Health insurance regulations are the mix of federal and state rules that decide what your plan must cover, how much of your premium goes to actual care, how you fight a denied claim, and how your health data is protected. The Affordable Care Act set most of the modern federal baseline starting in 2014. Other federal laws handle employer plans, mental health parity, surprise bills, and privacy. States license insurers, review rate hikes, and can require coverage beyond the federal floor.
What Plans Must Cover
A health plan cannot deny you coverage or carve out benefits because of a condition you had before you enrolled. It does not matter whether the condition was diagnosed, treated, or simply known to you — insurers cannot use your medical history against you.1GovInfo. 42 USC 300gg-3 – Prohibition of Preexisting Condition Exclusions or Other Discrimination Based on Health Status
Non-grandfathered individual and small-group plans also have to include ten categories of essential health benefits:2Office of the Law Revision Counsel. 42 USC 18022 – Essential Health Benefits Requirements
- Ambulatory patient services (outpatient care).
- Emergency services, regardless of whether the facility is in your network.
- Hospitalization, including surgery and overnight stays.
- Maternity and newborn care.
- Mental health and substance use disorder services.
- Prescription drugs, with at least one drug in every therapeutic category.
- Rehabilitative and habilitative services.
- Laboratory services.
- Preventive and wellness services, including vaccines and screenings.
- Pediatric services, including dental and vision care for children.
Before you buy, the insurer has to hand you a standardized Summary of Benefits and Coverage that spells out what the plan pays for, what it costs in common scenarios, and what the limits are, so you can compare plans on the same terms.3eCFR. 45 CFR 147.200 – Summary of Benefits and Coverage and Uniform Glossary
How Insurers Must Spend Your Premiums
The medical loss ratio rule caps how much of your premium an insurer can keep for overhead and profit. Large-group plans have to spend at least 85 percent of premium revenue on medical care and quality improvement. Individual and small-group plans have to spend at least 80 percent.4Office of the Law Revision Counsel. 42 USC 300gg-18 – Bringing Down the Cost of Health Care Coverage by Restricting the Share of Premium Dollars Spent on Administration and Profits
When an insurer misses that mark in a given state and market segment, it owes a rebate to the people it covered. The rebate shows up as a check, a premium credit, or a reduction in what you owe for the next plan year, calculated proportionally to what you paid in.
Mental Health and Substance Use Parity
If your plan covers mental health or substance use treatment, it cannot impose tighter financial limits on those services than it does on comparable medical and surgical care. Your copay for a therapy visit cannot run higher than your copay for an equivalent specialist visit. Your deductible for inpatient psychiatric care cannot exceed what you would pay for inpatient surgery in the same benefit classification.5eCFR. 29 CFR 2590.712 – Parity in Mental Health and Substance Use Disorder Benefits
The rule reaches past dollar limits. Session caps, medical-necessity standards for addiction treatment, and the criteria for admitting therapists to a network all have to be at least as generous as the equivalents on the medical side. Insurers have to document that comparative analysis and show it to regulators on request.
Surprise Bills and Price Information
The No Surprises Act stops out-of-network balance billing in situations where you had no real choice. If you go to an in-network hospital and an out-of-network surgeon, anesthesiologist, or radiologist treats you, that provider cannot bill you for the gap between their charge and what the insurer paid. The same protection covers emergency services anywhere. You owe only your normal in-network cost-sharing.6eCFR. 45 CFR Part 149 – Surprise Billing and Transparency Requirements
When the insurer and the provider disagree on the payment, they go to independent dispute resolution. Each side submits a final offer and a neutral arbitrator picks one, guided by factors like the median in-network rate for the service in that area. You stay out of it. Providers who violate the balance billing rules face civil penalties of up to $10,000 per violation.
Good Faith Estimates for Self-Pay Patients
If you don’t have insurance or you choose to pay out of pocket, the provider has to give you a written good faith estimate of expected charges before any scheduled service, including related items like lab work and anesthesia.7Centers for Medicare & Medicaid Services. The No Surprises Act Good Faith Estimates and Patient-Provider Dispute Resolution Requirements If the final bill exceeds the estimate by $400 or more, you can challenge it through the patient-provider dispute resolution process.
