CMS price-transparency regulations explained

The hospital price-transparency rule is short. Its core requirement fits in two sentences: every Medicare-participating hospital must publish a machine-readable file of every standard charge for every item it provides, and a separate consumer-friendly display of at least 300 shoppable services. Those two artifacts power every aggregated price-transparency tool that exists, this site included.

This piece walks through what the rule actually requires, where the legal text lives, what the penalty schedule looks like in 2026, and where compliance still falls short — using the live numbers from our Colorado atlas as evidence.

A short legal history

The rule traces back to section 2718(e) of the Affordable Care Act, which directed hospitals to publish a list of standard charges. CMS's 2019 final rule 84 FR 65524 operationalised that with detailed format requirements and an effective date of January 1, 2021.

The American Hospital Association sued, arguing the rule exceeded CMS's statutory authority. The DC Circuit upheld the rule in 2020. CMS implemented it on schedule.

In November 2021, CMS issued a follow-up rule sharply raising the penalty schedule — from a flat $300/day across all hospitals to a sliding scale based on bed count. The change took effect in 2022. CMS has since posted periodic enforcement bulletins on its hospital price-transparency landing page, naming hospitals that received civil monetary penalties (CMPs).

What 45 CFR §180.50 actually requires

The current version of the rule is codified at 45 CFR §180.50. It requires every Medicare-participating hospital operating in the United States to make public:

• · Five standard-charge disclosures for every item or service the hospital provides — gross charge, payer-specific negotiated charge for every payer-plan combination, de-identified minimum negotiated charge, de-identified maximum negotiated charge, and discounted cash price. (What's in an MRF walks through these in detail.)
• · A consumer-friendly display of at least 300 shoppable services — 70 specifically required by CMS, plus enough hospital-selected ones to reach 300 (or all available services if the hospital provides fewer).
• · Free public access to both files — no login, no fee — at a stable URL on the hospital's own website, refreshed at least annually.

The two-file architecture is intentional: the MRF is the underlying truth (a machine-readable export of the chargemaster and every contracted rate); the shoppable display is a more digestible, narrowly-scoped subset for consumer viewing.

The 70 CMS-mandated shoppable services

CMS designated 70 services as shoppable — ones a patient can plan in advance, where price comparison is meaningful. The list spans imaging (MRI, CT, ultrasound), labs, common surgical procedures (colonoscopy, joint replacement, gall-bladder), preventive screening (mammography, colonoscopy), and a handful of inpatient stays.

Hospitals must include all 70, plus enough additional hospital-selected services to reach 300. Many large hospitals exceed that floor. Some states layer their own lists on top — Colorado, for example, has a separate state-level price-transparency rule that adds requirements aimed at high-volume outpatient procedures. Colorado's enforcement is independent of CMS.

We surface the federal 70 in the CMS shoppable-services collection, with hospital-by-hospital prices for every code we currently parse.

The format requirements

CMS is specific about format:

• · The file must be machine-readable — CSV, JSON, or XML. PDFs and image formats are explicitly disallowed under 45 CFR §180.50(b)(1).
• · The file must be on the hospital's own domain, not a third-party hosting service.
• · It must be at a stable URL, refreshed at least annually.
• · The hospital's homepage must contain a prominent link to the file using specific anchor language CMS recommends ("price transparency," "standard charges").

In practice, machine-readability is uneven. Of the 80 Colorado hospitals we track in the compliance dataset, the format distribution at the most recent refresh was: 47 in `csv_tall`, 15 in JSON, 9 in `csv_wide`, 4 in HTML (a direct rule violation), 4 publishing nothing, and 1 in a format we couldn't classify on that crawl. For practical guidance on how to use these prices when calling a hospital, see the FAQ.

Penalties

The current penalty schedule:

• · For hospitals with 30 or fewer beds, $300 per day of non-compliance.
• · For hospitals with more than 30 beds, $10 per bed per day of non-compliance, capped at $5,500/day per hospital.
• · Penalties accrue after a CMS warning letter and a 90-day cure window. Non-compliance past the cure window triggers a civil monetary penalty.

Annualised, a maximum-penalty hospital can face over $2 million in fines per year. CMS has issued several public CMPs since 2022 and posts each enforcement action on its hospital price-transparency landing page.

The 90-day cure window matters: most hospitals that get a warning letter come into compliance before the fine clock starts. The published CMP list is the residual — hospitals that ignored the letter or failed to remediate.

The CMS validator

CMS publishes a public validator tool that scores any URL against the schema. It runs structural checks (the file parses, required fields are present), conformance checks (codes match expected coding systems, payer fields are populated), and content checks (rates are plausible, no obviously corrupted values).

Three validator fields drive the per-hospital compliance scorecard:

• · `cms_validator_valid` — boolean. Did the file parse cleanly under the schema?
• · `cms_error_count` — number of validator errors (the strict, breaking ones).
• · `structural_error_count` — number of structural problems (missing required fields, wrong column names, broken nesting).

At the most recent refresh, 47 of the 80 Colorado hospitals we track produced a `cms_validator_valid` of `true` — roughly 59%. The remainder had at least one validator-flagged issue, most commonly a missing or malformed field. The atlas-wide structural-error count across all hospitals was 361, an average of about 4.5 per hospital that publishes anything at all.

Common compliance failures

From the pipeline's perspective, the recurring issues are:

• · The homepage MRF link is broken. The hospital republished the MRF on a new path and didn't update the homepage anchor. We catch this when the link 404s.
• · Wrong format. A handful of hospitals publish HTML or PDF — a direct rule violation.
• · Missing payer-specific negotiated rates. Some MRFs post only gross charge and cash price, omitting the contracted-rate disclosure that is the most useful piece for consumers.
• · Missing rate methodology. A negotiated rate without a methodology field (case rate, per diem, percent of charges, fee schedule) is much harder to interpret meaningfully.
• · Stale data. A file last modified more than 12 months ago violates the annual-refresh rule.
• · Corrupt files. ZIP archives that fail to extract, JSON files with non-UTF-8 bytes, parquet conversions that hit ZSTD decompression failures. Six Colorado hospitals' files fail to fully parse in our latest pipeline run; the failures are tracked in `precompute-errors.json` and reported back via the workspace scorecard.

What's next on the regulatory horizon

Two related rules and a growing set of state-level efforts shape what comes after the current price-transparency requirements:

• · [Transparency in Coverage](https://www.cms.gov/healthplan-price-transparency) — the payer-side analog. Insurers must publish their negotiated rates and out-of-network allowed amounts in machine-readable form. This is a separate rule with its own format spec, and a separate dataset orders of magnitude larger than the hospital MRFs.
• · Enhanced payer-specific reporting. CMS has signaled it may require more granular plan-level disclosure in MRFs — payer plus specific plan name plus product line — to close the "Anthem, generic" pattern some hospitals have used to satisfy disclosure without saying much.
• · State-level price-transparency laws. Colorado, California, Texas, Maine, Massachusetts, and others have layered state requirements on top of the federal rule. These vary widely and are enforced independently of CMS.

The aggregate effect: the underlying disclosure surface is expanding, but the standardisation gap — between hospitals, across states, and between hospitals and payers — hasn't closed. Aggregation reads from all of it and folds it into one schema; the methodology page documents how.