The No Surprises Act: What You Need To Know

By: Daniela Ras

Another summer is in the books! Taking stock of the season, some of us might have taken some well-deserved PTO in the past few months. Maybe the family convinced you to get back in touch with your adventurous side, so you got out of your comfort zone with something like SCUBA diving, mountain climbing, or ziplining over a canyon. Or maybe you stayed local, enjoying the culinary offerings of your home city and going out to see the summer blockbusters. 

Regardless of how you chose to spend your summer, one thing is for sure: not everything goes according to plan. If you’re one of the unlucky few whose summer escapades led to a doctor’s visit, you might have benefitted from the No Surprises Act (NSA), a federal statute now in effect across all 50 states. 

The NSA went into effect on January 1, 2022, as part of the Consolidated Appropriations Act (2021). Its primary goal—you guessed it—is to protect consumers from surprise medical bills, particularly those which occur when patients unknowingly receive care from out-of-network providers or facilities and are billed for amounts not covered by insurance. The legislation applies to individuals with group health plan coverage or individual health insurance, including plans purchased directly from insurers. By contrast, the NSA does not apply to those covered by Medicare, Medicaid, Veteran’s Affairs Health Care, or TRICARE.¹ 

The NSA creates key protections for consumers who lack a realistic choice between in-network and out-of-network services. For example, patients can no longer be billed for the balance of most emergency care even if it was provided by an out-of-network hospital or an independent emergency department, and prior authorization is not required in order to receive protection. In addition, out-of-network providers administering non-emergency care at in-network hospitals, outpatient departments, critical access hospitals, or ambulatory surgical centers cannot bill patients for the balance between their charges and what insurance pays.² 

By contrast, the NSA will not apply to non-emergency care provided at an out-of-network facility, nor will it apply to non-emergency care for in-network settings other than those previously listed, such as a community health clinic or doctor’s office.³ Healthcare providers may also seek a waiver of the NSA’s protections by providing patients with a clear explanation of potential costs of a procedure at least three days beforehand and obtaining the patient’s consent. The notice and consent form must be presented apart from other documentation and must be signed separately.⁴

Importantly, the NSA establishes a system for resolving payment disputes between providers and insurers through independent dispute resolution (IDR) without involving the patient as a middleman. First, the plan administrator sends the provider an initial payment or notice of denial of payment. Should the provider disagree with the payment decision, they can try to negotiate the payment amount. When negotiations fail, the provider can begin the IDR process.⁵

In the IDR process, the health plan or health insurance issuer and provider each submit an offer for payment of the disputed amount to a third-party arbitrator known as a “certified IDR entity.”⁶ The entity then selects one of the offers to be the amount of payment, which shall be “binding upon the parties involved” and due within 30 days.⁷

While the NSA has provided relief for consumers, this framework has prompted questions regarding what remedies are available to private parties in the event that IDR awards remain unpaid past the 30-day period. A recent decision handed down by the Second Circuit has found that the NSA does not create a private right of action to enforce IDR awards. 

East Coast Advanced Plastic Surgery v. Cigna Health and Life Insurance Co.

East Coast Advanced Plastic Surgery (ECAPS) is a medical practice that performs breast reconstruction surgery for cancer patients that have undergone mastectomies. The organization is an out-of-network provider that contracted with Cigna Health and Life Insurance Co. to provide medical services to individuals covered by Cigna-administered plans in exchange for 85% of ECAPS’s billed charges.⁸ 

ECAPS claims that in most cases, Cigna paid ECAPS far below the agreed upon rate. The health care provider won more than $3 million in IDR awards against Cigna, though the health-plan administrator did not pay within the 30-day timeframe.⁹ For its part, Cigna claims that ECAPS engaged in fraudulent billing practices, causing Cigna to overpay by $8.5 million for certain ECAPS services, including: (1) claims for services ECAPS had not sufficiently documented, (2) duplicate claims for the same service, and (3) claims for medically unnecessary services. ¹⁰

ECAPS brought a federal lawsuit to compel payment, seeking a declarative judgment that Cigna violated the NSA by failing to pay, whereas Cigna moved to dismiss the claim. The district court granted Cigna’s motion to dismiss for failure to state a claim, and the Second Circuit upheld the decision, stating that the NSA does not contain an implied private right of action. The court explained that the NSA delegates enforcement authority to several federal agencies as well as to state governments. Such a statutory scheme “reflects Congress’s intent that the NSA, including payment of the IDR awards, be enforced through administrative action rather than private litigation.”¹¹ 

The Second Circuit continued that the determination of who may sue to enforce a federal law is left to Congress, which typically must do so expressly. This means that the text and structure of a statute must yield a “clear manifestation” of congressional intent before such a right is implied by the court.¹² Whether the statute utilizes rights-creating language is considered, as well as whether the statute’s methods of enforcement manifest an intent to create a private remedy as opposed to empowering agencies to enforce their own regulations. 