Employer Plans and Keeping Coverage After You Leave
Most people with private coverage get it through work, and the Employee Retirement Income Security Act sets how those plans run. ERISA requires a Summary Plan Description that explains your benefits, the claims process, and your appeal rights in plain language.8Office of the Law Revision Counsel. 29 USC 1001 – Congressional Findings and Declaration of Policy The people who run the plan owe you a fiduciary duty, and they can be personally liable to restore losses they cause by breaching it.9Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Duty
If you lose your job, have your hours cut, or hit certain other qualifying events, COBRA lets you keep that employer coverage for a while instead of dropping off immediately.10Office of the Law Revision Counsel. 29 USC 1161 – Plans Must Provide Continuation Coverage to Certain Individuals Job loss or reduced hours gets you up to 18 months. A second qualifying event during that window, such as a divorce or a dependent aging out, can extend it to 36 months. Events like the death of the covered employee or a divorce trigger 36 months from the start.11Office of the Law Revision Counsel. 29 USC 1162 – Continuation Coverage
The price shifts hard. Your employer no longer subsidizes the premium, so you pay up to 102 percent of the full plan cost: what the employer and employee were paying between them, plus a 2 percent administrative surcharge.12Office of the Law Revision Counsel. 29 USC 1162 – Continuation Coverage If you qualify for a disability determination in the first 60 days of COBRA, coverage can run to 29 months, with the premium rising to 150 percent for the months past the first 18.
Boundary worth knowing: ERISA preempts most state insurance regulations for self-insured employer plans, which is how many large companies structure their coverage. State mandates you might expect to apply often don’t reach those plans.
The Employer Mandate
Employers with 50 or more full-time employees (including full-time equivalents) have to offer affordable coverage meeting minimum value standards, or face penalties. Failing to offer any coverage carries an inflation-adjusted penalty of $3,340 per full-time employee for 2026, minus the first 30 employees. Offering coverage that is unaffordable or too thin triggers a separate penalty — $5,010 in 2026 — but only for each employee who ends up getting a marketplace premium tax credit.13Office of the Law Revision Counsel. 26 USC 4980H – Shared Responsibility for Employers Regarding Health Coverage Employers document compliance on Forms 1094-C and 1095-C, and you get a copy of your 1095-C for your own tax filing.14Internal Revenue Service. Instructions for Forms 1094-C and 1095-C
Appealing a Denied Claim
When an insurer denies a claim or ends coverage, you have the right to challenge it in a defined process. The first step is an internal appeal handled by the insurer. For services you haven’t received yet, the insurer has 30 days to decide. For services already provided, it has 60 days. For urgent cases where delay could seriously harm your health, the response is due within four business days, and the initial decision can come by phone with a written notice to follow within 48 hours.15HealthCare.gov. Appealing a Health Plan Decision
If the internal appeal fails, you can take it to external review by an independent organization with no tie to the insurer. You have four months from the denial notice to ask for one. Standard reviews are decided within 45 days; expedited reviews for serious conditions within 72 hours. The reviewer’s decision binds the insurer: if you win, the insurer has to cover the service.16Centers for Medicare & Medicaid Services. HHS-Administered Federal External Review Process for Health Insurance Coverage The federal external review costs you nothing, and it overturns insurer denials more often than people expect.
When You Can Enroll
Individual marketplace plans are not available year-round. The annual open enrollment period runs from November 1 through January 15. Enroll by December 15 and coverage starts January 1; enroll between December 16 and January 15 and coverage starts February 1.17HealthCare.gov. When Can You Get Health Insurance
Outside that window, a special enrollment period opens for 60 days around certain life changes:18HealthCare.gov. Getting Health Coverage Outside Open Enrollment
- Losing existing coverage through a job change, an employer dropping your plan, or aging off a parent’s plan at 26.
- Household changes like marriage, the birth or adoption of a child, or divorce that costs you coverage.
- Moving to a new ZIP code or county with different plans available.
- Losing Medicaid or CHIP, which comes with a 90-day window.
Voluntarily dropping your coverage doesn’t qualify. The point of the structure is to keep people from waiting until they’re sick to buy in.
Privacy of Your Health Information
Federal privacy rules limit how insurers, providers, and other covered entities can use and share your health information. Your plan has to give you a Notice of Privacy Practices, and it generally cannot share your data beyond treatment, payment, and health care operations without written permission.19U.S. Department of Health and Human Services. The HIPAA Privacy Rule You have the right to request a copy of your records and ask for corrections.
Electronic records require specific safeguards, including encryption, access controls, and audits. If a breach happens, the entity has to notify you and report it to the Department of Health and Human Services. Penalties scale with culpability: as little as $145 per violation for unknowing infractions, up to $73,011 per violation for willful neglect, with the maximum annual penalty for repeated serious violations reaching $2,190,294 in 2026.
What States Still Control
Federal law explicitly preserves state authority over insurance, and state insurance departments do the day-to-day work: licensing insurers and agents, examining their finances, and reviewing proposed rate increases.20Office of the Law Revision Counsel. 15 USC 6701 – Operation of State Law If an insurer becomes insolvent, state guaranty associations cover unpaid claims up to limits that vary by state.
States can also require coverage beyond the federal essential health benefits — infertility treatment, autism therapy, specific cancer screenings — and they set network adequacy standards so that having a plan on paper translates into real access to providers within a reasonable distance and wait time. Your protections depend partly on where you live, so comparing plans within your own state’s marketplace matters more than relying on national averages.