Overview: Several federal laws create a baseline of consumer protections for people covered under group health insurance, regardless of which state they live in.

The group health insurance market is shaped by an interlocking set of federal statutes. Understanding what each law does — and what it does not do — is essential for the exam.

HIPAA (Health Insurance Portability and Accountability Act of 1996)

HIPAA's Title I addressed two core problems: people losing health coverage when changing jobs, and individuals with pre-existing conditions being denied or priced out of new group coverage.

Guaranteed renewability: Under HIPAA, group health plans must be renewed at the employer's option. An insurer cannot refuse to renew a group plan simply because employees filed high claims during the year. Renewal can only be denied in six narrow circumstances: nonpayment of premiums, fraud or intentional misrepresentation, violation of minimum participation requirements, the insurer exiting the market, the group leaving the plan's service area, or loss of association membership (for association-based plans).

Pre-existing condition portability: Before the ACA, HIPAA established the first federal limits on pre-existing condition exclusions. It defined a pre-existing condition as one for which treatment was received or recommended within 6 months before enrollment, capped exclusion periods at 12 months (18 for late enrollees), and required that prior continuous coverage — called creditable coverage — reduce the exclusion period day-for-day. The key rule: as long as there was no break in coverage of 63 or more days, prior insurance counted toward eliminating the exclusion. Pregnancy, newborns, and adopted children could never be subject to pre-existing condition exclusions.

ACA superseded HIPAA's pre-existing condition rules: Since January 1, 2014, the ACA completely prohibits all pre-existing condition exclusions in virtually all group and individual health plans. As a result, HIPAA's creditable coverage mechanism is largely obsolete, but HIPAA's guaranteed renewability and special enrollment rights remain active law.

Special enrollment rights: HIPAA guarantees employees the right to enroll in a group health plan outside of open enrollment when they experience specific qualifying events: losing other coverage (within 30 days), marriage, birth, adoption, or changes in Medicaid/CHIP eligibility (within 60 days). These rights allow employees to add coverage or dependents when life circumstances change.

Nondiscrimination: HIPAA prohibits group plans from discriminating against individual employees regarding eligibility, enrollment, or premiums based on health status factors: medical condition, claims experience, medical history, genetic information, or disability.

The Affordable Care Act (ACA)

The ACA dramatically expanded federal consumer protections for group health plans:

Guaranteed issue for small groups: Insurers must accept all small employer groups applying for coverage, regardless of employees' health
No annual or lifetime dollar limits on essential health benefits
Out-of-pocket maximums: Plans must cap annual out-of-pocket spending
Preventive services at no cost: In-network preventive care (vaccines, screenings, wellness visits) must be covered with zero cost-sharing
Dependent coverage to age 26: If a group plan covers dependents, children must be eligible through age 25
Rate review: Significant premium increases must be reviewed for reasonableness
Medical Loss Ratio (MLR): Small-group insurers must spend at least 80% of premium dollars on clinical care; if they spend less, they owe rebates
Modified community rating in the small-group market, prohibiting health-status discrimination in pricing

Mental Health Parity (MHPAEA)

The Mental Health Parity and Addiction Equity Act of 2008 requires that group plans covering mental health and substance use disorder (MH/SUD) services must do so on a basis no more restrictive than medical/surgical benefits. Specifically:

Financial requirements (deductibles, copays, coinsurance) for MH/SUD cannot be higher than those applied to comparable medical/surgical services
Quantitative treatment limitations (visit limits, day limits) on MH/SUD services cannot be stricter than equivalent limits on medical care
Non-quantitative treatment limitations (prior authorization requirements, medical necessity criteria, network admission standards) must be applied using processes and standards no more stringent for MH/SUD than for medical/surgical benefits

MHPAEA does not require a plan to offer MH/SUD coverage — but if it does, parity must apply. The ACA then mandated MH/SUD coverage as an essential health benefit in small-group and individual markets, effectively combining the two laws to ensure both coverage and parity for smaller employers.

ERISA and COBRA

ERISA governs private-sector employer-sponsored group health plans, requiring fiduciary responsibility, standardized claims and appeals procedures (including the right to independent external review after an internal appeal denial), and detailed plan disclosures through the Summary Plan Description (SPD).

COBRA (Consolidated Omnibus Budget Reconciliation Act) applies to employers with 20+ employees. It requires that workers and their dependents who lose group health coverage due to a qualifying event (termination, reduced hours, divorce, death, or loss of dependent status) be offered the right to continue the same group coverage for 18–36 months. The individual must pay the full premium plus a 2% administrative fee.

The No Surprises Act

Effective in 2022, the No Surprises Act protects group plan members from unexpected medical bills:

Emergency care at an out-of-network facility must be covered at in-network cost-sharing levels
When a patient receives care at an in-network hospital from an out-of-network provider (e.g., an anesthesiologist or radiologist the patient did not choose), that provider cannot balance-bill the patient
Air ambulance services from non-participating providers are subject to similar protections