You go to work one day and notice Susan is not there. Nobody you ask knows what happened to her, and management seems oddly tight-lipped about her whereabouts. Finally, they tell you and your co-workers that Susan has taken a leave of absence, but you get no additional details. Your company's attorneys, corporate compliance officers, and HR personnel have been properly coached as to the myriad of stringent health privacy rules in the workplace, and everyone is rightfully paranoid.

I am reminded of an eccentric law professor I had who relished saying that "no good deed goes unpunished" whenever discussing the inevitable unintended consequences of legislation or contract terms. But after 22 years of the Health Insurance Portability and Accountability Act (HIPAA), I am not even sure the law was ever a good deed—at least not for those who have weaponized its use against employers.

The HIPAA privacy rule was designed to protect individuals' medical records and other personal health information. However, the latest practices by health insurance carriers raise serious concerns about how they use these rules to maximize premiums.

Overly Cautious Here, Galloping Through Loopholes There

Companies that have fewer than about 250 employees on an insurance plan (the exact number varies from carrier to carrier) receive only meager, large-claims data at the end of the year. They do not get month-to-month information on claims versus premiums. The stated reason: Carriers are concerned that if they provide too much specific detail about employees' health and claims activity, the employer may be able to discern who has what condition. This, the logic goes, violates HIPAA. And the smaller an employee population, the greater the risk. So most carriers will start to give out detailed claims information once a plan includes at least 250 employees. That is 250 with Carrier A, not 250 split across Carriers A and B.