As applied to the NSA, the Second Circuit found that no private right of action was implied by the legislation’s text and structure. Specifically, the NSA refers to a provision of the Federal Arbitration Act (FAA) that allows private parties to appeal to the courts for vacatur of an arbitration award, but the NSA does not refer to the FAA’s complimentary provision for the confirmation and enforcement of IDR awards. The Second Circuit held that this omission was a “strong suggest[ion] that Congress did not intend to create a private right of action to enforce IDR awards.”¹³ While the NSA does use rights-creating language by mandating that payment of the IDR award be made within 30 days of determination, this alone is not enough without the express creation of a private remedy.

As for enforcement, the Second Circuit found that the NSA empowers several federal agencies as well as state governments to address violations. For example, the Secretary of Labor may bring a civil action to enforce the NSA’s provisions against any employee benefit plan established or maintained by any non-governmental employer “engaged in commerce.”¹⁴ Additionally, the Treasury Department may impose a tax on non-governmental group health plans that violate the Internal Revenue Code, which incorporates the NSA, in the event that IDR awards are not paid within 30 days. The Department of Health and Human Safety also has the authority to respond to IDR payment violations by state and local government group health plans through the imposition of civil money penalties. Finally, the Public Health Service Act permits states to enforce the NSA against health insurance administrators who issue, sell, renew, or offer health insurance coverage within state borders.¹⁵ Such provisions for the enforcement of the NSA led the Second Circuit to conclude that Congress intended to preclude other methods of enforcement like a private right of action. 

This decision by the Second Circuit provides valuable guidance for the lower courts, who are already implementing this rationale where private parties bring claims for the enforcement of IDR awards. For example, in September 2026 the New Jersey Supreme Court denied Multicounty Litigation designation to IDR payment disputes, stating that such claims are inappropriate for multicounty litigation due to a lack of uniformity among actors, facts, and defenses.¹⁶ Moving forward, health plan administrators should take note that while they likely will not face lengthy litigation brought by private healthcare providers, they will instead face the scrutiny of federal and state authorities. 

¹ U.S. Dep’t of Health and Human Services, et al., The No Surprises Act at a Glance: Protecting Consumers Against Unexpected Medical Bills (last accessed September 24, 2026) https://www.cms.gov/files/document/nsa-at-a-glance.pdf.

²  Id.

³ Id.

⁴ U.S. Dep’t of Labor. Avoid Surprise Healthcare Expenses: How the No Surprises Act Can Protect You (last accessed September 24, 2026) https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/publications/avoid-surprise-healthcare-expenses.

⁵ E. Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Ins. Co., No. 25-2204, 2026 WL 2751786 (2d Cir. Sept. 17, 2026).

⁶ Id.

⁷ 29 U.S.C. § 1185e(c)(5)(E)(i).

⁸ E. Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Ins. Co., No. 25-2204, 2026 WL 2751786 (2d Cir. Sept. 17, 2026).

⁹ Hailey Konnath, Second Circuit Says No Surprises Act Limits Private Right of Action (last accessed September 24, 2026) https://www.law360.com/insurance-authority/articles/2526720/2nd-circ-says-no-surprises-act-limits-private-right-of-action.

¹⁰ E. Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Ins. Co., No. 25-2204, 2026 WL 2751786 (2d Cir. Sept. 17, 2026).

¹¹ Id.

¹² Lopez v. Jet Blue Airways, 662 F.3d 593, 596 (2d Cir. 2011).

¹³ E. Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Ins. Co., No. 25-2204, 2026 WL 2751786 (2d Cir. Sept. 17, 2026).

¹⁴ Id.

¹⁵ Id.

¹⁶ 
New Jersey Court System. Notice – Civil – No Surprises Act – Denial of Application for Multicounty Litigation (MCL) Designation (last accessed September 28, 2026) https://www.njcourts.gov/notices/notice-civil-no-surprises-act-denial-of-application-multicounty-litigation-mcl-designation.