conditions that produce surprise bills. Three root causes continue to drive complaints and disputes.

Contract lag: Providers join and leave networks continuously. When contracting and directory systems are not connected in real time, there is always a window where a provider's directory status does not reflect their actual contract status.

Delegated data failures: Provider groups submit roster files in inconsistent formats on their own schedules. Without automated validation, errors enter the directory and compound before anyone catches them.

Outreach frequency gaps: The No Surprises Act requires verification every 90 days and directory updates within two business days of any reported change. Plans still running annual verification cycles are both out of compliance and carrying inaccuracy risk they are not measuring.

The Provider Directory Connection Most Plans Miss

Most conversations about surprise billing focus on resolution: the dispute process, arbitration, cost-sharing calculations. Those matter, but they address surprise bills after the damage is done.

The upstream leverage point is the directory. A Senate subcommittee investigation found that one-third of provider listings contacted were inaccurate. When a member relies on that information and receives an out-of-network bill, the plan absorbs the cost-sharing difference.

Every inaccurate listing is a claims liability that never appeared in any risk model. According to Atlas Systems' 2025 Member Experience Monitor, 40% say that Google and other “alternative” sources have more accurate provider information than directories. The financial impact is immediate. The reputational damage compounds with every enrollment cycle.

What the Law Requires from Health Plans Today

Four obligations under the No Surprises Act directly reduce surprise billing exposure:

Hold harmless: In covered situations, plans limit member cost-sharing to the in-network amount and absorb the difference. This is not discretionary.

Provider directory accuracy: Verify every listing at least every 90 days, update records within two business days of a reported change, and remove unresponsive providers rather than leaving them in place.

Notice and consent: Balance billing is permitted in narrow non-emergency circumstances only with specific, voluntary, advance written consent obtained before the service.

Good Faith Estimates: Providers must supply uninsured patients with a written cost estimate before scheduled care. A proposed pre-service AEOB rule for insured patients remains pending as of early 2026.

Balance Billing vs. Surprise Billing: Understanding the Difference

 

Balance Billing

Surprise Billing

What it is

Provider charges the gap between their full fee and what the plan paid

Patient receives an unexpected out-of-network bill they had no chance to avoid

Patient's knowledge

Patient chose or knew the provider was out-of-network

Patient had no reasonable opportunity to know

NSA protection

Not automatically prohibited; depends on context

Prohibited for emergency care, covered ancillary services, and air ambulance

Balance billing is a billing method. Surprise billing is the patient experience that results when it occurs in a protected situation without informed consent.

The Financial and Reputational Cost to Health Plans

Surprise billing exposure extends well past paying the claim. The downstream costs are real and consistently undercounted.

Claims liability: Directory-driven out-of-network services mean the plan covers cost-sharing it never modeled for. Systematic data failures create material financial exposure at scale.

Regulatory penalties: Violations can result in civil monetary penalties of up to $10,000 per incident, along with federal audits and corrective action plans.

Member retention: Atlas Systems' 2025 Member Experience Monitor found that 80% of members who encountered a directory error trusted their health plan less as a result. Members who receive an unexpected bill tied to a directory error do not renew quietly.

What CMS-4208-F2 and the REAL Health Providers Act Add to the Picture

For plans managing Medicare Advantage business, surprise billing risk now extends into how directory data performs publicly on Medicare Plan Finder. Inaccurate listings mean members enroll based on a network that does not reflect reality, then encounter the gap when they seek care.

The REAL Health Providers Act's cost-sharing liability provision, effective plan year 2028, converts each of those directory failures into a direct claims obligation.

Building the Operational Controls That Actually Prevent It

Prevention requires controls that surface inaccuracies before they reach any member. Three capabilities define what that looks like:

  1. Upstream data normalization: When delegated roster files arrive in inconsistent formats, automated normalization resolves NPI mismatches, removes duplicates, and validates records before they enter the directory.
  2. Continuous verification: A 90-day cycle means tracking each provider record individually and triggering outreach before the window closes, not running a quarterly batch and calling it done.
  3. Real-time system connectivity: When a contract terminates, that status needs to reach the directory within days. Without a live connection between contracting and directory platforms, the lag between those two systems is where surprise billing originates.

A plan that discovers a directory problem through a member complaint is already downstream of the failure. PRIME® by Atlas Systems supports this kind of continuous data management: automated roster normalization, ongoing monitoring against live provider data, and real-time directory updates that close the gap before it reaches a member. See how PRIME® supports surprise billing prevention.

Get a demo today!

FAQs

What is surprise billing in healthcare?

