# Morrowspan Benefits Technologies: Growth With Controlled Access **Deck:** A synthetic benefits-navigation startup scenario examines how employer growth can outpace account controls, client separation, vendor oversight, and public-facing data practices. ## Synthetic scenario notice > **Synthetic scenario. All organizations, people, evidence, findings, and outcomes in this paper are fictional and created for illustration. No actual client engagement or achieved result is represented. Public references support sector context only. Any resemblance to real entities is coincidental.** ## Enrollment scale created an operating-control decision Morrowspan Benefits Technologies is a fictional benefits-navigation and enrollment startup. Its illustrative model combined enrollment support, a member portal, benefits education, and claim-question routing. Employer administrators uploaded rosters and plan materials; employees requested help and sent documents; outsourced navigators worked enrollment-peak cases. As accounts grew, a support specialist could not always tell whether a case record came from an employer roster, employee account, insurer response, or vendor handoff. Manager roles were copied from earlier launches, temporary navigators remained in group aliases, and a growth campaign added a demo form, analytics, and a pixel without one record of fields, tags, audiences, or vendor terms. The fictional choice was faster onboarding or defined boundaries. A fact-based assessment separates employer administration, employee service, claims activity, public marketing, and outside support without assuming legal status. ## Sector context requires factual classification Sensitive benefits data does not give every flow the same legal status. HHS states that HIPAA Rules apply to covered entities and business associates; company health plans are listed health plans, while entities outside both definitions have no HIPAA obligation on that basis. Actual role, contract function, and information flow matter. [1] HHS lists claims processing, administration, and data analysis among functions that can make a provider a business associate when PHI is involved. A third-party administrator assisting a health plan with claims processing is an example, and subcontractors can also be within that relationship. Written arrangements define permitted use, disclosure, and downstream duties. [2] HHS identifies cookies, pixels, session replay, fingerprinting, and embedded app code as tracking technologies. For HIPAA-regulated entities, authenticated webpages generally expose tracking tools to PHI. HHS also identifies a 2024 court order vacating part of its analysis about certain unauthenticated public health-topic webpages. Public forms and tracking therefore merit context-specific review rather than a categorical conclusion. [3] NIST describes provider, verifier, relying-party, and identity-provider functions that may be distributed among organizations. Its guidance calls for documented proofing and authentication decisions where personal or protected information is accessible. [4] ## Synthetic evidence and assessment assumptions Authorized synthetic evidence consists of a sample roster, role matrix, data-flow sketch, de-identified queue fields, vendor inventory, selected policies, and public-page observations. No live accounts, claims systems, source code, production logs, or plan documents are in scope. Legal classification, plan-sponsor permissions, insurance obligations, and cybersecurity testing remain with specialists. An Executive HR Risk Assessment could compare written role rules with manager decisions and training. A People & Operations Assessment could trace accountability across product, support, sales, and vendors. A Digital Risk Audit could inspect observable forms, tracking, marketing statements, and governance. All findings are **illustrative** and fictional. ## Priority findings for a controlled scale-up ### 1. Employer, employee, and client data were not consistently separated **Illustrative severity: High. Illustrative confidence: Moderate.** The fictional role matrix used an employer-account label as a broad permission group. It did not distinguish an administrator needing roster status from a navigator needing an employee document or an account lead needing adoption metrics. The data-flow sketch did not identify exports to insurers, brokers, and benefit vendors. This connects to **HR Governance & Operational Controls** and **Executive & Management Accountability**. An operations leader could own boundaries, while product translates them into roles, fields, and export rules. An illustrative outcome is a map separating employer administration, individual service, analytics, and vendor exchange. It supports specialist review, not compliance proof. ### 2. Worker authorization and manager controls lagged the changing workforce **Illustrative severity: High. Illustrative confidence: Moderate.** The scenario used a manager request for onboarding, but not one event for reassignment, seasonal staffing, and departure. Outsourced navigators inherited queue membership through aliases. Managers did not certify that access matched employers, duties, or training. This is an **Employment Practices & Compliance**, **HR Governance & Operational Controls**, and **People & Operations Assessment** issue. A proportionate control could use a role catalogue, manager attestation, event-driven removal, and an exception route for enrollment surges. An illustrative outcome is clearer manager ownership. No scenario outcome indicates unauthorized access. ### 3. Claims-navigation handoffs lacked a single outsourced-operations standard **Illustrative severity: Elevated. Illustrative confidence: Moderate.