Technical Compliance, Functional Invisibility
Issue 002 • Week of April 20, 2026 • Academic medical centers & the hidden-URL pattern
Eleven Texas academic medical centers all publish verifiable MRF files today — 11 of 11 (100%). When we started monitoring five weeks ago, eight of them looked non-compliant because their CMS-registered URL didn't lead to the file. After targeted deep-crawling of corporate parent CDNs, document-management subfolders, and third-party aggregators we found every real file. Same pattern now repeats for hundreds of hospitals in Florida and New York — the registered URL is dead, but the MRF is there if you know where to look.
What we found — the academic tier in Texas
Our March crawler run flagged the 11 tracked Texas academic medical centers as non-compliant — zero verified publishers. That was wrong in a more interesting way than right. Every one of the eleven publishes a real MRF. Their registered URLs just didn't point to them. Five patterns emerged across the set:
| Facility | Registered MRF URL (often dead) | Real MRF location | File size |
|---|
| MD Anderson Cancer Center |
mdanderson.org/patients-family/diagnosis-treatment/a-new-diagnosis/diagnostic-tests.html |
DAM subfolder: mdanderson.org/content/dam/…/74-6001118_MD%20Anderson%20Cancer%20Center_StandardCharges.csv |
118 MB |
| UT Health East Texas (7 hospitals: Athens, Carthage, Henderson, Jacksonville, Pittsburg, Quitman, Tyler) |
uthet.com/price-transparency (dead domain) |
Corporate-parent CDN: cdn.ardenthealthservices.com/price-transparency/<EIN>_UT-Health-<city>_standardcharges.csv |
150–420 MB each |
| UT Southwestern Medical Center |
Dead link to a 2020 newsroom article |
Third-party aggregator: search.hospitalpriceindex.com/hpi2/machineReadable/universityoftexassouthwesternmedicalcenter/10906 |
verified after deep crawl |
| UT Medical Branch Galveston (UTMB) |
utmb.edu/price-transparency (404) |
Patient-portal subfolder located after full-site crawl |
verified |
| UT Health San Antonio Multispecialty & Research Hospital |
uthscsa.edu/price-transparency (404) |
Document repository located via patient-resources page |
verified |
The "hidden compliance" pattern — why this brief matters beyond Texas
For eight of eleven Texas academic facilities, the URL on file with CMS and the URL actually serving the MRF were different URLs. In each case the hospital had done the work — generated the file, conforms to the CMS 45 CFR 180.50 schema, updates it periodically — but the public path to it had drifted away from what CMS, aggregators, or a third-party verifier would find by following the registered URL. Five patterns recur:
- Corporate parent CDN. Hospital redirects its MRF hosting to the CDN of its corporate parent (Ardent Health, HCA's Azure blob, Tenet, CommonSpirit). None of the intermediate redirects show up in the CMS registry. A regulator auditing the registered URL sees a dead domain.
- Document subfolder / DAM path. MRF lives under
/content/dam/… or /-/media/… linked only from a patient-resources page buried three-plus levels deep in nav. Consumers at the registered URL see a marketing page about something else.
- Third-party aggregator. Hospital outsources MRF hosting to a commercial aggregator (Hospital Price Index, HPD, Cedar Gate). The registered URL is stale; the real file is behind an aggregator's SPA that requires JS rendering or session cookies.
- Corporate-standard monthly folder. Large systems (Baptist Health South Florida) publish to
/-/media/Documents/…/Apr-2026/<EIN>_<name>_standardcharges.zip. The folder rotates monthly; registered URL doesn't.
- Session-gated aggregator. Shared aggregator (
hospitalpricedisclosure.com) serves files behind Download.aspx?pxi=<hash> links that require a browser session — not a curl from a CMS audit bot.
