Status as of November 4, 2026: the final rule is published and becomes effective December 7, 2026. The Departments have said they will name the required file format in separate guidance.
What does the final rule change?
The Transparency in Coverage final rule was published in the Federal Register on October 6, 2026. Most of the headlines focused on the good news: smaller pricing files, quarterly updates instead of monthly, and data that people can actually open and use.
All true. But if you sponsor a self-funded health plan, one part of this rule deserves far more attention than it is getting. Starting March 6, 2027, every major pricing file posted for your plan has to carry an attestation that the data is true, accurate and complete, along with the name of a senior official who oversees it. Your TPA may build the files. Your carrier may host them. The plan is still yours, and so is the compliance obligation.
Here is the honest reality for most employers. You have never seen these files, you did not build them, and you probably could not tell if they were wrong. That is not a criticism. Nobody expects an HR director or CFO to audit a carrier’s negotiated rates line by line. That is why your vendor contracts matter so much right now.
The original Transparency in Coverage rules came out in 2020, and the pricing files went live in July 2022. The idea was simple: plans would publish their negotiated rates so employers, researchers and patients could finally see what care costs. In practice, the files were enormous, full of duplicate data and hard to compare with what hospitals post. According to the CMS fact sheet, the Departments of Labor, Treasury, and Health and Human Services pointed to three barriers: file size, missing context, and poor alignment with hospital price data.
Here is what the update fixes:
- Smaller files with less clutter. Contracts often list a rate for every provider in a group, whatever their specialty. That is how a podiatrist ends up with a negotiated rate for heart surgery. Plans now have to remove those unlikely provider and service combinations, using the same internal rules they use to pay claims.
- One file per network. In-network rate files are organized by provider network instead of by individual plan. Many plans share the same network and rates, so this should cut duplicate files sharply.
- Quarterly updates. The in-network rate and out-of-network allowed amount files update quarterly instead of monthly. The prescription drug file stays monthly. The Departments estimate the changes will save plans and issuers about $174.5 million a year, net, starting in the second year.
- More out-of-network data. The old 20-claim minimum left many out-of-network files nearly empty. The threshold drops to 11 claims, and the data is grouped by market type, including self-insured plans.
- New context files and easier access. Plans must post a Taxonomy File and a Utilization File, plus a plain text file in the website’s root folder that points to the files and lists a monitored email address for questions. A homepage footer link labeled “Price Transparency” or “Transparency in Coverage” is also required.
- One file format. The rule requires a single format, and the Departments said they intend to name JSON in guidance for the in-network, allowed amount, Taxonomy and Utilization files.
For anyone who analyzes this data, these are welcome changes. For you as a plan sponsor, the bigger story sits further down in the rule.
Which deadlines belong on your calendar?
The rule does not hit all at once. Here is how the phases line up for a calendar-year plan:
| Date | What starts | Who usually does the work |
|---|---|---|
| December 7, 2026 | The rule becomes effective | No action on its own, but the clock starts |
| January 1, 2027 | Personalized cost-sharing estimates by phone, plus updated self-service tool rules (plan years beginning on or after this date) | TPA or carrier customer service |
| March 6, 2027 | New in-network and out-of-network file rules, network-level files, the 11-claim threshold, the single file format, and the signed attestation | TPA, carrier or network owner |
| September 6, 2027 | Taxonomy file, text file and website footer link requirements | TPA, carrier or network owner |
| July 1, 2028 | First Utilization File posted, then updated once a year | TPA, carrier or network owner |
Under the rule’s timing provisions, the reworked in-network and allowed amount files post on the first day of each calendar quarter, starting with the first quarter after March 6, 2027. The text file posts on the first day of the first quarter after September 6, 2027, and must be updated within 7 calendar days of any change.
If your plan year does not start in January, the phone requirement follows your plan year. A July 1 plan picks it up on July 1, 2027.
The column on the right is the one to watch. Nearly every task on this list is done by a vendor. Not one of them shifts the legal duty off your plan.
What is the attestation, and who signs it?
This is the part of the rule that changes things for employers.
Starting March 6, 2027, each in-network rate file, out-of-network allowed amount file, prescription drug file, Taxonomy File and Utilization File has to include an attestation. It states that, to the best of the plan’s knowledge and belief, the file includes all required information and the data is true, accurate and complete as of the file’s date. Each file must also carry the name of the plan’s CEO, president or a senior official designated to oversee the data. The Taxonomy and Utilization files carry the attestation once they are required.
The Departments said the attestation is meant to build confidence in the disclosures and line them up with the hospital price transparency rules, which already use a similar sign-off.
Why this lands on your desk
The rule names the plan’s CEO, president or senior official. For a self-funded plan, the plan is yours.
Now think about what that person would be vouching for: rates negotiated between a carrier and thousands of providers, contract terms you likely cannot see, and claims logic that lives inside your TPA’s systems. The Departments expect the person signing to consult the staff who built the files. Most employers do not have that staff. Your TPA does.
Picture your CFO being asked to sign a statement that a file this large is complete and accurate. That conversation should not go well. You cannot attest to something you have no way to check.
Your TPA can attest, if the contract says so
The rule lets a plan meet the attestation requirement through a written agreement under which another party, such as a TPA, makes the attestation and names its own senior official. That option is available only when the plan has also contracted with that party to provide the files.
That is the whole question. Your protection depends almost entirely on what your agreement says. If it is silent, do not assume your vendor has picked this up.
Can you hand the work to your TPA?
You can hand off the work. You cannot hand off the responsibility. The Departments said in the rule that the duty to comply rests with the group health plan, even when the plan pays a service provider to do the work. They went further: if a self-insured plan sponsor is concerned that its TPA cannot meet the new requirements, the plan should address that concern in its contract with the TPA.
