The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) is taking action to protect healthcare providers, health, insurers, employer, and other health plans and their sponsors and others from being penalized for refusing to cover or pay for abortion by states or other entities covered by the rights of conscience rules of the Weldon Amendment.

Plan sponsors, fiduciaries, administrators and insurers that have offered abortion or other reproductive rights coverage under pressure from Biden, administration or state agencies, threatening adverse consequences for not covering those procedures should reevaluate their options in light of the new guidance and adjust their design or administration accordingly.

On March 19, 2026, OCR announced its investigation of 13 states for allegedly violating the Weldon Amendment federal health care conscience law by coercing health care entities, health insurers, and employers and their health plans to provide coverage of, or pay for, abortion contrary to conscience.

The Weldon Amendment, among other things, prohibits federal, state, or local government discrimination against health care entities that choose not to pay for, or provide coverage of, abortion. 

After it repudiated a 2021 Biden Administration era letter that excluded employers and plan sponsors from the scope of health care entities protected by the Weldon Amendment, OCR notified states and other regulated entities no longer rely on the now-repudiated legal position.

OCR Director Paula M. Stannard says, “Under the Weldon Amendment, health care entities, such as health insurance issuers and health plans, are protected from state discrimination for not paying for, or providing coverage of, abortion contrary to conscience. Period.”

OCR’s announcement builds upon the Trump Administration policy and HHS’ resulting recent efforts to enforce federally protected right of conscience protections and protect human life. 

Over the past year, OCR initiated a host of policy revisions and investigations in furtherance of President Trump’s priorities of protecting rights of conscience and human life. See  Fact Sheet: HHS Takes Comprehensive Action to Enforce Conscience Rights and Protect Human Life, and OCR’s conscience and religious freedom webpage.

Among other things, OCR has taken action to protect health care workers, support whistleblowers, and reinforce adherence to religious and conscience exemptions in the Vaccines for Children Program as part of these policies.

Earlier this year, OCR also issued a Notice of Violation that found an Illinois state law violated the Weldon and the Coats-Snowe Amendments, which are part of the two dozen federal health care conscience protection statutes that HHS enforces. The Illinois Notice of Violation charged the Illinois law unlawfully ties health care provider conscience protections to referral requirements in the case of abortion.

Along with the charges against Illinois, OCR also:

• Issued three public notices describing OCR deregulatory actions to align with President Trump’s E.O. 14182, Enforcing the Hyde Amendment; and
• Issued nationwide Dear Colleague Letter explaining OCR’s right of conscious policy under the Trump Administration.

That guidance rescinded and repudiated certain Biden Administration era policies that the Trump Administration viewed outdated or inconsistent with the law as construed and enforced by the Trump Administration.

To educate the public, OCR also released a nationwide Dear Colleague Letter summarizing federal health care conscience protection statutes, including those laws specific to abortion, sterilization, and assisted suicide.

In light of the new OCR emphasis on protecting rights of conscience against governmental, encroachment, as well actions of private healthcare or other organizations regulated or funded by OCR, as well as healthcare providers, health plans and insurers, their employer or other sponsors, and fiduciaries should evaluate their policies and practices. 

Health plans, their employer and other sponsors, fiduciaries, and administrators that felt compelled to offer abortion or other reproductive services, Taylor vaccine policies, or engage in other conduct and violation of their rights of conscious should consult experienced legal counsel about the protections potentially available under the new policies of the Trump Administration and the required or recommended steps to take to revise their plans to defensively exercises rights.

Meanwhile, states, local governments, government contractors, and healthcare and other organization, subject to HHS write a conscious rules should reevaluate their policies regarding abortion, vaccination, and other reproductive rights in light of the new guidance to avoid violating the adjusted policies.

If you have questions about this or other health care concerns, contact the author. 

For More Information

We hope this update is helpful. For more information about the  or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel and a Martindale-Hubble “AV-Preeminent” (Top 1%) attorney and advisor board certified in labor and employment law by the Texas Board of Legal Specialization peer peer celebrated as “Top Rated Lawyer” and “LEGAL LEADER™ “Top Rated Lawyer” and “Best Lawyer” for her work in ERISA & Employee Benefits Law, Health Care Law, Labor and Employment Law, and Business and Commercial Law.

Nationally recognised for her decades of leading edge health and other employee benefits and insurance, compensation, human resources and other management work, public policy leadership and advocacy, coaching, teachings, and publications, Ms. Stamer is well known for her decades of pragmatic, leading edge work, scholarship and thought leadership on health benefit and other health and managed care, privacy and data security and other employee benefit, insurance, and health industry legal, public policy and operational concerns. 

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.  As a a key focus of this work, she has continuously and extensively worked with domestic and international health plans, their sponsors, fiduciaries, administrators, and insurers; managed care and insurance organizations; third party administrators and other health benefit service providers; hospitals, health care systems and other health care providers, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies.

Her experience includes more than 35 years of leading edge work for employer and other plan sponsors, plans and their fiduciaries, insurers, third party administrators, health care clearinghouses and other health care, insurance and other data and technology providers, and others on health and other employee benefits design, administration, compliance, and policy including decades of work on fiduciary compliance and risk management; eligibility, coverage and other plan mandates; administrative simplification and transparency; PBM, pharmacy and pharmaceutical management and regulation; surprise billing and other non-par provider; direct provider, vendor and other credentialing, contracting and management; and other managed care and insurance; high deductible, minimum or level premium, captive and other non traditional funding; and agency and private audits, investigations and enforcement; and other insured and self-insured health benefit contracting, design, administration, regulation, fiduciary and other liability managment, and other design, compliance, risk management, defense, and operations solutions.

She also has extensive experience helping health care systems and organizations, group and individual health care providers, health plans and insurers, health IT, life sciences and other health industry clients prevent, investigate, manage and resolve  sexual assault, abuse, harassment and other organizational, provider and employee misconduct and other performance and behavior; manage Section 1557, Section 504, Civil Rights Act and other discrimination and accommodation, and other regulatory, contractual and other compliance; vendors and suppliers; contracting and other terms of participation, medical billing, reimbursement, claims administration and coordination, Medicare, Medicaid, CHIP, Medicare/Medicaid Advantage, ERISA and other payers and other provider-payer relations, contracting, compliance and enforcement; Form 990 and other nonprofit and tax-exemption; fundraising, investors, joint venture, and other business partners; quality and other performance measurement, management, discipline and reporting; physician and other workforce recruiting, performance management, peer review and other investigations and discipline, wage and hour, payroll, gain-sharing and other pay-for performance and other compensation, training, outsourcing and other human resources and workforce matters; board, medical staff and other governance; strategic planning, process and quality improvement; meaningful use, EMR, HIPAA and other technology,  data security and breach and other health IT and data; STARK, ant kickback, insurance, and other fraud prevention, investigation, defense and enforcement; audits, investigations, and enforcement actions; trade secrets and other intellectual property; crisis preparedness and response; internal, government and third-party licensure, credentialing, accreditation, HCQIA and other peer review and quality reporting, audits, investigations, enforcement and defense; patient relations and care;  internal controls and regulatory compliance; payer-provider, provider-provider, vendor, patient, governmental and community relations; facilities, practice, products and other sales, mergers, acquisitions and other business and commercial transactions; government procurement and contracting; grants; tax-exemption and not-for-profit; privacy and data security; training; risk and change management; regulatory affairs and public policy; process, product and service improvement, development and innovation, and other legal and operational compliance and risk management, government and regulatory affairs and operations concerns. to establish, administer and defend workforce and staffing, quality, and other compliance, risk management and operational practices, policies and actions; comply with requirements; investigate and respond to Department of Insurance, Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, trucking, alcohol and firearm, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry actions: regulatory and public policy advocacy; training and discipline; enforcement;  and other strategic and operational concerns.

Former lead advisor to the Government of Bolivia on its Social Security Privatization reform, miss Stamer also has extensive legislative and regulatory affairs experience on federal, state and international employee benefits, healthcare, workforce, education, insurance, data privacy and security, antitrust, and other regulations and reforms.

In addition, Ms. Stamer contributes her time and leadership to numerous policy, professional, civil and other organizations, Ms. Stamer currently or previously served as the Scribe leading annual agency meetings on HIPAA and other issues with the Department of Health and Human Services; leadership Council Representative, speaker, author and faculty lead for the American Bar Association (“ABA”) Joint Committee on Employee Benefits; the ABA International Section International Employment Law Committee and International Life Sciences Committee Chair; the ABA Tort Trial and Insurance Practice Section Medicine and Law Committee Chair and Employee Benefits and Worker’s Compensation Committees Vice Chair; the ABA Health Law Section Managed Care & Insurance Interest Group Chair and Risk Management Interest Group Chair; the ABA RPTE Employee Benefits & Other Compensation Group Chair and Welfare Benefit, Fiduciary Responsibility, and Plan Terminations and Transactions Committees Chair; Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association; a Southwest Benefits Association Board Member; a SHRM Consultants National and Region IV Board Chair; WEB National Board Member and Dallas Chapter President; National Kidney Foundation of North Texas Board Member and Compliance Chair; Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency Board President; a North Texas United Way Long Range Planning Committee Member; and other leadership involvement in a broad range of other professional and civic organizations.

Author of hundreds of highly regarded works on health and other benefits, human resources, health care, insurance, data privacy and security and other related concerns, examples of these publications include “Transparent PBM Contracting,” “ACOs, Direct Contracting: Legal & Practical Challenges For Employers, Providers & TPAs,” “The Medicare Advantage Contracting Manual,” “Third Party Administrator (TPA) Contracting Principles and Strategies and a multitude of other publications and presentations. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

National insurer Aetna Inc., has agreed to pay $117,700,000 to resolve Federal allegations that it violated the False Claims Act by submitting or failing to withdraw inaccurate and untruthful diagnosis codes for its Medicare Advantage Plan enrollees in order to increase its payments from Medicare.

The settlement adds to the growing list of Justice Department enforcement actions and settlements involving leading Medicare Advantage insurers accused of defrauding or engaging in other prohibited conduct dealing with the Medicare program.

These and other payer-focused investigations, prosecutions and settlements alert employer and union sponsored health plans, their sponsors and fiduciaries of the advisability of using prudent processes to verify the compliance of their health insurance vendors or the accuracy of their charges or other data to comply with the Employee Retirement Income Security Act (“ERISA”) and protect themselves and their plans from other avoidable costs and liabilities.

MA Plan Violations

The Medicare Advantage (“MA”) Program, established under Medicare Part C allows Medicare beneficiaries to opt out of traditional Medicare and enroll in private health plans offered by insurance companies known as Medicare Advantage Organizations, or “MAOs.” The Centers for Medicare & Medicaid Services (“CMS”) pays MAOs a fixed monthly amount adjusted for various risk factors that affect expected health expenditures for the beneficiary. In general, CMS pays MAOs more for sicker beneficiaries expected to incur higher healthcare costs. To qualify for these “risk adjustments,” CMS requires MAOs to submit medical diagnosis codes to show their plans cover sicker patients.

The United States alleges that Aetna submitted inaccurate and untruthful patient diagnosis data to CMS in order to inflate the risk adjustment payments it received from CMS, failed to withdraw the inaccurate and untruthful diagnosis data, failed to repay CMS, and falsely certified in writing to CMS that the data was accurate and truthful. The settlement announced on March 12, 2026, resolves these allegations.

“The government pays private insurers over $530 billion each year to care for Americans enrolled in Medicare Advantage,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “We will continue to hold accountable insurers that knowingly submit inaccurate or unsupported diagnoses to improperly inflate reimbursement.”

The United States contends that, for payment year 2015, Aetna operated a “chart review” program in which it paid diagnosis coders to review medical records (also known as “charts”) and identify all medical conditions that the charts supported. Aetna relied on the results of those chart reviews to submit additional diagnosis codes to CMS to obtain additional payments. However, CMS and the Justice Department claim Aetna’s chart reviews did not substantiate some diagnosis codes previously reported by Aetna to CMS. Aetna did not delete or withdraw those diagnosis codes, which would have required Aetna to reimburse CMS. The Justice Department alleges that Aetna used the results of its chart reviews to identify instances where Aetna could seek additional payments from CMS while ignoring those same results when they indicated Aetna was overpaid.

The settlement also resolves further allegations that, for payment years 2018 to 2023, Aetna knowingly submitted or failed to delete or withdraw inaccurate and untruthful diagnosis codes for morbid obesity to increase the payments it received from CMS for beneficiaries enrolled in its MA plans. The medical records for individuals diagnosed as morbidly obese typically include one or more Body Mass Index (BMI) recordings. Aetna submitted or failed to delete inaccurate and untruthful diagnosis codes for morbid obesity for individuals whose recorded BMI was inconsistent with a diagnosis of morbid obesity, and these codes increased the payments made by CMS.

The civil settlement related to morbid obesity resolves a lawsuit filed under the whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government when they believe that a defendant has submitted false claims for government funds and receive a share of any recovery. The qui tam case is captioned United States ex rel. Mary Melette Thomas v. Aetna Inc., et. al., number 24-cv-339 in U.S. District Court for the Eastern District of Pennsylvania. The settlement in this case provides for the whistleblower, a former Aetna risk-adjustment coding auditor, to receive a $2,012,500 share of the settlement amount.

