The Association: Cherish is the word

The National Association of Health Underwriters, provided a helpful presentation on these new rules, including something which seems to have gone unremarked, but seems to me to be very disturbing:

“In applying the nondiscrimination provisions of paragraphs … the group or association may not treat the employees of different employer members of the group or association as distinct groups of similarly-situated individuals based on a health factor of one or more individuals“

In other words, they can’t decline a given member (or employer) based on health or claims.

How do we know this? Well, in examples of association  actions which don’t pass “the smell test” we see this:

“As part of the membership application process, Individual D provides certain health information to Association C [and is declined coverage].”

What does this explicitly admit?

That someone at the association is reading and evaluating the Personal Health Information (PHI) of its members. This is a red flag, flares and tornado sirens going off all at once. I know from my ACA training that secure handling of PHI is an absolutely mission critical component of my job; there are significant sanctions imposed for mishandling it.

When I enroll a new group, I always advise employers to have their employees seal their applications in an envelope (with their name on the outside). Or better yet, use an online enrollment service. This way, they know that the employee has competed the paperwork/enrollment process, but no idea what health issues (if any) are disclosed. I do this so that later on, an employee can’t say “well, you only fired me because I’m a diabetic.” If the employer didn’t see the app, he couldn’t have known, so no worries.

But here, the employer is handing over his employees’ sensitive, personal health information to a total stranger, with no idea how it will be handled. And, of course, this entails an incredible liability on the association’s part.

Why isn’t this getting more play?