What CMS actually requires

Origin

Where the rule comes from § 180.10

Part 180 implements section 2718(e) of the Public Health Service Act, which requires every hospital in the United States, each year, to establish, update and make public a list of its standard charges for the items and services it provides.¹

That statutory sentence sat largely unenforced for years. CMS gave it teeth in the CY2020 hospital outpatient payment rule — final rule CMS-1717-F2, published 27 November 2019 at 84 FR 65524, with Part 180 beginning at 84 FR 65602 — which took effect on 1 January 2021.² The American Hospital Association challenged it and lost in the D.C. Circuit; the requirements have been live ever since.

Part 180 has been amended three times since, each time through the annual outpatient payment rule, and each amendment made the requirement more specific rather than broader:

• 86 FR 63998 (16 November 2021) — raised the penalty ceiling and scaled it to hospital size.³
• 88 FR 82184 (22 November 2023, the CY2024 rule) — imposed the mandatory CMS template, the file naming convention, the .txt pointer file and the footer link.⁴
• 90 FR 54087 (25 November 2025, the CY2026 rule) — replaced the affirmation with an attestation naming a responsible officer, and replaced the single estimated allowed amount with a distribution.⁵

Vocabulary

The words the rule turns on § 180.20

Compliance disputes are usually definitional. These are the terms that decide them.¹

Scope

Who must comply, and who is deemed compliant § 180.30

The definition is licence-based, not Medicare-based. A “hospital” is an institution licensed as a hospital under state or local law, or approved as meeting those licensing standards.¹ That sweeps in facilities that take no Medicare money at all.

“State” is defined to include the District of Columbia, Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa and the Northern Mariana Islands — which is why this audit covers 56 states and territories rather than 50.

Three classes of hospital are deemed by CMS to be in compliance under § 180.30(b), which is a subtly different thing from being exempt — the requirement does not bind them in practice, and no enforcement follows:

This tracker marks 164 hospitals Exempt on that basis and excludes them from every compliance rate, because counting a VA hospital as failing would be counting a rule that does not apply to it.

One more line in § 180.30(c) is easy to miss and does a lot of work: unless stated otherwise, all of this information must be made public electronically via the internet. A binder at the front desk is not compliance.

Obligation one

What must be in the file § 180.50(b)

Section 180.40 sets out two duties: a machine-readable file of all standard charges for all items and services, and a consumer-friendly display of shoppable services. Section 180.50 governs the first.¹

Since 1 July 2024 the required content is a fixed list of data elements, grouped into four families. The full data dictionary is on the previous page; in regulatory terms:

The attestation

Since 1 January 2026, the file itself must carry a statement, in words CMS prescribes, that the hospital has included all applicable standard charge information, that it is true, accurate and complete as of the file’s date, and that every negotiated charge expressible as a dollar amount has been expressed as one. Where a charge genuinely cannot be reduced to a dollar figure, the hospital attests that it has published everything needed for the public to derive it. The file must also name the chief executive, president or designated senior official responsible for the encoding.¹

That last part is the substantive change. From 2024 to 2025 the requirement was an affirmation attached to a file; from 2026 it is an attestation with a named human behind it.⁶

Frequency

At least once every twelve months (§ 180.50(e)). This is the requirement the tracker’s file age column tests: a file whose last_updated_on is more than 365 days old is, on its face, out of compliance with § 180.50(e). 124 of the files read in the last crawl were in that state.⁷

Form

What shape it must take § 180.50(c)

Before 1 July 2024: “a single digital file that is in a machine-readable format,” and no more. On and after that date: the file must conform to a CMS template layout, data specifications, and data dictionary.¹

That single sentence is what converted the rule from a disclosure requirement into a data standard. CMS maintains the template as a public technical guide — CSV “tall”, CSV “wide” and JSON — and publishes a validator that tests a file against it.⁸ The current data dictionary is v3.0, carrying template version 3.0.0.

