I really wish we could effectively apply Hanlon’s Razor in these cases and force the CEO and board of directs to literally chose between "are you and your CIO malicious" or "is your CIO so grossly incompetent that you have utterly failed in your fiduciary duty"

Isn't that the problem? In for profit healthcare being malicious IS the fiduciary duty. So long as everyone else is playing the same game, there's no reason for one insurance to suddenly "break good".