{"generated_at":"2026-10-03T01:35:00Z","title":"US hospital GHP machine-readable-file census: what actually serves, in what format, at what size","description":"Three dated probes of the CMS Hospital General Price Transparency (GHP) machine-readable-file (MRF) universe. Population = the public ghp-compliance tracker: 3,983 file URLs at the 2026-09-29 snapshot, 3,988 at 2026-10-02 (+5, live churn). N=25 (seed 42, direct egress, 2026-09-29/30) and N=99 (seed 7, tunnel egress, 2026-10-02) stratified samples of that URL list, a two-egress retry of every unreachable row, and a data.cms.gov DCAT-US diff. Format = magic bytes of the bytes actually served (the HTTP content-type is what the operator claims; magic bytes are what the consumer parses). CC BY 4.0. Cite as api.pennyforge.org/hospital-prices. Companion article: dev.to, 'Where hospital price files actually live in 2026' (2026-10-02).","population":{"source":"public ghp-compliance tracker (GitHub) — hospitals' self-declared 45 CFR 180 pointers","hospital_records":5419,"urls_at_2026_09_29":3983,"urls_at_2026_10_02":3988,"churn":"+5 URLs in four days — the list is alive; files are added and dropped weekly","top_domains":[{"domain":"healthcare.ascension.org","urls":63},{"domain":"providence.org","urls":44},{"domain":"hcafloridahealthcare.com","urls":44},{"domain":"adventhealth.com","urls":41},{"domain":"healthy.kaiserpermanente.org","urls":36},{"domain":"avera.org","urls":35},{"domain":"dignityhealth.org","urls":34},{"domain":"mercy.net","urls":31},{"domain":"upmc.com","urls":28},{"domain":"bswhealth.com","urls":26}],"urls_note":"raw pointer rows with an MRF URL; the 2026-10-02 article reported 3,977 distinct URLs from its pull (3,934 distinct in the 2026-10-02 re-pull)"},"n25_first_pass":{"sampled":25,"seed":42,"egress":"direct (US residential host IP)","probed_at":"2026-09-29/30","http_200":17,"oversize_gt_100mb":5,"note":"first pass, superseded by the N=99 run; kept for the trend line","oversize_note":"of the files actually fetched; a further 144 MB file (ccn 050133) was behind a 403 at fetch time"},"n99_census":{"sampled":99,"seed":7,"egress":"tunnel (Mullvad, datacenter-ish US vantage)","probed_at":"2026-10-02","http_status":{"200":81,"403":11,"406":1,"ERR":6},"served_format_by_magic_bytes":{"csv":26,"octet-non-csv":7,"octet-csv":26,"json":12,"html":4,"zip":6},"csv_served":52,"url_claimed_csv_but_csv_served":49,"note_claim":"of the 49 URLs whose path claims .csv, only a subset actually serves CSV — and URLs claiming other formats (incl. 'dynamic' download endpoints) serve CSV at similar rates; the path extension is not a contract","dynamic_download_endpoints":{"sampled":22,"returned_200":21,"csv_by_magic_bytes":17,"note":"17 of 21 (81%) serve CSV by magic bytes — 14 of them behind a lying content-type"},"size_mb_of_served_files":{"min":0,"p50":28.21,"p90":162.13,"max":251.67},"oversize_gt_100mb":15,"top_domains_in_sample":[{"domain":"adventisthealth.org","n":2},{"domain":"parkview.com","n":1},{"domain":"adventhealth.com","n":1},{"domain":"baptisthealth.com","n":1},{"domain":"mercy.com","n":1}]},"cross_egress_retries":{"method":"every non-200 row re-probed from the other egress (direct <-> tunnel), then a full-body read of the survivors","retried_rows":12,"resolved":[{"ccn":"030062","route":"TUNNEL","bytes":6330597,"served_as":"json-magic","url":"https://hospitalpricedisclosure.com/download.aspx?pi=L*__*5isnkJWsT9OFJEKfZzfA*-*"},{"ccn":"371310","route":"binary-read","bytes":14570474,"served_as":"zip-magic","url":"https://www.mercy.net/content/dam/mercy/en/web-assets/charge-files/263173902_mercy-hospital-healdton_standardcharges.zip"},{"ccn":"380022","route":"TUNNEL","bytes":1291122,"served_as":"csv-like","url":"https://samaritanhealth.pt.panaceainc.com/MRFDownload/samaritanhealth/albany"},{"ccn":"450489","route":"binary-read","bytes":168112,"served_as":"zip-magic","url":"https://s3.amazonaws.com/ycubaa-production-marlin-1-charge-management-public/facilities/741f735f-d6cc-4802-8169-175329ceb889/95-3999999_MedicalArtsHospital_StandardCharges_120723.xlsx"}],"still_unreachable_from_both_egresses":["150006","150022","150193","171329","171357","250136","391303","640001"],"finding":"4 of 12 were egress-sensitivity (a bot wall, not a dead file); 8 are genuinely unreachable from both a US residential and a datacenter-ish vantage"},"data_cms_gov":{"checks":[{"at":"2026-09-29","what":"the machine-readable-files page","result":"gone from data.cms.gov"},{"at":"2026-10-01","what":"slug probe","result":"404","dcat_datasets":3422},{"at":"2026-10-02","what":"slug probe + full DCAT-US diff","result":"404; catalog grew to 3,426 (+4) with exactly one dataset titled 'price' — none is the GHP MRF list"}],"conclusion":"CMS's own catalog no longer links the hospital price files; the files live on a thousand-plus hospital and IT-vendor domains"},"caveats":["Egress matters: most 403/406 failures are bot walls that another vantage passes (4 of 12 confirmed by retry); every count here is vantage-specific","Magic bytes are read from the first chunk of a file that can be 200MB; classification is of the head, not the whole body","The URL list is hospitals' self-declared pointers — a dead URL is a compliance finding, not just a 404","N=99 is a stratified snapshot of 3,988 URLs, not a full census; stratification key = URL-claimed format"],"license":"CC BY 4.0","cite_as":"https://api.pennyforge.org/hospital-prices"}