The investigation and resolution of this matter illustrate the government’s emphasis on using the False Claims Act and other federal health care fraud laws to combat healthcare fraud. While traditionally these efforts have emphasized the investigation and prosecution of civil or criminal claims against health care providers, often at the urging or based on data provided by large health insurance payer entities contracted with Medicare, over the past year the Justice Department and Department of Health and Human Services Office of Inspector General (“OIG”) and state regulators have announced a growing series of False Claims Act and other health care fraud charges and settlements against Medicare Advantage, health insurance exchange and other major health insurers participating in Medicare programs.

For example, in January, 2026, the Justice Department announced Kaiser Foundation Health Plan Inc.; Kaiser Foundation Health Plan of Colorado; The Permanente Medical Group Inc.; Southern California Permanente Medical Group; and Colorado Permanente Medical Group P.C. (collectively “Kaiser”) agreed to pay $556 million to resolve allegations that they violated the False Claims Act by submitting invalid diagnosis codes for their Medicare Advantage Plan enrollees in order to receive higher payments from the government.

The Kaiser settlement resolved allegations that, from 2009 to 2018, Kaiser engaged in a scheme to increase its Medicare reimbursements by pressuring physicians to add diagnoses after patient visits through “addenda” to patients’ medical records. The United States alleged that Kaiser developed various mechanisms to mine a patient’s past medical history to identify potential diagnoses that had not been submitted to CMS for risk adjustment. Kaiser then sent “queries” to its providers urging them to add these diagnoses to medical records via addenda, often months and sometimes over a year after visits. In many instances, the United States alleged, the diagnoses added by the providers had nothing to do with the patient visit in question, in violation of CMS requirements.

The United States further alleged that Kaiser set aggressive physician- and facility-specific goals for adding risk adjustment diagnoses. It alleged that Kaiser singled out underperforming physicians and facilities and emphasized that the failure to add diagnoses cost money for Kaiser, the facilities, and the physicians themselves. It also alleged that Kaiser linked physician and facility financial bonuses and incentives to meeting risk adjustment diagnosis goals.

The United States alleged that Kaiser knew that its addenda practices were widespread and unlawful. Kaiser ignored numerous red flags and internal warnings that it was violating CMS rules, including concerns raised by its own physicians that these were false claims and audits by its own compliance office identifying the issue of inappropriate addenda.

The Kaiser civil settlement includes the resolution of certain claims brought in lawsuits under the qui tam or whistleblower provisions of the False Claims Act by Ronda Osinek and James M. Taylor, M.D., former employees of Kaiser. Under those provisions, private parties are permitted to sue on behalf of the United States and receive a portion of any recovery. The qui tam cases are captioned United States ex rel. Osinek v. Kaiser Permanente, et al., No. 3:13-cv-03891 (N.D. Cal.) and United States ex rel. Taylor v. Kaiser Permanente, et al., No. 3:21-cv-03894 (N.D. Cal.). The relator share of the recovery totaled $95 million.

While the number of settlements and prosecutions against health insurance entities remain relatively small, Medicare Advantage and other health insurance organizations or their affiliates contracted with Medicare’s also have faced a myriad of other False Claims Act or other charges of misconduct. See e.g., Troy Health, Inc. Enters Non-Prosecution Agreement and Admits to Fraudulently Enrolling Medicare Beneficiaries and Identity Theft; Executive Vice President Of Insurance Brokerage Pleads Guilty In $133M Affordable Care Act Fraud Scheme; Health Plus Was Excluded for 10 Years for Failing to Supply Payment Information Required in an OIG Subpoena.

Health Plan Sponsor & Fiduciary Implications

Coupled with the OIG’s recent addition of health care payer-focused projects to its latest compliance plan, however, these prosecutions and settlements should warn health care payers to tighten their controls and other compliance while signaling the advisability of tighter scrutiny of payer vendors by employer and other private health program sponsors and fiduciaries.

Employer and other plan sponsors face obvious financial risks from inappropriate vendor charges and actions. Because ERISA’s duty of prudence obligates plan fiduciaries to act prudently to protect plan assets and provide for proper administration of the plan, health plan fiduciaries also risk personal liability for failing prudent due diligence, contractual, audit, oversight, enforcement and requires plan fiduciaries to prevent plan losses and administrative errors arising from these and other vendor misconduct and performance deficiencies.

If you have questions about this or other health care concerns, contact the author. 

For More Information

We hope this update is helpful. For more information about the  or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel and a Martindale-Hubble “AV-Preeminent” (Top 1%) attorney and advisor board certified in labor and employment law by the Texas Board of Legal Specialization peer peer celebrated as “Top Rated Lawyer” and “LEGAL LEADER™ “Top Rated Lawyer” and “Best Lawyer” for her work in ERISA & Employee Benefits Law, Health Care Law, Labor and Employment Law, and Business and Commercial Law.

Nationally recognised for her decades of leading edge health and other employee benefits and insurance, compensation, human resources and other management work, public policy leadership and advocacy, coaching, teachings, and publications, Ms. Stamer is well known for her decades of pragmatic, leading edge work, scholarship and thought leadership on health benefit and other health and managed care, privacy and data security and other employee benefit, insurance, and health industry legal, public policy and operational concerns. 

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.  As a a key focus of this work, she has continuously and extensively worked with domestic and international health plans, their sponsors, fiduciaries, administrators, and insurers; managed care and insurance organizations; third party administrators and other health benefit service providers; hospitals, health care systems and other health care providers, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies.

Her experience includes more than 35 years of leading edge work for employer and other plan sponsors, plans and their fiduciaries, insurers, third party administrators, health care clearinghouses and other health care, insurance and other data and technology providers, and others on health and other employee benefits design, administration, compliance, and policy including decades of work on fiduciary compliance and risk management; eligibility, coverage and other plan mandates; administrative simplification and transparency; PBM, pharmacy and pharmaceutical management and regulation; surprise billing and other non-par provider; direct provider, vendor and other credentialing, contracting and management; and other managed care and insurance; high deductible, minimum or level premium, captive and other non traditional funding; and agency and private audits, investigations and enforcement; and other insured and self-insured health benefit contracting, design, administration, regulation, fiduciary and other liability managment, and other design, compliance, risk management, defense, and operations solutions.

She also has extensive experience helping health care systems and organizations, group and individual health care providers, health plans and insurers, health IT, life sciences and other health industry clients prevent, investigate, manage and resolve  sexual assault, abuse, harassment and other organizational, provider and employee misconduct and other performance and behavior; manage Section 1557, Section 504, Civil Rights Act and other discrimination and accommodation, and other regulatory, contractual and other compliance; vendors and suppliers; contracting and other terms of participation, medical billing, reimbursement, claims administration and coordination, Medicare, Medicaid, CHIP, Medicare/Medicaid Advantage, ERISA and other payers and other provider-payer relations, contracting, compliance and enforcement; Form 990 and other nonprofit and tax-exemption; fundraising, investors, joint venture, and other business partners; quality and other performance measurement, management, discipline and reporting; physician and other workforce recruiting, performance management, peer review and other investigations and discipline, wage and hour, payroll, gain-sharing and other pay-for performance and other compensation, training, outsourcing and other human resources and workforce matters; board, medical staff and other governance; strategic planning, process and quality improvement; meaningful use, EMR, HIPAA and other technology,  data security and breach and other health IT and data; STARK, ant kickback, insurance, and other fraud prevention, investigation, defense and enforcement; audits, investigations, and enforcement actions; trade secrets and other intellectual property; crisis preparedness and response; internal, government and third-party licensure, credentialing, accreditation, HCQIA and other peer review and quality reporting, audits, investigations, enforcement and defense; patient relations and care;  internal controls and regulatory compliance; payer-provider, provider-provider, vendor, patient, governmental and community relations; facilities, practice, products and other sales, mergers, acquisitions and other business and commercial transactions; government procurement and contracting; grants; tax-exemption and not-for-profit; privacy and data security; training; risk and change management; regulatory affairs and public policy; process, product and service improvement, development and innovation, and other legal and operational compliance and risk management, government and regulatory affairs and operations concerns. to establish, administer and defend workforce and staffing, quality, and other compliance, risk management and operational practices, policies and actions; comply with requirements; investigate and respond to Department of Insurance, Board of Medicine, Health, Nursing, Pharmacy, Chiropractic, trucking, alcohol and firearm, and other licensing agencies, Department of Aging & Disability, FDA, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD, FTC, SEC, CDC and other public health, Department of Justice and state attorneys’ general and other federal and state agencies; JCHO and other accreditation and quality organizations; private litigation and other federal and state health care industry actions: regulatory and public policy advocacy; training and discipline; enforcement;  and other strategic and operational concerns.

Former lead advisor to the Government of Bolivia on its Social Security Privatization reform, miss Stamer also has extensive legislative and regulatory affairs experience on federal, state and international employee benefits, healthcare, workforce, education, insurance, data privacy and security, antitrust, and other regulations and reforms.

In addition, Ms. Stamer contributes her time and leadership to numerous policy, professional, civil and other organizations, Ms. Stamer currently or previously served as the Scribe leading annual agency meetings on HIPAA and other issues with the Department of Health and Human Services; leadership Council Representative, speaker, author and faculty lead for the American Bar Association (“ABA”) Joint Committee on Employee Benefits; the ABA International Section International Employment Law Committee and International Life Sciences Committee Chair; the ABA Tort Trial and Insurance Practice Section Medicine and Law Committee Chair and Employee Benefits and Worker’s Compensation Committees Vice Chair; the ABA Health Law Section Managed Care & Insurance Interest Group Chair and Risk Management Interest Group Chair; the ABA RPTE Employee Benefits & Other Compensation Group Chair and Welfare Benefit, Fiduciary Responsibility, and Plan Terminations and Transactions Committees Chair; Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association; a Southwest Benefits Association Board Member; a SHRM Consultants National and Region IV Board Chair; WEB National Board Member and Dallas Chapter President; National Kidney Foundation of North Texas Board Member and Compliance Chair; Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency Board President; a North Texas United Way Long Range Planning Committee Member; and other leadership involvement in a broad range of other professional and civic organizations.

Author of hundreds of highly regarded works on health and other benefits, human resources, health care, insurance, data privacy and security and other related concerns, examples of these publications include “Transparent PBM Contracting,” “ACOs, Direct Contracting: Legal & Practical Challenges For Employers, Providers & TPAs,” “The Medicare Advantage Contracting Manual,” “Third Party Administrator (TPA) Contracting Principles and Strategies and a multitude of other publications and presentations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources. 

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any  fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2026 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Plans, Payers Would Face Significant systems & Data Changes To Comply

February 21, 2026, is the deadline for health plan fiduciaries, sponsors, insurers, service providers and other concerned parties to comment on the Proposed Transparency in Coverage Rule jointly proposed by the Centers for Medicare & Medicaid Services (“CMS”), the Department of Labor (“DOL”), and the Department of the Treasury (collectively, the “Departments”) on December 19, 2025. 

The Proposed Rule proposed to take effect in 2027 seeks to significantly revise the existing Transparency in Coverage rules currently applicable to health plans by reducing file complexity and size, making data clearer, and producing more usable information that consumers, employers, and innovators can rely on. If adopted as proposed, health plan and health insurers, their sponsors, fiduciaries and service providers will be required to implement the data, systems and consumer updates necessary to comply with the self-service internet-based tool provisions for plan years (in the individual market, policy years) beginning on or after January 1, 2027. 

The 2020 Transparency in Coverage rules originally issued during the first Trump Presidency requires health plans and health care providers to share detailed pricing information.

Under current rules, non-grandfathered group health plans and health insurance issuers offering non-grandfathered group and individual health insurance coverage are required to post machine-readable files monthly for each plan or coverage they offer—an In-network Rate File disclosing in-network rates for all covered items and services, an Allowed Amount File disclosing out-of-network allowed amounts and the associated billed charges, and a prescription drug file disclosing in-network rates and historic net prices for covered items and services. These requirements became applicable in July 2022.^[1]

Since these rules took effect, health plans. And insurers have faced criticism for lax compliance with the 2020 Teansparency in Coverage Rules. Additionally, the rules themselves have been criticized for provisions that allow oversized files, duplicative data, unstandardized data information, and other issues to limit the use, accessibility and reliability of the data released under the original rule.  

In line with Executive Order 14221,  the newly proposed rule seeks to confront these barriers by simplifying how data is organized, eliminating unnecessary information, and making consumer-facing cost tools more accessible to more consumers by:

• Requiring plans and issuers to exclude from the In-network Rate Files certain data for services providers would be unlikely to perform.
• Reorganizing In-network Rate Files by provider network rather than by plan, cutting redundancy, and aligning with how most hospitals report data pursuant to the Hospital Price Transparency requirements.
• Requiring Change-log and Utilization Files so users can easily identify what has changed from one In-network Rate File to the next and have clear information on which in-network providers are actively furnishing which items and services.
• Reducing reporting cadence for In-network Rate and Allowed Amount Files from monthly to quarterly, significantly reducing burden while maintaining meaningful transparency.
• Increasing the amount of out-of-network pricing information reported by reorganizing Allowed Amount files by health insurance market type, reducing the claims threshold to 11 or more claims, and increasing the reporting period from 90 days to 6 months and the lookback period of data from 180 days to 9 months. 

