Hey friends, Quick question. Your state just passed a law saying every insurance plan has to cover a specific test. A month later, your insurer denies it. Were they allowed to do that? The honest answer is: maybe. It depends on which government writes the rules for your specific plan, and most people don't realize there are two governments in this fight. Today we're going to walk through federal and state mandates with Biscuit the corgi. If you're new here, Issue 1 was the founding story and Medical Billing 101 introduced Biscuit, who twisted his ankle and learned how a $20,000 sticker price turns into a $2,400 bill. Today Biscuit is back at the doctor's office, and Dr. Singh is about to order a test that should be covered by a brand new state law. Spoiler: it gets denied anyway - Shivang
TL;DR: A mandate is a law that tells insurers what they must cover or how they must behave. Federal mandates apply to almost every plan. State mandates apply to some plans and skip right over others, including the plan two-thirds of working Americans actually have. By the end of this you'll know which bucket your plan is in, what to ask when something gets denied, and (if you work in market access, there's a section just for you at the bottom) why this single distinction decides whether a new therapy gets paid for or quietly dies on the vine.
Oh, also if you’re new here, welcome! My name is Shivang, I left my cushy tech job getting biotechs paid from insurance to make health insurance easy to understand for everyone: regular people, doctors, practice owners, and billing / market access teams. Start here 😃 If you can’t already tell, I’m obsessed with dogs and I use cartoon dogs to make sense out of insurance! 🐶
So what is a mandate, actually
A mandate is a rule the government puts on insurance companies. Before we get into them, three names are going to keep showing up. Worth knowing what they are.
ACA: The Affordable Care Act, the 2010 law that set the federal floor for what most health plans have to cover.
No Surprises Act: A federal law in effect since 2022 that protects you from surprise out-of-network bills, mostly in emergencies and when an out-of-network doctor treats you at an in-network hospital.
ERISA: A 1974 federal law that governs employer benefit plans. Remember this one. It's quiet now and does the most damage later.
Two flavors.
Coverage mandates say what a plan has to pay for. The Affordable Care Act sets the federal baseline, requiring every individual and small-group plan to cover ten categories of essential health benefits like maternity care, mental health, and prescription drugs. States can add to that list, and many do: around 20 have passed some form of biomarker testing mandate, about half require some kind of infertility coverage with a smaller group going as far as IVF, and plenty more cover autism services, hearing aids for kids, and other treatments. The list is long, and it changes every legislative session.
Process mandates say how the plan has to behave. The Fderal No Surprises Act bans balance billing for most ER visits, state prior authorization reform laws cap how long an insurer can sit on a request, and price transparency rules force hospitals to publish their rates. None of these touch what gets covered. They set the rules for how the insurer does its job.
Both kinds exist for the same reason. Left alone, insurers cover what's cheapest and deny what's expensive. Mandates are the floor.
Biscuit's new problem
Biscuit's ankle healed. Then on a routine follow-up, Dr. Singh notices something on his blood panel that needs a closer look. They order a specific biomarker test. Standard of care, totally reasonable.
Biscuit lives in a state that passed a biomarker testing mandate last year. Every health plan in the state, the law says, has to cover biomarker testing when a doctor orders it for a covered condition. Biscuit saw the news when the law passed. He figured this one was easy.
Three weeks later: denied. "Not medically necessary, per the plan's policy."
He calls the line on the back of his card, and the rep is friendly. So, Biscuit points to the new state law. The rep says, calmly, "Sir, that law doesn't apply to your plan."
Biscuit is now staring at a piece of paper from his own state government and a denial letter from his insurance company that contradict each other, and somehow both are correct. HOW!?
Two governments, one insurance card
Here's what nobody tells you. Two different governments can write the rules for your health plan, the federal one and your state. Which set your plan actually answers to comes down to a single question: who's actually paying the claims.
If an insurance company is the one paying your claims, your plan is what's called "fully insured." Somebody pays a premium to that insurer, usually your employer, or you directly if you bought your own plan on the marketplace, and in exchange the insurer takes on the financial risk of covering your care. Because an insurer is carrying that risk, your plan falls under state insurance law, which means every mandate your state legislature passes lands squarely on it.
The "marketplace" just means buying your own plan instead of getting one through a job, on healthcare.gov or your state's exchange.
