There was a proposal published in 2014 that would have required health plans to obtain HIPAA compliance certification. The proposal was withdrawn in 2017 due to the significant burden it would have placed on employer-funded health plans, but – at the time – the HHS said it was looking at other options “to show compliance with statutory requirements”. As yet, nothing has materialized.