Additionally, to ensure that every individual can access accurate, personalized health care pricing information in the way that works best for them, the proposed rule would tighten requirements for health plan or issuer-provided price comparison tools by aligning them with consumer protections established under the No Surprises Act.

The proposed rule also will require group health plans and health insurance issuers to provide the same detailed cost-sharing information whether viewed online, or in print or provided by telephone, upon request.

The Departments aim for these changes to better equip employers, innovators, and researchers with the information they need to strengthen negotiations, identify cost drivers, and build new tools that help consumers shop for care with confidence by making pricing information more accurate, more accessible, and more actionable by improving clarity, accuracy, and providing better contextual information.

The proposed rules do not include major changes to prescription drug disclosure requirements, which the Departments say they intend to address separately.^[1]

The Departments seek feedback from stakeholders during the 60-day comment period on all elements of the proposed rule, including opportunities for further standardization and burden reduction. The deadline to submit comments is February 21, 2026.

Health plan sponsors, fiduciaries, administrators, and other concern, people should timely review and submit comments. Employers and producers also should begin evaluating and preparing to adapt their existing plan documents, contracts, policies, and procedures to them impending rules. Because noncompliance with these rules also can have significant liability exposures, this is an excellent time for health plan sponsors, and fiduciaries to review and confirm the adequacy of their existing practices and documentation.

If you have questions about these health plan exposures or other health care, workforce employee benefits or other regulatory compliance or investigations concerns, contact the author. 

More Information

We hope this update is helpful. For more information about the or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on health and other employee benefits, insurance, healthcare, workforce, HIPAA and other data and technology and other compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer has more than 35 years experience advisingemployers about these and other workforce, employee benefits, internal controls and other operations and compliance concerns. 

Ms. Stamer is nationally recognized for her decades of leading-edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, insurance, healthcare, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also often speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could change the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2026 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press. ™ For information about licensing for republication, please contact the author directly. All other rights reserved.

The $100,000 damages and reinstatement award Occupational Safety and Health Administration (“OSHA”) imposed on Fort Worth-based trucking company Balkan Express LLC cautions other employees to seek legal advice before terminating or taking other adverse action against employees who have reported or participated in investigations of safety or other laws. LOSHA ordered Balkan Express LLC to reinstate and compensate a worker who was terminated after reporting safety concerns, in violation of the Surface Transportation Assistance Act, which protects commercial motor vehicle safety complaints. OSHA ordered Balkan Express to reinstate the employee and pay back wages, interest, compensatory, and punitive damages totaling more than $100,000.

OSHA’s Whistleblower Protection Programs enforce 25 whistleblower statutes that protect employees from retaliation for reporting potential violations involving safety, health, environmental protection, and other public interest concerns. These statutes include:

• The Occupational Safety and Health Act (OSH Act), Section 11(c);
• The Consumer Product Safety Improvement Act (CPSIA)
• The FDA Food Safety Modernization Act (FSMA);
• The Moving Ahead for Progress in the 21st Century Act (MAP-21);
• The Asbestos Hazard Emergency Response Act (AHERA);
• The Clean Air Act (CAA);
• The Comprehensive Environmental Response, Compensation and Liability Act (CERCLA):
• The Energy Reorganization Act (ERA)
  Federal Water Pollution Control Act (FWPCA);
• The Safe Drinking Water Act (SDWA)
  Solid Waste Disposal Act (SWDA);
• The Toxic Substances Control Act (TSCA);
• The Anti-Money Laundering Act (AMLA);
• The Consumer Financial Protection Act (CFPA);
• The Criminal Antitrust Anti-Retaliation Act (CAARA);
• The Sarbanes-Oxley Act (SOX);
• The Taxpayer First Act (TFA);
• The Affordable Care Act (ACA);
• The Federal Railroad Safety Act (FRSA);
• The International Safe Container Act (ISCA)
  National Transit Systems Security Act (NTSSA):
• The Pipeline Safety Improvement Act (PSIA);
• The Seaman’s Protection Act (SPA)
  Surface Transportation Assistance Act (STAA); and
• The Wendell H. Ford Aviation Investment and Reform Act for the 21st Century (AIR21).

In addition to the anti-retaliation provisions enforced by OSHA, employers also face significant retaliation exposures under Equal Employment Opportunity, employee benefits, collective bargaining, and a broad range of other laws. These retaliation statutes and others arising under other statutes enforced by other agencies, through private litigation,or both can protect workers that make good faith reports of violations or cooperate in investigations even if the reported action doesn’t actually violate the law. An organization’s history of responding to reports of suspected violations also can affect the penalties the organization faces for statutory violations of these laws in court or agency prosecutions.

Retaliation exposures are significant and growing. For instance, Equal Employment Opportunity Commission (“EEOC”) statistics show the 42,301 charges alleging retaliation filed in Fiscal Year 2024 made retaliation the most prevalent filing for the seventeenth consecutive year in Fiscal Year 2024 and continued rising in 2025.

If you have questions about anti retaliation law exposures or other workforce concerns, contact the author. 

More Information

We hope this update is helpful. For more information about the  or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on health and other employee benefits, insurance, healthcare, workforce, HIPAA and other data and technology and other compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer has more than 35 years experience advising employers about these and other workforce, employee benefits, internal controls and other operations and compliance concerns.

Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, insurance, healthcare, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Employers and workers relying on Visas or other U.S Customs and Immigration Enforcement (“USCIS”) documentation or credentials should confirm their forms, fees and other practices and protocols are up-to-date and closely monitor changes, particularly in light of evolving policies and tightening enforcement.

For instance, on January 5, 2026, USCIS reminded affected applicants that starting March 5, 2026, it will accept only the 08/21/25 edition of its Form I-765, Application for Employment Authorization. Until then, applicants may choose to use either the 01/20/25 edition or the updated 08/21/2025 edition.

The change to the Form I-765 is on of a host of changes USCIS has adopted.impacting foreign workers,travel and other requirements.

Other recently announced fee changes includ

• Form I-131, Application for Travel Documents, Parole Documents, and Arrival/Departure Records;
• Form I-589, Application for Asylum and for Withholding of Removal;
• Form I-765, Application for Employment Authorization; 
• Form I-821, Application for Temporary Protected Status; and
• Form I-941, Application for Entrepreneur Parole.

USCIS also recently issued ew guidance that limits the age of foreign nationals’ photos that can be used to create immigration documents to no more than three years. This update enhances national security and prevents identity fraud. Currently effectivethe new guidance in the USCIS Policy Manual limits the use of photos to those that were taken within three years of the date a person files a USCIS form. Additionally, self-submitted photos will no longer be accepted. Only photos taken by USCIS or other authorized entities will be used. This ensures every photo used in a secure document is recent, accurate, and reliable—key requirements to preventing fraud and identity theft.   This policy change aligns with Department of Homeland Security priorities to modernize screening and vetting processes and address the vulnerabilities in identity documents.

Certain forms will require a new photo, regardless of when an applicant’s or petitioner’s last photograph was taken. These include Form I-90, Application to Replace Permanent Resident Card; Form I-485, Application to Register Permanent Residence or Adjust Status; Form N-400, Application for Naturalization; and Form N-600, Application for Certificate of Citizenship.

Other recently announced changes include but aren’t limited to changes to travel and parole documents and a host of other form, policy and procedures changes.

These are just a few of recent developments and more are anticipated. Sign up for updates and check for updates at https://www.uscis.gov.

If you have questions about immigration and customs law or other workforce requirements and concerns, contact the author. 

More Information

We hope this update is helpful. For more information about the or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on health and other employee benefits, insurance, healthcare, workforce, HIPAA and other data and technology and other compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer has more than 35 years experience advising employers and others about these and other workforce, immigration, employee benefits, internal controls and other operations and compliance concerns. 

Ms. Stamer is nationally recognized for her decades of leading-edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, insurance, healthcare, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also often speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could change the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2026 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press. ™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Health plans, their fiduciaries, service providers, and sponsors and healthcare provide providers, providing service covered by No Surprises Act (“NSA”) should confirm they’ve updated their fees for the independent dispute resolution process in response to changes taking affect January one, 2026.

On Monday, December 29^th, the Department of Health and Human Services (HHS), the Department of Labor (DOL), and the Department of the Treasury (collectively, the Departments) updated the No Surprises Act (NSA) website to reflect the 2026 certified Independent Dispute Resolution (IDR) entity fees in accordance with the Federal Independent Dispute Resolution (IDR) Process Administrative Fee and Certified IDR Entity Fee Ranges Final Rule (IDR Fees Final Rule).

The updated IDR entity fees now published on the NSA website are effective for disputes initiated on or after January 1, 2026. For these disputes, the administrative fee amount is $115 per party per dispute, and the certified IDR entity fee ranges are $200-$840 for single determinations and $268-$1,173 for batched determinations. The website now includes information on the fee set by each certified IDR entity within these ranges.

The IDR Fees Final Rule, effective as of January 22, 2024, set forth the 2025 IDR entity fee ranges, which will remain unchanged for 2026.

If you have questions about this or other health care concerns, contact the author. 

More Information

We hope this update is helpful. For more information about the  or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on health and other employee benefits, insurance, healthcare, workforce, HIPAA and other data and technology and other compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, insurance, healthcare , data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Diabetes treatment costs remain a leading health plan and health care cost driver.

Approximately one in four U.S. health care dollars (about 25%) is spent on people with diagnosed diabetes. Of this amount, about 61% of the costs are directly attributable to diabetes itself, with the remainder being general medical costs. 

For 2021–2022, treating diabetes among U.S. adults cost an estimated $153.2 billion each year. The average cost per person receiving care was $5,810 per year, with prescription medicines accounting for more than 80 percent of the total.

A recent statistical brief based on data from AHRQ’s Medical Expenditure Panel Survey (MEPS) highlights these costs and how the prevalence of treated diabetes varies by age, income, insurance coverage, and type of care. The report also breaks down spending by service and payment source, offering a closer look at the financial impact of diabetes treatment.

Janet Dhillon was sworn in as the 17th director of the Pension Benefit Guaranty Corporation (“PBGC”) on November 3, 2025.

Dhillon succeeds Gordon Hartogensis, who served as director from May 2019 to April 2024.

Dhillon previously served as acting assistant secretary and principal deputy assistant secretary of the Department of Labor’s Employee Benefits Security Administration (“EBSA”).

From May 2019 to November 2022, Dhillon was a commissioner on the U.S. Equal Employment Opportunity Commission (“EEOC”) and served as its chair from May 2019 to January 2021.  

Outside of government, Dhillon served as the general counsel of several Fortune 500 companies, including US Airways Group, Inc., JC Penney Company, Inc., Burlington Stores, Inc. and Dollar Tree, Inc. She began her legal career at the law firm of Skadden, Arps, Slate, Meagher & Flom LLP.

Dhillon earned her Juris Doctor from UCLA School of Law and a Bachelor of Arts from Occidental College in Los Angeles.

PBGC administers two insurance programs designed to safeguard pension plan participants in distressed plans: (1) The Single-Employer Program is financed by insurance premiums, investment income, and assets and recoveries from failed single-employer plans. (2) The Multiemployer Program that insures private sector union pension plans is financed by insurance premiums and investment income. Special financial assistance for financially troubled multiemployer plans is financed by general taxpayer monies.

The overall funded status of multi employer pension plans has improved substantially in recent years, primarily due to the Special Financial Assistance (SFA) program under the American Rescue Plan Act of 2021 (ARPA). 

The aggregate funded percentage for all multiemployer plans was an estimated 100% as of mid-2025, up from 97% at the end of 2024.

Without the SFA program, the aggregate funded percentage would be closer to 91%. As of June 30, 2025, 122 plans had received nearly $73 billion in SFA, which has prevented many from becoming insolvent.The financial outlook for the Pension Benefit Guaranty Corporation’s (PBGC) multiemployer program, which was previously projected to run out of money, has stabilized, with a projected solvency date beyond 2063. 

While private sector pension fund is stabilizing, funding concerns remain about many public sector pension plans.

The “vast majority” of public plans are considered fragile (funded ratio of 60% to 90%) or distressed (funded ratio below 60%).

Unfunded liabilities for state and local plans have remained above $1 trillion since the 2008 Financial Crisis, standing at an estimated $1.2 trillion in 2025.

As of late 2025 data, states with the most distressed plans (lowest funded ratios) include Illinois, New Jersey, Kentucky, and Mississippi. 

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

A recent Northern District of Texas ruling reminds life insurance and other benefit plan sponsors, fiduciaries, administrators and insurers of the benefits of including clear, unambiguous beneficiary designations in their plan documents.

The District Court in Metropolitan Life Insurance Co. v. Wallace granted a domestic partner and common-law wife’s summary judgment for ERISA plan life insurance proceeds in an interpleader action brought against the plan.

The action arose after the insured died without designating a beneficiary.

Ambiguous beneficiary designation provisions can expose plans and their fiduciaries to significant cost or expense where the plan doesn’t contain clear rules. In this case, the plan document has clear provisions for determining the beneficiary.

The Court found the plan terms mandated that the plan distribute benefits to a spouse or domestic partner before the deceased’s parents. Accordingly, distribution to the common law spouse or domestic partner was upheld.

