What CMS-1850-P Actually Costs You: 340B, Site-Neutral, and 1,444 CAPs

I pulled every price-transparency enforcement action CMS has published since 2021, and the number that stopped me was not the penalties.

It was the corrective action plans. Exactly 28 hospitals have ever received a civil monetary penalty. Another 1,444 have been pushed into a corrective action plan. If you have been budgeting for price transparency as a fine you probably will not get, you have been budgeting for the wrong thing.

That matters right now because CMS-1850-P, the CY2027 outpatient proposed rule, contains a request for information asking how to make hospital machine-readable files comparable to each other. Comparable means machine-checkable. Machine-checkable changes what enforcement can do at scale.

I want to walk through what this rule actually proposes, including four items you will not find in the Federal Register abstract, and then show you what the enforcement record looks like when you put four years of it in one place. If you are new to how the pieces fit together, our revenue cycle management services page lays out the full cycle, and the 13 steps of the revenue cycle is the plainer starting point.

What CMS-1850-P Actually Proposes

• Docket: CMS-1850-P
• Published: July 7, 2026
• Citation: 91 FR 41734
• Comment period closes: August 31, 2026

The proposed rule covers CY2027 payment rates for the Hospital Outpatient Prospective Payment System and the Ambulatory Surgical Center payment system, updates to the Hospital Outpatient Quality Reporting (OQR) and Ambulatory Surgical Center Quality Reporting (ASCQR) programs, an expansion of prior authorization to additional Botulinum Toxin injection services, provisions from the Consolidated Appropriations Act 2026 for off-campus outpatient departments, accrediting organization deeming for certain administrative requirements under the Emergency Medical Treatment and Labor Act (EMTALA), the federal law requiring hospitals to screen and stabilize emergency patients regardless of ability to pay, a request for information on standardizing hospital price transparency data, notices of closure of teaching hospitals with the opportunity to apply for the residency slots that frees up, and a solicitation of comments on a possible separate Inpatient Prospective Payment System payment for domestically procured personal protective equipment and essential medicines.

That is the abstract. It is accurate and it is incomplete.

The Four Things The Abstract Does Not Mention

The Federal Register abstract runs eight items long. Every analyst who covered this rule led with four that are not among them.

The 340B Drug Pricing Program lets qualifying hospitals buy outpatient drugs at a discount, and Medicare reimburses them against the Average Sales Price (ASP) of those drugs. The proposal would pay ASP minus 33.4% for 340B acquired drugs, down from ASP plus 6%. CMS arrives at that figure from its own hospital survey, which found 340B acquisition costs sat roughly 33.4% below both the mean and median ASP. Separately, the rule raises the annual conversion-factor reduction that recoups the CY2018-2022 340B remedy payments from 0.5% to 3%.

CMS puts its own number on that second change: it estimates the offset would reduce OPPS spending by approximately $2.3 billion in CY2027.

On the surgical side, CMS proposes to remove 637 services from the Inpatient Only list, the second phase of a phase-out that ends with the list eliminated entirely on January 1, 2029. There are 1,438 services left on it today, so 637 is roughly half the remainder. A further 618 procedures would be added to the ASC covered procedures list. And site-neutral payment would extend to off-campus imaging without contrast, reimbursed at the physician rate rather than the outpatient rate.

All of the above is from the rule text itself, not from summaries of it. HFMA, Fierce Healthcare and HealthLeaders all reached the same read independently.

None of those four appear in the abstract. Not in shorthand, not by name. The abstract has room for teaching hospital closure notices and a comment solicitation on domestically procured personal protective equipment, and it does not name the provision CMS itself scores at $2.3 billion. If you built your internal summary from the Federal Register landing page, which is what most people do, you missed the parts that move money.

I am not making a point about CMS drafting here. I am making a point about how regulatory intelligence fails inside health systems. A summary is not a source. The abstract for this rule is a real document written by the agency that wrote the rule, and reading only that abstract would still have produced a wrong picture of your CY2027 exposure.

The 2.4% That Is Not 2.4%

CMS proposes an outpatient department fee schedule increase factor of 2.4% for hospitals and ASCs meeting their applicable quality reporting requirements, built from a market basket increase reduced by a 0.8 percentage point productivity adjustment. In conversion-factor terms the CY2026 OPPS figure of $91.415 becomes $102.004 for CY2027 once the budget-neutral 340B adjustment is applied. The ASC conversion factor moves from $56.322 to $57.766 for compliant facilities.

Read in isolation, that is a raise.

You do not have to take my word that it is not, because CMS does the subtraction itself. In its own impact analysis, the agency estimates the OPD update increases payments by approximately $1.82 billion against CY2026. It then estimates the 340B remedy offset reduces payments by approximately $2.3 billion in the same year.

For providers subject to both, the agency’s own arithmetic nets out negative. The 2.4% applies to the base. The 340B change applies to a specific and often high-margin slice of drug spend. The site-neutral extension applies to a specific service location. Which of those touch you is a question about your mix, not about the headline.

This is why “what did we get in the update” is the wrong first question for CY2027 planning. The right question is which of your service lines sit in the categories that change, and how much volume runs through them. That is a modeling exercise against your own case mix, not a percentage you can apply across the board. A revenue cycle analytics view that can slice by service line and location type is the difference between answering that in an afternoon and answering it in a month.

Four Years Of Enforcement, In Our Data

Here is the part I actually came to write about.

CMS publishes its hospital price transparency enforcement activity as a public record. Individually the entries are not that interesting. Assembled, they are. We pulled the full set: 11,440 enforcement actions across 4,907 hospitals, each carrying a hospital, a state, an action type and a date, and analyzed it ourselves (extract dated May 1, 2026).

