Good journalism helped drive change on surprise bills—but these loopholes in the law deserve scrutiny