The Regulation of Private Health Insurance

Private health coverage is subject to significant requirements at the state and federal levels. While the Affordable Care Act (ACA) of 2010 ushered in many new requirements for the federal regulation of private health coverage, another federal law, the Employee Retirement Income Security Act (ERISA), has for over 50 years regulated the most predominant form of health coverage for people under age 65, employer-sponsored coverage.

States have traditionally been the primary regulators of health insurance, and state health insurance protections continue to play a major role alongside a growing list of federal protections aimed at addressing a variety of consumer concerns, including access to coverage, affordability, and adequacy. This chapter describes the landscape of laws and regulations that address health care coverage and the complicated interactions between state and federal requirements that can make these protections challenging for consumers to navigate. In this chapter, it is not possible to cover every single state and federal requirement for private plans, so the focus is on the primary laws and regulations that apply to private insurance coverage.

Private health coverage is a mechanism for people to finance the health care services and medications they need, protecting them from the potentially extreme financial costs of this care.

At its core, health coverage is a financial contract between a private organization insuring the risk of loss and a policyholder. Where those insuring the risk or paying health claims are private entities such as insurance companies or private employers, this coverage is considered “private.” Coverage available in Health Insurance Marketplaces created by the ACA is considered private coverage, even though the Marketplaces are administered by state or federal government agencies. Public coverage, by contrast, involves financing arrangements for programs such as Medicare and Medicaid, which are paid primarily from public sources. This includes private plans participating in Medicare Advantage and Medicaid managed care arrangements. (See the chapters on Medicare and Medicaid for more information.)

A fundamental concept for the private provision of health coverage is pooling the health care “risk” of a group of people to make the costs of coverage more predictable and manageable. The goal typically is to maintain a risk pool of people whose health, on average, is the same as that of the general population. Private health coverage regulation has historically included steps to prevent insurers and plan sponsors from avoiding people in poor health, while also ensuring that risk pools include people in good health to guard against “adverse selection.”

A risk pool with adverse selection that attracts a disproportionate share of people in poor health, who are more likely to seek health coverage than people who are healthy, will result in increased costs to cover those in the pool, leaving those in better health to seek out a pool with lower costs.

Sources of private coverage. An individual with private coverage generally obtains it through one of two sources, either through their employer (“group” coverage) or by directly purchasing it from an insurer (“nongroup” coverage). Other related sources of coverage don’t exactly fit into one of these two categories, such as coverage provided by professional associations.

1. Employer coverage: In 2023, about 165 million people under age 65 had coverage through an employer. Employer-sponsored coverage is offered to eligible employees and usually to employees’ dependents, such as spouses and children. This coverage is referred to as “group” coverage, which is further broken down into small-group or large-group depending on the number of employees (Figure 1).

Private employers who “sponsor” group health plan coverage could include a range of entities, from a single nationwide retail employer with thousands of employees in many states to a small “mom and pop” operation with a handful of employees in one location. A single union can also be a group health plan sponsor of private coverage as an “employee organization,” as well as entities called “multiemployer” plans that are collectively bargained entities run by a joint board of trustees from labor and management that oversee collectively bargained benefits provided to employees of more than one employer, often in the same industry (for example, hotel workers or skilled workers in the building trades).

Public employers—federal, state, or local government—also sponsor group health coverage. The Federal Employee Health Benefit (FEHB) Program is the largest employer-sponsored health plan in the US. State and local government health plans are often referred to as non-federal governmental plans.

Employers, private and public, have at least two approaches to make coverage available to employees:

• Fully-insured. An employer can purchase coverage from an insurer to cover their employees for a set premium. In this “fully-insured” arrangement, the insurer bears the financial risk if that group of employees ends up costing more than expected; these plans are regulated by the state in which they are sold. Each state has a group market for the sale of health insurance that is divided by size of the group for oversight and regulation: large group and small group.
  • Large Group Insurance Market typically involves insurance products sold to employers with 51 or more individuals (employees).
  • Small Group Insurance Market is generally an employer group of 50 or fewer individual employees. Small employers can purchase small group coverage from an insurer or through the state’s health insurance exchange or Small Business Health Options Program (SHOP). In a handful of states, the SHOP is the only place where a small employer can purchase state-regulated small group insurance coverage.
• Self-insured. Employers can also use a “self-insured” (also often referred to as “self-funded”) arrangement where the employer assumes the financial risk by directly paying all covered claims. The employer typically contracts with a third-party administrator (TPA) to administer benefits by paying claims, designing benefits, establishing provider networks, and coordinating other aspects of coverage. TPAs are some of the same private organizations that provide health insurance as another line of business, as well as organizations called Pharmacy Benefit Managers (PBMs) that administer prescription drug benefits. As a result, coverage may not appear different to the covered worker than if they had fully-insured coverage. As explained in an upcoming section, unlike fully insured health coverage, self-insured coverage provided by private employers is largely not subject to state law but is governed primarily by federal law—mainly ERISA. Self-insuring health benefits are more common among larger employers because they can spread risk over a larger number of enrollees.

2. Individually-purchased insurance coverage: An individual can purchase private health coverage for themselves and their family without the involvement of their employer, referred to as “nongroup” coverage. Every state has an “individual insurance market” that consists of the following:

• Marketplace. The ACA required the creation of health insurance Marketplaces in each state, where individuals can purchase insurance, with federal financial assistance for premiums and cost sharing if eligible. The coverage purchased from a Marketplace must meet certain minimum standards, including coverage of essential health benefits, no preexisting condition exclusions, and limits on varying premiums based on health status (“ACA-compliant” insurance). (See the ACA chapter for more information.)
• Off Marketplace. People can also purchase individual insurance outside the Marketplace where federal financial assistance is unavailable. This could include ACA-compliant plans similar to those offered on the health insurance Marketplaces, and other types of coverage or financial products with lower premiums, but less comprehensive coverage than ACA-compliant plans, such as short-term limited duration coverage, fixed and hospital indemnity arrangements, health care sharing ministries, and others.

