Private insurers stealing from HSA accounts