Who enforces HIPAA?

States enforce the legal requirements on health insurance issuers. If a state does not act in its areas of responsibility, the Secretary of Health and Human Services may decide that the state has failed to “substantially enforce” the law. Federal authority can be used, through the Centers for Medicare and Medicaid Services, to enforce the law and penalize the insurers.

The US Secretary of Labor also has the authority to enforce the health care portability requirements on group health plans under ERISA (Employee Retirement Income Security Act), including self-insured arrangements. And participants and beneficiaries can file lawsuits to enforce their rights under ERISA, as amended by HIPAA.

Can states change HIPAA’s insurance requirements?

The following answer applies to grandfathered plans, those that existed before September 23, 2010. Check with your employer to find out your health care plan’s start date, to learn if it’s grandfathered. If it isn’t, this section does not apply to you.

Yes, in certain circumstances. States may impose stricter requirements on health insurance issuers in the 7 areas listed below. States may:

  • Shorten the 6-month “look-back” period before the enrollment date to decide what’s a pre-existing condition
  • Shorten the 12-month maximum pre-existing condition exclusion periods (or the late enrollee’s 18-month maximum condition exclusion)
  • Count prior insurance coverage as creditable even though there’s been more than a 63-day break in coverage
  • Increase the 30-day period for newborns, adopted children, and children placed for adoption to enroll in the plan so that no pre-existing condition exclusion period may be applied thereafter
  • Further limit the circumstances in which a pre-existing condition exclusion period may be applied beyond the exceptions described in federal law. (The “exceptions” under federal law are for certain newborns, pregnancy, and genetic information in the absence of a diagnosis.) Also remember that the Affordable Care Act law does not allow insurance plans to deny coverage based on pre-existing conditions.
  • Require more periods of special enrollment
  • Reduce the maximum HMO affiliation period to less than 2 months (3 months for late enrollees)

States may sometimes impose other requirements on insurance companies and HMOs. If your health coverage is offered through an HMO or an insurance policy issued by an insurance company, you can check with your state insurance department’s office to find out the rules in your state. Find your State Insurance Department in the blue pages of your local phone book, or visit the National Association of Insurance Commissioners online at www.naic.org/state_web_map.htm.

The American Cancer Society medical and editorial content team

Our team is made up of doctors and oncology certified nurses with deep knowledge of cancer care as well as journalists, editors, and translators with extensive experience in medical writing.

Last Medical Review: May 19, 2016 Last Revised: May 19, 2016

American Cancer Society medical information is copyrighted material. For reprint requests, please see our Content Usage Policy.