For More Information 

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Employers that collected payments under the COVID-era Department of the Treasury Payroll Support Program (“PSP”) should heed the $8,100,000 Delta Airlines is paying as a reminder to ensure their own compliance with any COVID-19 relief programs.

The Justice Department announced today that Delta Air Lines Inc., headquartered in Atlanta, Georgia, has agreed to pay to resolve allegations that it violated the False Claims Act by awarding compensation to certain corporate officers and employees that exceeded the compensation limits Delta agreed to as part of its participation in the PSP program.

The settlement is an example of some of the aggressive audit and enforcement activities the federal government is now pursuing against recipient of COVID relief funds. recipients of such funds should verify that they can demonstrate compliance with all requirements of the program recipients who discover compliance deficiencies, should seek the advice of experienced counsel to assist in seeking a voluntary resolution for any compliance deficiencies to minimize exposures.

For More Information Or Help

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

The $250,000 a Mississippi employer is paying for discriminating in favor of non-citizen visa holders warns all US employers against discriminating against legally authorized workers based on national origin.

The settlement agreement with H2A Complete II Inc., that the Justice Department announced today reminds US employers not to discriminate among workers, legally authorized to work in the United States in employment practices based differences in the basis of their eligibility to work or national origin.

The settlement resolves charges that H2A Complete II Inc. violated the Immigration and Nationality Act (“INA”) by unfairly favor H-2A visa holders over U.S. workers for agricultural employment opportunities.

The second “Protecting U.S. Workers Initiative” settlement under the second Trump Administration, the settled demonstrates the Administration’s commitment to targeting, investigating, and bringing enforcement actions against employers that intentionally discriminate against U.S. workers due to a preference for temporary visa workers.

Under the settlement, the company will pay $25,000 in civil penalties to the United States, undergo training, revise its employment policies, and not include excessive experience requirements in job postings that are unlawfully aimed at excluding U.S. workers from employment opportunities.

The announcement of the settlement quotes Attorney General Pamela Bondi as stating, “This Department of Justice will continue to protect our country’s workers from unlawful discrimination in favor of foreign nationals.”

“DOJ’s Civil Rights Division is protecting American workers from unlawful discrimination by employers that prefer to hire foreign visa workers instead of U.S. workers,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “Protecting job opportunities for the American workforce is one of our top priorities.”

Although the Trump administration has made protecting US worker jobs, a priority, US employers should keep in mind that federal law, generally prohibits discrimination based on national origin or legal status to work, except where specifically provided by law. Accordingly, employers should be prepared to demonstrate that choices among applicants are made based on merit. employers should not apply a bias in favor of workers of a particular eligibility to work status, such as citizenship, or holding a particular type of visa, unless that status is specifically required by the applicable requirements of law for the position.

For More Information Or Help

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

The Internal Revenue Service (“IRS’) is updating the mortality tables used for defined benefit plans and determining minimum present values for annuity distributions.

Notice 2025-40 specifies updated static mortality tables to be used for defined benefit pension plans under § 430(h)(3)(A) of the Code and section 303(h)(3)(A) of ERISA. This notice also specifies a mortality table for use in determining minimum present value under § 417(e)(3) of the Code and section 205(g)(3) of ERISA for distributions with annuity starting dates that occur during stability periods beginning in the 2026 calendar year.

The Notice is scheduled for publication in IRB: 2025-31, dated July 28, 2025.

For More Information Or Help

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Employers should take note of recent changes made by the Citizenship and Immigration Services to the Form I-9, Employment Eligibility Verification and the Department of Homeland Security (“DHS”) Privacy Notice. While the updates don’t require employers to adopt the new I-9 Form until other current forms expire or are revoked, employers should know the changes to ease the administration of their I-9 requirements.

Form I-9

The revised Form I-9 with edition date 01/20/25 and expiration date 05/31/2027 includes minor changes to Form I-9 to align with statutory language.

Key updates include: 

• Renaming the fourth checkbox in Section 1 to “An alien authorized to work” 

• Revising the descriptions of two List B documents in the Lists of Acceptable Documents 

• Adding appropriate statutory language and a revised DHS Privacy Notice to the instructions.

While the revised Form I-9 with an edition date 01/20/25 is now available for download, multiple previous editions remain valid until their respective expiration dates: 

• Form I-9 (08/01/23 edition) that is valid until 05/31/2027 

• Form I-9 (08/01/23 edition) that is valid until 07/31/2026 (Employers using this form must update their electronic systems with the 05/31/2027 expiration date by July 31, 2026.) 

E-Verify

Also, starting April 3, 2025, E-Verify and E-Verify+ will have updated the Citizenship Status selection during case creation to reflect this statutory language. The selection “A noncitizen authorized to work” will be updated to “An alien authorized to work.” 

Employers should note: 

• If an employee attests on Form I-9 as “A noncitizen authorized to work,” the employer must select “An alien authorized to work” in E-Verify. 

• E-Verify cases will display “An alien authorized to work,” while employees and employers may continue to see “A noncitizen authorized to work” on Form I-9, depending on the form edition being used. 

• E-Verify+ participants will see the updated 01/20/25 edition date and 05/31/2027 expiration date reflected in Form I-9NG. 

Additionally, E-Verify users creating cases through Web Services applications will see the employee status attestation automatically updated to “An alien authorized to work”—even if the WS application submits “A noncitizen authorized to work” if the employee selected citizenship status number four on Form I-9. 

This change does not affect the current Interface Control Agreement (ICA) version 31.1, which already provides the necessary guidance for Web Services developers. WS developers should update their platforms to transmit “An alien authorized to work” instead of “A noncitizen authorized to work” as soon as possible.

The author of this update, Cynthia Marcotte Stamer is an attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and others about I-9 and other workforce, employee benefits, compensation, performance management, reengineering and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation; Cynthia Marcotte Stamer is an attorney board certified in labor and employment law by the Texas Board of Legal Specialization, management consultant, author, public policy advocate and lecturer sought out by clients and industry and government leaders for her more than 35 years of health, insurance, employment and employee benefits and other industry management work, thought leadership, public policy and regulatory affairs advocacy, coaching, teaching, and publications on health and other employee benefits, health care, insurance, workforce and other risk management and compliance.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally. 

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Mansfield, Texas resident Steven Strong and Florida resident Cory Lloyd face up to 20 year prison sentences if convicted on federal criminal health care fraud charges for their alleged participation in a scheme to submit fraudulent enrollments to fully subsidized Patient Protection & Affordable Care Act insurance plans (“ACA plans”).

ACA plans offer eligible enrollees tax credit subsidies paid by the federal government directly to insurance plans in the form of a payment toward the applicable monthly premium.

According to court documents, Lloyd and Strong conspired to enroll consumers in ACA plans that were fully subsidized by the federal government by submitting false and fraudulent applications for individuals whose income did not meet the minimum requirements to be eligible for the subsidies.

President of a health insurance brokerage, Lloyd allegedly received commission and other payments from an insurance company in exchange for enrolling consumers in the ACA plans.

In turn, Lloyd allegedly paid commissions to marketing company chief executive officer Strong in exchange for consumer referrals.

As alleged in the indictment, Lloyd and Strong targeted vulnerable, low-income individuals experiencing homelessness, unemployment, and mental health and substance abuse disorders, and, through “street marketers” working on their behalf, sometimes offered bribes to induce those individuals to enroll in subsidized ACA plans. Marketers working for Strong’s company allegedly coached consumers on how to respond to application questions to maximize the subsidy amount and provided addresses and social security numbers that did not match the consumers purportedly applying.

As a result of being enrolled in subsidized ACA plans for which they did not qualify, some of these consumers experienced disruptions in their medical care.

The indictment alleges that Lloyd and Strong used misleading sales scripts and other deceptive sales techniques to convince consumers to state that they would attempt to earn the minimum income necessary to qualify for a subsidized ACA plan, even when the consumer initially projected having no income.

Lloyd and Strong also allegedly conspired to bypass the federal government’s attempts to verify income and other information.

Lloyd and Strong allegedly engaged in the scheme to maximize the commission payments they received from insurers, resulting in their companies’ receiving millions of dollars in commissions.

As alleged in the indictment, Lloyd and Strong’s scheme caused the federal government to pay at least $161,900,000 in subsidies.

Cory Lloyd and Steven Strong are each charged with conspiracy to commit wire fraud, three counts of wire fraud, conspiracy to defraud the United States, and two counts of money laundering. If convicted, each faces a maximum penalty of 20 years in prison on each count of conspiracy to commit wire fraud and wire fraud, five years in prison for conspiracy to defraud the United States, and 10 years in prison for each count of money laundering.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, managed care organizations, health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation; Cynthia Marcotte Stamer is an attorney board certified in labor and employment law by the Texas Board of Legal Specialization, management consultant, author, public policy advocate and lecturer sought out by clients and industry and government leaders for her more than 35 years of health, insurance, employment and employee benefits and other industry management work, thought leadership, public policy and regulatory affairs advocacy, coaching, teaching, and publications on health and other employee benefits, health care, insurance, workforce and other risk management and compliance.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally. 

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

A Florida construction company owner will serve 48 months in prison and forfeit more than $5.5 million as well numerous real properties and cash, and to pay over $55 million in restitution for conspiracy to commit wire fraud, conspiracy to defraud the United States and willful violation of a workplace standard that resulted in the death of an undocumented alien employee and other payroll tax, safety and other fraud.

According to court documents, Manual Domingos Pita owned and operated Domingos 54 Construction, a subcontracting business for the wood framing of new construction homes. Domingos 54 was a shell construction company that Pita used to provide workers, including undocumented aliens, with construction jobs. However, Pita failed to secure the required workers compensation insurance coverage for these employees by falsifying in worker’s compensation insurance applications the number of workers for which he sought coverage. In addition, Pita failed to pay any federal employment taxes on the wages that these workers earned during the course of the scheme between 2018 and 2022. As a result, Pita caused several worker’s compensation insurance companies to sustain a loss of over $22.7 million in premiums that they could have charged had they been aware of the number of workers which they had been manipulated into covering with their policies.

In addition, Pita failed to pay to the IRS over $33.7 million in federal employment taxes on those workers’ wages.

Between February and July 2019, investigators with the Occupational Safety and Health Administration (“OSHA”) issued six citations to Domingos 54 for failure to provide fall protection to workers. Even after being cited for these violations, Pita continued to ignore OSHA requirements. In March 2020, Pita assigned a worker and three other carpenters to install sheeting on the roof of a residential home in windy conditions without providing the required fall-protection gear or ensuring its use. As a result, one of the workers was blown off the roof and died from his injuries.

Pita pleaded guilty to the charges on July 9, 2024. The Federal District court sentenced him on February 20, 2025.

“The defendant in this case engaged in a deliberate scheme to defraud insurance companies, the government and evade taxes, resulting in huge losses to the U.S. Treasury, and to personally enrich himself,” said Acting U.S. Attorney for the Middle District of Florida Sara C. Sweeney. “In addition, flagrant violations of OSHA safety standards put workers at unacceptable risk, ultimately resulting in the death of an employee. My office is committed to federally prosecuting and holding accountable anyone who violates these laws and regulations.”

“Not only does this type of scheme give an illegal advantage over honest competitors, it intends to allow the use of illegal, undocumented labor to achieve that advantage,” said Special Agent in Charge Ron Loecker of IRS Criminal Investigation’s Tampa Field Office. “It’s a blatant form of cheating that undercuts fair competition, costs the government millions of dollars in tax revenue, and skirts our nation’s immigration laws. This case reaffirms our unwavering commitment to prosecuting those who engage in fraud at the expense of workers, taxpayers, and law-abiding businesses.”

The prosecution and conviction reminds construction and other business operators that the Justice Department and federal law enforcement agencies investigate and prosecute payroll tax, safety, worker’s compensation and other crimes by employers even when the impacted workers are undocumented aliens.

For Help With Investigations, Policy Updates Or Other Needs

If your organization would like to learn more about the concerns discussed in this update or seeks assistance auditing, updating, administering or defending its human resources, compensation, benefits, corporate ethics and compliance practices, or other work force or performance-related concerns, please contact management attorney and consultant Cynthia Marcotte Stamer.

An attorney Board-Certified in Labor and Employment Law by the Texas Board of Legal Specialization and American College of Employee Benefits Counsel Fellow, Ms. Stamer’s workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership on helping organizations and leaders about manage their internal and external workforce, employee benefits and compensation, regulatory compliance and governmental affairs and other legal and operational practices and risk have earned her recognition as a Fellow in the American College of Employee Benefits Counsel, a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Labor and Employment Law and Health Care Law; a “Best Lawyers” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” and numerous other honors.

For more than 35 years, Ms. Stamer’s work has advised businesses and business leaders about enhancing the effectiveness and defensibility of their operations using employment and other workforce and services management, employee benefits, compensation, performance management, contracting, Federal Sentencing Guideline and other compliance and risk management, investigations, and other legal and operational tools and solutions.  While helping businesses define and manage the conduct and performance of their employees, contractors and vendors, she also assists employers and others with compliance with federal and state equal employment, compensation, health and other employee benefits, workplace safety, leave, employment tax, and other labor and employment, privacy and data security, and other laws: advises and assists management to monitor and reengineer workforce, employee benefits, compensation, safety and other policies and practices in response to regulatory, business, economic, and other developments; advises and defends businesses against labor and employment, employee benefit, wage and hour and other compensation, employment tax, fraud, Federal Sentencing Guideline and other regulatory compliance by the Department of Labor agencies, Department of Justice, Securities and Exchange Commission, Federal Trade Commission, Department of Justice, Office of Federal Contracts and Compliance, and other federal agencies; state Departments of Labor and other federal agencies; state workforce and labor, safety, workers’ compensation and other agencies; and employees, contractors, employee benefit plan participants and vendors, and others.

