The cms-hpt.txt pointer file

Rationale

The problem it solves

By 2023, thousands of hospitals were publishing price files that satisfied every accessibility rule in § 180.50(d) and were still, in practice, unfindable.

Nothing in the original rule said where a hospital must put its file. So the files went everywhere: four clicks deep under “Patients & Visitors”, on a billing vendor’s domain, behind a page that rendered its download link in JavaScript, on a subdomain nobody linked to. Each individually compliant; collectively, a national dataset that could only be assembled by hand.

The CY2024 rule’s fix was deliberately small. Rather than dictate where the file lives, CMS required an index at a fixed, predictable address saying where it lives. CMS was explicit about the purpose: to facilitate automated access to hospital MRFs.²

The same trick as robots.txt

A well-known path at the root of a domain, in a format a five-line parser can read, whose whole job is to say where the interesting thing actually is. The design is borrowed and it works for the same reason: you never have to crawl a site to find the file, you only have to guess the domain.

Specification

What CMS requires § 180.50(d)(6)

The regulation names four pieces of information; CMS’s technical specification fixes the file name, the location and the exact attribute spellings that carry them.¹²

Attribute names are CMS’s, from the technical specification behind its TXT File Generator.² The regulation itself lists four items; the contact splits into two attributes in the specification.
Attribute	Regulation calls it	Meaning
location-name	The hospital location name corresponding to the MRF	The name of the facility whose charges are in the file. This is the field that makes the pointer self-identifying, and everything below depends on it.
source-page-url	The source page URL that hosts the MRF	The public web page from which the file can be downloaded — the human-facing page, not the file.
mrf-url	A direct link to the machine-readable file	The file itself. A URL that returns the CSV or JSON, not a page about it.
contact-name	Hospital point of contact information	A person or team able to answer technical questions about the file and its contents.
contact-email	Hospital point of contact information	Their email address.

Three mechanical rules

The file is named cms-hpt.txt. Not hpt.txt, not cms_hpt.txt.
It sits at the root of the domain hosting the MRF — in CMS’s words, without regard to page structure. A hospital at hospital.com publishes https://hospital.com/cms-hpt.txt, whatever its site’s navigation looks like.
One entry per location. Where a file covers several locations, the five attributes repeat for each inpatient location and each standalone emergency department.

Note whose obligation this is. The rule binds the hospital to ensure that the website it selects to host its file establishes and maintains these things. A hospital that outsources hosting to a billing vendor has not outsourced the duty — and in practice this is where a good share of missing pointer files come from.

Anatomy

A file, annotated

The whole format. Five attribute: value lines per location, blank line between entries, nothing else.

https://example.org/cms-hpt.txt — single location

location-name: Example Regional Medical Center
source-page-url: https://example.org/patients/pricing
mrf-url: https://example.org/files/521234567_Example-Regional-Medical-Center_standardcharges.csv
contact-name: Dana Whitfield
contact-email: pricetransparency@example.org

Illustrative, in the layout of CMS’s own published examples.²

Read it in order and it answers every question a crawler has. Which hospital? The location name — matched against the CMS registry, this is what tells an automated audit whether it has found the right building. Where do humans go? The source page. Where is the actual file? The mrf-url, which should return a CSV or JSON directly, and whose filename should itself follow the naming convention. Who do I ask? The contact.

Health systems

Systems, shared files, and vendors

Most American hospitals belong to a system, and systems publish one pointer file covering many hospitals. This is expressly contemplated by the specification, and it is where the format gets interesting.²

Different charges, different files

Where two locations under one licence have different standard charges, § 180.50(a)(2) requires a separate file for each. They may share a source page, but each entry carries its own mrf-url.

Two locations, two files, one source page

location-name: Example Hospital East
source-page-url: https://example.org/price-transparency
mrf-url: https://example.org/price-transparency/521234567_Example-Hospital-East_standardcharges.csv
contact-name: Jordan Ellis
contact-email: mrf@example.org

location-name: Example Hospital West
source-page-url: https://example.org/price-transparency
mrf-url: https://example.org/price-transparency/529876543_Example-Hospital-West_standardcharges.json
contact-name: Jordan Ellis
contact-email: mrf@example.org

Same charges, one file, still two entries

Where a hospital and, say, its standalone emergency department share a set of charges, one file may cover both — but the pointer still lists each location separately, repeating the shared source page and MRF URL. The entry is per location, not per file. That matters to anyone matching a hospital by name: a location that shares a file is still named.

Where the vendor case goes wrong

When a vendor hosts the file, the pointer must give the vendor’s source page and MRF URLs — and the vendor’s domain then has to carry a pointer file of its own, since the requirement attaches to the website hosting the MRF. Both halves are frequently missed. The hospital’s own domain often has no cms-hpt.txt at all, on the assumption that the vendor handled it.

Convention

The file name is data too § 180.50(d)(5)

CMS prescribes the MRF’s filename exactly: <ein>_<hospital-name>_standardcharges.[json|csv].¹

Reading a compliant filename

521234567_Example-Regional-Medical-Center_standardcharges.csv
└───┬───┘ └──────────────┬──────────────┘ └──────┬──────┘ └┬┘
   EIN             hospital name           fixed literal format

This is a quiet but useful piece of engineering. The Employer Identification Number is a nationally unique identifier for the filing entity, so a compliant filename identifies its publisher independently of whatever the pointer file claims — which is exactly what you want when auditing a claim. CMS publishes a naming wizard for hospitals that would rather not get it wrong.³

The other half of (d)(6)

The footer link § 180.50(d)(6)(ii)

The same paragraph that requires the pointer file also requires a link in the footer of the hospital’s website — including the homepage — labelled exactly “Price Transparency”, pointing to the page that hosts the link to the file.¹

The two requirements are a matched pair, aimed at the two kinds of visitor. The pointer file is for machines; the footer link is for the person who has been told their hospital publishes prices and cannot find them. A prescribed label matters here for the same reason a prescribed path does: it makes the thing searchable across five thousand sites that share no other convention.