Surprise billing occurs when a patient receives an unexpected charge from an out-of-network provider they did not knowingly choose. It most commonly happens during emergency care, when a facility assigns an out-of-network provider to an in-network procedure, or when a member selects a provider based on directory information that is inaccurate or outdated.

How does the No Surprises Act protect patients from surprise medical bills?

The law prohibits balance billing in emergency situations, for covered ancillary services at in-network facilities, and for out-of-network air ambulance services. In those situations, patients pay only their in-network cost-sharing. The plan absorbs the difference. Providers cannot balance bill without specific, voluntary, advance written consent in the narrow non-emergency circumstances where that exception applies.

What is the difference between surprise billing and balance billing?

Balance billing is the practice of billing a patient for the gap between the provider's full charge and what the plan paid. Surprise billing is what the patient experiences when that bill arrives unexpectedly from a provider they had no real opportunity to identify as out-of-network. All surprise bills involve balance billing, but not all balance billing constitutes a surprise bill under the law.

Are Medicare Advantage plans subject to surprise billing rules?

The No Surprises Act does not apply directly to Medicare Advantage plans, which have separate billing protections under Medicare. However, the REAL Health Providers Act extended the same directory accuracy standards to MA plans, and cost-sharing liability for directory-driven errors applies to MA beginning plan year 2028.

How can health plans reduce the risk of surprise billing complaints and litigation?

The most effective intervention happens before any bill is generated: running 90-day verification cycles on every provider record, normalizing delegated roster data before it enters the directory, and maintaining real-time connectivity between contracting and directory systems. Plans that build this infrastructure reduce directory-driven surprise billing at the source, before it generates claims liability, regulatory penalties, or member complaints.

In this blog

Jump to section

    Learn how to continuously monitor vendor risks and make fast, audit-ready risk decisions


    Related Reading

    Blogs

    CMS-4208-F2: What Medicare Advantage Plans Must Do Before October 2026

    Blogs

    REAL Health Providers Act: What MA Plans Must Do Before 2028

    Blogs

    Provider Network Analytics: Transform Data Into Network Intelligence

    Blogs

    Provider Data Governance Framework: Roles, Rules & Enforcement

    Blogs

    Ghost Networks: An Industry Problem Hiding in Plain Sight

    Blogs

    How Modern Payer Operations Turn Data Chaos Into Competitive Advantage

    Blogs

    CMS CAHPS Compliance & Reporting: Audit Readiness and Bonus Payments

    Blogs

    CMS Provider Directory Requirements: Your Compliance Guide

    Blogs

    CMS Regulations in Healthcare: Key Guidelines for Providers and Hospitals

    Blogs

    What Is the CAHPS Patient Satisfaction Survey?

    Blogs

    Complete Guide to Delegated Credentialing

    Blogs

    Bi-Directional Provider Data Exchange: Benefits and Use Cases

    Blogs

    Data Challenges in Healthcare: Why Health Plans Can't Afford Inaccurate Provider Information

    Blogs

    Best Provider and Physician Engagement Strategies

    Blogs

    Fast Provider Onboarding: Reduce Credentialing Delays

    Blogs

    No Surprises Act Provider Directory Requirements Explained

    Blogs

    Choosing a Provider Data Management Tool: 2026 Buyer's Guide

    Blogs

    Why Provider Enrollment Takes So Long and How to Fix It

    Blogs

    Vendor Credentialing by State: The Complete Guide for Compliance

    Blogs

    AI for Provider Networks: From Data Overload to Intelligent Action

    Blogs

    2026 Network Adequacy Requirements: What Health Plans Must Know

    Blogs

    Audit Readiness: Key Components, Benefits, and Best Practices

    Blogs

    Physician Burnout: Causes and How to Prevent It

    Blogs

    Credentialing Turnaround Time: Best Strategies for Faster Approvals

    Blogs

    How Provider Relationship Management Improves Healthcare Outcomes

    Blogs

    Simplified SNP MOC Provider Training with Atlas Systems

    Blogs

    The 10 Best Medical Credentialing Companies in 2026

    Blogs

    Provider Network Management for Payers: Fix Data, Reduce Risk, Cut Costs

    Blogs

    Healthcare Compliance Software: Top Tools, Features, and Benefits

    Blogs

    What Are the Compliance Differences Between GDPR and HIPAA?

    Blogs

    Healthcare Compliance Program: Stark Law Risks & OIG Guidance

    Blogs

    How Credentialing Automation Eliminates Manual Provider Work

    Blogs

    What Is CVO Credentialing? Benefits, Process & Automation

    Blogs

    Understanding the 2025 NCQA Credentialing Standards for Healthcare Providers

    View all blogs