Reachability

Where it must live, and how reachable it must be § 180.50(d)

This is the part of the rule most often broken, and the only part an outside observer can measure cheaply. Publishing the file is not enough; it has to be findable and fetchable without conditions.¹

Those last two exist because the first three failed in practice. A file that satisfied every accessibility rule could still be four clicks deep behind a search box no crawler would find. The CY2024 rule’s answer was to standardise the front door.⁴

Obligation two

The other half of the rule § 180.60

Everything above concerns machines. Section 180.60 concerns patients, and this tracker does not measure it — but a hospital fully compliant with § 180.50 can still be in breach here.¹

A hospital must display, in consumer-friendly form, standard charges for at least 300 shoppable services: as many of the 70 services CMS specifies as it actually provides, plus enough of its own choosing to reach 300. A hospital that does not provide 300 shoppable services publishes as many as it has. In choosing which to add, it must consider how often it actually provides and bills for them.

For each, it must publish a plain-language description, the payer-specific negotiated charge with payer and plan named, the discounted cash price (or the gross charge where no cash price exists), the de-identified minimum and maximum, the location and setting, and the primary billing code. Ancillary services get the same treatment. The display must be searchable by description, billing code and payer, and updated annually with the update date shown.

Dates

The compliance timeline

Six years of staged obligations. Each row is a date on which something new became required of every hospital in the country.¹⁸

1. 1 Jan 2021
   Part 180 takes effect A machine-readable file of all standard charges, plus a consumer-friendly display of 300 shoppable services. Format essentially unconstrained. Penalty capped at $300 per day for any hospital of any size.
2. 1 Jan 2022
   Penalties scale with size The flat $300 becomes $300 per day for hospitals of 30 beds or fewer, $10 per bed per day above that, capped at $5,500 per day.
3. 1 Jan 2024
   Good faith, an affirmation, and a front door Hospitals must make a good-faith effort at accuracy and affirm it in the file. The .txt pointer file in the website root and the “Price Transparency” footer link both become mandatory.
4. 1 Jul 2024
   The CMS template becomes mandatory Files must conform to the CMS layout, data specifications and data dictionary, and follow the <ein>_<hospital-name>_standardcharges naming convention. Most general, hospital, standard-charge and coding elements required from this date.
5. 1 Jan 2025
   The remaining elements phase in Estimated allowed amount for percentage- and algorithm-based charges; drug unit and type of measurement; modifiers.
6. 1 Jan 2026
   Attestation, NPIs, and a distribution instead of an average Template v3.0.0. The affirmation becomes an attestation with a named attester. Type 2 organisational NPIs required. The estimated allowed amount is removed and replaced by the 10th percentile, median and 90th percentile allowed amounts plus a remittance count.
7. 1 Apr 2026
   CMS begins enforcing the v3.0 elements A three-month grace period on the January changes, and the point from which a file missing the new elements is a deficiency rather than a work in progress.

Consequences

Enforcement, and what a penalty costs §§ 180.70–180.110

CMS does not fine a hospital for being non-compliant. It fines a hospital for refusing to fix non-compliance. The distinction shapes everything about how the regime behaves.¹

How CMS finds out

Under § 180.70(a)(2), CMS may act on complaints from individuals or entities, on third-party analyses of non-compliance, on its own audits and comprehensive reviews, on certifications it requires from an authorised hospital official, and on any further documentation it demands. The second of those is the formal route by which an outside dataset — this one, for instance — can become an input to enforcement.

The escalation, in order

1. Step 1
   Written warning notice § 180.70(b)(1) Names the specific violations. The hospital must acknowledge receipt in the form and by the deadline the notice specifies.
2. Step 2
   Corrective action plan § 180.80 Requested where the non-compliance is a material violation — expressly including failing to make standard charges public at all, and failing to publish them in the required form and manner. The hospital submits the actions it will take and the timeframe, subject to CMS review and approval.
3. Step 3
   Civil monetary penalty § 180.90 Available only where the hospital fails to respond to the CAP request or fails to comply with an approved plan. Notice by certified mail; the penalty and the hospital’s name are published on a CMS website.