If your employer is the one paying the claims, your plan is "self-funded," which means the employer takes on the risk directly. They'll usually still hire an insurance company to run the plan, processing claims, building the provider network, and sending you a card with a familiar logo, so from where you sit it looks identical to anyone else's coverage. The difference is that the money paying for your MRI comes straight out of the employer's bank account, not the insurer's. Plans like these are governed by a federal law called ERISA, and ERISA overrides any state law that tries to regulate employer benefit plans. So the state mandates that land on fully insured plans simply don't reach yours.
The kicker: per KFF's 2025 Employer Health Benefits Survey, 67% of covered workers are in self-funded plans, where your employer pays the claims. That number climbs to 80% at large firms. So most people with job-based coverage are sitting in a plan their state cannot touch, and almost none of them know it, because the card in their wallet says Aetna or Cigna or Blue Cross just like everyone else's.
That's the loophole Biscuit just fell into. His employer self-funds. The state biomarker mandate is real, it's the law, and it does not apply to his plan.
Two-thirds of insured workers in America carry a card that looks like insurance, acts like insurance, and lives outside state insurance law.
The mechanics, in two lines
Federal mandates apply to almost every plan. The big federal protections, like the ACA's required benefits and the ban on surprise bills, apply whether your plan is self-funded, fully insured, bought on the marketplace, or offered through an employer of any size. (Insurance sorts employers into "small group," usually 50 or fewer workers, and "large group," anyone bigger.) For federal rules, the funding type doesn’t change much. For state rules, it changes everything, which is exactly where we're headed next.
State mandates apply only to fully insured plans. That includes individual marketplace plans, small-group plans, and the fully insured large-group plans some employers still buy. It does not include self-funded employer plans, regardless of how big or small the employer is.
Wait, but there are edge cases. Some states are testing how far they can push, mostly around prescription drugs. North Dakota just passed a law (HB 1584) that lets it regulate pharmacy benefit managers, the companies that handle drug coverage, even when they're working for self-funded plans. Those plans used to be off-limits to that kind of state rule. Other states are trying similar moves, and the courts haven't worked out how far any of it can go. For now the basic rule still holds: if you're fully insured, state mandates apply to you. If you're self-funded, they don't.
What this means for everyone in Biscuit's chain
Dr. Singh ordered the right test. The clinical answer didn't change. The coverage answer changed because of a piece of paperwork nobody in the exam room thought to ask about. Multiply that one appointment across the country and you get the same denial landing on thousands of patients whose doctors followed the standard of care exactly.
For the billing team at Dr. Singh's clinic, every claim with a big insurer logo on it might be playing by state rules or federal rules, depending entirely on the employer standing behind that card. Same logo, different rulebook. Which is why benefit verification at intake, the unglamorous front-desk step where someone checks what a plan actually covers before the visit happens, matters way more than it gets credit for. It's the first domino in revenue cycle management (more on RCM here), the whole behind-the-scenes machine that turns a visit into a paid claim.
For Biscuit's employer, self-funding is the reason they get to design their own plan without juggling 50 state rulebooks. That freedom is the whole point. It also means they, not the state, are the ones deciding whether to cover the test the state just mandated for everyone else.
What patients can actually do
Pull your insurance documents. Look for the phrase "self-funded," "self-insured," "ASO" (administrative services only), or "your employer is the plan sponsor." If you see any of that, you're in a self-funded plan. If you don't, call HR and ask one question: "Is our health plan fully insured or self-funded?" They'll know the answer in ten seconds.
If you're fully insured and your state has a mandate that fits your situation, you have real recourse. State coverage mandates are enforced by your state's Department of Insurance, the agency that licenses and polices every insurer operating in the state. (A few states call it a Division of Insurance or fold it into a bigger department, but every state has one.) When a plan that answers to state law denies something that law says it must cover, that agency is the referee you get to call.
Here's how it actually works:
You file a complaint, usually for free, through the department's website or by mail.
You attach the denial letter, the explanation of benefits, a note from your doctor, and a pointer to the specific state law you think the insurer broke.
The department reviews it, contacts the insurer, and makes them explain themselves.
If the insurer violated state law, the department can order them to reverse the denial and pay the claim, and in some cases fine them on top of it.
The exact timelines and steps vary by state, so check your own department's site for specifics before you start.
Two things worth knowing:
This only works for fully insured plans, because that's the only kind a state Department of Insurance has authority over. If you're self-funded, the state has no jurisdiction, and your complaint route runs through the U.S. Department of Labor instead, which oversees ERISA plans.
