CFR > Title 45 - Public Welfare > SUBTITLE A—DEPARTMENT OF HEALTH AND HUMAN SERVICES > SUBCHAPTER B—REQUIREMENTS RELATING TO HEALTH CARE ACCESS (parts 140 to 159) > PART 150—CMS ENFORCEMENT IN GROUP AND INDIVIDUAL INSURANCE MARKETS > SUBPART C—CMS Enforcement With Respect to Issuers and Non-Federal Governmental Plans—Civil Money Penalties (§150.301 to §150.347) > 150.303—Basis for initiating an investigation of a potential violation.

150.303—Basis for initiating an investigation of a potential violation.

(a) Information. Any information that indicates that any issuer may be failing to meet the HIPAA requirements or that any non-Federal governmental plan that is a group health plan as defined in section 2791(a)(1) of the PHS Act and 45 CFR § 144.103 may be failing to meet an applicable HIPAA requirement, may warrant an investigation. CMS may consider, but is not limited to, the following sources or types of information:
(1) Complaints.
(2) Reports from State insurance departments, the National Association of Insurance Commissioners, and other Federal and State agencies.
(3) Any other information that indicates potential noncompliance with HIPAA requirements.
(b) Who may file a complaint. Any entity or individual, or any entity or personal representative acting on that individual's behalf, may file a complaint with CMS if he or she believes that a right to which the aggrieved person is entitled under HIPAA requirements is being, or has been, denied or abridged as a result of any action or failure to act on the part of an issuer or other responsible entity as defined in § 150.305.
(c) Where a complaint should be directed. A complaint may be directed to any CMS regional office.