So my company has had a pharmacy client for 5+ years. They got bought by a bigger company, who got bought by a much bigger company, United Health.

In order for us to continue working with them, a company claiming to be contracted by United Health wants my company to provide them the following:
- Articles of Incorporation
- Proof that all of my employees are US citzens (drivers licenses and Social Security cards
- Our resumes
- Certificate of Insurance
- Invoices for 2-3 of our clients
- W-2s for each of my employees

In addition, they want each of us to have drug tests and background checks through a company called HireRight. They did say we can blot out the personal information on any documentation we provide, but we will have to provide personal information for the background checks.

This has really set off my internal alarms as some kind of scam, but the person I work with at this pharmacy has indicated that other companies he deals with have been asked to provide the same. Some of the items I have no problem providing, such as the drug tests, certificate of insurance.

We get around 20% of our income from this company, so we can lose the business and still do fine, but it's a pretty big chunk of money nonetheless.

What are everyone's thoughts? Should I agree to provide the info?

quote:

a company claiming to be contracted by United Health wants my company to provide them the following:

<snip>

What are everyone's thoughts? Should I agree to provide the info?

- Check with your parent company and United Health.
- If legit, you have no choice, if you want to remain employed with them.

The W-2 info would concern me.

might need to get a lawyer involved negotiating on your behalf.

pick the couple that are the most onerous and see if you can get them abated somewhat

my company does contract negotiations with large hospital systems (not my job personally) and I do know sometimes the requirements / precise verbiage goes back and forth between legal teams before the signatures are finalized

bottom line -- you may have some 'wiggle room'

what they are 'requiring' is probably a set template they always use and 'assume' new orgs will automatically submit

-------------------------

quote:

They did say we can blot out the personal information on any documentation we provide,

Seems very heavy handed and overdone to me. Why do they need W2s, invoices from OTHER clients etc? How does that improve their operational security? These are NOT their clients or their employees. My first reaction was to just say no. But on second thought, here's what I would do. Give them what they want, but blot out 95% of whatever you give them. If they ask what's up with that, your response is that you complied with their request, but redacted all of the personal information. My view is that 95% of it would be personal information. If they drop you because of it, I would see a lawyer and litigate. I'm dead serious about that.

Management can force any conditions of hire on you they want. You’ll either have to comply or start looking for employment elsewhere. It might be a good thing if they’re trying to separate out non-citizens. Drug tests are no big deal as long as they’re paying, but I’m not sure why the W-2 requirement is relevant unless it’s to make sure people aren’t being our under the table.

We do business with several major healthcare providers. Most all require this some more detailed than others.

Almost all use a 3rd party company to certify us.

Resumes, a "certificate of good standing" for the corporation, and an insurance cert all make sense.

I've never seen the other requirements in a sub-contract agreement. They have no right to the W-2 info.

If my company provided my W-2, SSN, and driver's license info as part of a contract, I'd sue them.

If we provided other clients invoices to a third-party, that would be in violation of privacy terms of those contracts.

If the company wanted it, we'd certify that our employees are US citizens, checked as part of our hiring. No way would we provide SSNs or driver's license info. Providing SSN + home address is ripe for identity fraud.

Unless this is a government contract (ie required by law), I wouldn’t want to continue to do business with a client like this. Red flags:

other clients’ invoices - this has legal ramifications such as Anti-trust laws. You need to have your attorney involved and specifically discus antitrust laws.

W2s for employees - unless you bill by the hour with each employee having a different rate (ie cost plus contract) then this has privacy law ramifications too. You need to have your attorney involved and likely HR too.

---

Ego is the anesthesia that deadens the pain of stupidity

DISCLAIMER: These are the author's own personal views and do not represent the views of the author's employer.

Not my area of expertise, but some of what they're requesting sounds rather sketchy. They have no right to invoices for your other clients. Were I one of your other clients and found you were sharing our business relationship with other clients, you'd quickly become a non-vendor. Same with the W-2s. ISTM they have no right to that information. What you pay your employees, what deductions they take, etc. is none of their business.

Do what you must, but I'd be inclined to terminate the relationship and find new clients.

quote:

Check with your parent company and United Health.
- If legit, you have no choice, if you want to remain employed with them

^^^^^^^^^^^^^^
This. United Health has a HUGE footprint and can dictate conditions such as this. Let us know how it works out.