3. Other Sources of Private Health Coverage: Other sources of health coverage subject to unique regulatory standards include health coverage provided through entities called “multiple employer welfare arrangements” (MEWAs), “church plans,” and coverage provided by colleges and universities for their students.

• A MEWA is generally any arrangement that provides benefits – in this case, health benefits – to employees of more than one unrelated employer. Historically, MEWAs have been vehicles for organizations to market less expensive health benefits to groups of employers, especially small employers. To address a history of MEWA insolvencies attributed to a lack of proper government oversight, changes to ERISA in 1983 created a complicated regulatory regime just for MEWAs, subjecting them to a mix of federal and state laws.
• One type of MEWA, also governed by ERISA, allows groups of more than one employer to sponsor health coverage for their employees, known as an “Association Health Plan.” Traditionally, these types of plans have been available to groups of small employers in a similar industry, such as those who sell real estate or work in a similar profession. In recent years, federal efforts to expand the criteria for what types of employers may form an AHP have been the subject of litigation and regulations.
• Church plans are offered to employees by a church or association of churches, including entities controlled by or associated with a religion, such as religiously-affiliated hospitals and schools. Unlike other employer-sponsored plans, church plans are exempt from most ERISA requirements and some of the ACA’s health reforms. These regulatory gaps in church plans, including coverage of contraception, have been the subject of numerous legal proceedings.
• A student health plan is any health coverage sponsored by a college or university for students. While it is not group coverage, it can be sponsored by a university in the same way employers sponsor health coverage. The ACA has special rules for this coverage. While an insured arrangement is considered individual market coverage, exceptions allow it to be provided without the insurer having to meet certain ACA market rules. A university can also sponsor a self-insured health plan for students. These arrangements do not have to meet the ACA’s market rules, although states may regulate them.

Most private plans utilize a “network” of health care providers and hospitals, with some plans requiring a referral from a primary care provider (PCP) for enrollees to see a specialist. These types of arrangements, referred to as “managed care plans,” attempt to control costs and utilization through financial incentives, development of treatment protocols, prior authorization rules, and (in limited circumstances) dissemination of information on the quality of provider practices. Most private health coverage, whether employer-sponsored or individually purchased, falls into one of the following types:

All of these plan types are available in the individual market, both on and off the Marketplace. Most employers that offer health benefits offer just one type of health plan, though larger firms may offer more. PPOs are the most common type of health plan offered by employers.

Other employer-sponsored health coverage arrangements: Employers also can offer a Health Reimbursement Arrangement (HRA), which is an employer-funded group health plan, sometimes paired with a high-deductible health plan (HDHP), that reimburses an employee up to a certain amount for qualified medical expenses and, in some instances, health insurance premiums. Reimbursements are tax-free to the employee, and amounts in the account can carry over to the following year, but employees lose any amounts when they leave the employer. Other variations of HRAs include an Individual Coverage HRA (ICHRA), where an employee can use funds in the HRA to purchase individual insurance either on or off the Marketplace. Qualified Small Employer Health Reimbursement Arrangements (QSEHRAs) are HRAs that certain small employers can make available for tax-free reimbursement of certain expenses.

Health Savings Accounts (HSAs): HSAs are tax-advantaged savings accounts that enrollees in certain HDHPs can use to pay for qualified medical expenses. While the HDHP associated with an HSA is usually sponsored by an employer or obtained through a Marketplace plan, the HSA itself is not usually considered employer-sponsored coverage (in contrast to HRAs). HSAs are owned by the individual and are portable, meaning consumers can carry them from job to job and use them after retirement.

Value-Based Arrangements: Some private health plans utilize “value-based” coverage and alternative payment models. These designs, primarily used in federal Medicare and Medicaid demonstration projects, aim to make providers more accountable for patient outcomes through various financial and other incentives. The objective of value-based care design is to shift the fee-for-service reimbursement model of paying for care based on “volume” to a system that pays based on the “value” of a service. Demonstration results to date have not shown major savings, but these designs are still discussed as a potential cost-containment tool for private health coverage. Payers and providers have also looked to value-based payment models to improve health disparities and to provide more patient-centered care.

The regulatory framework for private health coverage has evolved into a complicated system of overlapping state and federal standards. This federalism framework creates a sometimes precarious “marriage” between state and federal authority in order to implement health policy goals.

1. States lead on insurance regulation, but with a federal fallback for most protections.

The regulation of insurance has traditionally been a state responsibility. States license entities that offer private health insurance and have a range of insurance standards, including financial requirements unique to state law. However, the federal government has played an increasingly significant regulatory role over the past 50 years.

The federal pension law, ERISA, passed in 1974, applies to insured and self-insured private employer-sponsored health coverage with similar legal and enforcement mechanisms to protect individuals covered by private group health plans as those created for pension plans.

Separately, the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) created new federal requirements and the basic framework for how state and federal law now interact. Under this “federal fallback” structure, states may require that insurers in the group and individual market (as well as state and local government self-insured plans) implement federal requirements on health coverage. If a state fails to “substantially enforce” the federal requirements, the federal government will enforce those protections. The federal fallback framework was intended to allow states to continue to regulate private coverage while ensuring that all consumers nationwide have a floor of federal protections when a state fails to implement them.

The federal fallback framework does not apply to self-insured employer-sponsored coverage. The U.S. Department of Labor (DOL) almost exclusively regulates private self-insured employer-sponsored plans. The Center for Medicare and Medicaid Services (CMS) directly enforces federal protections against state and local government self-insured employer plans (although states can also do so).

2. ERISA limits the application of state law for those with private employer-sponsored coverage.

ERISA specifically “preempts” or prevents state law from applying to most self-insured group health plans, limiting the scope and application of state protections for many Americans covered by employer-sponsored plans.

Aspects of this preemption have been the topic of almost 50 years of litigation, resulting in three overall conclusions:

• Most state insurance laws, including state benefit mandates, don’t apply to self-insured ERISA plans, resulting in fewer regulatory requirements on these plans than on fully-insured plans.
• State insurance laws generally do apply to fully-insured ERISA plans.
• ERISA provides exclusive, yet limited, civil remedies for enrollees in ERISA plans who are harmed due to a violation of the law.

