The amount and extent of federal regulation affecting private health insurance has increased significantly, especially since the passage of the Affordable Care Act (ACA) in 2010. As previously discussed, the ACA largely preserved the framework for regulating private coverage while adding a long list of new provisions to the various regulated parts of our fragmented health care system. This means specific and overlapping requirements for insurers, employer-sponsored plans, and more recently, under the No Surprises Act, providers.
The ACA has also generated a flurry of activity stemming from long-standing political and philosophical disagreements over the role of federal government regulation of health care. Efforts to repeal and replace the ACA, several U.S. Supreme Court cases challenging ACA provisions, and hundreds of other lower court cases on the ACA and other federal claims mean that legislation in this area is and will continue to be in flux.
Regulatory priorities can and do shift depending on which party controls the White House and Congress, resulting in ever-changing federal standards. This section examines the current landscape of federal requirements. A discussion of each individual federal regulation is beyond the scope of this chapter, but the major requirements have been organized into six categories:
- Access to health insurance
- Affordability of health insurance
- Design and adequacy of benefits
- Reporting and Disclosure of Coverage
- Reviewing and appealing health claims
- Other federal standards
1. Access to coverage
Federal health care reform has long prioritized expanding health insurance coverage for those who do not have it, especially those who are not eligible for government programs such as Medicaid or Medicare, or who do not have coverage through their current employer. Prior to the passage of the Affordable Care Act in 2010, state laws and regulations sought to address adverse selection in health insurance by allowing insurers to employ certain practices, such as "underwriting," which allowed insurers in the individual and group markets to deny coverage or renewal of coverage because of an individual's health status or group claims history, and helped plans maintain predictable and stable risk pools. In addition, an insurer could cover an applicant but charge a higher premium based on age, health status, gender, occupation, or geographic location. In addition, insurers could exclude benefits for certain health conditions if a person was diagnosed or treated for the condition before becoming insured (the "pre-existing condition" exclusion).
States have made some reforms, particularly in the small group market, to remove these barriers to insurance. Some of these changes became part of the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996. However, it was not until the passage of the ACA that private insurance regulation, at least in the individual and small group markets, underwent fundamental changes.
Basic protections for private insurance coverage. The ACA established major market rules designed to extend coverage to most U.S. residents. New ACA requirements include:
Requirements to stabilize premiums and other risk pool protection measures. Regulation of the private insurance market under the ACA has also raised concerns that its protections, including guaranteed issue and the elimination of medical underwriting for certain types of insurance, will lead to adverse selection (discussed in the first section). Regulators' efforts to prevent adverse selection have also targeted certain plans and products that are not required to comply with most ACA rules, such as short-term, limited-term plans. Non-ACA-compliant insurance may be attractive to consumers looking to lower monthly costs, but such plans can lead consumers to be underinsured and can disrupt the risk pool by drawing away healthier individuals.
Federal guidance and regulations designed to protect the risk pool under the ACA include:
Standards to prevent gaps in insurance coverage. Access to coverage is also enhanced by federal requirements for continuity of coverage or care to prevent gaps for those who lose or are at risk of losing coverage, including:
2. Financial protection and accessibility
High cost, both in the form of premiums and cost-sharing, has been a defining feature of employer-sponsored and individually purchased health insurance (for unsubsidized enrollees). Federal reforms were designed to address the stability and affordability of health insurance. Key provisions include:
3. Design and adequacy of benefits
Federal requirements also include a growing list of minimum standards regarding plan design and administration to ensure that plan participants have sufficiently comprehensive coverage to cover necessary health care services and processes that do not unnecessarily restrict access to covered benefits. Such requirements include laws that prohibit plans from imposing annual dollar limits on coverage that require waiting periods longer than 90 days before employer-provided coverage begins. States may impose additional benefit requirements for state-regulated plans, such as comprehensive coverage requirements for state-regulated plans, such as comprehensive coverage requirements for mental health, substance use disorder, or fertility services.
The ACA requires all private health plans that are not enrolled in the program to cover preventive services without cost sharing among members. These requirements change over time as recommendations for preventive services are updated and new services are added. In general, they include:
The requirement for insurance coverage of preventive services has been the subject of extensive litigation since the passage of the ACA. For more information on these litigations, see the fact sheet. The contraceptive coverage requirement has been the subject of two U.S. Supreme Court cases and several regulations that now allow employers to not cover contraceptives if they have religious objections.
Other required design standards for most health plans
Large group, small group, individual, and self-insured health plans are required to meet other standards to reduce out-of-pocket costs and improve access to quality of care. Such standards include:
Design standards are limited to individual and small group plans. Federal requirements for design standards for health plans for certain segments of the individual and small group market have changed since the passage of the ACA. Plans must comply with these rules as part of the annual certification of qualified health plans. Examples of these standards include:
4. Disclosure, reporting and transparency
In 2023 survey of insured adults, a majority of Marketplace and employer-sponsored insurance (ESI) enrollees reported difficulty understanding some aspects of their health insurance compared to consumers enrolled in Medicaid and Medicare:
Lack of information or understanding of key features of health insurance coverage can put patients at financial risk and lead to negative health outcomes. Employers and other purchasers of health care services also have difficulty obtaining the information they need to make informed decisions about cost-effective coverage options and hold providers accountable for plan design, contracting, and administration. Over time, there has been an increase in regulations aimed at making information more accessible to enrollees and potential enrollees, as well as to federal agencies performing their oversight functions. The question of what information should be disclosed and how useful it is remains an issue.
