NSA enforcement: CMS, the states, and the penalty math

Who enforces the No Surprises Act against providers?

Enforcement is layered. CMS administers the federal No Surprises Act requirements and hosts the complaint and implementing-guidance process at the federal level 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That CMS hosts the federal No Surprises Act guidance and complaint process, that the Act restricts balance billing in defined settings, and that it creates the patient-provider dispute-resolution process available when a bill exceeds the estimate.2Ref 2Office of the Federal Register (2026).45 CFR Part 149 — Surprise Billing and Transparency Requirements.The operative federal rule text implementing the No Surprises Act, including the patient-provider dispute process and its substantial-difference ($400) threshold., while states enforce their own surprise-billing laws where they have the authority. For an individual clinician, though, the abstract question of who investigates matters less than the two mechanisms that actually reach into your bank account: the patient-provider dispute process, and — on the insurance side — the False Claims Act.

Those two are worth separating because they attach to different work. The dispute process is where a self-pay patient challenges an estimate that turned into a much larger bill 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That CMS hosts the federal No Surprises Act guidance and complaint process, that the Act restricts balance billing in defined settings, and that it creates the patient-provider dispute-resolution process available when a bill exceeds the estimate.. The False Claims Act, by contrast, is not an NSA penalty at all; it is a far larger exposure that attaches when you submit claims to federal health programs 3Ref 3U.S. Department of Justice (2026).The False Claims Act.That the False Claims Act imposes treble damages and per-claim penalties for knowingly submitting false claims to federal programs, that 'knowingly' includes reckless disregard, and that qui tam relators can sue.. Knowing which one a given situation implicates tells you how worried to be.

CMS and the federal complaint process

At the federal level, CMS is the agency behind the No Surprises Act. It hosts the implementing guidance and the complaint pathway a patient uses to report a suspected violation, and it publishes the operative requirements clinicians have to meet 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That CMS hosts the federal No Surprises Act guidance and complaint process, that the Act restricts balance billing in defined settings, and that it creates the patient-provider dispute-resolution process available when a bill exceeds the estimate.. The rule text those requirements come from lives in the federal surprise-billing and transparency regulations, which are the authority to read when a specific obligation is in question 2Ref 2Office of the Federal Register (2026).45 CFR Part 149 — Surprise Billing and Transparency Requirements.The operative federal rule text implementing the No Surprises Act, including the patient-provider dispute process and its substantial-difference ($400) threshold..

For a solo practice, the practical implication is that a federal complaint is a document-driven process: an investigator asks what estimate you issued, what you billed, and how the two line up. A practice that can produce the estimate it gave, the codes behind it, and the final claim is in a fundamentally different position from one reconstructing the story after the fact. Treat the paper trail as the response you are pre-writing today.

The state layer

The federal scheme does not stand alone. The No Surprises Act operates alongside state surprise-billing laws, and which enforcer acts on a given patient's plan can depend on your state and on whether that plan is state-regulated or federally governed. Because that variation is the entire subject, the state layer is treated as its own topic rather than flattened into the federal picture here.

The practical move is to identify your own state's surprise-billing statute and its insurance regulator, then read how they interact with the federal baseline for the plans you actually bill. A rule that binds a fully-insured plan in your state may not touch a self-funded employer plan seen the same week. Do not assume the federal frame is the whole enforcement story where a state has built its own.

The dispute process: the mechanism you'll actually meet

For a self-pay practice, the realistic enforcement touchpoint is the patient-provider dispute resolution process, not a federal fine. A self-pay or uninsured patient may take a bill to that process when the amount billed runs at least $400 above the good-faith estimate you gave 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That CMS hosts the federal No Surprises Act guidance and complaint process, that the Act restricts balance billing in defined settings, and that it creates the patient-provider dispute-resolution process available when a bill exceeds the estimate.2Ref 2Office of the Federal Register (2026).45 CFR Part 149 — Surprise Billing and Transparency Requirements.The operative federal rule text implementing the No Surprises Act, including the patient-provider dispute process and its substantial-difference ($400) threshold.. This is the heart of the $400 rule: cross that gap and the patient has a formal path to contest the difference before a dispute-resolution entity.

at least $400 over the estimate is the threshold that opens the door, and the process can reduce what you are entitled to collect toward the estimate you issued. The lesson is not to pad estimates defensively but to build them from your real fee schedule so the final bill lands inside the window. An accurate estimate is the cheapest way to keep this process from ever starting.

The False Claims Act: the exposure that dwarfs the rest

The largest financial risk in this whole area is not an NSA penalty. The False Claims Act attaches when you knowingly submit false claims to federal health programs, and it carries treble damages plus per-claim penalties — and "knowingly" reaches reckless disregard, not just deliberate fraud 3Ref 3U.S. Department of Justice (2026).The False Claims Act.That the False Claims Act imposes treble damages and per-claim penalties for knowingly submitting false claims to federal programs, that 'knowingly' includes reckless disregard, and that qui tam relators can sue.. A relator can also bring a qui tam suit on the government's behalf, which is how many of these cases begin.

The connection to the No Surprises Act is discipline, not doctrine. The same carelessness with numbers that produces a wildly inaccurate estimate is the carelessness that produces a false claim, and only one of those has treble damages behind it. For a solo practice, the takeaway is that honest, documented billing math protects you across both regimes at once — the estimate you defend to a patient and the claim you defend to a program are the same habit.

What actually applies to an office-based self-pay practice

Scope your worry to your setting. The balance-billing protections apply only in defined settings 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That CMS hosts the federal No Surprises Act guidance and complaint process, that the Act restricts balance billing in defined settings, and that it creates the patient-provider dispute-resolution process available when a bill exceeds the estimate., and an independent clinician seeing self-pay patients in their own office generally operates outside them — which is why the good-faith-estimate rules, not the balance-billing ban, are where an office-based self-pay practice usually meets the No Surprises Act. That reframes enforcement risk considerably for a practice of one.

For most solo clinicians, then, the day-to-day exposure is: issue accurate estimates, honor the requirements that make up the NSA for office practice, and keep the paper that would answer a dispute. The balance-billing civil-penalty machinery aimed at facility scenarios is unlikely to be your exposure; a patient dispute over an estimate, and the FCA on any insurance claims, are the two that are.

Reducing your enforcement exposure

Exposure shrinks with a few repeatable habits, none of which require counsel on retainer. The through-line is that every enforcement path in this area rewards a clean, retrievable record and punishes reconstruction, so the work is front-loaded into your intake and billing routine rather than saved for the day a complaint arrives.

• Issue estimates from your actual fee schedule — accuracy keeps bills inside the dispute window
• Keep the estimate, the codes, and the final claim together — that packet is your complaint response
• Post your required patient notice — the one-page notice is part of honoring the office obligations
• Keep your directory duties current — a wrong listing is its own money loss
• Calendar any deadline the day it arrives — a dispute or complaint has response windows you do not want to miss

Run through the estimate rules and the NSA for office practice as a checklist, and enforcement stops being a threat you react to and becomes a standard you already meet.