What it shows:

• Hospitals issued a warning notice: 2,577
• Escalated to a corrective action plan: 1,444
• CAP rate among warned hospitals: 56%
• Hospitals ever penalized: 28
• Enforcement actions in 2025: 5,432
• Enforcement actions in 2024: 2,087

Two things fall out of that.

The fine is not the risk. A total of 28 civil monetary penalties across 4,907 hospitals is a rounding error. If your price transparency posture is built on the odds of being fined, the odds are genuinely in your favor and always have been.

The corrective action plan is the risk. More than half of every hospital that received a warning ended up in a CAP. A CAP is staff time, legal review, remediation work and a public record, and it arrives on CMS’s schedule rather than yours. That is the cost nobody budgets for, because it does not look like a penalty line.

And enforcement volume rose 2.6x between 2024 and 2025, on top of a fourfold step between 2022 and 2023. Our extract runs through May 2026, so the 2026 figure in our file is partial and I am not going to present it as a trend.

Texas, California and Florida lead on volume, which mostly tracks hospital count rather than anything regional.

It is worth being concrete about what a corrective action plan involves, because the phrase sounds administrative and the work is not. A CAP means submitting a remediation plan to CMS, executing it against their timeline, and evidencing completion. It pulls in whoever owns your machine-readable file, whoever owns contracting, and usually legal. None of those people have slack. And the record is public, which matters if you are in a market where a competitor or a local reporter is inclined to look.

For organizations building patient-facing or payer-facing products rather than operating a hospital, the same standardization pressure lands differently, and RCM compliance in digital health product development covers that side.

Why an RFI Changes The Arithmetic

CMS is asking, in this rule, how to improve comparability and standardization of the information hospitals report in machine-readable files and consumer displays, and it calls out complex contracting methodologies specifically.

Requests for information are not requirements. They are how CMS finds out whether a requirement is workable before proposing one.

The operative word is comparability. Today a machine-readable file can satisfy the letter of the rule and still be effectively unreadable next to another hospital’s file, because the two encode the same contract structure differently. Percent-of-charge arrangements, case rates, carve-outs and stop-loss provisions all have more than one defensible representation.

If comparability becomes the standard, files stop being documents that a reviewer opens and start being data that a system reads. Non-compliance stops requiring a complaint or a manual review to surface. That is what changes the arithmetic behind the numbers above: the enforcement volume in our dataset was produced under a regime where finding a problem took human effort.

Specialty organizations tend to feel this first, because their contract structures are less standard. The behavioral health side is a good example of how differently the same rules land by specialty, which our behavioral health revenue cycle guide gets into.

A file built to satisfy an auditor and a file built to be compared are different artifacts. Most hospitals built the first one, correctly, because that was the requirement. The work is knowing which one you have.

Prior Auth: The Line Item Versus The Trajectory

The rule expands prior authorization to additional Botulinum Toxin injection services. On its own that is narrow, and if you do not bill those services it does not touch you.

The direction is the part worth your attention. Prior authorization requirements have been extended service line by service line across successive rules, while a separate track of regulation has been building the technical plumbing. CMS-0057-F mandates a Prior Authorization API for affected payers by January 1, 2027. Our prior authorization services page covers what that integration work involves, and the downstream consequence when it does not happen shows up in denial management.

If you treat each expansion as a staffing question, you add coordinators every time the list grows, and the list keeps growing. If you treat it as an integration question, the work is the standards and systems underneath: the X12 278 transaction that carries an authorization request between provider and payer, the Da Vinci implementation guides, and the connection into whichever EHR your organization runs, whether that is Epic, Cerner or eClinicalWorks.

I will be honest about where the difficulty actually sits, because it is not where most vendor material puts it. Connecting to a major EHR is well-trodden. The hard part is the last mile: the cases that do not fit the standard integration path, the payer-specific rules that do not generalize, the write-back that has to land in the right place in the right workflow. That is the work, and pretending otherwise helps nobody.

The ASC Half Of The Rule, Which Most Coverage Skips

Almost everything written about CMS-1850-P treats it as an outpatient rule. It is an outpatient and ambulatory surgical center rule, and the ASC provisions point in the opposite direction to the hospital ones.

ASCs get the same 2.4% update. They also get an expanded covered-procedures list, and they are the natural destination for a good share of the 637 procedures coming off the Inpatient Only list. Where a hospital reads those removals as migration risk, an ASC reads them as addressable volume.

If you operate both, this is one decision, not two. The question is whether a procedure leaving the Inpatient Only list should move to your own ASC or leak to someone else’s. That is a case-mix and capacity question with a revenue cycle tail: different payer rules, different authorization requirements, different claim edits. The billing mechanics genuinely differ between settings, which is worth understanding before the volume moves rather than after, and the distinction between the two is the sort of thing medical billing versus revenue cycle management sets out plainly.

The claims side deserves attention too. Moving volume across settings means new payer-specific edits and a new denial profile, which is a claims processing configuration exercise more than a clinical one. Teams that migrate volume without touching their edit logic tend to discover the gap through denials a quarter later.

Off-Campus Departments And EMTALA

Two smaller provisions worth knowing about.

The rule would implement Consolidated Appropriations Act 2026 provisions for off-campus outpatient departments of a provider. Combined with the site-neutral imaging proposal, the practical effect is that the payment status of your off-campus locations deserves a fresh look rather than an assumption carried over from last year.

Separately, CMS proposes that hospital accrediting organizations with deeming authority assess compliance with certain EMTALA administrative requirements during accreditation and reaccreditation surveys. This moves part of EMTALA administrative review into a cycle you already run, which is less a new obligation than a new place an existing one gets checked.