Out-of-network billing is 'out of control,' report finds