Today, some argue that ERISA preemption sustains the employer-based health coverage system because meeting an ever-growing list of state laws would be costly for employers, particularly those with employees in multiple states. Having national uniform standards, they argue, provides employers with an incentive to offer coverage. Others argue that preemption handcuffs states’ ability to protect consumers and control health care costs and that it is no longer needed given the ACA’s employer shared responsibility provision for larger employers and the increased regulation that applies a variety of rules to both fully-insured and self-insured plans. Prospects for change are limited, but some have explored the possibility of alternative approaches.

3.  Federal regulation of private health coverage can differ based on the market/source of coverage.

Private health insurance regulations vary based on the insurance market and the source of coverage. This is in part due to ERISA preemption and the ACA, which applies many reforms only to the individual and small-group markets.

Further complicating this are plans that existed before the ACA was passed, called “grandfathered” plans, that do not have to meet many of the ACA standards, so long as no significant changes in cost sharing and benefits are made to the plan.

The ACA did, however, alter federal law to create a large number of consumer protections that apply many of the same regulatory requirements across almost all sources of private health coverage. (See Table 7.)

Finally, some federal standards only apply to employer-sponsored plans (insured and self-insured) that are governed by ERISA, such as the requirement on employers with 20 or more employees to provide temporary continuation of coverage in certain situations, known as COBRA, which also applies to certain state and local government employers. There are also obligations on plan “fiduciaries” that are unique to ERISA plans.

This all means consumers can have different legal protections with their private coverage based on their coverage type and the state where they live.

4. Special exceptions in regulations allow certain types of private coverage to avoid having to meet many insurance protections.

Some private plans are specifically exempt from most federal private health coverage protections, including the ACA. These forms of coverage are often called “non-ACA compliant” coverage. While “non-ACA compliant” does not automatically mean it is illegal or inappropriate, some forms of this coverage have come under increasing scrutiny by federal and state authorities due to their gaps in consumer protections.

These types of coverage fall into these general categories:

• Coverage that is an “excepted benefit” is specifically carved out of most of the ACA and other federal requirements. Some are considered health coverage under federal law, such as certain dental and vision benefits, and other forms of coverage may not be, such as fixed and hospital indemnity, cancer-only coverage, accidental death and dismemberment, and long-term care coverage. (This Health Affairs article provides a more detailed description of excepted benefits.)
• Short-term limited-duration coverage and other forms of coverage are not regulated as health insurance under federal rules (as mentioned in the previous section).
• Employer-sponsored plans with less than two participants who are current employees. This exception was included in the 1996 HIPAA law and has been interpreted as excluding employer-sponsored plans that cover only retirees from many federal insurance requirements.

Some of these forms of coverage are the focus of business promoters looking to market cheaper, largely unregulated forms of coverage. In some instances, this coverage might be promoted by unscrupulous actors who falsely market the coverage as meeting ACA requirements or as providing comprehensive coverage. In other cases, coverage is sold as supplemental “health” coverage along with ACA-compliant health insurance, sometimes with very high deductibles. These exceptions to the ACA’s broad coverage requirements can operate as loopholes in the implementation of consumer health coverage protections and may create ambiguities for consumers as well as employers.

5. Tax regulation matters for cost and access to health care and coverage.

Central to evaluating how private coverage works are the tax subsidies that reduce the cost of coverage and benefits, which can incentivize employers to sponsor and individuals to purchase private health coverage. Tax regulations also interpret what medical expenses (as opposed to general wellness or other non-medical expenses) get a tax preference.

The largest health care tax subsidy is applied to employer-sponsored coverage. Tax-exempt employer contributions for medical insurance premiums and medical care resulted in more than $224 billion in lost revenue for the federal government in 2022. Employer-sponsored health coverage is excluded from federal income tax, as well as federal employment taxes (and equivalent state taxes). The exclusion also applies to amounts reimbursed to employees by an employer under arrangements called “health flexible spending arrangements” (health FSAs), where an employee elects to have amounts withheld from their wages to pay for medical expenses. The exclusion provides considerable tax savings for employers and employees making contributions toward health coverage. The value of this exclusion increases as income increases, making income tax savings greater for higher-income individuals than for lower-income individuals. For various policy reasons, including to rein in health care costs, there have been efforts to change or cap this exclusion over the years, but to date, none have been successful. The most recent, the “Cadillac tax” provision of the ACA, was removed from the law before it was implemented (see the Employer-Sponsored Health Insurance chapter).

Additionally, the ACA created refundable tax credits based on household income to help individuals purchase coverage on a health insurance Marketplace (see the Affordable Care Act chapter). In contrast to the employer exclusion, tax subsidies for Marketplace participants are higher for those with lower incomes. Temporary increases in these credit amounts, passed as part of the American Rescue Plan and the Inflation Reduction Act, have led to record Marketplace enrollment. Unless Congress extends them, the temporary increases expire at the end of 2025. Unlike employer-sponsored insurance, Marketplace enrollees who pay a premium for their individual market insurance coverage generally do so with after-tax dollars (although an employer can sponsor tax-advantaged ICHRAs or QSEHRAs, as described above, to help employees pay for Marketplace and other individual market coverage).

In addition to the tax advantages related to employer-sponsored health coverage and tax subsidies received by lower-income individuals with Marketplace coverage, HSAs bring their own set of tax advantages for those who use funds in the account to pay for cost sharing and for items the IRS includes as qualified medical expenses. In 2025, a federal budget reconciliation law was enacted that may increase the use of HSAs.

The scope and extent of federal regulation affecting private health coverage has vastly increased, especially with the passage of the Affordable Care Act (ACA) in 2010. The ACA largely retained the framework for the regulation of private coverage, adding a long list of new provisions to different regulated pieces of our fragmented health care system. This means specific and overlapping requirements on insurers, employer-sponsored plans, and, more recently, in the No Surprises Act, also on providers.