A former lead consultant to the Government of Bolivia on its social security privatization policy with decades of domestic and international government affairs and public policy experience, Ms. Stamer also has extensive experience providing advice to organizations, Congress and state legislators, federal and state regulators, and others about workforce, education, employee benefits, safety, health, insurance and other public policy concerns.

A prolific author and highly sought out thoughtleader, Ms. Stamer also speaks, coaches management and publishes extensively on these and other related matters.

For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see here or contact Ms. Stamer directly.

Other Helpful Resources & Information

If you found this article of interest, you also may be interested in reviewing other Breaking News, articles and other resources like:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication, click here.  If you do not wish to receive these updates in the future, unsubscribe by updating your profile here.

NOTICE:  These materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice, a substitute for legal advice, an offer or commitment to provide legal advice or an admission. The information and statements in these materials may not address all relevant issues or apply to any particular situation or circumstances.  The author reserves the right to qualify or retract any of these statements at any time. and does not necessarily address all relevant issues. Because the law evolves, subsequent developments could impact the currency and completeness of this discussion. The author disclaims and has no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers are urged to engage competent legal counsel for consultation and representation at any time, considering the specific facts and circumstances presented in their unique circumstances. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from using this publication.  Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication.  Circular 230 Compliance. The following disclaimer is included to comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein. ©2025 Cynthia Marcotte Stamer.  All rights reserved.

Heads up auto industry employers. Department of Transportation’s National Highway Traffic Safety Administration (“NHTSA”) just finalized released final rules outlining its Auto Safety Whistleblower Program procedures that impact motor vehicle manufacturers, part suppliers, and dealerships (“Auto Businesses”).

The final rules define the whistleblower award process, the filing requirements, and the eligibility criteria for potential whistleblowers.

The final rules define a “whistleblower” to include “any Auto Business employee or contractor who voluntarily provides to the NHTSA original information relating to any motor vehicle defect, noncompliance, or any violation or alleged violation of any notification or reporting requirement of 49 U.S.C. Chapter 301, or a regulation thereunder, which is likely to cause unreasonable risk of death or serious physical injury.”

The adoption and promotion of these whistleblower rules and remedies increase exposures for auto businesses to whistleblower claims. Auto industry businesses should take care to ensure they have adopted, communicated, and administer proper processes for maintaining and defending their compliance with defect, detection and reporting, anti-retaliation and other requirements of the rules.

Auto industry employers also should use care to minimize the risk of whistleblower liability to employees who have made reports of defects or engaged in other activity protected by the final rules as well as other activities protected under federal or state law. These actions include but are not limited establishing a well designed, administered and documented compliance program to prevent violations; notification of employees and contractors of your policy of non-discrimination and non-retaliation against individuals for engaging in actions protected by the final rules; maintaining strong documentation to support employment, promotion, demotion, and other employment decisions; using care when addressing employment termination or other employment related evaluations of workers who filed reports or engaged in other protected activity to promote defensibility against whistleblower and retaliation claims; notify workers of procedures for reporting suspicions of retaliation for engaging in protected activity; and other safeguards to strengthen the defensibility of the businesses, actions in the event of a possible claim.

The author of this update, Cynthia Marcotte Stamer is an attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, who has worked extensively with auto industry and other businesses business associates on whistleblower and other compliance and risk management. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her. 

For More Information

We hope this update is helpful. For more information about the  or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on workforce and other risk management and compliance.

Ms. Stamer’s work throughout her career has focused heavily on working with businesses domestically and internationally on employment, benefits, Federal Sentencing Guidelines and other workforce management, regulatory and public policy and other legal and operational concerns.  

Author of many highly regarded compliance, training and other resources on workforce and other risk management and compliance, Ms. Stamer is widely recognized for her thought leadership and advocacy on these matters.  

In addition, Ms. Stamer serves as a Scribe for the American Bar Association (“ABA”) Joint Committee on Employee Benefits annual agency meetings with OCR and shares her thought leadership as International Section Life Sciences Committee Vice Chair, and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources. 

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any  fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Employers subject to the Family and Medical Leave Act (“FMLA”) should avoid getting nailed like Methodist Family Health by the U.S. Labor Department denying federally-protected family leave.

The Labor Department announced November 14, 2024 that Methodist Family Health paid $14,082 to resolve charges from an investigation by the Wage and Hour Division that found Methodist Family Health prematurely terminated a worker out on family medical leave in violation of the FMLA.

The Labor Department found the worker qualified for 12 weeks of protected leave for a serious medical condition and parental leave after their child’s birth, but the employer terminated the worker after nine weeks of leave.

The employer erroneously limited the worker’s amount of protected leave based on the combined use of leave between the worker and the worker’s spouse,who is also employed by the company.

In announcing the back pay award, Wage and Hour District Director Hanz Grünauer warned, “The U.S. Department of Labor will defend worker protections and flexibilities protected by law and pursue all available remedies when those rights are violated.” 

To help workers identify and report FMLA violations to the Labor Department, it offers a search tool for workers to file online complaints, search for back wages collected by the Labor Department workers think they may be owed, and understand and enforce other rights.

If you have questions about or need FMLA or other employment, benefits or compensation compliance assistance or defense, contact the author of this update, Cynthia Marcotte Stamer.

More Information

We hope this update is helpful. For more information about the these or other legal, management or regulatory concerns, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.  

About the Author

Management attorney and operations consultant Cynthia Marcotte Stamer uses a client objective oriented approach to help businesses, governments, associations and their leaders manage people, performance, risk, legislative and regulatory affairs, data, and other essential elements of their operations.

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35+ years of workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership. As a part of this experience, Miss Stamer has experience assisting clients with auditing, compliance, investigation and defense of FMLA and other leave, SCA, Davis-Bacon, Fair Labor Standards Act and other workforce, leave, pay, benefits, compensation and fringe benefit concerns. 

A Fellow in the American College of Employee Benefit Counsel, Vice Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, Ms. Stamer’s work throughout her 35 year career has focused heavily on working with government contractors, health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. As an ongoing component of this work, she regularly advises, represents and defends businesses on Guideline Program and other compliance, risk management and other internal and external controls in a wide range of areas and has published and spoken extensively on these concerns.

Ms. Stamer also is widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on workforce, compensation, and other operations, risk management, compliance and regulatory and public affairs concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving, and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

The sweeping threat risk ransomware attacks present for health plans, their fiduciaries, business associate and other service providers, employer and other plan sponsors and their participants and beneficiaries is driven home by the disclosure of United Health Group (“UHG”) subsidiary Change Health to the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) that it now has sent approximately 100 million individuals individual breach notifications that the February 21, 2024, Blackcat 1234 ransomware attack Change Health experienced impacted their electronic personal health information (“ePHI”). With health plans particularly exposed to the rising epidemic of ransomware threats, health plans, their fiduciaries, employer and other health plan sponsors and service providers face growing imperatives to tighten up both their compliance and risk management against these cyber threats.

Health Plans, Their Fiduciaries, Sponsors and Service Providers Face Health Plan Related Cybersecurity Responsibilities & Risks

The UHG Change Health breach and its evolving fallout provides a timely reminder to health plans and insurers, their fiduciaries, plan sponsors, vendors and leaders to ensure their own timely and prudent steps both to respond to fallout from the UHG breach as well as to prevent, prepare for and respond to other future cyber threats direct threats to their own data and systems as well as indirect threats arising from ransomware, malware and other cyber events affecting business associates and other service providers, the plan sponsor, health care providers and other third party systems and data interfacing with their own systems and data.

Health plans and their business associate service providers face detailed responsibilities to prevent access, use, disclosure or destruction of electronic (“ePHI”) and other personally identifiable information (“PHI”) except as allowed by the Health Insurance Portability and Accountability Act (“HIPAA”) and to notify individuals of breaches of their ePHI in accordance with HIPAA’s breach notification rules. As part of these rules, HIPAA also restricts the circumstances that health plans legally can allow employers or their representatives to access or use health plan PHI without a HIPAA-compliant authorization from the applicable individual. The months-long delay in Change Health’s ability to identify the individuals whose ePHI was impacted by the February 21, 2024, breach demonstrates the challenges that ransomware and other malware attacks to their own or their party systems can create for health plans, their fiduciaries and business associates in fulfilling these obligations as well as carrying out other critical plan functions. Aside from dealing with the immediate demands created by the breach, the Change Health breach and other similar events are the type of events that prompt an obligation under the HIPAA Security Rule for health plans and other HIPAA-covered entities to review and update their documented HIPAA Security Risk analyses and resulting safeguards for protecting the destruction, loss of use, unauthorized use or disclosure and other HIPAA required safeguards against future ransomware or other threats. Health plans and their fiduciaries should consult with experienced legal counsel about recommended processes for conducting and documenting this updated analysis.

Beyond these HIPAA mandates, the disruptions to health plan data and operations experienced by many health plans as a result of the UHG/Change Health breach also puts health plan on notice of the potential need for health plans, their fiduciaries and service providers to conduct a documented, prudent analysis of their health plan security, backup and recovery, and other systems to both protect ePHI and other sensitive health plan data and systems from unauthorized destruction, access, and disclosure that could disrupt health plan operations, allow use or disclosure of plan information other than for the exclusive benefit of the health plan, its participants and beneficiaries or both under fiduciary responsibility rules of the Employee Retirement Income Security Act (“ERISA”).

In weighing their fiduciary responsibility to safeguard the health plan, its data and systems against ransomware, malware and other cybersecurity threats, health plans and their fiduciaries should keep in mind that the Department of Labor Employee Benefit Security Administration (“EBSA”) interprets the prudence, exclusive benefit and other ERISA fiduciary responsibility requirements as applying to PHI, financial, and other health plan data and systems. As part of these discretion, or control (“fiduciaries”) generally should take documented steps to ensure their ability to defend the prudence of their efforts to protect health plan data and systems including:

• To prevent disruptions to health plan systems and data from malware or other malicious or other events experienced by their health plan and its sponsors, service providers, and other third parties interfacing with health plan systems that could disrupt health plan enrollment, claims and appeals or other operations as well as against access, use or disclosure except as legally allowed for the exclusive benefit of the health plan participants and beneficiaries and in accordance with HIPAA;
• To implement and administer appropriate contractual, audit, oversight, notification, cyber liability and other coverage and indemnification and other arrangements with business associates and other third parties whose interactions with the health plan create threats to the integrity and security of health plan systems and operations;
• To plan and implement appropriate insurance, indemnity and other arrangement to pay for prudent investigations and other responses necessary to a known or suspected threat or breach impacting its health plan administration, data and systems;
• To plan and implement appropriate monitoring, notification, investigation, response and recovery arrangements to position the health plan to resume and continue timely administration of health plan enrollment, claims, appeals and other operations in the event the health plan or its service providers are impacted by a cybersecurity or other event that impacts health plan data or administrative systems;
• To ensure timely monitoring, notification and response to cyber and other threats to its systems and data to protect the health plan and its participants and beneficiaries from damages arising from cybersecurity and other threats to its systems and data;
• To communicate prudently with participants, beneficiaries and others regarding cybersecurity and other events impacting the security of data and systems; and
• To act prudently to ensure adequate monitoring and response to cybersecurity and other threats to health plan data and systems to prevent and mitigate disruptions to health plan data and systems that could disrupt the orderly and timely administration of their health plan.

Change Health/UHG Breach Highlights Health Plan Cyber Threats & Exposures

The sweeping disruptions to health plan and other operations arising from the UHG/Change Health ransomware attack graphically illustrate how malware and other cyber incidents can trigger catastrophic disruptions in health plan and other health industry operations whether experienced directly by the health plan or from the indirect effects of a cybersecurity event experienced by a third-party interfacing with the health plan.

Health plans are particularly at risk from ransomware, malware and other hacking threats. OCR breach reports confirm ransomware and hacking present the largest cyber-threats for health plans and health care providers. While most OCR HIPAA resolution agreements have involved health care providers, the largest HIPAA breaches and resulting HIPAA resolution payments to date have involved health insurers and their health plans.

Ransomware, hacking and other cyber risks present significant and growing threats to health plans and health care providers. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

The UHG breach demonstrates ransomware and other breaches can have sweeping liability and operational disruptions that extend beyond the original victim and include but are rarely limited to HIPAA penalties.

In response to the growing threat revealed by this data, OCR increasingly has urged health plans and other covered entities to protect their data and systems against ransomware and other cyberattacks. Choice Health/UHG attack occurred just days after OCR announced the second of two HIPAA resolution agreements since October as well as published a series of other guidance warning covered entities and their business associates to guard against ransomware and other cybersecurity threats as part of their HIPAA obligations prompted by concern over exploding threats.