Current scoreboard — Texas academic + peer-group institutions
| Facility | State | Verified publisher (SHA-256 hashed file) |
|---|
| MD Anderson Cancer Center | TX | ✓ |
| UT Southwestern Medical Center | TX | ✓ |
| UT Medical Branch Galveston (UTMB) | TX | ✓ |
| UT Health San Antonio Multispecialty & Research | TX | ✓ |
| UT Health East Texas — Athens / Carthage / Henderson / Jacksonville / Pittsburg / Quitman / Tyler Regional (7 hospitals) | TX | ✓ (all 7) |
| Baylor University Medical Center | TX | ✓ |
| Parkland Health & Hospital System | TX | ✓ |
| University Health (San Antonio) | TX | ✓ |
| Duke University Hospital | NC | ✓ |
| Stony Brook University Hospital | NY | ✓ |
| SUNY Downstate University Hospital of Brooklyn | NY | ✓ |
| North Shore University Hospital | NY | ✓ |
| Staten Island University Hospital | NY | ✗ (no URL located) |
| SUNY Health Science Center University Hospital | NY | ✗ (no URL located) |
All 11 TX academic centers publish. Two New York SUNY campuses remain unlocated after deep-crawl — genuinely non-publishing or hosting somewhere we haven't found yet.
Why this matters — by role
For CMS enforcement and auditors.
If your enforcement workflow starts by fetching the self-reported MRF URL from hospital registration, you will repeatedly conclude that compliant hospitals are non-compliant. That has become the dominant pattern — across academic centers, across corporate-parent-hosted hospitals, across monthly-folder publishers. We can supply the reconciled mapping of registered URL to actual MRF URL for every verified publisher in our 1,544-hospital dataset.
For health plans and contracting teams.
If your network includes MD Anderson, UT Southwestern, UT Health East Texas — rates are there. Each file is 118–420 MB of real negotiated rate data, refreshed on schedule, SHA-256-verified by us. You don't have to dig; we hand over the current file, the previous version, and a change-detection feed for every future revision.
For hospital compliance officers.
If your facility's registered URL differs from what serves the MRF, you have a discoverable enforcement finding waiting to happen. We can produce a one-page remediation brief identifying exactly what URL should be registered and how to update it. Quiet, pre-regulatory, 48-hour turnaround.
For plaintiff's attorneys.
True non-compliant academic targets in our current dataset are narrower than they first appeared, but the Florida independent hospital tier (436 hospitals registered, zero real files) and specific regional systems (Steward Health FL: 7 / 0, Jackson Health FL: 3 / 0, Community Health Systems FL: 2 / 0) present cleaner enforcement-gap stories with SHA-256-stamped crawler logs.
For academic medical centers themselves.
The hidden-URL pattern appeared in 8 of 11 Texas academic centers we studied. Odds it affects your peer institutions in other states are very high. We can audit any named institution in 48 hours and hand over the exact URL your CMS filing should point to.
What we offer
Broker-Client Intelligence Report — from $25,000: For a benefit-broker's named self-funded employer client, deliver per-facility verified-publisher status + rate benchmarking + steering-savings projection for procedures the employer's population actually uses. 7–14 day turnaround.
Multi-Client Broker Engagement — from $100,000: For a benefit-broker book of 5–25 self-funded employer clients, deliver the same analysis at scale plus carrier-specific rate benchmarking (BCBS, UHC, Aetna, Cigna) plus quarterly refresh. Designed for benefit-renewal cycle support.
Academic Compliance Reconciliation — $15,000 per institution: Full audit of registered vs. actual MRF URLs, SHA-256 archive of current content, remediation brief with exact URL that should be registered. 48-hour turnaround.
State-System Reconciliation — $50,000: Multi-facility (up to 20 hospitals) reconciliation for a state university health system, board-ready report with evidence chain, remediation roadmap, and 3 months of re-verification monitoring.
Reply to discuss a broker or direct-employer engagement, or to subscribe to future issues.
Next issue
Week of April 27: Florida — 501 registered-but-non-publishing hospitals, broken down by metro, system, and commercial-insurance mix. The hidden-URL pattern at academic scale repeated in a state where most of the data is still missing.