This audit does not test the footer link. Confirming it means rendering a homepage and reading its footer — a browser-weight operation per hospital, on sites that frequently render navigation in JavaScript, for a check whose failure mode is ambiguous. It is a real gap in coverage rather than a judgement that the requirement does not matter.

Method

How this audit uses it

The CMS hospital registry lists names and street addresses for all 5,419 hospitals in the country — and no website column.⁵ So the audit knows exactly what to look for and has no idea where to look. The pointer file is what makes that tractable.⁴

Because a pointer file names the locations it covers, it identifies itself. That single property turns domain discovery from an expensive search problem into a cheap verification problem: guess a domain, fetch one small text file, and read whether the hospital you are looking for is named inside it. A wrong guess costs one free request.

Probe

Four URLs per candidate domain /cms-hpt.txt and /.well-known/cms-hpt.txt, each with and without www.. The .well-known paths are not what the specification asks for, but enough hospitals put it there that not checking would produce false negatives.
Parse

Three formats, because that is what exists The specified repeating key: value blocks; JSON arrays, which some vendors emit instead; and blocks carrying several mrf-url lines under a single location. Keys are normalised across hyphen, underscore and run-together spellings.
Match

Location name against the CMS registry Hospital names repeat across states, so a name match alone is never enough. Ambiguous cases are adjudicated against the street address, and a language model is used only to decide which listed facility corresponds to a given CCN.
Corroborate

Against the file’s own header The MRF header carries the hospital’s address and its license_number | <ST> licensing state. Both are read with a ranged request — a few kilobytes, not the 164 MB average file — and checked against the registry row before a match is accepted.

The last step is the one that keeps the numbers honest. A pointer file is a claim made by a hospital about itself; the MRF header is a second, independent claim in a different document. When they agree, the match is sound. When they don’t, the hospital is recorded as Not assessed rather than assigned to a file that may not be its own.

Findings

What real pointer files look like

Four numbers from the 27 August 2026 crawl, and what each one is really saying.⁴

Hospitals	Outcome	What it means
37	No pointer published	The website answers, and there is no `cms-hpt.txt` at any of the four paths. A clean breach of § 180.50(d)(6)(i) — and strikingly rare, which is the good news in this dataset.
6	Pointer omits the file link	The file exists and names the hospital but carries no `mrf-url` for it. The index without the entry it is an index to.
119	Pointer blocked	The domain answered the request for a 300-byte text file with 403 or 429. Since § 180.50(d)(3)(iv) requires accessibility to automated searches, this is suggestive — but a browser may well succeed, so nothing is asserted.
379	Not named in the file	A working pointer file was found on the health system’s domain and it does not name this hospital. Either the system omitted a location it was required to list, or the name matching missed it. Both are plausible, so it counts against nobody.

The 37 is the number to sit with. Almost every hospital this audit could reach does publish a pointer file. The dominant failure in the dataset is not defiance — it is that 1,057 hospitals have no usable website on record at all, so no request was ever sent and no pointer file was ever looked for. The rule’s front door works well for the hospitals you can find the front of.

If you run a hospital website

Checking this takes one request: open https://your-domain/cms-hpt.txt in a browser. If it 404s, or if it loads but does not name every inpatient location and standalone emergency department under your licence, that is a live compliance gap. CMS publishes a TXT file generator that produces a conforming file from a form.³ If your hospital appears wrongly on the tracker, its outreach panel takes corrections and keeps them visibly separate from the crawl.

References

Sources

The requirement itself is one paragraph of regulation; almost all of the operational detail — the filename, the attribute names, the multi-location rules — lives in CMS’s technical specification rather than in the rule text.

45 CFR 180.50 — Requirements for making public hospital standard charges Electronic Code of Federal Regulations, current text. ecfr.gov/current/title-45/part-180/section-180.50 Used for: the four required items at (d)(6)(i), the footer link at (d)(6)(ii), the naming convention at (d)(5), the separate-file rule at (a)(2), and the automated-access requirement at (d)(3)(iv).
TXT File Generator — instructions and technical specifications CMS, cmsgov.github.io/hpt-tool/txt-generator. Cites the CY2024 OPPS/ASC final rule discussion at 88 FR 82111–82113. Used for: the cms-hpt.txt filename, root placement “without regard to page structure”, the five attribute spellings and their definitions, the one-entry-per-location rule, the shared-file and vendor-hosting cases, and CMS’s stated purpose of facilitating automated access.
Hospital Price Transparency tools — validator, MRF naming wizard, TXT file generator CMS, cmsgov.github.io/hpt-tool Used for: the existence of official tooling for generating a conforming pointer file and filename.
CMS HPT Tracker — national crawl, 27 August 2026 This project. Pipeline in scripts/hpt/, snapshot in data/hpt-audit/, results at tracker.html. Used for: the probe paths and parsing behaviour described in “How this audit uses it”, and every count in “What real pointer files look like”.
Hospital General Information CMS provider data catalogue. Committed to this repository at cms_data/Hospital_General_Information.csv. Used for: the registry of 5,419 hospitals, their names and addresses — and the absence of a website column that makes the pointer file necessary.