Historically, most health plans, their sponsors, fiduciaries, and business associates assumed they could rely upon their insurers or other service providers to handle breaches experienced by that vendor impacting their health plans or members. However, OCR HIPAA and EBSA ERISA guidance reflects that health plans and plan fiduciaries need to take prompt documented actions before, during and after an insurer or other plan administrative services provider experiences a cybersecurity incident.

While UHG struggles to recover and defend its actions before Congress, regulators, customers, plan members and patients, providers and others, health plans, their sponsors, fiduciaries, and vendor business associates need to ensure their ability to demonstrate and defend the adequacy of their own breach protections, response, and other compliance.

HIPAA Security & Breach Notification Responsibilities

While most health plans, their sponsors, fiduciaries and vendors expect Change Health and other UHG entities know UHG bears breach notification and other HIPAA responsibilities and to incur liabilities under HIPAA and other federal and state data privacy and cybersecurity laws, many health plan fiduciaries, sponsors, insurers, and administrative or other service providers don’t understand their own responsibilities to prevent and respond to the UHG and other cyber events potentially impacting their health plans under HIPAA. 

Guidance published by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) on March 13, 2023, alerts health plans and health insurers, their fiduciaries and plan sponsors, health care providers, health care clearinghouses, and their business associates (covered entities) against overlooking their own potential HIPAA responsibilities arising from the February 21 Choice Health attack or other similar events.

HIPAA requires covered entities and their business associates to protect the privacy and security of protected health information, to have and enforce HIPAA-compliant business associate agreements, to conduct timely documented risk assessments in response to known or foreseeable security threats, and to provide notice of a breach to OCR, affected individuals and for breaches affecting more than 500 individuals. This responsibility includes both protecting protected health information from unauthorized use or disclosure, as well as to prevent it from improper destruction or unavailability such as can result from a ransomware attack or other disaster.

Under the HIPAA Security Rule, covered entities must conduct documented risk assessments to evaluate and monitor their electronic personal health information (EPHI) and associated systems for potential breaches and other threats that expose EPHA to unauthorized use, access, disclosure, destruction or other compromise.

To fulfill this requirement, the Security Rule requires covered entities and business associates to conduct documented risk assessments impacting their EPHI and to update these risk assessments in response to internal or external events impacting the adequacy of their risk assessments or security safeguards.

While the responsibility of covered entities and business associates to protect EPHI against unauthorized use, access and disclosure from cybercriminals and others receives the most attention, the Security Rule also includes often less discussed responsibility to protect EPHI and related operating systems against destruction or other disruptions from a wide range of threats including ransomware attacks. 

OCR guidance makes clear that OCR views safeguarding EPHI against ransomware and other cybersecurity threats as encompassed in this duty.  As part of these efforts, OCR and other cybersecurity agencies have recommended among other things that covered entities and business associates:

• Routinely take inventory of assets and data to identify authorized and unauthorized devices and software;
• Prioritize remediation of known exploited vulnerabilities’
• Enable and enforce multifactor authentication with strong passwords;
• Close unused ports and remove applications not deemed necessary for day-to-day operations.

 See e.g., #StopRansomware: ALPHV Blackcat | CISA.

Furthermore, when a breach of results in an unauthorized use, access, disclosure or destruction of EPHI, the HIPAA Breach Notification Rule requires covered entities and their business associates to provide timely notification of the breach to subjects of the breached EPHI and OCR, and if the breach affects more than 500 subjects, to the media.  Concurrently, the HIPAA Security Rule requires health plans and other covered entities to evaluate through documented risk assessments and take appropriate timely action to update their EPHI security as necessary to respond to breaches, potential breaches and other evolving threats to their EPHI and related systems. 

On March 13, 2024, the Office of Civil Rights (OCR) released a “Dear Colleague letter” that warns the February 21, 2024 CH/UHG data breach is likely to trigger HIPAA obligations and investigations for Choice Health and UHG as well as other HIPAA-covered health plans, heath care providers, heath care clearinghouses and business associates.  While stating the investigation currently focuses on Change Healthcare and UHC, for instance, the Dear Colleague Letter warns that OCR anticipates that its response to the February 21, 2024 CH/UHG Attack eventually also will include “secondary” investigations of other health plans, health care providers, health care clearinghouses and business associates “tied to or impacted by this attack.”

In light of these anticipated secondary investigations, OCR’s Dear Colleague letter warns health plans, health care providers, health care clearinghouses, business associates to ensure they timely and properly handle their own potential HIPAA responsibilities arising from the CH/UHG Attack.  The Dear Colleague letter expressly alerts health plans, health care providers and other covered entities and business associates “that have partnered with Change Healthcare and UHG” in anticipation of OCR’s expected secondary investigations to ensure that their own ability to demonstrate their organization meet all required HIPAA responsibilities including that:

• All required “business associate agreements are in place;
• All required breach notifications are provided to HHS, affected persons and in the event of a large breach affecting more than 500 individuals, to the media; and
• All security and other HIPAA responsibilities are met.

The Dear Colleague Letter also directed covered entities and their business associates to the following previously released OCR resources for assistance in understanding their responsibilities for guarding EPHI against ransomware and other cybersecurity threats:

• The OCR HIPAA Security Rule Guidance Material webpage;
• OCR Video on How the HIPAA Security Rule Protects Against Cyberattacks;
• OCR Webinar on HIPAA Security Rule Risk Analysis Requirement;
• HHS Security Risk Assessment Tool;
• Factsheet: Ransomware and HIPAA; and
• Healthcare and Public Health (HPH) Cybersecurity Performance Goals.

Standing alone, the Dear Colleague Letter makes clear that all covered entities partnered with or impacted by disruptions from the CH/UHG attack need to take documented steps to reevaluate and tighten the adequacy of their existing security safeguards as well as their processes for monitoring and responding to evolving ransomware and other cybersecurity threats in anticipation of becoming the target of potential “secondary” OCR investigations arising from the CH/UHG Attack.

While the Dear Colleague Letter specifically references covered entities and business associates “partnered” with Choice Health, OCR’s previously issued guidance warning all covered entities and their business associates to safeguard their EPHI against ransomware and other cybersecurity threats, strongly suggest that all covered entities and business associates should consider the advisability of reevaluating the adequacy of their own EPHI safeguards in light of the heightened ransomware and other cyber threat illustrated by the CH/UHG Attack.  Consequently, all covered entities and business associates partnered with or impacted by the CH/UHG Attack or its resulting distributions specifically, as well as covered entities and business associates generally should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations arising from the Choice Health and other malware events and threats.

Health Plan Data Security & Breach Related ERISA Duties

In addition to any applicable HIPAA responsibilities, fiduciaries and sponsors of employer or union sponsored health plans subject to the Employee Retirement Income Security Act (ERISA) also should consider whether the CH/UHG Attack or the heightened ransomware and other cyber security threats any additional actions are prudently necessary to protect the health plan data, assets or operations.

ERISA generally requires individuals or entities named as fiduciaries or otherwise possessing functional discretionary authority or responsibility or authority over a plan or its assets (fiduciaries) to act prudently to protect and administer the plan and its assets.  Department of Labor Employee Benefit Security Administration (EBSA) guidance published in April, 2021 first officially confirmed its interpretation of ERISA’s duty of prudence as including a duty to utilize prudent cybersecurity safeguards.  Since EBSA published this cybersecurity guidance EBSA also has also added cybersecurity inquiries to its plan fiduciary audits. As a result, in addition to complying with HIPAA, ERISA-covered health plan fiduciaries and sponsors also should be prepared to demonstrate plan fiduciaries acted prudently to comply with HIPAA as well as the following actions to safeguard health and other employee benefit plan data and systems against cybersecurity threats:

• Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.

• Cybersecurity Program Best Practices: Assists plan fiduciaries and record-keepers in their responsibilities to manage cybersecurity risks.
• Online Security Tips: Offers plan participants and beneficiaries who check their retirement accounts online basic rules to reduce the risk of fraud and loss.

In light of this OCR and EBSA guidance, health plan sponsors, fiduciaries and vendors and other HIPAA covered entities and business associates are urged to take documented steps to audit and strengthen as needed their safeguards against hacking and other cybersecurity threats including:

• In the case of any health plan or health plan vendor, taking well documented steps to assess and tighten as necessary their health plan systems and data security to meet or exceed the recommendation outlined in the EBSA cybersecurity guidance or otherwise necessary to prudently guard their plans and plan data and systems against cybersecurity threats.
• Reviewing and monitoring on a documented, ongoing basis the adequacy and susceptibilities of existing practices, policies, safeguards of their own organizations, as well as their business associates and their vendors within the scope of attorney-client privilege taking into consideration data available from OCR, data regarding known or potential susceptibilities within their own operations as well as in the media, and other developments to determine if additional steps are necessary or advisable.
• Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility.
• Renegotiating and enhancing service provider agreements to detail the specific compliance, audit, oversight and reporting rights, workforce and vendor credentialing and access control, indemnification, insurance, cooperation and other rights and responsibilities of all entities and individuals that use, access or disclose, or provide systems, software or other services or tools that could impact on security; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; and other relevant matters.
• Verifying and tightening technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information and systems.
• Conducting well-documented training as necessary to ensure that members of the workforce of each covered entity and business associate understand and are prepared to comply with the expanded requirements of HIPAA, understand their responsibilities and appropriate procedures for reporting and investigating potential breaches or other compliance concerns, and understand as well as are prepared to follow appropriate procedures for reporting and responding to suspected
  violations or other indicia of potential security concerns.
• Tracking and reviewing on a systemized, well-documented basis actual and near miss security threats to evaluate, document decision-making and make timely adjustments to policies, practices, training, safeguards and other compliance components as necessary to identify and resolve risks.
• Establishing and providing well-documented monitoring of compliance that includes board level oversight and reporting at least quarterly and sooner in response to potential threat indicators.
• Establishing and providing well-documented timely investigation and redress of reported
  violations or other compliance concerns.
• Establishing contingency plans for responding in the event of a breach. 
• Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and requirements.
• Preparing and maintaining a well-documented record of compliance, risk, investigation and other security activities.
• Pursuing other appropriate strategies to enhance the covered entity’s ability to demonstrate its compliance commitment both on paper and in operation.

Because susceptibilities in systems, software and other vendors of business associates, covered entities and their business associates should use care to assess and manage business associate and other vendor associated risks and compliance as well as tighten business associate and other service agreements to promote the improved cooperation, coordination, management and oversight required to comply with the new breach notification and other HIPAA requirements by specifically mapping out these details.

Furthermore, while the preemption provisions of ERISA generally insulate health plans and their sponsors from responsibility or liability for complying with state insurance, data security, breach notification or other state law cybersecurity and cyber breach and breach notification laws and rules, health insurers and other health plan service providers generally remain subject to these state law requirements.  Consequently, health insurers, administrative service providers and other health plan vendors also should act promptly to evaluate and ensure their fulfillment of all applicable cybersecurity and data breach mandates under relevant state law.

Leaders of covered entities or their business associates also are cautioned that while HIPAA itself does not generally create any private right of action for victims of breach under HIPAA, breaches may create substantial liability for their organizations or increasingly, organizational leaders under state data privacy and breach, negligence or other statutory or common laws.  In addition, physicians and other licensed parties may face professional discipline or other professional liability for breaches violating statutory or ethical standards.  Meanwhile, the Securities and Exchange Commission has indicated that it plans to pursue enforcement against leaders of public health care or other companies that fail to use appropriate care to ensure their organizations comply with privacy and data security obligations and the Employee Benefit Security Administration recently has issued guidance recognizing prudent data security practices as part of the fiduciary obligations of health plans and their fiduciaries.

Health plans and other covered entities are reminded that appropriate strategic planning and use of attorney-client privilege and other evidentiary tools can critically impact the defensibility of pre-breach, breach investigation and post-breach investigation and decision-making. Because HIPAA, EBSA and other rules typically require prompt investigation and response to known or suspected hacking or other cybersecurity threats, health plans and other covered entities or business associates should seek the assistance of experienced legal counsel to advise and assist in these activities to understand the potential availability and proper use of these and other evidentiary rules as part of the compliance planning process as well as to prepare for appropriate use in the event of a known or suspected incident to avoid unintentional compromise of these protections.

ERISA & Other Risks From Untimely Timely Acceptance & Processing of Health Plan Eligibility & Benefit Provisions

Since Change Health shut down its tools and systems CH/UHG Attack has created and continues to cause nationwide disruptions in the ability of pharmacy, physician and other health care providers to submit, and health plans and insurers to receive and process a wide range of health care billing, claims and other transactions because of the widespread integration and use of Choice Health tools in systems health care providers and payers use for the submission, receipt, and processing of health care provider eligibility, billing and other health benefits.  

Along with the liabilities and headaches that the ransomware attack and resulting disruptions create for Choice Healthcare and UHG, delays and other disruptions in the handling of health benefit eligibility, claims processing, notifications and payment by health plans and their administrative services providers arising from can create a host of additional liability headaches health plans, health insurers, their fiduciaries and administrative services providers in addition to those arising directly from the HIPAA and other cybersecurity breach itself.

