No Surprises Act California: Compliance Guide for Practices

California practices must comply with both AB 72, effective July 1, 2017, and the federal No Surprises Act, effective for plan years beginning on or after January 1, 2022. That dual requirement controls balance billing, patient notices, consent records, and payment disputes, so a missed workflow step can increase denials, write-offs, and A/R days even when the patient is legally protected.

The counterintuitive part is that surprise-billing compliance doesn't end when the patient's liability is capped. It often moves the financial dispute upstream, from a patient balance to a payer negotiation, an independent dispute-resolution case, or a delayed payment review. In practice, the question isn't only whether your office avoided an unlawful balance bill. It's whether your registration, eligibility, claims, and follow-up systems can prove the right rule applied and recover the amount your practice is owed.

Why California Practices Face Double the Compliance Burden

California practices carry two compliance frameworks at once. AB 72 took effect on July 1, 2017, covering California health insurance policies or plans regulated by the Department of Insurance or the Department of Managed Health Care when issued, amended, or renewed after that date. The federal No Surprises Act applies for plan years beginning on or after January 1, 2022. California's Department of Insurance explains the state surprise-billing protections, while federal requirements add their own patient-protection and payment-dispute procedures.

The administrative burden appears in the handoffs. Staff must identify the payer and plan structure, determine which protections apply, document the encounter correctly, and route the claim through the proper payment process. A classification error can produce an invalid patient statement, a misdirected claim, or an appeal that must be rebuilt. The result is more rework, avoidable denials, and slower A/R collection.

The carve-out owners miss

AB 72 does not apply to Medi-Cal plans, Medicare plans, or self-insured plans, according to the California Department of Insurance. Self-insured employer coverage requires particular care because it is not treated like a California-regulated plan. Applying one standard workflow to every commercial payer can create incorrect assumptions about notice, consent, patient billing, and payment recovery.

The federal law covers emergency services, certain non-emergency out-of-network services delivered at in-network facilities, and air ambulance services. In protected situations, patients generally owe only their in-network cost sharing. The provider and plan handle the payment dispute separately.

Revenue-cycle rule: Patient protection and provider reimbursement require separate decisions. Staff must determine the patient's lawful responsibility and the payer's payment pathway.

Set up registration and billing controls before the claim reaches follow-up. Capture payer type, plan structure, facility and provider network status, service setting, and consent status in the account record. Practices seeking operational help can review medical billing services in California with these jurisdiction checks built into the workflow. Voice documentation also needs privacy controls. Guidance on secure dictation for clinics can help teams reduce manual entry without weakening protection for sensitive information.

State vs Federal Rules and What Applies to Your Practice

The first decision isn't “Can we bill the patient?” It's “Which legal framework governs this encounter?” Start with the insurance product, then confirm the service setting and network relationship. A fully insured plan regulated in California may fall under AB 72, while a self-insured employer plan generally requires federal analysis instead. Medicare and Medi-Cal remain outside AB 72's scope.

The federal framework is broader in the situations it addresses. California guidance states that the No Surprises Act prohibits surprise balance billing for emergency, nonemergency, and air-ambulance services, with the federal process resolving provider-plan payment disputes after patient cost sharing is handled. California's federal guidance%20Guidance%20(3_21_22).pdf) is the practical reference point for understanding the interaction.

Jurisdiction comparison

A useful internal decision tree asks four questions: Is the plan fully insured or self-insured? Is it regulated by a California agency? Is the service emergency, non-emergency, or air ambulance? Was the provider at an in-network facility and was valid consent obtained? That sequence prevents a common mistake, applying a state rule only because the practice and patient are located in California.

Providers should also separate patient billing compliance from payment recovery. The latter can require negotiation, documentation, and IDR preparation. For a practical discussion of how those disputes affect reimbursement, review this resource on how providers can protect revenue from underpayments. Practices evaluating physician-office applicability can also consult whether the No Surprises Act applies to physician offices.

Notice and Consent Requirements That Protect Your Revenue

Notice and consent errors are front-end revenue problems. When an out-of-network provider wants to use the waiver pathway in a situation where consent is permitted, the practice must deliver the required documents on time and retain evidence that the process occurred. A signed form obtained after the deadline may look complete in the chart, but it may not support the intended billing position.

For scheduled services, notice and consent documents must be delivered at least 72 hours before the appointment. If the appointment is scheduled within that period, the documents must be delivered the same day and at least 3 hours before care begins. Providers and facilities must retain a copy for at least 7 years, as described in CMS training materials on balance billing.

A workable front-end sequence

1. Identify the service and plan. Confirm payer structure, network status, facility relationship, and whether the service is protected. Don't let a generic “commercial insurance” field drive the decision.
2. Prepare the notice. Use the required disclosure and consent documents, including the expected out-of-network implications and the patient's right to decline consent where applicable.
3. Track the clock. Build the deadline into scheduling. A document-management system should show when the notice was sent, when the patient received it, and when the appointment begins.
4. Store the evidence. Retain the signed consent, delivery record, version of the notice, and encounter linkage for the required retention period.

