150.301—General rule regarding the imposition of civil money penalties.
If any health insurance issuer that is subject to CMS's enforcement authority under § 150.101(b)(2), or any non-Federal governmental plan (or employer that sponsors a non-Federal governmental plan) that is subject to CMS's enforcement authority under § 150.101(b)(1), fails to comply with HIPAA requirements, it may be subject to a civil money penalty as described in this subpart.