Has anyone in your company gone back to United Health to ask them about the request you have received? Along this line, you said United Health is a client. Seems unusual that a client is asking so much of a supplier--why? Think United Health needs to provide your company with some answers.

As others have opined, most of the info they demand is ok; some is not. Since your company can redact, do so. Blackout the body of the invoices (they just want to know who to call for further background) redact employee last names and personal numbers on the W-2's.

quote:

Originally posted by 12131:

quote:

a company claiming to be contracted by United Health wants my company to provide them the following:

<snip>

What are everyone's thoughts? Should I agree to provide the info?

- Check with your parent company and United Health.
- If legit, you have no choice, if you want to remain employed with them.

Thanks! This actually turned out to be the best advice - I called UHG and they told me that 1) they had no record of the contactor, and 2) we could continue working with them without providing any information to the contactor.

I notified the contactor of this. We'll see where it goes.

Thanks again, all!

Wow...was this some sort of elaborate phishing attempt to get all info needed to steal identities?

quote:

Originally posted by AUTiger89:

quote:

Originally posted by 12131:

quote:

a company claiming to be contracted by United Health wants my company to provide them the following:

<snip>

What are everyone's thoughts? Should I agree to provide the info?

- Check with your parent company and United Health.
- If legit, you have no choice, if you want to remain employed with them.

Thanks! This actually turned out to be the best advice - I called UHG and they told me that 1) they had no record of the contactor, and 2) we could continue working with them without providing any information to the contactor.

I notified the contactor of this. We'll see where it goes.

Thanks again, all!

No idea yet. I haven't heard back from the contractor. But if I do, I'll update the thread.

quote:

Originally posted by Jimbo Jones:
Wow...was this some sort of elaborate phishing attempt to get all info needed to steal identities?

quote:

Originally posted by AUTiger89:

quote:

Originally posted by 12131:

quote:

a company claiming to be contracted by United Health wants my company to provide them the following:

<snip>

What are everyone's thoughts? Should I agree to provide the info?

- Check with your parent company and United Health.
- If legit, you have no choice, if you want to remain employed with them.

Thanks! This actually turned out to be the best advice - I called UHG and they told me that 1) they had no record of the contactor, and 2) we could continue working with them without providing any information to the contactor.

I notified the contactor of this. We'll see where it goes.

Thanks again, all!

have you googled the company asking for the information on behalf of UH? If it is a scam, and, as your pharmacy friend has stated other companies have complied, then this "security" company is obtaining a lot of private data and should be reported.

I'm surprised UH didn't ask about who this company was because they seem to be targeting their suppliers, using UH's name.

UH should have some company security department head/VP...

And the "blotted out" thing seems hinky, too. If they want this stuff and its part of vetting your company, blotting out info seems counter productive.

quote:

Originally posted by HRK:
have you googled the company asking for the information on behalf of UH? If it is a scam, and, as your pharmacy friend has stated other companies have complied, then this "security" company is obtaining a lot of private data and should be reported.

I'm surprised UH didn't ask about who this company was because they seem to be targeting their suppliers, using UH's name.

UH should have some company security department head/VP...

I agree. Even if they are just stupid, they should be stopped.


They could just be idiots.

I think they are crooks. But idiocy is very popular these days.

We will supply limited amounts of generally public information for these requests, but employee data or individual identification requests are always denied.

We get this often from appraisal management companies wanting to hire our firm to provide an appraisal for them. Our standard answer is no. If pushed, and if the contract is lucrative enough, we'll provide a certificate of incorporation and a copy of our professional licenses for whomever is going to be assigned to do the work for this contract. Anything more than that is a flat out denial. They usually start with threats to use our competition instead of us, then move to lies that its required by law (it's not), and other creative tactics.

About 1/4 of the time (which I think is good odds) they come back a few days later and are will to waive all their bullshit requirements "just this one time". The thing is, my fee has ALWAYS doubled in the mean time.

If it was my company, I'd let UH know that your rates will have to go up to compensate for the additional risk and time this third party company is causing. Send a certificate of incorporation (not articles), send a copy of your appropriate business license, and perhaps a letter/certficate of insurance proof, send a copy of the appropriate professional license, and perhaps a letterhead memo outlining your own internal hiring policies and procedures. Other than that, its up to them to do the legwork to see if you are criminals. You owe them nothing, and can only increase your own liability to your employees by complying. Giving out private information is a bad idea, and can create some liability for you.