For ERISA-covered health plans, ERISA generally holds health plans and their fiduciaries accountable for the prudent, timely administration of health plan eligibility, claims and other administrative functions in accordance with the terms of the plan and within the applicable time frames and other requirements of ERISA’s reasonable claims procedure and adverse benefit determination rules.  Health plans and their ERISA plan administrators generally must receive and process claims transactions required by the adverse claim determination regulations and provide participants or beneficiaries with detailed written notifications for any claims not processed and paid within the relevant 72-hour, 15-day or 30-day time period specified by the adverse claim determination rules.  Noncompliance with these requirements both undermines the defensibility of the health plan’s denial of coverage and subjects the plan administrator to liability for EBSA penalties and/or discretionary awards of penalties plus attorneys’ fees and other costs of enforcement to plan participants or beneficiaries for failures to deliver timely notification of the denial.  To the extent that EBSA or a court determines that the failure to timely and appropriately process and pay benefits resulted from a lack of prudence or other breach of ERISA fiduciary duties, fiduciaries are at risk for incurring personal liability for actual damages to the plan or its participants plus attorneys’ fees and other costs of enforcement; EBSA penalties for engaging in a breach of fiduciary duty under ERISA section 502(l); or both.

Beyond these ERISA-related risks, delays in processing and payment of health care provider claims also create potential additional liability for health insurers, health plans and their administrators to the extent the disruptions prevent the timely payment and processing of health benefit claims in violation of health care provider rights under managed care or other provider contracts, prompt pay and surprise billing or other provider legal rights.  Unlike member claims assigned to providers, ERISA generally does not preempt these nonderivative provider rights and claims or the additional state law damages, penalties or other remedies arising under state law against health insurers, health plans and plan administrators found to violate these rules. Consequently, delays in payments to providers also could substantially increase the costs and liabilities that health insurers, health plans, their fiduciaries, administrators, and employers and other sponsors obligated under the plan terms or vendor contracts to pay these costs.

In light of these and other potential risks, health insurers and health plans, their employer, union and other sponsors, fiduciaries, administrative services providers and other vendors should act quickly to investigate and ensure proper management of the fallout from the CH/UHG Attack and the heightened ransomware and other cybersecurity threats it represents.

Along with working with qualified legal counsel to address the potential HIPAA, ERISA and other responsibilities the health plan or insurer, its fiduciaries, service providers and sponsor bear from the CH/UHG Attack and other cyber risks, most parties also will want to evaluate obligations to notify cybersecurity and other liability insurers, seek indemnification from Choice Healthcare, UHG or other potentially culpable parties and evaluate other sensitive data and strategies for mitigation of their health plan and their own resulting liabilities, costs and other consequences.

For Additional Information

We hope this update is helpful. Solutions Law Press, Inc. invites you to receive future updates by registering on  here and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you need have questions or need assistance with this or other cybersecurity, health, benefit, payroll, investment or other data, systems or other privacy or security related risk management, compliance, enforcement or management concerns, to inquire about arranging for compliance audit or training, or need legal representation on other matters,  contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

About the Author 

Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health and other benefit, health care and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

Ms. Stamer is widely recognized and sought out for her knowledge and experience on health, employee benefits and other privacy and security. Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

A Fellow in the American College of Employee Benefit Counsel, Scribe for the Co-Chair of the American Bar Association (“ABA”) JCEB Annual Agency Meeting with HHS-OCR, ABA International Section Life Sciences and Health Committee and Vice-Chair and Chair Elect of its International Employment Law Committee, Chair of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group Chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee and author of a multitude of highly-regarded publications on HIPAA and other cybersecurity, privacy, technology, employee benefits and health care publications, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• EEOC Publish Guidance Discrimination & Accommodation Duties Applying Vaccine Mandates
• Construction Industry Urged To COVID-19 Safety & Timekeeping Protocols
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• H-2B Application Filing Window For 4/1/24 Opens 1/2/24
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Brett Brenner Appointed EEOC Deputy Chief Operating Officer
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences, No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requirements For Federal Employees, Contractors, International Travelers, Head Start Educators & CMS-Certified Facilities
• Autism Health Plan Exclusions and Limitations May Trigger Mental Health Parity and Addiction Equity Act Liabilities
• Labor Department Shares Resources on PERM and H-2A Program Updates
• Trucking Cos.’ $1.25M Sex Discrimination warns Other Employers
• $167K In Backpay and Penalties Restaurant Paying For FLSA Violations Warns Other Businesses
• $400,000 Settlement Shows Risks Of Mishandling Pregnant Employees

OCR’s warning and referencing of these resources strongly signals that OCR will hold health plans and business associates targeted for OCR investigation after experiencing or being impacted by a breach to demonstrate their fulfillment of these and other requirements. Accordingly, given OCR’s Letter and the continued heightened ransomware and other cyber security risk, health plans and other covered entities and business associates, their fiduciaries, sponsors, and vendors whether or not partnered with or impacted by the Choice Health/UHG should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations due to he UHG/Choice Health and other ransomware, malware and cybersecurity events and threats.

Based on existing OCR guidance, Choice Health/UHG and other known and evolving ransomware and other cyber attacks almost certainly warrant the need for those partnered or impacted by the breach to conduct documented, evaluations of the need to provide breach notification, as well as updated risk assessments. Moreover, given the widespread and continuing exposure to ransom and other cyber security risks referenced in the OCR and other reports, even those covered entities not partnered or impacted also need to conduct updated risk assessments based on the notifications of emerging risks, highlighted by that breach.

Along with updating risk assessments and resulting safeguards, covered entities, and business associates also clearly should ensure that they have and are enforcing up-to-date, business associate agreements, privacy practices and policies, and cyber threat monitoring, defense and response.impacted health plans, their employer and other sponsors, fiduciaries and business associates also should ask legal counsel about the availability of and notification and other requirements to qualify for indemnity or liability insurance coverage of breach-related claims and other options to mitigate or recover liabilities and costs arising from these and other breaches.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

R Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• EEOC Publish Guidance Discrimination & Accommodation Duties Applying Vaccine Mandates
• Construction Industry Urged To COVID-19 Safety & Timekeeping Protocols
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• H-2B Application Filing Window For 4/1/24 Opens 1/2/24
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Brett Brenner Appointed EEOC Deputy Chief Operating Officer
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requirements For Federal Employees, Contractors, International Travelers, Head Start Educators & CMS-Certified Facilities
• Autism Health Plan Exclusions and Limitations May Trigger Mental Health Parity and Addiction Equity Act Liabilities
• Labor Department Shares Resources on PERM and H-2A Program Updates
• Trucking Cos.’ $1.25M Sex Discrimination warns Other Employers
• $167K In Backpay and Penalties Restaurant Paying For FLSA Violations Warns Other Businesses
• $400,000 Settlement Shows Risks Of Mishandling Pregnant Employees

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Health and fitness mobile application developers and other businesses that collect or handle electronic or other health care information that are not subject to the by the Health Insurance Portability and Accountability Act (“HIPAA”) should evaluate their responsibility to comply with the personal health record (“PHR”) breach notification requirements of the recently amended Federal Trade Commission (“FTC”) Health Breach Notification Final Rule (the “HBN Rule”) and if subject to the HBN, ensure their compliance taking into account amendments to the HBN Rule that took effect on July 29, 2024. 

The HIPAA Breach Notification Rule imposes specific requirements on health care providers, health plans, health care clearinghouses and their business associates (“HIPAA Entities”) to protect individually identifiable health information (“PHI”) against improper use, access, disclosure or destruction and to provide breach notification to individuals, the Department of Health and Human Services Office of Civil Rights (“OCR”) and the media if a breach of unsecured electronic protected information happens.

To provide for notifications of breaches of electronically identifiable health information not covered by HIPAA, the HBN Rule generally requires each vendor of PHRs covered by its rules (“PHR Vendors”) and related entity that discovers a breach of security of unsecured personally identifiable health information (“UPHI”) in a PHR it maintains or provides to notify:

• Each individual who is a citizen or resident of the United States whose unsecured UPHI was acquired by an unauthorized person as a result of the security breach
• The Federal Trade Commission; and
• If the breach involved UPHI of 500 or more residents of such State or jurisdiction is, or is reasonably believed to have been, acquired during such breach, prominent media outlets serving a State or jurisdiction,

Applicability To HBN Rule

Amendments to the HBN Rule that took effect on July 29, 2024, clarify that the HBN Rule breach notification requirements apply more broadly than many parties dealing with PHR and PHR technologies previously understood as well as other requirements of the HBN Rule.  The FTC revised several definitions in the HBN Rule to clarify that it applies health apps and similar technologies not covered by HIPAA by modifying the definition of “PHR identifiable health information” and adding two new definitions for “covered health care provider” and “health care services or supplies.” It also revised the definition of “PHR related entity” to make clear that 1) the HBN Rule covers entities that offer products and services through the online services, including mobile applications, of vendors of personal health records and 2) only entities that access or send UPHR to a personal health record — rather than entities that access or send any information to a personal health record — qualify as PHR related entities;

These changes clarify that the HBN breach notification requirements generally apply to p Providers and developers of websites, mobile applications, or internet-connected devices that provide mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, or diet, or that provides other health-related services or tools and other similar technologies that provide healthcare services and supplies, and related technologies not covered.

Other Changes & Clarifications To HBN Rule

• Breach Of Security: The Final Rule clarifies that a “breach of security” includes an unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or an unauthorized disclosure;
• Clarifying Multiple Sources Of PHR Identifiable Health Information: The FTC clarified what it means for a personal health record to draw PHR identifiable health information from multiple sources;
• Electronic Notification: The FT expanded the allowable use of email and other electronic means of providing clear and effective notice to consumers of a breach;
• Expanding Required Consumer Notice Content:  The amendments to the HBN Rule expand the required content that notifications of breaches must include. For example, the notice would be required to include the name or identity (or, where providing the full name or identity would pose a risk to individuals or the entity providing notice, a description) of any third parties that acquired unsecured PHR identifiable health information as a result of a breach of security;
• Changing Notification Timing: The amendment to the HBN Rule changes the deadline for providing breach notification to the FTC under the rule. For breaches involving 500 or more individuals, covered entities must notify the FTC at the same time they send notices to affected individuals, which must occur without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security; and
• Improving readability: The amendments to the HBN Rule also include changes to improve the rule’s readability and promote compliance.

HIPAA-Covered Breaches

HIPAA Entities are reminded that in addition to its broadly applicable Privacy, Security and Breach Notification Rules, OCR also has promulgated specific guidance about mobile application and related technology. This mobile application guidance, among other things, include risk analysis, configuration to reduce risks, and workforce training on appropriate use when HIPAA Entities use mobile application technologies.

Additionally OCR also has adopted specific requirements on the Use of Online Tracking Technologies by HIPAA Entities to collect and analyze information about how users interact with regulated entities’ websites or mobile applications. While the U.S. District Court for the Northern District of Texas ruled Am. Hosp. Ass’n v. Becerra, — F. Supp. 3d —-, No. 4:23-cv-1110, 2024 WL 3075865 (N.D. Tex. June 20, 2024) ruled unlawful and invalidated the portion of this rule that provides that HIPAA obligations are triggered in “circumstances where an online technology connects (1) an individual’s IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers.” the remainder of that rule remains effective. HIPAA-Entities should ensure compliance with both of these rules as well as all other applicable HIPAA Breach and other rules.

To aid in this process, OCR has published various tools and resources on building privacy and security protections into mobile application technologies including the following:

• Mobile Health Apps Interactive Tool – The Federal Trade Commission (FTC), in conjunction with OCR, the HHS Office of National Coordinator for Health Information Technology (ONC), and the Food and Drug Administration (FDA), have updated the popular Mobile Health Apps Interactive Tool. This tool is designed to help developers of health-related mobile apps, including HIPAA-regulated entities, understand what federal laws and regulations might apply to them. The guidance tool asks developers a series of questions about the nature of their app, including about its function, the data it collects, and the services it provides to users. Based on a developer’s answers to those questions, the guidance tool points the app developer toward detailed information about certain federal laws that might apply. These include the FTC Act, the FTC’s Health Breach Notification Rule, the Health Insurance Portability and Accountability Act (HIPAA) Rules, and the Federal Food, Drug and Cosmetics Act (FD&C Act), Children’s Online Privacy Protection Rule (COPPA), and 21st Century Cures Act and ONC Information Blocking Regulations.
• Health App Use Scenarios & HIPAA – PDF – This guidance details various use scenarios for mHealth applications, and explains when an app developer may be acting as a business associate under the HIPAA Rules.
• Access Right, Apps, and APIs – View frequently asked questions about how the HIPAA Rules apply to covered entities and their business associates with respect to the right of access, apps, and application programming interface (APIs).
• Health Information Technology – View frequently asked questions on HIPAA and health IT.
• Guidance on HIPAA & Cloud Computing – OCR developed guidance to assist HIPAA covered entities and business associates, including cloud services providers (CSPs), in understanding how they can use cloud computing technologies while complying with their HIPAA obligations.

These resources can be helpful for both HIPAA-Entities to comply with HIPAA and non-HIPAA covered entities to comply and manage risks under the HBR Rule.

In the face of these and other Federal and state law rules, all parties dealing with electronic health information should confirm their status under the FTC and OCR Rules and take documented steps to verify, monitor and maintain their compliance with breach notification and other requirements.