That is regulators telling you where to look. Your contract is the tool.
These obligations also tie into your broader duties under ERISA. Choosing a vendor is a fiduciary decision, and so is monitoring whether that vendor does the job. Our guides to the third-party administrator’s role and how to vet benefits vendors cover what that oversight looks like.
What the penalties can look like
Transparency in Coverage sits alongside other group health plan mandates in the tax code. A failure can trigger the excise tax under Internal Revenue Code section 4980D, which is generally $100 for each day of noncompliance for each individual the failure relates to. There are caps, exceptions and correction rules for failures that were not willful, so the real exposure depends on the facts. On a plan with hundreds or thousands of members, the daily figure adds up quickly.
The Departments also said they will prioritize compliance and enforcement as these rules roll out, and will work to make enforcement actions transparent to the public.
Costs may show up in your admin fees
The Departments recognize that service providers may recover the cost of these changes through administrative fees. They expect any increase to be limited, because the requirements build on systems that already exist. Even so, you will want to know what you are paying for, and whether that fee comes with real accountability.
When does the phone requirement start?
The attestation gets most of the attention, but the phone requirement is the one your employees will notice. For plan years beginning on or after January 1, 2027, members can call and get the same personalized cost-sharing estimates they would find in the online tool or on paper. A few details matter:
- It is the number on the ID card. Plans must use the customer assistance number already printed on member ID cards. No separate hotline.
- The answer has to be accurate when it is given. Estimates must be correct as of the time of the call and provided during the call.
- There is an optional cap. Plans can limit phone estimates to no fewer than 20 providers per day, as long as they tell the caller about the limit.
- It does double duty. Meeting this requirement also satisfies the No Surprises Act price comparison rule for phone guidance, including for grandfathered plans that are not otherwise covered by these rules.
The Departments chose not to add call center standards such as required hours or wait times. They left that to plans and their vendors, so it is on you to make sure the service your members get is useful.
Think about how that call goes for an employee. They are scheduling an MRI, they dial the number on their card, and they want a real price. If the representative cannot pull it up, or reads off something that turns out to be wrong, that frustration lands on HR, not on the TPA. Ask your vendor how it is training staff and testing this before your 2027 plan year begins.
What should you settle with your TPA before March 2027?
Most administrative services agreements were written years ago. At best, they say the TPA will “provide machine-readable files as required by law.” That one line does not cover what the final rule now asks for. Here is what Ethos Benefits would want answered, in writing, before March 6, 2027:
- Who signs the attestation? This is the big one. Ask your TPA or carrier to confirm that it will make the attestation for your plan’s files and that it is taking responsibility for producing and posting those files. Put it in the contract or an amendment. A friendly email does not count. If your vendor will not attest, that tells you how confident it is in its own data.
- Who posts the files, the text file and the footer link? Most self-funded employers do not host pricing files on their own websites. Confirm where the files will live, who maintains the root-folder text file and who monitors the email inbox for questions. If any of this lands on your website, your IT and HR teams need to know now.
- How fast do errors get fixed? Files will sometimes be wrong. What matters is how quickly your vendor catches and corrects problems, and whether it tells you. Ask for a written correction process with clear timelines.
- Who pays if something goes wrong? Look for indemnification that covers penalties, excise taxes and costs caused by inaccurate or incomplete files your vendor produced. If the contract caps your vendor’s liability at a few months of admin fees, that cap may not mean much against a per-day, per-person excise tax. Check with your fiduciary liability insurance carrier about whether this exposure is covered.
- Is the phone line really ready? Ask how representatives will pull personalized estimates, how they are being trained and what happens when the system cannot produce an answer. If your plan year starts January 1, you are already short on time.
- Can you get your own claims data? The Departments used this rule to remind plans of the Consolidated Appropriations Act, 2021 ban on gag clauses: your agreements cannot block access to your plan’s de-identified claims and encounter data. Published rates are one thing. Your claims tell you what your plan actually paid. The annual gag clause attestation is due every December 31, so review both together.
- What are you paying for this? If your admin fee is rising to cover new transparency work, you should see what that money buys: what is being added, what accountability comes with it, and whether the increase is a one-time charge or permanent.
None of these questions are hostile. A good vendor should welcome them. If yours gets defensive, that is useful information too. If you are weighing a change of administrator, TPA procurement puts these terms on the table before you sign.
What will transparency still not tell you?
The final rule is a real step forward. Cleaner files and better context will help researchers, regulators and the tools built on this data.
Be honest about its limits, though. A published rate shows what a carrier negotiated with a provider. It does not show how your specific claims were priced, bundled or adjusted before they hit your plan’s bank account. The Departments themselves said the files hold rates and historical billed charges only, and cannot reflect any one person’s cost-sharing.
The most useful number for your plan is still the one in your own claims data. That is why the contract questions above matter. Access to your data, accountability for accuracy and clear terms on who answers for mistakes turn transparency into something you can use. Our article on health plan claims data access covers the pending federal bill that would make that access a legal right.
What should employers do now?
You run every other part of your business with strategy and clear accountability. Your health plan deserves the same, especially now that someone’s name goes on the files.
You do not need to become an expert on machine-readable files. You do need a documented process for choosing vendors, reviewing what they do and fixing what is not working. That is the core of plan governance, and it is what the Fiduciary Framework™ is built to support, from vendor oversight to compliance documentation you can stand behind.
If you are not sure what your TPA agreement says about attestation, indemnification or data access, Request a Strategic Analysis and we will review it with you before March 2027.
This article summarizes federal regulations for general information and is not legal advice. Dates reflect the final rules published in the Federal Register on October 6, 2026, as of November 4, 2026. File format and other technical details will be set in separate guidance.