Most federal disclosure, reporting, and transparency requirements fall into two categories: Disclosure to patients and/or the public (Table 9) and reporting to the federal government (Table 10). Note that the requirements presented in these tables are not exhaustive, but include examples of some of the basic reporting, disclosure, and transparency requirements to which plans, providers, and facilities are subject.
Ongoing reporting of private plans to federal agencies is an agency oversight tool to assess regulatory compliance and identify trends. In some cases, agencies are required to use this information to provide summary information to the public and Congress.
5. Claims and appeals process
Access to a fair system for consumer complaints about plan actions and claim denials is a key element of federal consumer protection.
The Clinton Administration's 1997 "Patients' Bill of Rights" initiative led several federal agencies to take regulatory action to strengthen consumer protections for patients and employees. As part of this initiative, the U.S. Department of Defense updated the claims and appeals rules that applied to ERISA-regulated private employer plans to make the claims process more efficient:
- Faster (shorter timeframes for plans to make decisions on applications and appeals)
- Fairer (ensure that plan decision-makers have no conflict of interest)
- More complete (more transparent by disclosing more information to consumers - including language access standards - about the reasons for denying a claim).
In 2000, the DOL issued regulations governing the "internal" claims review process conducted within a plan or plan sponsoring employer. For the first time, these updated rules addressed features of managed care such as prior authorization, in which health plans determine medical necessity before the plan covers an item or service, which, for example, requires shorter time frames for claims decisions and appeals for such "prior" claims.
These rules formed the basis for reforms applied to all private health insurance plans under the ACA. These reforms provided federal protections for internal claims and the appeals process and added the ability for consumers to appeal the denial of a claim and the claims review process to an entity independent of the plan through a process called "external review." Only certain types of claims, such as those involving clinical judgment, are subject to external review.
Policy makers have renewed their focus on the prior authorization process and claims and appeals review in general. The claims and appeals review standards that apply to Medicare Advantage, Medicaid, and some Marketplace plans were recently updated to reduce delays in making decisions and provide more transparency in the results of claims and appeals reviews.
6. Other federal standards
A number of other federal laws and regulations protect consumers in private health insurance, often indirectly, and sometimes have more stringent enforcement and penalties than federal insurance laws. These include:
Civil Rights Act. The Civil Rights Act of 1964 (and its later amendments, including the Pregnancy Non-Discrimination Act) and the Americans with Disabilities Act of 1990 created protections against discrimination on the basis of race, color, national origin, sex, age, and disability. At a minimum, these standards apply to employers with 15 or more employees and, in effect, govern the insurance coverage of those employers' group health plans.
Section 1557 of the ACA includes a nondiscrimination provision that could potentially apply many existing civil rights laws directly to health care organizations, including insurers receiving federal funds. The extent to which it applies has been the subject of several sets of regulations, most recently under the Biden administration in 2024. The rule restores nondiscrimination protections for LGBTQ+ people seeking health care and insurance coverage, including for gender-affirming care.
Antitrust Laws . Health care antitrust laws prohibit anticompetitive practices and mergers among health care providers, hospitals, and insurers that may reduce competition and raise prices. As provider consolidation has increased, federal agencies such as the U.S. Department of Justice and the Federal Trade Commission (FTC) have stepped up enforcement initiatives in recent years, as discussed in the brief. Health insurers are also subject to antitrust scrutiny as the largest health insurers' market share continues to dominate in most regions. One area of scrutiny is the oversight of pharmacy benefit managers, which are now mostly owned by or affiliated with leading health insurers.
Privacy Laws . As digital technology has evolved, policymakers' concerns about protecting consumer health information have also grown, as the rapid development of new technologies (e.g., health-related apps) has made it difficult for regulations to keep pace. The key federal privacy requirements for health care providers' use of certain patient information set forth in the HIPAA regulations are nearly 25 years old. Efforts are underway to update these rules, including specific standards for abortion information after the Supreme Court invalidated the constitutional right to abortion in 2022. In addition, the Federal Trade Commission is trying to regulate areas not directly covered by HIPAA, such as software applications that are increasingly sold as part of health insurance.
Special protections for the confidentiality of substance use disorder information are governed by a law known as "Part 2." This law is designed to protect the confidentiality of this information, but also allows providers to share mental health and substance use disorder information with plans and other organizations to coordinate treatment and manage benefits.
Plans and issuers are prohibited from entering into an agreement with a provider, third-party administrator, or other service provider (including pharmacy benefit managers) that limits the plan's and issuer's access to claims, cost, or quality of service information about providers enrolled in the plan, plan sponsors, and other entities, a practice known as a "gag clause." Plans and issuers must file an annual declaration with the federal government that they are in compliance with these requirements.