There are inadequate consumer protections from harmful medical billing practices that result in unavoidable, unexpected, and often financially devastating medical bills. The problem stems from increasing cost shifting to patients underway in American health care and the inordinate complexity that makes health care transactions nearly impossible for consumers to navigate. A particularly outrageous exemplar is the phenomenon of surprise medical bills, which refers to unanticipated and involuntary out-of-network bills in emergencies or from out-of-network providers at in-network facilities. Other damaging medical billing practices also include the opaque and a la carte nature of medical bills, epitomized by added “facility fees,” as well as harsh medical debt collection and credit reporting practices. The impetus of this article was driven by the simple questions: are these harmful health care billing practices legal? And if so, what can be done to protect patients as consumers? The questions are simple but the answers are not. This article canvasses a growing body of financial protections under federal and state law for health care consumers and concludes that, notwithstanding these significant efforts, consumer financial protections are inadequate for most health care consumers in this country. The article sets forth a model set of policy reforms that build upon state reforms to protect health care consumers. The biggest gaps in protection, however, are structural ― most states have not adopted robust health care consumer financial protections, and even if many more states did, ERISA preempts many state efforts to protect health care consumers for the large and growing number of consumers insured by self-funded employer health plans. Despite salutary state innovation in the area of patient financial protection, a growing ERISA vacuum means a federal solution is necessary to protect all health care consumers from medical-billing abuses.