I think ( not remembering the exact language ) that ACA requires health insurance coverage for all residents of the USA ( except for specific exemptions) -- so not having insurancemay expose him to the individual responsibility payment , even though he could not obtain the required coverage without SSN / ITIN. Sorry for your predicament
