Hospital Price Transparency Compliance: What It Actually Takes in 2026

Hospital price transparency has been a federal requirement since January 2021, and most hospitals still get it wrong. Not because the concept is hard. Publish your prices, in a machine-readable format, at a predictable URL. That part is simple to describe. What's hard is that the technical spec has changed three times since 2021, the CY2026 update added a personal attestation from a named executive, and CMS has started actually fining people for getting it wrong.

This is a practical walkthrough of what the rule requires today, why so many files still fail, and how to find out where your own file stands before CMS does.

The rule in plain terms

Under 45 CFR 180.50, every hospital operating in the United States has to publish two things: a consumer-facing display of common shoppable services, and a comprehensive machine-readable file listing every item and service the hospital provides, along with the negotiated rate for every payer and plan.

That machine-readable file is the part that trips people up. It has to include, for every line item: a plain-language description, a billing code and code type, the care setting, the gross charge, the discounted cash price, and the payer-specific negotiated rate for every payer and plan the hospital contracts with. Where a negotiated rate can't be expressed as a flat dollar amount, the file has to include the underlying formula, algorithm, or fee schedule instead, plus a written methodology explaining how to derive it.

The file has to be published in one of a few CMS-approved formats: CSV (in a "tall" or "wide" layout) or JSON. It has to sit at a predictable location, discoverable through a cms-hpt.txt file at the hospital's domain root. And starting with the CY2026 schema update, it has to carry a real name behind it.

What changed for 2026

Three things, and they all raise the stakes.

A signed attestation. The file must now encode a statement, affirmed by the hospital's CEO, president, or another senior official the hospital designates, that the data is true, accurate, and complete as of the file's publish date. Before this year, hospitals published a generic compliance line with nobody's name attached. Now a specific person is on record. A missing or malformed attestation isn't a formatting slip anymore. It means nobody is actually attesting to anything, which is one of the first things a reviewer checks. See our full attestation guide for the detail.

Percentile allowed amounts. The old "estimated allowed amount" placeholder is gone. Hospitals now have to report the median, 10th percentile, and 90th percentile allowed amounts, calculated from actual remittance data over a 12 to 15 month lookback, along with the count of claims behind each number. A percentile field with no count behind it, or a 10th percentile that's somehow higher than the median, is a structural error.

Organizational Type 2 NPIs. For certain taxonomy codes, the file now has to carry the hospital's Type 2 National Provider Identifier, active and verifiable in the NPPES registry. An NPI that fails a basic checksum, or one that doesn't resolve to an active organizational record, both count as a failure, for different reasons. More detail on all three changes is in our schema v3.0 guide.

Why so many files still fail

We built an automated scanner that checks real hospital files against the current CMS rule and ran it against every file we could reach. Not a survey. Not a sample. An actual line-by-line parse of the machine-readable files hospitals have published.

Of the files we successfully fetched and parsed, none came back completely clean. The single most common failure, by a wide margin, is the new attestation requirement: a missing statement, a blank attester name, or a confirmation flag that was never actually set to true. Right behind that: line items missing a required field, most often a billing code type or a care setting. Third most common: files that haven't been updated in over a year, which is itself a violation since CMS requires at least an annual refresh.

None of these are exotic edge cases. They're the basics, and hospitals are still missing them at scale, months after the rule took effect.

There's also a quieter failure mode worth knowing about if you're building your own tooling to check this: in the CSV formats, the attestation text isn't stored under a column literally named "attestation." The metadata header row's eighth column uses the attestation sentence itself as the column name, and the value underneath is just a true or false flag. Any script that searches for a column called "attestation" will silently miss it. We only found this by parsing real files at scale, not by reading the spec.

What CMS enforcement actually looks like

This isn't theoretical risk. Hospitals with 30 beds or fewer face a flat $300 per day for noncompliance. Larger hospitals face $10 per bed per day, capped at $5,500 per day, which works out to close to $2 million a year for the largest facilities if the noncompliance goes unresolved.

CMS issued roughly twice as many civil monetary penalties in 2025 as the year before, with individual fines ranging from the low tens of thousands into the high hundreds of thousands of dollars. Of the thousands of hospitals CMS has reviewed, a majority had already received a warning or a corrective action request before any fine was issued. The CY2026 rule also introduced a meaningful reduction in the penalty amount for hospitals that waive their right to a hearing and settle quickly, a fairly clear signal that CMS expects, and wants, more enforcement actions to move fast. More numbers in our penalty tracker guide.

How to check your own file

You don't need to guess whether your file is compliant, and you don't need to wait for a CMS review to find out. The fastest way to know is to run your actual published file through a rule-by-rule check against the current schema: required fields, code types, percentile math, NPI validity, attestation completeness, freshness, and discoverability at your cms-hpt.txt endpoint.

A few things worth checking yourself right now, even without tooling:

• Open your file and confirm the attestation statement is present, the attester's name is filled in (not blank, not a placeholder), and the confirmation flag is actually true.
• Check the file's last-updated date. If it's been more than 12 months, that's a standalone violation regardless of what else is correct.
• Spot-check a handful of line items for a billing code, a code type, a care setting, and a gross charge. Missing any of these on even one row is technically a failure, though reviewers generally look at the pattern, not a single row.
• Confirm your cms-hpt.txt file is live at your domain root and actually points at the current file, not a stale URL from a prior year.

If you want the full automated version of this check, including percentile-math validation and NPI verification against the live NPPES registry, MRF Preflight runs it for free in under a minute against any published URL, with plain-English explanations for every finding and a citation back to the exact regulatory text behind it. No account required to check a file, and no cost to see where you stand.

This guide reflects the CMS hospital price transparency rule (45 CFR 180.50) as updated by the CY2026 OPPS final rule. It's a compliance reference, not legal advice. Rules and enforcement guidance can change; if a fine or formal review is already in motion, talk to counsel, not a blog post.