Insurers watch that complaint mailbox closely. A formal complaint creates a regulatory paper trail, and a stack of them invites exactly the kind of scrutiny an insurer would rather avoid. It's the reason a denial that went nowhere on a friendly phone call sometimes gets resolved within days once a complaint is officially on file.
What can market access teams do
If you build payer strategy for a new therapy, diagnostic, or device, this section is the reason you got this issue forwarded. Every state mandate looks like a win on the press release and a question mark on the forecast. The mandate covers fully insured lives. Your forecast probably assumes most commercial lives. Those two numbers are not the same.
Three things worth taking into your next meeting:
Build your market size around the split. In your target state, only about a third of people with commercial coverage are in fully insured plans, the only ones the mandate actually touches. The other two-thirds are in self-funded plans it can't reach. If your payer mix model doesn't separate those two groups, your forecast is off by a wide margin from day one. "The state mandated coverage" sounds like a win, but it tells you almost nothing until you break it down by funding type.
Treat the self-funded employer as its own buyer. Most teams underinvest here. A self-funded employer can add your therapy whenever it wants, with no mandate to wait for and none it has to follow, and a benefits consultant or HR team can often move faster than a health plan's pharmacy and therapeutics (P&T) committee. Some of the biggest access wins in oncology and rare disease in recent years came from large self-funded employers choosing to cover something directly. If your strategy ends at the national PBM and the regional Blue Cross plans, you've left the people with the most decision-making power off your map.
Keep an eye on the ERISA preemption fights. The action right now is in pharmacy, where the question of how far ERISA shields self-funded plans from state rules is being tested in court. If that shield weakens, a state mandate becomes a much more powerful access tool. If it holds, the employer channel stays the one that matters most. Either way, the team tracking these cases in real time gets a forecasting edge the others won't see coming.
All three depend on the same thing: knowing what each payer's policy actually says. A mandate sets a floor, but the real coverage criteria, the restrictions, the prior-auth language, the step edits, live in individual payer medical policies, and those are scattered across hundreds of documents that move every quarter. That's what Converus.ai pulls together, putting payer policy information in one place so you can see how a therapy is really covered and where it's restricted across payers, instead of rebuilding that picture by hand for every account.
What can billing teams do
If you run billing or revenue cycle at a practice, this one's for you. The card in front of you won't tell you which rulebook the claim follows. Two patients can hand you the same insurer logo on the same network, and one plan answers to state law while the other answers only to federal. That single difference decides whether a denial is worth fighting and how you fight it.
Catch the funding type at intake. When you run benefit verification, find out whether the plan is fully insured or self-funded. It's the one thing the card keeps to itself. Ask the payer, or scan the plan documents for "self-funded," "self-insured," "level-funded," or "ASO" (administrative services only). Write it in the chart next to the plan name. Here's what that one field buys you: it tells you which rulebook the claim follows before a denial ever shows up, so you can spot which mandates apply, set the patient's expectations honestly, and write the right appeal the first time instead of the second. A minute now saves you hours later.
Check funding type before you write the appeal. An appeal built on a state mandate only works on a fully insured plan. Try it on a self-funded plan and it's dead before anyone reads it, because state law never applied. For self-funded plans you work from the plan's own rulebook (the Summary Plan Description), the federal rules that do apply, and the plan's internal and external appeals, with the Department of Labor as the place you escalate. For fully insured plans the state mandate is fair game, and the state Department of Insurance is where you take it. Same denial, different playbook, and the wrong one just burns a week.
Get the rules in one place. Knowing the funding type only helps if you can find the policy that goes with it, and payer rules live scattered across dozens of portals, bulletins, and PDFs that change without telling anyone. That's the gap Converus.ai is built to close. It pulls payer policy information into one place, so your team can find the rule that applies to a given plan and situation instead of hunting across a dozen sites for it.
Bottom line: funding type decides which rules you're even allowed to cite. Catch it early and you stop firing good appeals at the wrong referee.
What to do this week
Whatever seat you're in, ask one question this week.
Patient: Is my plan fully insured or self-funded?
Doctor or biller: Do we capture funding type at benefit verification, and does our denial workflow check it before the appeal goes out?
Market access: Does our forecast split state mandate impact by funding type, or does it quietly assume the mandate applies to everyone?
RCM / billing: Do we know the funding type before we start billing this patient?
The answer changes everything downstream.
That's issue one. Hit reply, I read everything, and the best questions become the next lesson.
Bork Bork,
Shivang
