"The rule requires plans to treat certain services from out-of-network providers and facilities as in-network in applying cost-sharing, such as deductibles and co-insurance.... Similarly, the rule forbids out-of-network providers from billing participants for amounts in excess of the participant's in-network cost-sharing responsibility, subject to the participant's ability to waive this protection in some situations."