The Feds Just Rewrote Health Plan Price Transparency. Here's What Changes for Brokers, TPAs and Benefits Tech.

WASHINGTON — The Departments of Labor, Health and Human Services and the Treasury on Oct. 6 published a final rule that rebuilds how U.S. health plans disclose what they pay doctors and hospitals. This is particularly critical in understanding how self-funded companies operate; a large blind spot in 5500 filings that will now increasingly be closed.

Published October 7, 2026 · Hillwinds industry analysis

The 338-page rule overhauls the Transparency in Coverage requirements. Under them, nearly every employer health plan and insurer has had to post its negotiated prices online since 2022. The industry responded by giving anyone access to giant 50–100GB files per company with minimal documentation. PBMs were notably excluded from the original implementation. The rule brings PBM data into the fold, reorganizes those massive public files around provider networks and cuts updates from monthly to quarterly. It also requires a senior executive to attest that the data is accurate and makes cost estimates available to members by phone.

The implication is that pricing information is about to become much more available than it was before. For the benefits industry, most of the work falls on third-party administrators. Most self-funded employers rely on a TPA to produce these files, yet the rule keeps the employer legally responsible if the TPA gets them wrong. The first major deadline is March 6, 2027.

How we got here

Transparency in Coverage is the payer-side twin of the hospital price transparency rules hospitals have followed since 2021. It started with a 2019 executive order directing federal agencies to bring hidden health care prices into the open.

The original rules, finalized in November 2020, required two things:

• For members: an online tool showing personalized out-of-pocket cost estimates.
• For the public: three machine-readable files. One covers in-network negotiated rates, one covers out-of-network allowed amounts, and one covers prescription drug prices.

A month later, Congress passed the No Surprises Act. It separately required plans to offer price comparisons online and by phone. The in-network and out-of-network files went live in July 2022. The prescription drug file was put on hold and still hasn't been implemented.

The files worked, up to a point. In the agencies' words, they released “an enormous amount of previously hidden pricing data.” They also became nearly unusable at scale.

• Size: In-network files across the industry run to roughly 1 petabyte every month.
• Clutter: Many rates are for combinations that will never occur, such as a podiatrist with a negotiated rate for heart surgery. One data company the rule cites, Serif Health, has estimated that more than 80% of in-network rates fall in this “zombie” category.
• Accuracy: A January 2026 study by Indiana's Department of Insurance found duplicate entries, conflicting rates for the same service and invalid billing codes.
• Findability: Some plans hid files behind CAPTCHAs, required users to enter an EIN to download a single file, or blocked automated downloads outright.

In February 2025, Executive Order 14221 directed the agencies to make pricing “standardized and easily comparable across hospitals and health plans” and to step up enforcement. A proposed rule followed on Dec. 23, 2025. It drew comments from 132 carriers, TPAs, employers, data companies, providers and researchers. The final rule keeps most of the proposal, drops two of its more burdensome pieces and speeds up the timeline.

Who it affects

The rule applies to non-grandfathered group health plans, both fully insured and self-funded, and to insurers in the group and individual markets. Church plans are not exempt. The agencies' own estimates of the market it touches:

• 2.77 million ERISA-covered group health plans, with 135.5 million participants. 77.7 million of them are in self-funded plans.
• 90,900 state and local government plans covering 43.8 million people
• 24.4 million individual-market enrollees

The agencies expect the work itself to fall on about 1,303 insurers (counted state by state) and 205 TPAs. Fully insured plans lean on their carrier, and self-funded plans lean on their TPA. Enforcement is split three ways. The Department of Labor polices ERISA plans, states police insurers, and HHS polices state and local government plans.

What the rule does

1. Files get organized by network, not by plan

Plans will publish one in-network rate file per provider network instead of one per plan. Today the same rates are copied across thousands of plans that share a network. Each file must now carry:

• the network's common, public-facing name
• a provider network identifier
• the product type (HMO, PPO, etc.) of each plan that uses it

TPAs can combine many employers that share a network into a single file.

2. The “zombie rates” come out

Plans must drop provider-and-service combinations they would never pay for, based on the specialty-matching rules they already use to process claims. Two new files back that up:

• Taxonomy file: shows which provider specialties the plan will pay for which services.
• Utilization file: an annual list of which in-network providers actually billed and were paid for which services in the prior plan year. It shows yes or no only, not claim counts.

Together, the agencies estimate, these changes and network-level reporting will cut total file volume by about 70%, from roughly 1 petabyte a month to 300 terabytes.

3. More out-of-network data

Out-of-network allowed-amount files will be grouped by market: individual, small group, large group and self-funded. The minimum claims threshold for reporting a price drops from 20 to 11, matching CMS's standard privacy cutoff. The reporting window doubles from 90 days to six months. TPAs can pool data across the self-funded clients they administer, which should surface far more prices.

