Strategic Product Manager

Montana CSI holds public hearing on BCBSMT cybersecurity breach after court denies TRO. Helena, Mont. - The Montana Office of the Commissioner of Securities and Insurance (CSI) held a public administrative hearing on January 22, 2026, regarding a cybersecurity breach involving Health Care Service Corporation, a mutual legal reserve company, doing business as Blue Cross Blue Shield of Montana (BCBSMT). Prior to the hearing, BCBSMT sought a temporary restraining order (TRO) from the Lewis and Clark County District Court to prevent the hearing from taking place. The court denied that request, and the hearing proceeded as scheduled. The purpose of the hearing was to receive evidence and determine whether BCBSMT complied with Montana law requiring the timely reporting of cybersecurity incidents, as well as to examine the facts and circumstances surrounding the breach. The cybersecurity event, which BCBSMT reported to CSI in October 2025, may have impacted approximately 462,000 Montanans and involved sensitive consumer data, including personally identifiable and protected health information. During the hearing, evidence and testimony addressed the timeline of events, BCBSMT's response to the breach, and its assertion that a third-party vendor, Conduent Business Services LLC, was responsible for the cybersecurity incident. CSI is reviewing whether BCBSMT fulfilled its statutory obligations regardless of third-party involvement. This includes evidence that BCBSMT was first received notification from Conduent Business Services in January 2025 about a potential data breach, but did not notify CSI until October 2025. "It is troubling that it appears BCBSMT attempted to avoid regulatory oversight and accountability by seeking to block this hearing through the courts," said Communications Director Tyler Newcombe. "Our office is committed to protecting Montanans and ensuring a fair, transparent, and very serious process when sensitive personal and health data may have been placed at risk. That is exactly what this hearing was designed to do. Our office will consider all the evidence and then issue a final order in due course." Montana law requires regulated entities to report cybersecurity breaches in a timely manner to protect consumers and ensure transparency. The hearing was conducted pursuant to that authority. A Hearing Examiner will review the record and prepare a proposed decision for the Commissioner to consider. CSI will release additional information, including a detailed timeline of events, as it becomes available. The Office of the Montana State Auditor, Commissioner of Securities and Insurance (CSI), protects Montana consumers by ensuring a fair and competitive insurance marketplace. The agency licenses insurance companies and producers, investigates complaints, ensures compliance with insurance laws, and helps consumers make informed decisions. For more information or to get help with your health insurance options, contact the CSI at csimt.gov or 406-444-2040, or visit the official Montana Health Answers website at ratereview.healthcare.gov. The Montana State Auditor, Commissioner of Securities and Insurance, regulates the insurance and securities industries in Montana. The State Auditor is also an ex officio member of the Montana Board of Land Commissioners. James Brown was elected Montana State Auditor in 2024.

