Information that may trigger an investigation of State enforcement includes, but is not limited to, any of the following:

(a) A complaint received by CMS.

(b) Information learned during informal contact between CMS and State officials.

(c) A report in the news media.

(d) Information from the governors and commissioners of insurance of the various States regarding the status of their enforcement of PHS Act requirements.

(e) Information obtained during periodic review of State health care legislation. CMS may review State health care and insurance legislation and regulations to determine whether they are:

(1) Consistent with PHS Act requirements.

(2) Not pre-empted as provided in §146.143 (relating to group market provisions) and §148.120 (relating to individual market requirements) on the basis that they prevent the application of a HIPAA requirement.

(f) Any other information that indicates a possible failure to substantially enforce.

[64 FR 45795, Aug. 20, 1999, as amended at 78 FR 13440, Feb. 27, 2013]