Methodology, disclaimers & privacy

An Atalaya check is a live read of a hospital’s own public machine-readable standard charges file. We split the report by where each statement comes from, on purpose.

For anything the CMS Schema v3.0 validator evaluates, we run the CMS validator (@cmsgov/hpt-validator) and show its result and its own error messages verbatim. We do not paraphrase them or compute our own compliance judgment on top of them. Where the validator does not run, for example on a JSON file that needs a full download, or a file we cannot reach, we say so rather than invent a verdict.

For facts the validator does not evaluate, reachability, file age, naming, coverage, and enforcement record, we compute each from public data and label it with its source, against 45 CFR 180.50.

It is not a legal determination and not a statement of compliance. We never render “compliant,” “safe,” or “guaranteed.” Any dollar figure is illustrative and conditional, a potential exposure anchored to published penalty notices, not a prediction that any hospital will be penalized. We never observe or state a hospital’s attestation-signature status from outside.

The rule is 45 CFR 180. Covered-hospital identity comes from CMS Hospital General Information and the CMS Provider of Services file. Enforcement facts come from CMS public datasets and published civil-monetary-penalty notices. Findings come from a live check at request time, cached only briefly; we never serve a stale run.

Every check resolves to exactly one hospital, the one you searched. We do not return, compare, rank, or list multiple hospitals on this site. Cross-hospital analysis is a separate product and never appears on the public site.

To show a full report we ask for a work email and verify it, and we record the checks you run. We use this to reply to you and to improve the check; we do not sell your personal information. A shareable result page is set to not be indexed by search engines. You can ask us to delete your data at any time via the contact page.