The Health Insurance Portability and Accountability Act (HIPAA) of 1996 has been praised and criticized for asserting federal authority to regulate health insurance. We review the history of federalism and insurance regulation and find that HIPAA is less of a departure from traditional federal authority than it is an application of existing tools to meet evolving health policy goals. This interpretation could clarify future health policy debates about appropriate federal and state responsibilities. We also report on the insurance environments and the HIPAA implementation choices of thirteen states. We conclude with criteria for judging the success of HIPAA and the evolving federal/state partnership in health insurance regulation.