4. Easier to find, open to automated access

• Files update quarterly on fixed dates: Jan. 1, April 1, July 1 and Oct. 1. Prescription drug data stays monthly once that file takes effect.
• Every plan, insurer or hosting TPA must post a standard .txt file in the root folder of its website. It must link to the files and list a monitored contact email. The idea is borrowed from the hospital rules.
• Websites must add a footer link to the files.
• Files must be open to people and automated tools. No logins, CAPTCHAs, rate limits or “enter your EIN” gates.
• All files must use a single open format (JSON in practice).

5. Someone has to sign

Each file must name a CEO, president or designated senior official who attests that the data is true, accurate and complete. When a TPA produces the files under a written agreement, the TPA's executive can sign instead. The agencies also said they “will prioritize compliance and enforcement” and that enforcement actions “will be transparent to the public.”

6. Price quotes by phone

Members can now get the same personalized cost estimates by phone that the online tool provides. Plans must answer at the customer service number on the member's ID card, for up to 20 providers per day. Estimates must also note when a member could still be balance-billed under state or federal law. Meeting this requirement also satisfies the No Surprises Act's price comparison mandate, so plans don't need to build two tools.

What didn't make the cut

• Enrollment counts. The proposal would have required plan-by-plan enrollment in every file. Carriers and TPAs said the data sits in separate systems and could expose sensitive business information. The agencies dropped it.
• Change-log files. These would have flagged what changed each quarter. They were dropped as too burdensome, so users will compare files themselves.
• A central federal database. Many commenters asked the government to host or index all the files. The agencies declined, citing cost.
• Small-employer EINs. Commenters asked for the EINs of small businesses buying coverage through the federal SHOP marketplace. Not now; the agencies said they will “explore” it.

Key dates

What it means for brokers

A new reason to call your self-funded clients. When a TPA produces these files, the employer is still the party out of compliance if the TPA misses a deadline or posts bad data. The rule says that if a sponsor doubts its TPA can deliver, it “should take all necessary steps to address such concern in its contract with the TPA.” That makes TPA readiness a natural agenda item for Q4 and Q1 renewal meetings.

Better data for network conversations. Network names, IDs and product types will make it easier to compare networks across carriers. The Utilization file, once it arrives, will show which in-network providers are actually being used, which is useful for network adequacy and steerage discussions.

Watch admin fees. The agencies acknowledge that TPAs and other service providers may pass compliance costs through in admin fees, though they expect the increases to be modest. Expect the question to come up at renewal.

A reminder about claims data. The rule reminds plans that federal law bars contracts that block them from accessing their own de-identified claims data. Brokers can use that point when clients run into data-access friction.

What it means for TPAs

The heaviest lift falls on you, on a short clock. The agencies originally proposed a 12-month runway. They cut it to five months for the core file changes. Between now and March 6, 2027, TPAs need to:

• map every client plan to its provider networks, with names, IDs and product types, and put client EINs in the Table of Contents file
• remove zombie rates using their claims-adjudication specialty rules, then publish a Taxonomy file explaining those rules
• move to fixed quarterly posting dates
• remove CAPTCHAs, gates and rate limits from file hosting
• arrange an executive attestation for every file

By October 2027, add a root .txt file and a monitored inbox. By July 2028, add the Utilization file. The agencies rate the Utilization file the single most expensive piece of the rule, at roughly 680 hours of work per organization.

There is upside. TPAs can now publish one file per network across all their clients instead of one per client plan. They can also pool out-of-network data across clients when applying the 11-claim threshold. Quarterly posting cuts hosting and bandwidth costs.

Don't wait for the spec. The technical schema (version 3.0) will be developed publicly on CMS's GitHub “shortly after” publication. The agencies were blunt that “development can and should begin before Schema 3.0 is formally finalized.” Client service agreements should also be updated to spell out who attests, who hosts the text file and who answers the contact inbox.

What to watch next

• Enforcement. The agencies promise to prioritize it and to make actions public.
• The prescription drug file. It was required in 2020 and never enforced. The agencies say they will begin implementing it “in short order.”
• Future additions the agencies flagged as possibilities: EINs for small SHOP employers, an optional “rented vs. owned” network field, and guidance on outlier and stop-loss pricing terms.
• Congress. The Patients Deserve Price Tags Act (S. 2355) would push transparency further.

The bottom line

Four years in, Transparency in Coverage is moving from “publish everything” to “publish something people can use.” Files will be smaller, more standardized, easier to find and signed by an executive.

The burden shifts toward the TPAs and carriers who produce them, and the opportunity shifts toward those who can make sense of them.

For brokers, TPAs and benefits tech companies, the window to prepare closes March 6, 2027.