45 C.F.R. § 150.205 Sources of information triggering an investigation of State enforcement.
Title 45 - Public Welfare
Information that may trigger an investigation of State enforcement includes, but is not limited to, any of the following: (a) A complaint received by CMS. (b) Information learned during informal contact between CMS and State officials. (c) A report in the news media. (d) Information from the governors and commissioners of insurance of the various States regarding the status of their enforcement of HIPAA requirements. (e) Information obtained during periodic review of State health care legislation. CMS may review State health care and insurance legislation and regulations to determine whether they are: (1) Consistent with HIPAA requirements. (2) Not pre-empted as provided in §146.143 (relating to group market provisions) and §148.120 (relating to individual market requirements) on the basis that they prevent the application of a HIPAA requirement. (f) Any other information that indicates a possible failure to substantially enforce.
Title 45: Public Welfare
PART 150—CMS ENFORCEMENT IN GROUP AND INDIVIDUAL INSURANCE MARKETS
Subpart B—CMS Enforcement Processes for Determining Whether States Are Failing To Substantially Enforce HIPAA Requirements
§ 150.205 Sources of information triggering an investigation of State enforcement.

