What changed
FACT: A final rule (Federal IDR Operations, Federal Register 2026-06-04) now requires group health plans and issuers to register in the Federal IDR portal and to disclose specified information via standardized CARC/RARC codes on any paper or electronic remittance advice sent to non-contracted providers with the initial payment or denial. It also amends open-negotiation, IDR-initiation, eligibility-review, and batching requirements.
Why now
FACT: The mandated CARC/RARC codes create, for the first time, a machine-readable marker inside standard ERA/835 files identifying claims subject to NSA surprise-billing protections. Before this rule, detecting IDR-eligible underpayments required manual claim-by-claim review. HYPOTHESIS: There is a window of months before incumbent RCM platforms fully exploit the new codes; a focused tool that ships against the code specifications early captures the small/mid OON groups incumbents ignore.
Converging signals
Three signals meet at one point: (1) a final rule compelling plans/issuers to emit standardized eligibility codes; (2) a defined recovering class (OON providers, facilities, air-ambulance groups) with money contractually owed to them; (3) a federal portal with rigid, deadline-bound submission mechanics (open negotiation, initiation, eligibility documentation, batching, admin-fee payment). Rule + filer class + portal is exactly the forced-flow convergence shape.
Customer pain
OON provider groups (emergency medicine, anesthesia, radiology, air ambulance) are systematically underpaid on NSA-protected claims and must catch each underpayment, issue an open-negotiation notice, then initiate IDR inside short statutory windows with correct eligibility documentation and batching — or forfeit the money. INFERENCE (labeled in input as such): CMS has reported on the order of hundreds of thousands of IDR disputes per year with billions contested, so missed deadlines and undetected eligible claims are recurring, quantifiable losses.
Who pays
The BENEFICIARY and BUYER are aligned but distinct from the mandated party: plans/issuers are forced to disclose, but the paying customer is the OON provider group recovering money — and more efficiently, the revenue-cycle/billing (RCM) company that serves dozens of such groups. Per-dispute fee or per-seat subscription; white-label to RCM vendors. Fees are not capped by the rule (per input).
Solved today
Manual review of remittances by billing staff; contingency-fee IDR consultants and boutique dispute-management vendors; a few large PE-backed provider groups run in-house tooling. HYPOTHESIS: small and mid-size OON groups and regional RCM firms mostly work from spreadsheets and miss eligible claims and deadlines.
Why current solutions are bad
Manual detection cannot scale to per-claim review of ERA files; contingency consultants take a large cut and prioritize big-dollar batches; deadlines are unforgiving (forfeiture on miss); the new CARC/RARC codes are brand-new and existing workflows don't parse them yet. Incumbent consultants billing a share of recoveries are proof of spend and the wedge: replace a percentage fee with flat per-dispute software pricing.
Proposed product
An IDR ops layer for OON groups/RCM firms: ingest 835/ERA files (SFTP or clearinghouse export), parse the newly mandated CARC/RARC codes to flag NSA-eligible underpaid claims against expected-value benchmarks, generate compliant open-negotiation notices, track every statutory clock (open negotiation, 4-business-day IDR initiation window, eligibility responses, admin-fee payment), assemble eligibility documentation, and apply the amended batching criteria to maximize per-dispute economics. Dashboard + alerts + exportable dispute packages; portal submission assist as a fast follow.
MVP version
A pipeline that accepts a batch of 835 files, outputs a ranked worksheet of NSA-flagged underpaid claims with deadline dates and dollar deltas, plus auto-generated open-negotiation notice PDFs. No portal integration needed for v1 — the detection + deadline layer alone is sellable. Test with public 835 samples and the CMS CARC/RARC guidance specs.
30-day build
Read the full final rule and the CMS code-specification guidance; build the 835 parser and NSA-eligibility flagger; get HIPAA posture in order (BAA template, encrypted storage, access controls — buyable off the shelf, e.g. a HIPAA-compliant hosting stack); recruit 2-3 design partners from RCM/billing communities (HBMA members, emergency-medicine billing groups) with a free retro-analysis: 'send us last quarter's ERAs, we'll show you the money you missed.'
60-day build
Convert retro-analyses into live monitoring contracts; add open-negotiation notice generation and the deadline calendar; sign first white-label conversation with a regional RCM firm; harden batching logic per the amended criteria.
90-day revenue plan
5-10 provider groups or 2-3 RCM firms at $500-1,500/mo platform fee plus $50-100 per dispute prepared. The retro-analysis demo ('we found $X you forfeited') is the demonstrated-value close this founder sells with. Statutory deadlines mean buyers cannot defer once shown live misses.
Distribution path
Direct outreach to OON-heavy specialties' billing managers; HBMA and RCM-industry channels; white-label to RCM vendors who lack the new-code parsing; content SEO on the new CARC/RARC codes (brand-new terms, zero content competition today — HYPOTHESIS).
Pricing hypothesis
$500-1,500/mo per provider group for monitoring + $50-100 per dispute package prepared; white-label per-seat for RCM firms. Deliberately undercuts contingency consultants taking a percentage of recoveries.
Technical difficulty
Moderate. X12 835 parsing is well-trodden (open-source parsers exist); the eligibility logic is rule-following, not ML; deadline tracking is CRUD. Hardest parts: keeping pace with CMS code-specification guidance updates and HIPAA-grade infrastructure. Well within solo AI-assisted range; the founder has shipped a federal-portal production app before.
Legal / regulatory risk
PHI in ERAs requires HIPAA BAAs and real security controls — a cost and sales-friction item, not a blocker (standard for every RCM vendor). Must not give legal advice on dispute merits; position as ops software. Track CMS guidance for code specifications. No finder-fee caps stated in the rule per input.
Platform dependency
The Federal IDR portal is government infrastructure — no deplatforming risk. Dependency on CMS guidance stability for code specs is real but affects all competitors equally.
Founder fit
Very high on the proven-edge pattern: a federal rule creates machine-readable filing/recovery events tied to a federal portal, monetized per transaction — structurally identical to his FMCSA ELDT per-upload business. Caveat (honest): healthcare RCM is a new domain with an existing vendor ecosystem, unlike the greenfield ELDT registry; he'll need a design partner with domain fluency in his first 30 days.
Breakout potential
The ERA-parsing + deadline-clock engine generalizes: state balance-billing arbitration regimes (NY, TX, NJ run their own IDR-like processes) are near-identical replication markets, and the same ingestion layer extends to other payer-underpayment detection beyond NSA claims.
Final recommendation
PURSUE as a top-tier candidate. It survived the kill attempts: money is genuinely owed (reimbursable, not speculative), the buyer is reachable without enterprise procurement (provider groups and RCM firms buy operational tools), spend is proven (contingency consultants exist), the new CARC/RARC mandate is a concrete just-created wedge, and the shape matches the founder's proven federal-portal-per-transaction edge. The honest risks are incumbent response speed and domain entry, not demand. Validate with retro-analyses before building portal automation.
Next action
Pull the full final rule text and the referenced CMS CARC/RARC code-specification guidance; confirm effective/applicability dates (not stated in excerpt); then run one free retro-analysis on a real OON group's 835 files via an HBMA/billing-community contact to quantify missed recoveries — that number is the entire sales pitch.