According to a U.S. Census Bureau report, in 2012, approximately 64% of individuals in the United States were covered by a form of private health insurance provided either through an employer or a union, or purchased by an individual from a private company. While states traditionally have been the principal regulators of health insurance, since the 1970s the federal government has become increasingly involved. The Patient Protection and Affordable Care Act (ACA), as amended, greatly expanded federal regulation of health insurance by adding a number of health insurance market reforms designed to increase access to private health insurance for individuals and enhance the quality of health care. Among many other things, ACA sets new minimum standards for private health insurance coverage, including an extension of dependent coverage to age 26; the elimination of preexisting condition exclusions; a bar on lifetime and certain annual benefit limits; coverage of certain essential health benefits; a prohibition on health insurance rescissions except under limited circumstances; and coverage of preventive health services without cost sharing. These requirements may apply to group health plans, broadly defined as plans established or maintained by an employer that provides medical care. Group health plans can be insured (i.e., purchased from an insurance carrier) or self-insured (funded directly by the employer). ACA's requirements may also apply to "health insurance issuers," health insurers that issue a policy or contract to provide group or individual health insurance coverage. This coverage may be sold both inside and outside of state health insurance exchanges (i.e., "marketplaces"). In large part, Title I of ACA does not expressly contain enforcement tools, such as judicial review or civil monetary penalties, which may be imposed for violating these new private health insurance requirements. However, since ACA amends three preexisting statutes—the Employee Retirement Income Security Act (ERISA), the Public Health Service Act (PHSA), and the Internal Revenue Code (IRC)—enforcement under federal law may be carried out through mechanisms in those statutes. This report examines these selected federal mechanisms. In order to examine how ACA's private health insurance requirements will be enforced, it is helpful to understand the basic landscape of federal private health insurance regulation. Traditionally, health insurance matters were primarily regulated at the state, rather than the federal, level. Accordingly, states can and do regulate health insurance and insurers comprehensively. These requirements vary from state to state, but many states require insurers, for example, to be financially solvent and to pay claims promptly, and to mandate certain benefits (i.e., require health insurers to cover services provided by certain medical specialties or cover treatments for specific diseases). Congress explicitly recognized the role of the states in the regulation of insurance with the passage of the McCarran-Ferguson Act of 1945. This law was passed in response to the Supreme Court's ruling in United States v. South-Eastern Underwriters , in which the Court affirmed the federal government's right to regulate the competitive practices of insurers under the Commerce Clause of the U.S. Constitution. The intent of the McCarran-Ferguson Act was to grant states the explicit authority to regulate insurance in light of this decision. Section 2(a) of the act states, "The business of insurance, and every person engaged therein, shall be subject to the laws of the several States which relate to the regulation or taxation of such business." However, under the act, Congress also reserved to itself the right to enact federal statutes that specifically relate to "the business of insurance." Pursuant to this right, Congress has passed legislation which regulates insurance in particular instances. For example, in the 1970s, Congress passed ERISA to regulate private-sector employee benefit plans. While ERISA was primarily enacted to regulate pension plans, certain provisions of the act applied to welfare benefit plans, including those that provide medical, surgical, and other health benefits. Following passage of the act, like other non-pension plans governed by ERISA, these health plans were subject to fiduciary standards, reporting and disclosure requirements, and procedures for appealing a denied claim for benefits. In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA), which established certain minimum national standards for private health insurance. The basic intent of HIPAA's health insurance provisions was to reduce the possibility that individuals and certain employers would lose existing health plan coverage, and to help individuals to maintain coverage when changing jobs or purchasing coverage on their own. Under HIPAA, group health plans and health insurance issuers that provided group health coverage were subject to limitations on the period of time that an individual could be excluded from coverage because of a preexisting condition. The act also prohibited plans and issuers in the group health insurance market from discriminating against individuals in terms of eligibility for coverage, enrollment, premiums, or other contributions based on certain health-related factors, such as medical history or disability. The group health coverage requirements of HIPAA were set out as substantively similar provisions in three federal statutes: ERISA, the