CMS may also, where the hospital belongs to a health system, take the matter to system leadership and work through similar deficiencies across the system’s other hospitals (§ 180.70(c)).

The arithmetic

Two details that matter

• The 35% discount, and its carve-out. A hospital that waives its right to a hearing within 30 days pays 35% less — unless the penalty was imposed for failing to publish the machine-readable file or the consumer-friendly list at all. Total failure to publish gets no discount. Nor does a hospital that has already taken the discount once, on subsequent penalties for the same continuing violation.¹
• The violation is backdated. The effective date of a violation is the latest of: the first day the hospital was required to comply, the date twelve months after its last posted annual update, or a date CMS determines from its own monitoring. A hospital that let a file go stale is on the hook from the anniversary, not from the day CMS noticed.

Appeals run to an administrative law judge under 45 CFR part 150 subpart D, with one notable restriction: in deciding whether the amount is reasonable, the ALJ may consider only the hospital’s own postings, material the hospital previously submitted to CMS, and the material CMS used to monitor it (§ 180.100). Miss the 30-day window to request a hearing and the penalty stands without appeal, along with any later penalties for the same continuing violation (§ 180.110).

Method

What this audit can and cannot see

The tracker tests a specific, narrow subset of Part 180 — the parts observable from outside with an HTTP request. Here is exactly which paragraph each finding rests on.⁷

What the audit cannot see is most of the rule: whether the 300 shoppable services are published, whether the footer link exists on the homepage, whether the file validates against the template, whether the attestation is present and true, and whether any published rate matches the contract behind it. A hospital marked Compliant here has cleared the front door. It has not been audited.

References

Sources

Regulatory text is quoted and paraphrased from the current eCFR compilation of Part 180; each § chip and cite link on this page opens the exact paragraph. Federal Register documents are the authoritative record of each amendment.

1. 45 CFR Part 180 — Hospital Price Transparency Electronic Code of Federal Regulations, current text as amended through 25 November 2025. ecfr.gov/current/title-45/part-180 Used for: definitions, applicability, the required data elements, format, accessibility, update frequency, the shoppable-services requirement, and the whole of the monitoring, corrective-action, penalty and appeal provisions.
2. Medicare and Medicaid Programs: CY 2020 Hospital Outpatient PPS … Price Transparency Requirements for Hospitals To Make Standard Charges Public Final rule CMS-1717-F2, 84 FR 65524, 27 November 2019 (Part 180 at 84 FR 65602). federalregister.gov/citation/84-FR-65524 Used for: the origin of Part 180 and its 1 January 2021 effective date.
3. CY 2022 Hospital Outpatient PPS / ASC final rule 86 FR 63998, 16 November 2021. federalregister.gov/citation/86-FR-63998 Used for: the bed-scaled penalty structure effective 1 January 2022.
4. CY 2024 Hospital Outpatient PPS / ASC final rule 88 FR 82184, 22 November 2023. federalregister.gov Used for: the mandatory CMS template from 1 July 2024, the naming convention, the .txt pointer file and the footer link.
5. CY 2026 Hospital Outpatient PPS / ASC final rule 90 FR 54087, 25 November 2025. federalregister.gov Used for: the attestation and attester name, Type 2 NPIs, and the allowed-amount percentiles replacing the estimated allowed amount, all effective 1 January 2026.
6. Guide for Updating from Data Dictionary v2.2 to v3.0 CMS, documentation/UPDATE_GUIDE.md Used for: the affirmation-to-attestation change and the other v3.0 differences.
7. CMS HPT Tracker — national crawl, 27 August 2026 This project. Snapshot in data/hpt-audit/; results at tracker.html. Used for: the exempt and stale-file counts, the territory count, and the finding-to-paragraph mapping in the last section.
8. Hospital Price Transparency — technical implementation guide CMS, github.com/CMSgov/hospital-price-transparency, with tools at cmsgov.github.io/hpt-tool Used for: the implementation timeline table, the current template version, and the 1 April 2026 enforcement date for the v3.0 elements.