Both the insurance company and the employer could have exposure for this, and I really question why the insurance company would give the employer these codes at all.

yeah, that bit stuck out to me and made me wonder if OP isn't in the US, because the employer sucking this badly is something I believe, but this seems like a lawsuit waiting to happen for the insurance company which should know their risk.