Reason Number 6,985 that Medicare for all would be better

AOL CEO Tim Armstrong held a town hall meeting last week about why the company was cutting retirement benefits, one of his explanations caused a nationwide uproar.

"We had two AOL-ers that had distressed babies that were born that we paid a million dollars each to make sure those babies were okay in general," Armstrong said.

The comment set off a firestorm of controversy, with the mother of one of the babies publicly blasting Armstrong for his comments. He has since apologized and reversed the decision to cut pension plans.

But how did the company head learn about the health conditions of his employee's babies to begin with?

AOL would not respond to CNN's inquiry about how Armstrong got his information.

But believe it or not, it's perfectly legal for many companies to have access to employee records from their group health plans. That's right, the stuff you thought was just between you and your doctor.

Q: Can my insurer or employer get my health records without my permission?

A: Yes.

The Amended HIPAA Privacy Rule gives health plans and self-insured employers broad authority (“regulatory permission”) to get information without consent that is far more extensive than is needed for billing or any other reason related to a specific individual’s health care. Other uses for which health plans and employers are authorized to obtain use and disclose an individual’s health information without consent include:

Due diligence in connection with the sale or transfer of assets;
Certain types of marketing;
Business planning and development;
Business management and general administrative activities; and
Underwriting, premium rating and other activities relating to the creation, renewal or replacement of a contract of health insurance. Section 164.501