The operational danger is treating consent as a scanned attachment rather than a timed control. Registration staff need a hard stop or escalation route when the appointment falls inside the 72-hour window, especially for urgent referrals and add-on services. A workflow that shows only “consent complete” hides the fact that the document may have been completed too late.

Practices can also use Recepta.ai billing insights to think through how billing data and third-party processes affect review quality. The objective is simple: prevent an invalid waiver from becoming a patient statement, an avoidable write-off, or a payer dispute. Guidance on balance billing can help physician owners align the front desk, clinical scheduling, and RCM teams around the same rule.

The Independent Dispute Resolution Process Explained

IDR is the provider's route for contesting payment, not a mechanism for billing a protected patient. The federal process begins with a 30-business-day open negotiation period. If the parties don't reach agreement, either side may invoke federal IDR, submit its offer and supporting documentation to a certified IDR entity, and receive a binding payment determination. HHS analysis of the No Surprises Act describes this structure.

California guidance adds a tightly controlled sequence after negotiation. The health plan and provider have a 30-day negotiation period. If it fails, either side may initiate IDR within 4 days after that window closes, and the parties then have 3 days to jointly select an IDR entity. Missing those windows can eliminate the practical value of a meritorious dispute.

The economics behind the fight

The qualifying payment amount, or QPA, is the insurer's median contracted in-network rate for the same or similar service in the relevant market. It serves as a core benchmark in payment disputes, but it isn't a substitute for a complete case file. Your submission should connect the disputed service to the claim, explain the provider and facility circumstances, and identify the payment amount being challenged.

Demand has grown sharply. A Georgetown analysis reported 1.2 million new disputes in the first half of 2025, more than double the roughly 590,000 disputes in the first half of 2024. The same congressional materials noted a $115 per-party administrative fee for most of 2024. A later reported federal administrative fee was $15 in 2026, signaling an effort to reduce entry costs while preserving access to arbitration. The Congressional Research Service discussion provides the relevant dispute-volume and fee context.

That change doesn't make every claim worth pursuing. Compare the disputed underpayment with staff time, documentation effort, entity fees, cash-flow delay, and the likelihood that the file meets the applicable requirements. High-dollar, recurring, well-documented categories generally deserve a formal escalation policy. A practice that sends every account to IDR without triage can create administrative congestion instead of recovering revenue. Use a defined IDR process for the No Surprises Act with ownership, deadlines, and an approval threshold.

Good Faith Estimates and Uninsured Patient Protections

The No Surprises Act also creates a dispute path for uninsured or self-pay consumers. CMS states that the patient-provider dispute resolution process is available when the bill is at least $400 more than the good-faith estimate. CMS guidance for providers resolving payment disputes with patients identifies that threshold as a trigger for review.

For practice owners, the exposure begins before the claim exists. A good faith estimate needs to reflect the services your practice expects to provide and should be tied to the scheduled appointment, provider, location, and known service details. If another provider or facility will furnish related care, your intake process should make clear which charges your office controls and which it doesn't.

Build the estimate into scheduling

• Capture the request: Record whether the person is uninsured or self-pay and preserve the date the estimate was requested or delivered.
• Use a controlled fee source: Pull expected charges from an approved schedule rather than allowing staff to assemble prices from memory.
• Document assumptions: Note planned services, known exclusions, and circumstances that could change the final charge.
• Route changes quickly: If the clinical plan changes, send the account for estimate review before the statement cycle.
• Hold collections when appropriate: A patient dispute should trigger account review before ordinary collection activity continues.

The estimate isn't merely a customer-service document. It becomes evidence when the patient challenges a bill, so your practice should retain the estimate, delivery record, appointment information, charge detail, and any documented change in scope. A weak audit trail can force staff to concede charges that may otherwise have been defensible.

This process also improves financial conversations. Patients who understand expected charges earlier can discuss payment arrangements or financial assistance before care, while the practice reduces avoidable statement disputes. The owner's objective is not to guarantee that every final charge matches an estimate. It's to show that the estimate was prepared in good faith, delivered through a controlled process, and updated when the known scope changed.

Common Compliance Mistakes That Cost Practices Money

Surprise-billing compliance becomes expensive when it remains separate from daily revenue-cycle work. Errors begin in scheduling, eligibility, registration, claims editing, or follow-up, then surface as denied claims, invalid patient balances, delayed payments, or accounts staff cannot defend.

Five breakdowns to eliminate

1. Misidentifying payer jurisdiction. A California member ID does not establish which rules apply. Medicare, Medi-Cal, and self-insured plans can require different patient-billing and dispute workflows. Capture funding status and plan type as structured eligibility data, not free-text notes.

