Who will enforce HIPAA?
States have the primary enforcement responsibility for group and individual requirements imposed on health insurance issuers, using sanctions available under State law. If the States do not act in the areas of their responsibility, the Secretary of HHS may make a determination that the State has failed “to substantially enforce” the law, assert Federal authority to enforce, and can impose sanctions on insurers as specified in the statute, including civil monetary penalties. The Secretary of HHS has enforcement responsibility for nonfederal governmental plans, self-funded and insured, and can impose sanctions on plans or plan sponsors as specified in the statute, to include civil money penalties. The Secretary of Labor enforces requirements on employment-based group health plans including self-insured arrangements under ERISA. In addition, individual employees can file suit to enforce ERISA. The Secretary of the Treasury can impose tax penalties on employers or plans who are found to be