The ACA also unleashed a firestorm of activity resulting from longstanding political and philosophical differences on the role of federal government regulation of health care. Efforts to repeal and replace the ACA in 2017, several U.S. Supreme Court cases challenging ACA provisions, and hundreds of other cases in the lower courts on the ACA and other federal requirements mean the law in this area has and will continue to be in flux.

Regulatory priorities can and have shifted depending on what party controls the White House and Congress, resulting in ever-changing federal standards. This section reviews the current landscape of federal requirements. A discussion of every single relevant federal regulation is beyond the scope of this chapter, but the major requirements have been divided into six categories:

• Access to health coverage
• Affordability of health coverage
• Benefit design and adequacy
• Reporting and disclosure of information concerning coverage
• Review and appeal of health claims
• Other federal standards

1. Access to coverage

Federal health care reform has prioritized expanding health coverage to those without it for quite some time, especially for those not eligible for a public program such as Medicaid or Medicare, or who do not have coverage through their current employer. Prior to the passage of the Affordable Care Act in 2010, state laws and regulations were designed to address the potential for adverse selection in health insurance by allowing insurers to engage in certain practices such as “underwriting,” which allowed insurers in the individual and group markets to decline to cover or renew coverage due to a person’s health status or a group’s claims history, and helped plans maintain predictable and stable risk pools. Further, an insurer could cover the applicant, but charge a higher premium based on age, health status, gender, occupation, or geographic location. In addition, insurers could exclude benefits for certain health conditions if the person was diagnosed or treated for that condition before becoming insured (a “preexisting condition exclusion”).

States made some reforms, particularly in the small group market, to address these barriers to coverage. Some of these changes became part of the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996. However, it was not until the ACA that the regulation of private insurance, at least for the individual and small group markets, was fundamentally changed.

Core Private Insurance Coverage Protections. The ACA established core market rules designed to expand coverage to most people in the U.S. New ACA legal requirements include:

Requirements for premium stabilization and other efforts to protect the risk pool. The ACA’s private insurance market regulations also ushered in concerns that its protections, including guaranteed issue and the elimination of health underwriting for some coverage, would result in adverse selection (discussed in the first section). Regulatory efforts to prevent adverse selection have also focused on certain plans and products that do not have to meet most of the ACA rules, such as short-term limited-duration plans. Non-ACA-compliant coverage may be attractive to consumers looking for lower monthly costs, but these plans can leave consumers underinsured and may compromise the risk pool by drawing out healthier individuals.

Federal guidance and regulation aimed at protecting the risk pool as part of the ACA include:

Standards to prevent coverage gaps. Access to coverage is also enhanced by federal requirements to provide for the continuity of coverage or care to prevent gaps for those who do or could lose coverage, including:

2. Financial Protection and Affordability

High costs, in the form of both premiums and cost sharing, have been a defining feature of employer-sponsored and individually-purchased (for unsubsidized enrollees) health coverage. Federal reforms have sought to address the stability and affordability of health insurance. Key provisions include:

3. Benefit Design and Adequacy

Federal requirements also include a list of minimum standards for how a plan is designed or operated in an effort to ensure that enrollees have coverage that is comprehensive enough to cover medically necessary care, with processes that do not unnecessarily limit access to covered benefits. Such requirements include laws that prohibit plans from imposing annual dollar limits on coverage or requiring waiting periods longer than 90 days before employer-sponsored coverage kicks in. States may have additional benefit mandates for state-regulated plans, such as comprehensive coverage requirements for mental health or substance use disorders or fertility services.

Required coverage.

The ACA requires all private, non-grandfathered health plans to cover preventive services with no cost sharing for enrollees. These requirements change over time as preventive service recommendations are updated and new services are added. In general, these include:

The preventive care coverage requirement has been the subject of extensive litigation since the ACA was passed. KFF briefs provide more detail on this litigation and a 2025 U.S. Supreme Court decision involving ACA preventive care standards. The contraceptive coverage requirement has been the topic of two U.S. Supreme Court cases and several regulations, now allowing employers to not cover contraception if they have a religious objection.

Other required design standards across most health plans.

Large group, small group, individual, and self-insured health plans are required to abide by other benefit design standards that aim to contain out-of-pocket costs and improve access to quality care. These design standards include:

Design standards limited to individual and small group plans. Federal requirements on health plan design standards for certain segments of the individual and small-group markets have evolved since the ACA was passed. Plans must meet these rules as part of annual certification requirements for qualified health plans. Examples of these standards include:

4. Disclosure, Reporting and Transparency

The 2023 KFF Survey of Consumer Experiences with Health Insurance found that most Marketplace and employer-sponsored insurance (ESI) enrollees reported difficulty understanding some aspect of their health insurance compared to consumers enrolled in Medicaid and Medicare:

Lack of information or understanding about key features of an individual’s health coverage can put patients at financial risk and result in negative health outcomes. Employers and other health purchasers have also struggled to get the information they need to make prudent decisions about cost-effective coverage options and hold their service providers accountable for their plan designs, contracting, and administration activities. Regulations have increased over time to make more information available to enrollees or prospective enrollees, as well as to federal agencies to conduct their oversight responsibilities. What to disclose and how much information is useful is a continuing policy challenge.

Most federal disclosure, reporting, and transparency requirements fall into two categories: Disclosure of information to enrollees and/or the public (Table 9) and reporting to the federal government (Table 10). Note that the requirements provided in these tables are not exhaustive, but include examples of some of the main reporting, disclosure, and transparency requirements that plans, providers, and facilities are subject to.

Ongoing reporting by private plans to federal agencies is a tool for agency oversight to assess compliance with regulations and evaluate trends. In some instances, agencies are required to use this information to report aggregate information to the public and Congress.

5. Claims and Appeals Processes

Access to a fair system of review for consumer grievances about plan actions and claims denials has been a key element of federal consumer protection.