** The fictional support model routed benefit questions and documents to insurers, brokers, or case specialists. Vendor statements described service levels but not allowed information, escalation owners, channels, training evidence, subcontractor use, or return and deletion expectations. This connects to **Workforce Financial Risk**, **Executive & Management Accountability**, and a specialized overlay. HHS guidance makes function, PHI involvement, and downstream subcontractors relevant. [2] Counsel and privacy specialists could evaluate contracts. An illustrative outcome is a vendor register linking each handoff to an owner, data category, contract status, instructions, and training evidence. It does not establish contract sufficiency. ### 4. Public forms, analytics, and benefits marketing had no evidence trail **Illustrative severity: Elevated. Illustrative confidence: Moderate.** The scenario's demo form collected employer and contact details, while education pages and the portal used analytics tags. Sales material described simpler enrollment and personalized navigation, yet no owner maintained source support, approval history, audience restrictions, or a release checklist. Public pages and the portal had been treated as one digital property. This fits a **Digital Risk Audit** across Forms & Data Collection, Cookies & Tracking, Marketing & Claims, and Digital Governance. An illustrative outcome is a register for each form, recipient, purpose, tracker, marketing statement, and approval owner. It supports qualified review rather than treating a notice or banner as conclusive evidence. HHS guidance supports examining what tools collect and disclose, especially in authenticated areas. [3] ## Alternative control paths and tradeoffs Morrowspan could use client-dedicated queues and workspaces for clearer separation at the cost of slower flex staffing. Logical tenancy with field constraints, role-specific views, and auditable exports may preserve scale but requires stronger engineering and review discipline. Employer single sign-on can tie worker changes to an employer identity source, but may not cover dependents, former employees, or vendors. Managed local accounts can cover those groups but increase identity operations. NIST's model can inform either design. [4] A conservative marketing path excludes third-party tracking from authenticated areas and limits forms; a measurement-oriented path needs documented flows, approved vendors, and review. Counsel and privacy specialists should classify actual flows before leadership selects a path. ## Accountable 30/60/90-day roadmap **First 30 days.** An executive sponsor could name owners for data governance, product access, workforce operations, vendor management, and digital publishing. Those owners could inventory employment categories, client and employee data domains, account groups, public forms, trackers, marketing claims, and handoffs. William could personally lead the leadership-accountability session or recruit and oversee implementation personnel, especially operations and product leadership. The deliverable would be a decision log for assumptions, not-tested items, and specialist questions. **Days 31-60.** Product and operations owners could publish the role catalogue, approval workflow, review cadence, temporary-worker rules, and exception route. Vendor management could map each handoff to purpose, contract owner, data category, and escalation contact. Digital publishing could maintain a form-and-tracker register with source evidence for benefits marketing. Privacy counsel could assess applicability from documented facts. **Days 61-90.** Leadership could select dedicated or logical client segmentation, implement chosen rules in a controlled release, and train managers on authorization and escalation. A follow-up review could test joiner, mover, and leaver events; one vendor handoff; a claim-navigation escalation; and a public-page release. Results should be resolved, partial, or unresolved, not a statutory-compliance percentage. ## Illustrative verification and remaining exposure Illustrative verification compares a sample of active accounts with the role catalogue and assignment list, inspects selected departures, traces one case handoff, and reviews tracker and fields on selected public and authenticated pages. A further check confirms an owner and retained basis for one benefits marketing statement. These are fictional tests, not completed testing or achieved results. Remaining exposure could include incomplete identity feeds, emergency access, subcontractor changes, evolving plan terms, and the legal status of particular flows. A Digital Risk Verify or follow-up People & Operations Assessment could report a tested correction as resolved, partial, or unresolved. Counsel, privacy, security, insurance, and plan specialists remain responsible for professional interpretation. ## Professional scope limits This paper presents a fictional advisory scenario. The Goldsborough Group could provide prioritized operational recommendations, leadership accountability support, and observable digital-risk review under an agreed scope. The work would not provide a legal opinion, determine HIPAA or other regulatory applicability, certify security controls, conduct penetration testing, issue clinical advice, guarantee compliance, or represent savings, penalties, return on investment, or client outcomes. ## References [1]: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html "HHS Covered Entities and Business Associates" [2]: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html "HHS Business Associates Frequently Asked Questions" [3]: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html "HHS Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" [4]: https://pages.nist.gov/800-63-4/sp800-63.html "NIST SP 800-63-4 Digital Identity Guidelines"