PHSA, and the IRC. These three statutes apply to different types of private health insurance coverage and contain different types of enforcement mechanisms. Following enactment of HIPAA, Congress enacted other statutes that mirrored the three-statute regulatory model. These include the Newborns' and Mothers' Health Protection Act, which sets standards for benefits provided to mothers and newborns following childbirth; the Mental Health Parity Act of 1996, providing for parity between medical/surgical benefits and mental health benefits; the Women's Health and Cancer Rights Act, requiring group health plans providing mastectomy coverage to cover prosthetic devices and reconstructive surgery; and Michelle's Law, which extends the ability of dependents to remain on their parents' plan for a limited period of time during a medical leave from full-time student status. These federal insurance standards created by HIPAA and subsequent acts were intended to act as a federal "floor," while preserving the states' role in regulating health insurance. ERISA and the PHSA specify that the federal health insurance requirements as applied to health insurance issuers do not supersede state law, except to the extent that a state law "prevents the application" of a federal requirement. Thus, states are allowed to regulate health insurance more comprehensively than federal law, so long as these requirements do not conflict with federal standards. As noted above, ACA significantly amended and expanded upon these federal health insurance standards, adding several new requirements for group health plans and health insurance issuers in the group and individual markets. These provisions were added to the PHSA and incorporated by reference into ERISA and the IRC. Accordingly, the enforcement mechanisms of these three laws may be applied. As noted above, Title XXVII of the PHSA, Part 7 of ERISA, and Chapter 100 of the IRC generally apply federal health insurance standards to different types of private-sector health coverage. Further, the Secretaries of HHS, Labor, and the Treasury have shared interpretive and enforcement authority under these sections of the three statutes. In general, and discussed in more detail below, Title XXVII of the Public Health Service Act, administered by the Department of Health and Human Services, applies to health insurance issuers providing individual and group health coverage, and self-insured governmental plans. Part 7 of ERISA is administered by the Department of Labor and regulates health coverage provided by employers in the private sector. ERISA applies to insured and self-insured group health plans, as well as insurance issuers providing group health coverage. However, ERISA does not generally apply to governmental or church plans. The IRC, as administered by the Department of Treasury, covers employment-based group health plans, including church plans, but does not apply to health insurance issuers. The enforcement mechanisms are different under each of the three statutes. In general, the private health insurance requirements of Title XXVII of the Public Health Service Act apply to health insurance issuers in the group and individual markets and to self-funded non-federal governmental group plans. With respect to health insurance issuers, states are the primary enforcers of the private health insurance requirements. If the Secretary determines that a state has failed to substantially enforce a provision of Title XXVII of the PHSA with respect to health insurance issuers in the state, the Secretary is responsible for enforcing these provisions. While the statute does not specify what a state needs to do in order to be considered "substantially enforcing" the requirements of the PHSA, regulations outline the procedure to be followed by HHS in making a determination as to whether federal enforcement is needed. According to the Centers for Medicare and Medicaid Services (CMS), while the vast majority of states are enforcing ACA's health insurance market reforms, some have indicated that they lack authority to enforce or are otherwise not taking enforcement actions. The Secretary may impose a civil monetary penalty on insurance issuers that fail to comply with the PHSA requirements. The maximum penalty imposed under the PHSA is $100 per day for each individual with respect to which such a failure occurs. Similar to the IRC (discussed below), certain minimum penalty amounts may apply to a plan or employer if the violation is not corrected within a specified period, or if a violation is considered to be more than de minimis. In determining the amount of the penalty, the Secretary must take into account the entity's previous record of compliance with the PHSA provisions. In addition, a penalty may not be imposed for a violation if it is established to the Secretary's satisfaction that none of the entities knew (or if exercising reasonable diligence would have known) that the violation existed. If the violation was due to reasonable cause and not willful neglect, a penalty would not be imposed if the violation were corrected within 30 days of discovery. Entities found to violate the PHSA requirements may challenge the penalty in a hearing subject to a decision by an administrative law judge. Following this administrative hearing, entities may file an action for judicial review. Health insurance issuers may also sell coverage to qualified individuals and small employers through exchanges that are established in each state.