A 1997 Clinton Administration initiative, the Patient Bill of Rights, resulted in several federal agencies taking regulatory actions to enhance consumer protections for patients and workers. As part of this initiative, the DOL updated claims and appeals rules that applied to private-sector employer plans regulated by ERISA to make the claims review process:

• Faster (shortened timeframe for plans to make a decision on claims and appeals)
• Fairer (ensure plan decision makers were free of conflicts of interest)
• Fuller (more transparent through the disclosure of more information to consumers–including language access standards–about the reason for a claim denial)

The DOL issued regulations in 2000 governing the “internal” claims review process, conducted internally by a plan or plan-sponsor employer. For the first time, these updated rules accounted for managed care features such as prior authorization, where health plans determine medical necessity before the plan covers an item or service, requiring, for example, shorter time frames for claim decisions and appeals for these “pre-service” claims.

These rules were the basis for reforms applied across all private health coverage in the ACA. These reforms established a federal floor of protections for the internal claims and appeals process and added an option for consumers to appeal denied claims through an “external review” by an entity independent of the plan. Only certain types of claims, such as those that involve clinical judgment, are eligible for external review.

Policymakers have renewed scrutiny of the prior authorization process, as well as claims review and appeals generally. Claims and appeals standards that apply to Medicare Advantage plans, Medicaid, and some Marketplace plans were updated in 2024 to reduce delays in decision-making and to provide more transparency about the outcomes of claims and appeals decisions.

6. Other Federal Standards

Several other federal laws and regulations provide consumer protections in private health insurance, often indirectly, that sometimes have stronger enforcement mechanisms and penalties than federal insurance laws. These include:

Civil Rights Law. The Civil Rights Act of 1964 (and later amendments to it, including the Pregnancy Nondiscrimination Act) and the Americans With Disabilities Act of 1990 created protections against discrimination based on race, color, national origin, sex, age, and disability. At a minimum, these standards apply to employers with 15 or more employees, and, in effect, regulate those employers’ group health plan coverage.

Section 1557 of the ACA is a nondiscrimination provision that potentially applies many existing civil rights laws directly to health care entities, including insurers that receive federal funds. The extent of its reach has been the subject of several sets of regulations, with the iteration issued by the Biden administration addressing Section 1557’s ban on sex discrimination (among other issues) and reinstating protections against discrimination for LGBTQ+ people seeking health care and coverage, including for gender-affirming care. Trump administration actions will likely seek to undo this requirement and place restrictions on gender affirming care that the courts will be tasked with evaluating in the years to come.

Antitrust Laws. Antitrust laws in health care prohibit anticompetitive practices and mergers by health care providers, hospitals, and insurers, which can reduce competition and increase prices. As provider consolidation increases, federal agencies such as the Department of Justice (DOJ) and the Federal Trade Commission (FTC) have engaged in enforcement initiatives in recent years. Health insurers have also faced antitrust scrutiny as the market shares of the largest health insurers continue to dominate in most locations. Oversight of pharmacy benefit managers, now mostly owned by or affiliated with the largest health insurers, is one area of focus where Congress continues to debate whether additional standards are warranted, and state attorneys General are increasingly focusing their attention.

Privacy Laws. As digital health technology has advanced, so have concerns about protecting consumer health information, as the fast development of new technology (e.g., health-related apps, artificial intelligence) has made it difficult for regulation to keep up. The leading federal privacy requirements for health plans’ use of certain patient information, set out in HIPAA regulations, are now almost 25 years old. Efforts to update this regulation have been discussed, but have not yet been finalized. Updates to the HIPAA privacy rules were proposed toward the end of the first Trump administration. Updates to HIPAA’s security standards were proposed at the end of the Biden administration. It is unclear whether renewed proposals in this area are imminent. Regulatory changes to HIPAA in 2023 aimed at clarifying reproductive health care privacy were struck down by a federal court in 2025. The FTC has sought to regulate areas not covered directly by HIPAA, such as software applications increasingly marketed as part of health coverage. Continuing federal efforts to advance electronic information sharing (known as “interoperability”) will mean renewed calls for increased federal privacy and security protections.

Special privacy protections for substance use disorder information are regulated under a law known as “Part 2.” This law aims to protect the confidentiality of this information while still allowing providers to share patients’ mental health and substance use disorder information with plans and others to coordinate care and administer benefits.

Gag Clauses. Plans and issuers are prohibited from entering into an agreement with a provider, third-party administrator, or other service provider (including pharmacy benefit managers) that restricts the plan and issuer from accessing claim, cost, or quality information on providers, enrollees, plan sponsors, and other entities, known as a “gag clause.” Plans and issuers must annually submit an attestation of compliance with these requirements to the federal government.

Three federal agencies have overlapping jurisdiction for most federal regulation of private health plans: the U.S. Department of Health and Human Services (HHS), the U.S. Department of Labor (DOL), and the U.S. Treasury Department. Through a structure created by HIPAA in 1996, these three agencies jointly issue regulations and other guidance on laws passed by Congress that place the same or similar standards across all private plans.

The same or similar federal requirements for private health plans are typically contained in three separate statutes that each agency oversees:

As an example, if Congress passes a federal law that requires all insurers of individual and group coverage and all employer-sponsored plans to meet a certain standard, any regulations issued to implement that standard are usually issued jointly by HHS, DOL, and Treasury with separate but identical language added to the Public Health Service Act (PHSA), ERISA, and the Internal Revenue Code (IRC). However, each agency has its own requirements for how these laws are enforced. In addition to these overlapping authorities, each of these three agencies has exclusive federal authority over certain aspects of private health insurance regulation (though the federal authority might be shared with states in some instances):

Other agencies with important oversight roles of private health coverage include:

• HHS’s Office of Civil Rights: Implements HIPAA’s administrative simplification standards; ACA section 1557 nondiscrimination rules
• HHS’s Office of the National Coordinator: Coordinates efforts to implement and use health information technology and health information exchange
• HHS’s Food and Drug Administration: Regulates clinical investigations and supervises the safety of pharmaceutical drugs, biological products, and medical devices
• Department of Justice: Antitrust enforcement
• Federal Trade Commission: Antitrust enforcement
• Equal Employment Opportunity Commission (EEOC): Nondiscrimination in health coverage and wellness program standards

As the executive branch of the U.S. government, the federal government has the authority to execute laws passed by Congress and signed by the President, including issuing regulations to operationalize and implement a statute. In addition, specific agencies have the authority to investigate violations of the law and enforce the law through policy form review, market conduct exams, assessment of penalties, and/or bringing a court action to stop an insurer from violating the law (called an injunction).