2. Treating consent as a signature instead of a deadline. A signed form obtained outside the required window may not support the intended waiver. Configure scheduling software to calculate notice deadlines and prevent the account from proceeding without an escalation decision.

3. Retaining only the signature. A defensible file also needs delivery evidence, document version, appointment timing, and service linkage. Records must be kept for at least 7 years, so test retrieval periodically and use CMS's California consumer guidance to confirm the state framework.

4. Treating the QPA as the complete payment case. The QPA provides a benchmark, not the entire rationale for payment. A dispute file should include a clear explanation and supporting documentation. Without that context, the reviewer has little basis to distinguish the claim from the median contracted rate.

5. Missing the IDR trigger window. After the negotiation period closes, California guidance gives either side 4 days to initiate IDR and 3 days to jointly select an entity. Assign one owner, generate deadline alerts, and require an escalation decision before either window expires.

A checklist disconnected from claim status, statement status, and payment follow-up records activity without protecting revenue.

These failures also expose weak outsourced RCM oversight. Request exception reports, payer-jurisdiction logic, consent-timing audits, QPA support, and aging for open negotiations. A vendor reporting only total collections can miss leakage before an account reaches collections. The practical test is whether the partner can show which protected accounts were identified, documented, billed, disputed, and escalated, with ownership at each handoff.

Building a Compliance-First Revenue Cycle Strategy

Compliance works best when it becomes a series of system controls rather than a staff memory exercise. The workflow should begin at scheduling, continue through eligibility and registration, and remain visible during claim submission, remittance posting, patient statements, and payment disputes.

Put the decision into the record

Configure structured fields for:

• Plan structure: Fully insured, self-insured, Medicare, Medi-Cal, or unresolved.
• Network relationship: Facility, rendering provider, and ancillary provider status.
• Service setting: Emergency, scheduled non-emergency, or air ambulance context where relevant.
• Notice status: Delivery date, document version, consent date, and appointment time.
• Dispute status: Initial payment, negotiation start, negotiation end, IDR eligibility, and submission owner.

Claims staff should see the same flags that front-desk employees create. If the billing team can't tell why an account received protected treatment, it will either bill conservatively and write off recoverable revenue or bill aggressively and create compliance exposure.

Measure compliance beside traditional RCM metrics

Track denial rate and days in A/R alongside operational measures such as missing consent records, late notices, unresolved payer jurisdiction, unworked payment variances, and approaching IDR deadlines. Review a sample of protected accounts from scheduling through final payment, not just the claim form. That reveals whether the practice's controls work across departments.

CMS notes that the federal dispute infrastructure continues to change. Its rules and fact sheets describe a May 2026 final rule intended to streamline communication and clarify timelines, while also noting that federal court decisions have vacated multiple IDR-related provisions at different times, including batching rules, administrative fee requirements, initial-payment timing rules, QPA methodology, and certain air ambulance provisions. CMS's No Surprises Act rules and fact sheets should remain part of your policy-monitoring process.

A practice shouldn't freeze its workflow every time a rule changes. Maintain a versioned policy, name the person responsible for regulatory updates, and test payer-specific implementation against actual remittances. For broader RCM design, these revenue cycle management best practices provide a useful operational framework.

The right strategy reduces friction rather than adding paperwork. When the EHR flags the encounter, the notice deadline, patient-billing restriction, and payment-dispute route at the right moment, staff spend less time reconstructing history and owners gain clearer visibility into preventable leakage.

Happy Billing provides full-cycle RCM, denial management, A/R recovery, and compliance-focused billing workflows for high-stakes medical practices navigating California's state and federal surprise-billing requirements. Visit Happy Billing to evaluate your current workflow, identify revenue leakage, and determine whether a specialized RCM partner can improve claim follow-up without forcing an EHR migration.

How does AB 72 differ from the federal No Surprises Act?

AB 72 applies to qualifying California-regulated insurance plans issued, amended, or renewed on or after July 1, 2017, but excludes Medi-Cal, Medicare, and self-insured plans. The federal No Surprises Act applies for plan years beginning on or after January 1, 2022 and covers federal emergency, non-emergency, and air-ambulance protections.

What happens if consent is obtained too late?

A late consent form may not support the intended waiver pathway. For scheduled services, documents generally must be delivered at least 72 hours before the appointment. If scheduling occurs within that period, delivery must occur the same day and at least 3 hours before care begins.

When should a practice use IDR?

Use IDR when a protected out-of-network payment dispute remains unresolved after open negotiation and the expected recovery justifies the administrative work. Track the applicable deadlines closely, because California guidance allows initiation within 4 days after the negotiation window closes and joint entity selection within 3 days.

What should owners audit first?

Start with payer jurisdiction, notice and consent timing, retained documentation, patient statement suppression, QPA support, and dispute deadlines. Those controls show whether the practice is preventing unlawful billing while still pursuing appropriate reimbursement.