What the MLC Is Really Doing Today, Friday the 13th — And Why Members Are Being Cut Out

Today, the MLC's bosses and lawyers will justify selling our data for $100m to United Healthcare and its subsidiary, UMR. Union leaders must decide to comply or seek their members' consent.

Over the last few months, The Wire has reported on how the Municipal Labor Committee has been moving forward with the NYC Employee PPO, administered by UnitedHealthcare through its subsidiary UMR. That reporting showed the plan was built around strict cost targets and financial guarantees that depend on tighter control over how care is used — not just which doctors members can see, but how often care is approved, delayed, or denied.

More recently, The Wire revealed that a major piece of that arrangement involves prescription drug data held by union welfare funds. MLC leaders discussed that unlocking roughly $100 million in projected credits or savings was tied to insurers receiving pharmacy data covering most plan participants. That context matters because prescription data is a gold mine for UnitedHealthcare’s deny-and-delay machine. It allows the insurer to identify high-cost members, flag treatment patterns, train proprietary AI systems, and justify tighter utilization rules — often before a claim is even filed. Seen this way, the current push to obtain prescription data, and the effort to convince union leaders they do not need to go back to members for consent, is not incidental. It is the logical next step in a plan that relies on data to control care.

All of this is now being set up for a decision at today’s meeting of the Municipal Labor Committee. By then, MLC union leaders will already have the federal HIPAA documents in hand and will be asked to accept a simple conclusion: that consent is unnecessary and there is no real obligation to go back to members. That framing is not neutral. It is designed to settle the question before members ever have a chance to weigh in — even as leaders know the prescription data is central to the NYCE PPO deal, will directly feed UnitedHealthcare’s deny-and-delay systems, and carries legal and fiduciary risks under New York law. Once leaders proceed with full knowledge of what is at stake, responsibility for the consequences will rest squarely with those who chose to bypass members.

How HIPAA Is Being Used to Shrink the Question

The materials sent to MLC leaders focus almost entirely on one narrow point: federal HIPAA rules that permit health plans to share protected health information for “health care operations” without individual authorization.

What those materials do not do is address New York law. They do not discuss heightened state protections for certain health information. They do not analyze fiduciary duties owed by welfare fund trustees. And they do not confront the risks of centralizing massive volumes of prescription data inside a corporate insurer’s analytics systems.

By presenting HIPAA as the beginning and end of the legal analysis, the MLC reduces a major governance decision into a technical compliance exercise — and removes members from the process altogether.

Prescription Data Is a Medical Fingerprint

Prescription data is a medical fingerprint. It reveals who is sick, who is vulnerable, and who will cost an insurer money — all without a single member ever being asked for consent.

Even without diagnoses attached, prescription histories expose mental health treatment, HIV and PrEP use, cancer therapies, fertility care, and other deeply sensitive medical realities. Once centralized, that information becomes extraordinarily powerful.

And power, in this case, is not neutral.

Why UnitedHealthcare’s Track Record Matters

This data would not be going to a neutral bookkeeper. It would be going to UnitedHealthcare, the largest insurer in the country, operating through UMR, with its leading record of denying care more than anyone in the healthcare industry.

UnitedHealthcare has already shown what happens when health data is centralized at scale. In 2024, its Change Healthcare subsidiary suffered the largest health-care data breach in U.S. history, exposing personal and medical information tied to tens of millions of people. That breach did not occur because rules were ignored. It occurred inside a highly “compliant” system built for aggregation.

Under New York law, union leaders cannot pretend that lesson is irrelevant.

Data Isn’t Just Stored — It’s Weaponized

UnitedHealthcare is a leader in proprietary, AI-driven utilization management systems — technology designed to analyze patient data and generate automated or semi-automated decisions about coverage, prior authorization, and medical necessity.

These systems are opaque. Their logic is protected as trade secrets. And their incentives are aligned with cost containment.

Handing over prescription data doesn’t just satisfy an administrative request. It feeds those systems, sharpens them, and shifts decision-making further away from patients and clinicians — and toward algorithms members can’t see or challenge.

Calling this “health care operations” does not change what it is.

The “We’re Not Sharing It With the City” Red Herring

MLC leaders have also leaned on another talking point: that prescription data will not be shared with the City itself. That claim is a red herring. New York City is the sponsor of a self-funded NYCE PPO, and the City already sits at the center of this arrangement through its contracts, guarantees, and financial backstops.

Whether the data is technically handed to a City agency misses the point. What matters is that the data is being centralized inside the insurer and administrator that operate the City’s plan and make utilization decisions on its behalf. Once prescription data is embedded in UnitedHealthcare’s systems, it directly informs how the City’s self-funded plan is managed — how costs are controlled, which treatments face hurdles, and which members are flagged as financial risks. Saying “the City doesn’t get the data” distracts from the reality that the data will still be used to run the City’s plan intended to cut costs. The impact on members is exactly the same.

New York Law Still Applies

HIPAA is a federal floor. New York law goes further.

State law imposes heightened protections for HIV-related information, mental health treatment, and substance-use-related care — categories that can be plainly inferred from prescription data alone. New York also imposes independent data-security obligations and fiduciary duties on trustees that HIPAA does not erase.

None of that analysis appears in the materials circulated to MLC leaders.

Proceeding anyway does not make those issues disappear. It shifts the risk onto the trustees who approve the transfer.

This Is About Avoiding Members

If union leaders were required to go back to members and say, “We want to share your prescription histories with UnitedHealthcare and its administrator — do you agree?” the outcome would not be guaranteed.

Members might ask questions.

They might demand limits.

They might say no.

That uncertainty is exactly what this strategy is designed to avoid.

By asserting that consent is not required, the MLC bypasses the people with the most at stake. Once the data is shared, the decision cannot be undone. The precedent is set.

This Is a Choice — Made With Notice To Union Leaders

The federal HIPAA documents were sent to MLC leadership in advance of the meeting. Leaders were given the legal argument they need to move forward.

What they were not given — and what members were never given — is a full accounting of New York law, fiduciary responsibility, or the consequences of surrendering control over deeply personal health information.

At this point, moving forward is not a misunderstanding.

It is a choice.

HIPAA may allow this.

New York law may not.

And members were never asked.

That should concern everyone.

---

Learn more:

---

---