Regulations and Other Guidance

Process: The federal regulatory process is governed primarily by the Administrative Procedure Act (APA). This law, along with specific executive orders, governs the process known as “notice and comment rulemaking,” where regulations are proposed (through a notice of proposed rulemaking or “NPRM”) and are subject to public comment for a certain period of time and then finalized. The process is administered by the Office of Management and Budget (OMB), an agency within the Executive Office of the President. The OMB’s Office of Information and Regulatory Affairs (OIRA) coordinates the review and release of regulations from the agencies. Regulations are published in the Federal Register, a daily publication of regulations and notices. Information about regulations under OIRA review is available by agency at Reginfo.gov, and the public can view all regulations and comment letters at Regulations.gov. Twice a year, OMB issues a regulatory agenda of regulations agencies expect to publish in the coming months.

Authority: Once a regulation has gone through the notice and comment process and a final rule is issued, it is generally considered to have the force of law, meaning private actors must comply with it, and individuals can rely on having the protections set out in the law and the regulation. However, regulations are subject to legal challenge under the APA if they are inconsistent with the statute.

Review of regulations by courts: Traditionally, if a regulation interprets a part of a statute that was not clear as drafted by Congress, and a federal court reviews a challenge to the regulation, the court would uphold the interpretation in a regulation unless it is unreasonable or arbitrary. Essentially, courts deferred to the expertise of government regulators and the regulatory review process to uphold a regulatory requirement if they deemed the interpretation reasonable. This practice is called “Chevron deference,” named after a Supreme Court case from 1984, Chevron v. Natural Resources Defense Council, that set out the framework for court review of ambiguous language in a statute. This standard of review can result in agencies having discretion to implement policy changes through the interpretation of regulation. That discretion was challenged in recent years as too broad, giving regulators too much authority, and in June 2024, the U.S. Supreme Court overruled its previous decision, meaning federal courts are no longer required to defer to regulations of administrative agencies in circumstances where they traditionally would have. Eliminating Chevron deference could weaken the impact of regulation on public policy and shift more policy decisions to courts.

Sub-regulatory guidance: Other types of information and guidance commonly issued by a federal agency that do not go through the formal regulatory notice and comment process are referred to as “sub-regulatory.” Information and interpretation in sub-regulatory guidance usually do not have the force of law as regulations do, and typically do not create legally binding obligations on private parties. They are, however, useful in quickly communicating information to regulated entities and the public to signal how and when the agency plans to implement a new law, and the timing of that implementation. However, reliance on these types of guidance by consumers has its limits since regulated entities might still assert that this type of guidance is not binding on them. Examples of sub-regulatory guidance include:

• Frequently asked questions, manuals, memos, and letters used by CMS, DOL, and the IRS: Certain provisions of the ACA have been the subject of numerous sub-regulatory guidance, including over 60 pieces of guidance in the form of frequently asked questions issued jointly by CMS, DOL, and the IRS. Sub-regulatory guidance also includes implementation manuals, policy letters, and enforcement memos.
• Advisory opinion or information letters: The DOL and IRS have used advisory or information letters and chief counsel notices to address fact-specific questions at the request of regulated entities. DOL and IRS responses to these inquiries only apply to the specific parties and scenarios addressed, so they can’t be relied on by the public and can create ambiguities about what the law requires, which can remain unresolved for years until formal regulations are finalized. Note that the IRS also has several other types of guidance with varying levels of authority.

Enforcement

Given the federal fallback framework described in previous sections, the enforcement mechanism for most federal requirements on private coverage depends on the type of health plan and the federal agency enforcing the requirement, as summarized in Table 13 below.

Government enforcement. Under the existing federal fallback framework, CMS has developed a process for determining whether a state is substantially enforcing each specific federal insurance protection. This means that whether a state or CMS is responsible for enforcement can differ for each health coverage standard, resulting in a patchwork of federal and state enforcement responsibilities. In addition, both the DOL and the IRS each have their own separate enforcement processes for the federal standards they implement.

Private Right of Action and Remedies. Some laws also allow individual consumers or their representatives to bring a lawsuit independent of the government to address a violation. These laws may detail what types of “remedies” are available if the challenge is successful—for example, an injunction to stop a violation, a civil penalty, or compensatory or punitive damages. Without this “private right of action,” aggrieved consumers must rely solely on the government to act to address a violation of the law. Even federal laws, such as ERISA, that allow individual consumers to bring a lawsuit to resolve certain disputes, have limited remedies to address a violation. ERISA does not generally allow monetary damages as a remedy.

The federal fallback framework also applies to most of the requirements on health care providers and facilities that are now part of federal law. In 2020, Congress passed and President Trump signed the Consolidated Appropriations Act (CAA), which includes new protections on balanced billing (the No Surprises Act) and various provider rules regarding disclosure and transparency. States are expected to enforce these standards against providers, with CMS as the federal fallback. State health departments or state agencies that oversee provider and facility licensing and practice standards oversee these rules. CMS has surveyed states and entered into collaborative enforcement agreements with each state, including which CAA rules the state is prepared to enforce and which ones CMS will need to implement. CMS can assess a penalty of up to $10,000 per violation against a provider or facility for non-compliance.

Enforcement of other standards. Outside of the above federal fallback framework, each agency has its own separate enforcement mechanisms for the laws it implements alone. For instance, HHS has the authority to assess fines under HIPAA privacy rules for violations, but individuals harmed by a HIPAA violation do not have a private right of action under that law. Enforcement processes and remedies available under federal nondiscrimination requirements under the Civil Rights Act or the Americans with Disabilities Act vary, but some include monetary damages in the form of compensatory damages.

