The No Surprises Act is best known for protecting patients from unexpected out-of-network bills. Less well known is a disclosure rule that reaches practice websites: certain providers and facilities must explain those protections on their homepage, on a sign and in a notice to insured patients.
Many independent practices are not covered by that disclosure rule at all, while others, including physicians who work in hospitals or surgery centers, often are. This guide walks through who must post the notice, what it must say, where it goes on your website and how the free CMS model notice helps. It does not cover the good faith estimate rule for uninsured and self-pay patients, which is a separate requirement; see our guide to good faith estimates for self-pay patients. For what an out-of-network practice can say about superbills, see out-of-network practice advertising.
This is general information, not legal advice. Sources cited were checked on October 29, 2026: 45 CFR 149.430 (provider and facility disclosure requirements regarding patient protections against balance billing), 45 CFR 149.30 (definitions, including health care facility), 45 CFR 149.410 and 149.420 (the balance billing prohibitions), the CMS Model Disclosure Notice Regarding Patient Protections Against Surprise Billing (OMB 0938-1401, expiring December 31, 2028), the CMS No Surprises Act overview of rules and fact sheets, and CMS’s Medical Bill Rights page. State balance billing laws differ, and the notice must describe the ones that apply. Have a health care attorney confirm whether the rule applies to you.
What the rule requires
45 CFR 149.430(a) says each health care provider and health care facility, including hospital emergency departments and independent freestanding emergency departments, must do three things with information about patient protections against balance billing, subject to exceptions:
- Make it publicly available.
- Post it on a public website of the provider or facility, if it has one. Under 149.430(c)(1), the information, or a link to it, must appear on a searchable homepage. A provider or facility without its own website does not need to post it online.
- Give it to insured patients. Under 149.430(c)(3), people covered by a group health plan or group or individual health insurance get a one-page notice, double-sided at most, in print no smaller than 12 point, delivered in person or by mail or email as the patient chooses. Under 149.430(d), it is due no later than when you request payment from the patient, or, if you do not request payment, when you submit a claim to the plan.
149.430(c)(2) adds a sign posted prominently at your location, unless you have no publicly accessible location.
What the notice must say
Under 149.430(b), the disclosure must use clear and understandable language and include:
- A statement explaining the federal requirements and prohibitions that apply to the provider or facility under 45 CFR 149.410 and 149.420, the balance billing protections for emergency services and for certain non-emergency services at in-network facilities.
- If applicable, a statement explaining any state law limits on what an out-of-network provider or facility may charge a patient after the plan pays.
- Contact information for the state and federal agencies a patient can contact if they believe the provider or facility has violated the requirements described in the notice.
You may add other information as long as it does not conflict with these points.
Who is exempt
The exceptions in 149.430(e) matter most to independent practices. A provider is not required to make the disclosures if it does not furnish items or services at a health care facility or in connection with visits at health care facilities, and does not have to give them to individuals whose services are not furnished at or in connection with a visit at a health care facility.
For non-emergency services, 45 CFR 149.30 defines a health care facility as a hospital, a hospital outpatient department, a critical access hospital, or an ambulatory surgical center described in section 1833(i)(1)(A) of the Social Security Act. So a typical stand-alone office, such as many dental, chiropractic, med spa or primary care offices, may fall outside the provider disclosure rule if none of its services are furnished at or in connection with a visit to one of those facilities. That is a question to settle with counsel, because it turns on where and how each service is delivered.
Practices that are more likely to be covered include physicians and other clinicians who see patients in a hospital, hospital outpatient department or surgery center, such as surgeons, anesthesiologists, radiologists, pathologists and hospitalists, and any practice that owns or runs one of those facilities. 45 CFR 149.420(b) says the notice and consent exception never applies to items and services related to emergency medicine, anesthesiology, pathology, radiology and neonatology, which is one reason those specialties pay close attention to these rules.
Under 149.430(f), when a provider furnishes covered services at a facility and has a written agreement with the facility to post the sign and give the one-page notice, the provider meets those two requirements through the facility. If the facility fails to do so, the facility, not the provider, violates them. That agreement does not cover the provider’s own website, so a covered provider with a website still needs the homepage link.
Use the CMS model notice
CMS publishes a Model Disclosure Notice Regarding Patient Protections Against Surprise Billing. Its instructions say providers and facilities can, but are not required to, use it, and that HHS considers use of the model notice, in accordance with the instructions, to be good faith compliance with the disclosure requirements of 45 CFR 149.430 if all other applicable requirements are met. The instructions also say that if a state develops model or required language consistent with the federal law, HHS will consider good faith use of the state language compliant with the requirement to describe state law protections.
In practice, most covered practices start with the CMS model notice, add their state’s information where needed, and have counsel review the result.
Where it goes on your website
The rule says the information or a link to it must appear on a searchable homepage. A few practical points for your site:
- Put a clearly labeled link on the homepage, such as Your rights and protections against surprise medical bills, not only in a deep footer menu that search tools and patients cannot easily find.
- Link to a normal web page that contains the full notice, not only a scanned image. Text is easier to read, search and translate, and works with screen readers. Our guide to website accessibility for medical practices covers why that matters.
- If you also offer a downloadable version for printing, keep it to one page, double-sided at most, in 12 point print or larger.
- Keep the state section current. Check it when your state changes its balance billing law and at least once a year.
- If you have several locations or websites, make sure each covered one has the link.
Our medical website design page explains how we build required notices into a practice site so they stay visible without crowding the homepage.
Keep your marketing consistent with the notice
The balance billing protections depend on network status, so marketing that talks about insurance needs to be accurate. List the plans you are in network with precisely, update the list when contracts change, and avoid broad statements such as we take all insurance when you mean you will submit claims to out-of-network plans. A patient who reads your insurance page and then receives a bill should find that the page, the notice and the bill tell the same story.
Does every medical practice need the No Surprises Act notice on its website?
No. Under 45 CFR 149.430(e), a provider that does not furnish items or services at a health care facility, or in connection with visits at one, is not required to make the disclosures. For non-emergency services, 45 CFR 149.30 defines health care facilities as hospitals, hospital outpatient departments, critical access hospitals and certain ambulatory surgical centers. Have counsel confirm how this applies to you.
Where on the website must the notice appear?
149.430(c)(1) says the information, or a link to it, must appear on a searchable homepage of the provider’s or facility’s website. A provider or facility without its own website does not need to post it online.
Is there an official template?
Yes. CMS publishes a Model Disclosure Notice Regarding Patient Protections Against Surprise Billing. Its instructions say HHS considers use of the model notice, in accordance with the instructions, to be good faith compliance if all other applicable requirements are met.
Is this the same as the good faith estimate notice?
No. The balance billing disclosure in 149.430 is about protections for people with health coverage. The good faith estimate rules are for uninsured and self-pay patients and have their own notice requirements.
We work at a hospital that posts the notice. Are we covered?
Under 149.430(f), a written agreement with the facility can satisfy the sign and one-page notice requirements for services you furnish there. It does not cover your own website, so if you have one and the rule applies to you, add the homepage link.
Sources
- 45 CFR 149.430: Provider and facility disclosure requirements regarding patient protections against balance billing
- 45 CFR 149.30: Definitions (health care facility)
- 45 CFR 149.410: Balance billing in cases of emergency services
- 45 CFR 149.420: Balance billing in cases of non-emergency services performed by nonparticipating providers at certain participating facilities
- CMS: Model Disclosure Notice Regarding Patient Protections Against Surprise Billing (PDF, OMB 0938-1401)
- CMS: No Surprises Act overview of rules and fact sheets
- CMS: Medical Bill Rights