No Surprises, new challenges: Supreme Court limits provider enforcement under NSA. On January 12, 2026, the U.S. Supreme Court declined to review whether providers have a private right to enforce Independent Dispute Resolution (IDR) awards under the No Surprises Act (NSA). This leaves in place the June 2025 decision of the U.S. Court of Appeals for the Fifth Circuit's that limits providers' ability to seek court intervention for unpaid awards, signaling that courts may deny future private right of action claims from providers seeking to enforce unpaid IDR awards. As a result, providers in the Fifth Circuit, and potentially beyond, face an additional barrier in securing timely payment from insurers. However, recent data from the U.S. Department of Health and Human Services (HHS) indicate that the IDR process itself remains an effective tool for providers, who continue to prevail in most disputes and often secure higher payments than initially offered by insurers. This reinforces the value of the IDR process, even as legal avenues for enforcement are curtailed. In Guardian Flight LLC and Med-Trans Corp. v. Health Care Service Corp., two providers filed a complaint against Health Care Service Corp., the insurer, for failing to timely pay 33 IDR awards, alleging a violation of the NSA. The Fifth Circuit upheld dismissal of the case, holding that the NSA does not create a private right of action for providers to enforce IDR awards in court, with enforcement authority resting exclusively with HHS. By denying certiorari, the Supreme Court allows this ruling to remain effective within the Fifth Circuit's jurisdiction, and it will likely have influence in other regions as well. The Supreme Court's refusal to intervene means that providers cannot directly sue insurers in federal court to enforce unpaid IDR awards, at least in the Fifth Circuit. Instead, providers must rely on HHS to enforce compliance. This creates a practical challenge because the IDR process can yield favorable payment decisions, but actual collection of those payments may be delayed or complicated if insurers do not comply promptly. The NSA, effective January 2022, protects patients from unexpected medical bills for certain out-of-network (OON) services, including emergency care and certain non-emergency services where patients did not knowingly consent to OON care. The NSA also creates an Independent Dispute Resolution process to resolve payment disputes between OON providers and health plans, allowing them to establish the payments for out of network charges. The IDR process is a binding, final-offer arbitration system. After a 30-day open negotiation period, either party may initiate IDR within four business days. Both sides submit proposed payment amounts, and a certified IDR entity selects one. Key factors considered by IDR entities include the Qualifying Payment Amount (QPA), provider market share, patient acuity, provider type, and good faith efforts to contract. Prior payments and government program rates are excluded from consideration. Final decisions must be issued within 30 business days, with payment due within 30 business days thereafter. Recent Data: Provider Success in IDR According to May 2025 data from HHS's Center for Consumer Information and Insurance Oversight (CCIIO), the IDR process remains highly effective for providers. In the last quarter of 2024, 467,268 IDR cases were initiated. Providers, facilities, and air ambulance services prevailed in 72.8% (340,537) of determinations. In 71.2% (332,860) of those cases, the final payment amount was higher than the Qualifying Payment Amount. Notably, emergency department and radiology claims represented 50% of all IDRs initiated. Moreover, only 3.9% (18,409) of disputes were found to be ineligible for the IDR process, reflecting improved understanding of eligibility criteria and process efficiency. These trends suggest a persistent undervaluation of provider services by payers and underscore the IDR process as a vital recourse for fair reimbursement. Providers continue to prevail in most disputes, reinforcing the IDR process as a critical mechanism for ensuring equitable payment. The Supreme Court's denial of certiorari in Guardian Flight LLC and Med-Trans Corp. v. Health Care Service Corp increases the importance of mastering the IDR process, as direct judicial enforcement is now foreclosed in the Fifth Circuit. Providers must focus on: * Meticulous Documentation: Maintaining thorough records of services rendered, communications with insurers, and payment histories to support IDR submissions and potential HHS enforcement actions. * Process Familiarity: Understand IDR eligibility, timelines, and required documentation to avoid procedural errors and maximize chances of prevailing. * Proactive Engagement with HHS: In cases of nonpayment, promptly notify HHS and provide complete documentation to facilitate enforcement. * Strategic Use of IDR: Given the high provider success rate, providers should not hesitate to pursue IDR when faced with underpayment or denial, especially for high-volume or high-value claims. * Advocacy for Regulatory Improvements: Engage with professional associations to advocate for more robust and timely HHS enforcement mechanisms, as reliance on agency action is now critical.

Providers ask Supreme Court to weigh in on No Surprises Act enforcement. Two air ambulance companies - Guardian Flight LLC and Med-Trans Corporation - have petitioned the Supreme Court of the United States to review whether providers can use the courts to enforce payment awards under the No Surprises Act ("NSA").[1] The providers argue that, without judicial review, insurers could ignore arbitration awards issued through the NSA's Independent Dispute Resolution ("IDR") process. Enacted in 2022, the NSA established the IDR process to resolve payment disputes between healthcare providers and insurers for out-of-network services - particularly in emergency situations or when patients have no choice of provider. The IDR process functions as a form of binding arbitration: after negotiations fail, both parties submit their best payment offers to a neutral arbiter, who selects one based on factors such as median in-network rates, service complexity, and geographic considerations. This mechanism was designed to remove patients from billing disputes, ensuring they are only responsible for in-network cost-sharing amounts while providers and insurers resolve payment disagreements directly through the arbitration system. At the district court, the air ambulance companies sued Health Care Service Corporation for failing to timely pay dispute resolution awards under the NSA.[2] The district court dismissed the case, ruling that the NSA does not contain a private right of action.[3] In June 2025, the United States Court of Appeals for the Fifth Circuit affirmed the dismissal, agreeing that the NSA does not allow for a private right of action.[4] The Fifth Circuit also affirmed the district court's ruling that the providers lacked standing under ERISA. In their October 8 petition to the Supreme Court, the providers argue that the Fifth Circuit wrongly held that the NSA does not create a private right of action and that providers lack standing under ERISA absent a direct financial injury. The providers assert that these rulings undermine the NSA's intent to create a fair payment mechanism while protecting patients from balance billing. The Fifth Circuit's ERISA ruling conflicts with decisions from the United States Court of Appeals for the Sixth and Eighth Circuits, setting up a potential circuit split on whether beneficiaries (and by extension, providers) may bring similar claims without showing out-of-pocket loss. The outcome of this petition could significantly affect how providers enforce arbitration awards under the NSA and pursue payment disputes with insurers. [1] See Guardian Flight LLC v. Health Care Serv. Corp., 735 F. Supp. 3d 742 (N.D. Tex. 2024) here.