The McCarran-Ferguson Act, enacted by Congress in 1945, clarified that states have the primary role in regulating the business of insurance. Although changes have since been made to that law, states have several mechanisms in place to regulate insurance. States license entities that offer private health coverage in a process that reviews the insurer’s finances, management, and business practices to ensure it can provide the coverage promised to enrollees. States also license the insurance agents and brokers in the state (see the section “What Is the Role of Health Insurance Brokers and Other Assisters?” for more information).

State insurance laws and regulations vary by state, though commonly include:

Most states require health plans to provide specific data that is included in the state’s all-payer claims databases (APCDs). These are state databases that include medical, pharmacy, and often dental claims, as well as eligibility and provider files collected from and aggregated across all private and public payers in a state. APCDs can provide states with a perspective on cost, service utilization, and quality of health care services across the full spectrum of payers in a state, which can be a tool in state efforts to control health care costs and promote value-based care.

Some states are also developing additional state-level regulations related to health plan network adequacy, health plan price transparency, public option plans, reinsurance programs, and more. These state-level regulations and protections do not apply to enrollees in self-insured plans offered by private employers (see the section “What is Private Health Insurance” for more information). However, these enrollees may have some of these protections through other federal laws and regulations.

State legislatures enact state insurance laws and typically grant regulatory authority to the state’s insurance regulator/commissioner. State enforcement mechanisms vary widely by state, regulation, state resources, and staffing capacity. Shifting political priorities at the state level can also influence enforcement priorities and actions. For example, state insurance agencies may ensure compliance with certain benefit mandates by primarily relying on complaints from consumers, consumer advocates, or health care providers to trigger a compliance review of the plan in question, while other state insurance agencies conduct periodic systematic reviews of all plans subject to the law or regulation.

Navigating an increasingly complicated health coverage landscape has increased the focus on the availability and expertise of entities that assist purchasers of health coverage (consumers and employers). Assisters can include agents and brokers who are paid commissions from insurers, as well as consumer assistance programs created by the ACA, which are often publicly funded and nonprofit, who may provide similar assistance as agents and brokers, but also specialize in individuals transitioning in and out of public programs such as Medicaid or assisting those without insurance to find coverage.

Agents and brokers have long played a significant role in connecting individuals and employers to private health coverage by helping them understand health insurance options and costs. An “agent” typically represents a single insurer and provides information about that insurer’s coverage options. A “broker” is not aligned with any one insurer but could, in theory, place coverage from any insurer selling products in a state.

Agents and brokers assist individuals in choosing a qualified health plan on a health insurance Marketplace. Their role in Marketplace enrollment has grown over the years. In the 2024 plan year, 78% of ACA coverage was sold through health insurance agents compared to 43% in 2016. Web brokers, who facilitate plan selection online through Marketplace capabilities, have also played a large role in Marketplace enrollment.

Agents and brokers in the health insurance Marketplace have faced scrutiny for alleged fraudulent activity in recent years due to consumer reports of unauthorized enrollment and plan switches by agents and brokers. In response, CMS, under President Biden, began requiring additional steps to be taken before agents and brokers can make changes to a consumer’s HealthCare.gov enrollment, and hundreds of agents’ and brokers’ Marketplace agreements were suspended for reasonable suspicion of fraudulent activity. In an attempt to address Marketplace fraud, the Trump administration finalized a regulation in 2025 that, along with the 2025 budget reconciliation law, creates new administrative hurdles for consumers to enroll in Marketplace coverage and receive premium tax credits. These 2025 actions made few changes to broker oversight requirements for Marketplace plans. The Trump administration also reinstated many agents and brokers suspended in recent years, and federal indictments related to broker fraud for actions that allegedly occurred as far back as 2018 still await resolution.

Even before the creation of the Marketplaces, agents and brokers had been selling coverage in the individual and group insurance market, especially to small employers needing expertise in finding health insurance for their employees. Large employers also use agents and brokers, who often work for employee benefit consultants or brokerage firms and receive commissions (or, in some cases, a fixed fee) to find vendors to support their self-insured group health plan or for placing other forms of insurance that they provide or make available to employees as “voluntary” benefits.

Broker Compensation Reporting. Employer plans governed by ERISA must meet ERISA fiduciary standards. These standards prohibit plans from contracting with a “party-in-interest,” which is an entity that may have a conflict of interest because it is receiving compensation from a third party for activity it is doing for the employer plan. For instance, a benefits consultant may be helping an employer find a third-party administrator (TPA) for its group health plan, and the consultant is paid by the employer for their work but also gets a commission from the TPA if the employer decides to use its services. Employers are prohibited from entering into this type of transaction with the consultant unless they can show it was done in a “reasonable manner.”

Under rules added to ERISA by the CAA, one way an employer plan can demonstrate that its contract with a broker/consultant is reasonable is to show that it received information from the broker/consultant about the compensation the broker/consultant received from the TPA. Under these rules, an employer plan fiduciary violates ERISA if it does not receive from a broker or consultant information about the direct and indirect compensation the broker receives. Also, insurers offering individual insurance (on- and off-Marketplace) and those offering short-term limited-duration plans must disclose to enrollees and report to CMS any direct or indirect compensation they pay to agents and brokers for enrolling individuals in this coverage.

Consumer Assistance Programs. The ACA required the creation of other types of assisters to assist consumers with enrollment, plan selection, insurance problems, and, in some cases, post-enrollment support. These programs must provide impartial, no-cost help to consumers and cannot be affiliated with an insurance company.

Navigator programs, which are federally funded through grants, were created to raise public awareness and assist individuals in enrolling in qualified health plans as well as provide post-enrollment support. Navigators participate in trainings and are required to be knowledgeable in eligibility and enrollment rules and available QHP options, and maintain privacy and security standards. In 2025, CMS announced a 90% cut in Navigator funding, the largest funding cut since the program began. The current plan year funding of $100 million will be reduced to $10 million for 2026. These cuts come as enhanced Marketplace subsidies are set to expire at the end of 2025 and federal cuts to Medicaid begin to take effect in 2026, both of which could result in significant coverage losses.

