Fake No Surprises Act IDR (Independent Dispute Resolution) balance-billing open-negotiation lure — "Out-of-network bill — open negotiation period expires in 30 days, action required via patient portal" targeting both patients and providers caught in NSA balance-billing disputes. NSA IDR backlog 2025-26 + CMS portal updates make the deadline-expiring framing credible. Real IDR submissions go through cms.hhs.gov / nsa-idr.cms.gov / portal-iv.cms.gov, never via third-party portal. Source: GC1 R8 multiagent council top-5 (S2 healthcare specialist).

Fake No Surprises Act IDR (Independent Dispute Resolution) balance-billing open-negotiation lure targeting both patients and providers caught in NSA balance-billing disputes. The phish narrative arrives as: "No Surprises Act IDR open negotiation period for your out-of-network balance billing claim expires in 30 days — action required via patient portal," or "Out of network independent dispute resolution deadline expiring — submit through NSA IDR portal." The NSA IDR backlog 2025-26 (CMS reported 100,000+ disputes pending decision Q4 2025) plus ongoing CMS portal updates make the deadline-expiring framing credible enough that even patients with active legitimate disputes can't pattern-match the phish. Lookalike portals harvest insurance member-ID, DOB, billing-zip, claim-number, and provider NPI — sufficient data for downstream insurance-claim fraud and synthetic-identity creation. Real NSA IDR submissions go through cms.hhs.gov / nsa-idr.cms.gov / portal-iv.cms.gov; CMS never demands portal re-authentication via inbound email link, and the open-negotiation period under NSA Section 9817 has fixed regulatory timelines (30 business days from the QPA notice) that legitimate notices reference precisely, not vaguely. Compromised victims face illegitimate balance-billing settlements credited to attacker-controlled accounts plus PHI exposure. Distinct from generic-medical-bill-collection lures — this signal is specifically the No Surprises Act / IDR / open-negotiation regulatory framing. Fires when body references No Surprises Act / NSA / balance billing / out-of-network / independent dispute / IDR / open negotiation AND contains deadline / expires / action-required / portal / submit / negotiation-period urgency. Excludes cms.hhs.gov, cms.gov, nsa-idr.cms.gov, hhs.gov, and the broader .gov umbrella. Auto-classified as danger via the `-lure` suffix. Source: GC1 R8 multi-agent council top-5 (S2 healthcare specialist).