Related assisters include Certified Application Counselors (CACs) who also assist consumers in resolving insurance issues and identifying the coverage option that best suits their needs. CACs, however, are not required to meet the same standards as Navigators or participate in all of the activities required of Navigators (e.g., providing post-enrollment assistance). In states using the federally-facilitated Marketplace (FFM), CACs are overseen by Certified Application Counselor Designated Organizations (CDOs), which are designated by CMS and include organizations such as community health centers, hospitals, and social services agencies. To serve as a CAC in an FFM state, the individual must be affiliated with a CDO and is typically a staff member or volunteer. CACs are not federally funded and instead rely primarily on outside non-profit organizations and foundations. 

The ACA also established Consumer Assistance Programs (CAPs) to assist consumers with insurance problems and identify their best options for health coverage. Unlike the Navigator program, which was specifically created to assist Marketplace, Medicaid, and CHIP consumers, CAP programs also assist consumers with employer-sponsored coverage and other types of coverage. The ACA provided an initial appropriation for CAPs, which 35 states and Washington, D.C., took advantage of, but CAP programs have received no federal funding since 2012. Many states have continued their CAP programs using their own funds, but others have discontinued their operations.

2025 and beyond will likely see a retrenchment in regulation at the federal level that could impact the private coverage gains of the last decade. While states will still play a significant role in regulating private health insurance, the fragmented structure of private health care regulation and enforcement means that states alone are limited in what they can do to affect national change or influence private employer-based coverage, where most insured Americans under 65 get their coverage. The future regulatory outlook for private health coverage will be shaped by the following three key features:

Deregulation and Litigation. The Trump administration has put in motion, through several executive orders and other actions, deregulation across the health care sector. For example, a January 2025 executive order required that for every new regulation promulgated, federal agencies must identify at least ten existing regulations to repeal, which could impede future rulemaking. Another executive order required all federal agencies to coordinate with the president’s Department of Government Efficiency (DOGE) to review all regulations to make sure they are consistent with “law and Administration policy.” Using this executive order, the Trump administration has limited the enforcement of final regulations on mental health parity and short-term, limited-duration plans. Also in February 2025, President Trump issued an executive order that rescinded several executive orders issued by President Biden, including one aimed at strengthening the ACA.

These types of regulatory rescissions and a general deregulatory executive agenda, along with disruptions in agency structure and the personnel layoffs in the federal health care agencies, could have long-term impacts on private health care regulation. The outcome of court challenges to many of these deregulatory actions will determine future developments. In addition, changes in how courts review agency decisions—that is, the major decisions by the Supreme Court to limit agency discretion—could be a barrier to the Trump administration’s deregulation initiatives, as federal courts now have more power to second-guess policy decisions of the President. Look for attempts at codifying the Trump administration’s priorities through congressional action to get past any court barriers. Also, expect to see more actions from this administration through executive orders, voluntary industry agreements, and sub-regulatory guidance (e.g., advisory opinions that approve various industry arrangements). Changing enforcement priorities for federal agencies could leave patients looking to state and private mechanisms to get the protections written in federal law.

Technology Advancements. Expect wide-ranging recommendations from major stakeholders on which aspects of artificial intelligence (AI) and telehealth should be promoted and protected from federal regulation. The Trump administration has already announced its plans to speed up the development of AI and reduce regulation. With limited federal regulation anticipated during this administration, much of the future outlook for consumer protections will depend on the voluntary actions of industry and how transparent those activities are. For example, in July 2025, the Trump administration announced a new voluntary initiative aimed at enhancing health data interchange (known as “interoperability”) and expanding patients’ access to their own health data and reported that more than 60 companies had pledged to participate. Open questions about data privacy, security, and accuracy are key concerns as the details of this initiative and new apps are developed. Participation is optional, and the initiative does not create any new legally binding requirements for these companies. While the market for digital health care tools could benefit from the emphasis on AI and virtual care, without updated federal privacy and security rules, such as HIPAA, and nondiscrimination requirements, consumers may have to look to state regulation for these protections. Additionally, new, expensive gene therapies and blockbuster medications will likely increase the overall cost of health care and could also challenge policymakers to rethink existing reimbursement structures and government intervention in pricing.

Consumer Choice. Look for policy shifts from consumer assistance and protection to efforts to broaden the health coverage choices available to consumers to include those that may not meet all of the ACA’s consumer protection requirements. The emphasis on “choice” will likely include efforts to encourage consumers to use tax-advantaged accounts such as health savings accounts, which can be used to set aside funds to purchase an increasing variety of items and pay for health care services provided via direct primary care arrangements and telehealth before the deductible applies. Policy debates on whether low-income individuals and those with chronic illnesses are best served by these account-based models are also possible.

• KFF Survey of Consumer Experiences with Health Insurance
• Explaining Health Care Reform: Risk Adjustment, Reinsurance, and Risk Corridors
• What resources are available for privately insured patients who get surprise balance bills?
• No Surprises Act Implementation: What to Expect in 2022
• Examining Prior Authorization in Health Insurance
• Final Prior Authorization Rules Look to Streamline the Process, but Issues Remain
• Mental Health Parity at a Crossroads
• Consumer Appeal Rights in Private Health Coverage
• Price Transparency and Price Variation in U.S. Health Services
• Network Adequacy Standards and Enforcement
• Pre-existing Conditions: What Are They and How Many People Have Them?
• Proposals for Insurance Options That Don’t Comply with ACA Rules: Trade-offs in Cost and Regulation
• Supreme Court Decision Limiting the Authority of Federal Agencies Could Have Far-Reaching Impacts for Health Policy
• 2022 Survey of ACA Marketplace Assister Programs and Brokers
• Rise in Use of Mental Health Apps Raises New Policy Issues
• Navigating the Maze: A Look at Health Insurance Complexities and Consumer Protections
• How Pending Health-Related Lawsuits Could be Impacted by the Incoming Trump Administration
• Charting the Way Forward: New Efforts to Advance Electronic Health Information Sharing

Pestaina, K., Wallace, R., & Long, M., The Regulation of Private Health Insurance. In Altman, Drew (Editor), Health Policy 101, (KFF, October 2025) https://www.kff.org/health-policy-101-the-regulation-of-private-health-insurance/ (date accessed).