About the Author 

Scribe responsible for planning and leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with HHS-OCR for more than a decade and author of many highly regarded publications on HIPAA and other privacy and data security, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of HIPAA and other cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for government contractors and other public and private businesses; managed care and other health and life science, insurance, technology, and other performance and data dependent organizations,

A Fellow in the American College of Employee Benefit Counsel, Immediate Past Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Co-Chair of its International Employment Law Committee, and its Health Care Liaison; Immediate Past Chair of the ABA TIPS Section Medicine & Law Committee; Past Chair of the ABA Managed Care & Insurance Interest Group; Former Chair of the ABA RPTE Employee Benefits & Other Compensation Group and Chair or Co-Chair of its Welfare Benefit Committee for more than 10 years , and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

The more than $560,000 in civil monetary penalties (“CMPs”) collected since March by the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) from three HIPAA-covered entities for failing to respond to medical record requests within 30 days as required by the Health Insurance Portability & Accountability Act (“HIPAA”) right of access rule (“Access Rule”) shows patients, their personal representatives and health care providers, health plans, health care clearinghouses (“Covered Entities”) the seriousness of OCR’s commitment to enforcement of the Access Rule.

On August 2, 2024, OCR announced emergency medical provider American Medical Response (“AMR”) paid a $115,200 civil monetary penalty (“AMR CMP”) for waiting 370 days before delivering medical records requested by a patient’s personal representative.  OCR’s AMR CMP announcement follows its April 1, 2024 announcement Hackensack Meridian Health, West Caldwell Care Center (“Hackensack Meridian Health”) paid a $100,000 CMP (“HMH CMP”) for waiting 161 days to provide medical records requested by a patient’s personal representative and March 29, 2024 announcement of its agreement to accept payment of $35,000 in satisfaction the previously assessed $250,000 CMP against Phoenix Healthcare LLC d/b/a Green County Care Center (“Phoenix”) for Access Rule violations.  With these three actions, OCR collected $565,000 in CMPs for Access Rule violations since March 29, 2024, and has announced a total of 49 high-dollar Access Rule CMP or settlement collections since announcing its Access Rule enforcement initiative in 2019.

OCR’s pursuit of CMPs in excess of $100,000 against each of these three entities for failing to respond to a single request for patient records makes clear OCR’s readiness to investigate and pursue big dollar penalties against Covered Entities for even a single failure to deliver documents to a requesting patient or personal representative. With these HIPAA penalties in addition to the up to the $190 per day per request Labor Department administrative penalty, and discretionary award up to $100 per day plus attorneys’ fee and court cost courts can award suing participants or beneficiaries wrongfully denied timely access to plan information or documents under the Employee Retirement Income Security Act (“ERISA”) health plans, their plan administrators, insurers and fiduciaries should take care to ensure their health plans and their administrators and vendors timely respond to all medical record and otehr requests.

HIPAA Right Of Access Rule

HIPAA’s Privacy Rule right of access (“Access Rule”) is part of the national standards that HIPAA Privacy, Security, and Breach Notification Rules (“Privacy Rule”) require that Covered Entities and their business associates meet for protecting to protect individuals’ protected health information (“PHI”), limit uses and disclosures of PHI, and give individuals the right to timely access and to obtain a copy of their PHI records and certain other rights.  Like other Privacy Rule violations, Access Rule violations can subject a Covered Entity or business associate to expensive HIPAA civil monetary penalties (“CMPs”).

The Access Rule codified in 45 C.F.R. 164.524 generally requires that a Covered Entity to respond to a request from an individual or its personal representative to access or for a copy of protected health information (“PHI”) in any records set of a Covered Entity or its business associate within 30 days of receipt of the individual’s request.  OCR Access Rule guidance makes clear OCR views this deadline as the maximum allowed period

The Covered Entity can respond to a right of access request by granting or denying the request in whole or in part, or if it is unable to provide the records within 30 days for a legitimate reason, the Access Rule allows the Covered Entity a one-time 30-day extension of the response timeframe by sending the requestor a written statement of the reasons for the delay and the date within the extended response deadline by which the Covered Entity will complete its action on the request. 45 C.F.R. § 164.524(b)(2).

The Access Rule also contains specific guidance governing the calculation of the allowable fee, if any, the Covered Entity can charge for providing the PHI to a reasonable cost-based fee calculated following the Access Rule.  It also sets forth other requirements about the manner and format in which the Covered Entity must deliver the PHI.

OCR is responsible for implementing the Privacy Rules and enforcing non-criminal violations of its requirements.  When OCR finds violations of the Access Rule or other HIPAA violations, HIPAA as amended by the HITECH Act,¹ generally authorizes OCR to impose and collect a CMP determined based on the following penalty schedule, with adjustments for inflation:

• A minimum of $100 for each violation where the Covered Entity or business associate did not know and, by exercising reasonable diligence, would not have known that it violated the HIPAA provision, provided the total amount of CMPs imposed on the Covered Entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.
• A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the Covered Entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000.
• A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
• A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.³ The adjusted amounts apply only to CMPs whose violations occurred after November 2, 2015.

$115,200 AMR CMP

According to the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) August 1, 2024 announcement of the AMR CMP, AMR paid OCR the $115,200 AMR CMP after OCR assessed the CMP in a Notice of Final Determination that AMR violated the Access Rule.

The Notice of Final Determination arose from an OCR investigation of a complaint made by an attorney (“the Patient’s Attorney”) on behalf of a patient transported by AMR alleging that AMR failed to provide a patient with timely access to its medical records after many failed attempts by the patient to obtain the records.

According to the Proposed Notice of Determination, the Patient’s Attorney sent AMR a fax on the patient’s behalf on October 31. 2018 asking for copies of a patient’s medical records including, “all billing records pertaining to treatment rendered for 9/15/2015 injury date; Patient Balance Verification; all medical records pertaining to treatment rendered for 9/15/2015 injury date” in electronic format to the patient’s attorney (“access request”). The access request was in writing, signed by the Patient’s Attorney, that clearly identified the Patient’s Attorney and where to send the copy of the Patient’s Attorney’s PHI. The Patient’s Attorney received a fax transmission report reflecting that AMR received her request on October 31, 2018. Although AMR uses an electronic health record (EHR) for its medical records and maintains the Patient’s Attorney’s requested PHI in its HER, it did not respond to this request by November 30, 2018, the date 30 days from receipt.

On November 8, 2018, the Patient’s Attorney also mailed a copy of her October 31, 2018, access request to AMR’s Seattle, Washington office via certified mail and received confirmation of delivery on November 13, 2018 from the United States Postal Service. The Patient’s Attorney also subsequently sent two follow-up requests for the PHI records on January 24, 2019.

Although AMR’s electronic medical record confirmed AMR received these requests, AMR did not respond to the Patient’s Attorney’s request until March 1, 2019, 121 days after the initial request, when AMR sent the Patient’s Attorney an invoice requiring payment of an access fee before AMR would provide the requested records to Complainant.

On March 18, 2019, the Patient’s Attorney then sent AMR another follow-up letter that reiterated the Patient’s Attorney’s multiple access requests and advised AMR that if AMR did not send the PHI to the Patient’s Attorney electronically within seven days the Patient’s Attorney would file a complaint with OCR.  Since AMR failed to deliver the requested records in electronic format within the specified period, the Patient’s Attorney filed a complaint with OCR on July 29, 2019, alleging that AMR violated the Access Rule by failing to provide a copy of the patient’s PHI in response to the Patient’s Attorney’s multiple access requests.

OCR’s October, 2019 investigation found AMR repeatedly failed to timely respond to the patient’s access request even though AMR had procedures in place for processing individuals’ written access requests.

In response to OCR’s investigation, AMR sent the requested records to the Patient’s Attorney on November 5, 2019, 370 days after the Patient’s Attorney’s initial request.

In response to OCR’s investigation, AMR also amended its internal procedures to streamline and better track access requests. OCR notified AMR of the results of OCR’s investigation on August 3, 2021, and offered AMR an opportunity to resolve the matter informally.  Rather than accepting this offer, however, AMR responded to OCR through counsel on August 9, 2021, asking OCR to “reconsider its position” without providing a counteroffer or otherwise engaging in negotiations with OCR. While OCR did not disclose the terms of its proposed offer of resolution, acceptance of this offer presumably would have allowed AMR to resolve the charges for an amount less than the $115,200 CMP ultimately imposed.

OCR then sent an April 15, 2022 Letter of Opportunity (LOO) to AMR, which informed AMR that OCR’s investigation indicated that AMR violated HIPAA’s Access Rule and providing AMR with an opportunity to submit written evidence of mitigating factors and affirmative defenses to this violation as well as evidence to support a waiver of a CMP for violating the Access Rule.  OCR determined AMR’s May 16, 2022 response to the LOO did not support any affirmative defense to the charges or grounds for waiver of the CMP but weighed AMR’s LOO response alleging mitigating factors in determining the amount of the CMP.

Based on these factual findings, OCR sent AMER a Notice of Proposed Determination that announced OCR’s intent to impose the $155,200 AMR CMP for its violation of the Access Rule by failing to provide timely access to the Patient’s Attorney after receiving her lawful requests.

Finding the Reasonable Cause penalty tier applicable for purposes of determining the CMP for  AMR’s Access Rule violation from December 1, 2018, to February 28, 2019, OCR calculated the AMR CMP as follows: $39,680 CMP Calendar Year 2018 (31 days from 12/1/18-12/31/18 at $1,280 per day); plus           $75.520 CMP Calendar Year 2019 (59 days from 1/1/19 to 2//19, at $1,280 per day) = $115,200 Total CMP

While AMR argued that OCR should exercise its discretion and choose not to apply any CMPs because of “multiple mitigating factors, OCR determined AMR’s arguments factually inaccurate and not meriting change of the CMP assessment from the reasonable cause level. Accordingly, OCR refused to reduce the original $115,200 based on alleged mitigating factors. 

After AMR did not challenge the determinations of OCR in the Notice of Proposed Determination within the allowed period, OCR issued the Final Notice of Determination imposing the $115,200 AMR CMP and AMR paid that amount.

Since as early as 2016, OCR has made Access Rule enforcement a priority.  Along with its assessment of the AMR CMP, OCR’s commitment to continued Access Rule enforcement is demonstrated by the 48 other previously announced Access Rule enforcement actions through July 31, 2024. 

$100,000 Hackensack Meridian Health CMP

Before it collected the AMR CMP, on April 1, 2024, OCR already had announced its collection of a $100,000 CMP from a New Jersey skilled nursing facility for violating the Access Rule in April.

Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (“HMH”) is a skilled nursing facility that provides long-term care and rehabilitation services.

In May 2020, OCR received a complaint alleging that HMH failed to provide a personal representative with access to his mother’s medical records even after HMH received sufficient documentation that the patient’s son who requested the records as his mother’s personal representative.

OCR found that HMH failed to respond timely to a HIPAA right of access request. In September 2023, OCR issued a Notice of Proposed Determination (“HMHPD”) seeking to impose the $100,000 civil money penalty. When HMH waived its right to a hearing and did not contest OCR’s findings, OCR finalized the Notice of Final  Determination imposing the $100,000 CMP.

The OCR investigation found that when Peter Lindsay originally requested copies of the medical records of his mother, Lois Lindsey (“mother”) from WCCC in an April 19, 2020 email, WCCC responded with an April 22, 2020 e-mail denial that requested Mr. Lindsay provide WCCC a copy of a power of attorney, medical proxy or similar document executed by the mother establishing that he was his mother’s personal representative. However, when WCCC still failed to deliver the requested medical records after Mr. Lindsey sent a copy of his mother’s power of attorney via May 23, 2020 e-mail, Mr. Lindsey complained to OCR.

After OCR notified WCCC on October 15, 2020, its investigation of the complaint, WCCC acknowledged that it failed to respond to the complainant’s request for his mother’s medical records within 30 days of receiving the complainant’s written request for the records but still did not deliver the records until December 1, 2020, 161 days after the complainant’s request.

By letter dated March 25, 2022, OCR informed WCCC its investigation found that WCCC failed to provide timely access to protected health information and offered WCCC an opportunity to settle this matter informally.  Although OCR’s letter encouraged WCCC to contact OCR no later than ten days after receipt of the letter, OCR received no response until WCCC responded via e-mail through its attorney on April 29, 2022, that WCCC disagreed with OCR’s proposed resolution, OCR received an email correspondence from the WCCC’s attorney stating WCCC’s disagreement with OCR’s proposed resolution.  OCR then responded by issuing a May 16, 2022 Letter of Opportunity (LOO) informing WCCC that OCR found preliminary indications of non-compliance and providing WCCC with an opportunity to submit written evidence of mitigating factors, affirmative defenses, or waiver factors for OCR’s consideration in determining the CMP amount.

In the June 15, 2022 response to the LOO sent by WCCC’s attorney, WCCC acknowledged receipt of both the April 19, 2020, medical record request and the power of attorney emailed on April 23, 2020.  WCCC also admitted that instead of providing Mr. Lindsay with the requested medical record, WCCC instead sent a copy of the mother’s medical records to another facility to which Ms. Lindsay was transferred. WCCC’s attorney admitted WCCC should have handled the request differently but indicated at the time of the original request, both Mr. Lindsey and his mother were parties to ongoing litigation with WCCC over non-payment for care, that WCCC also was struggling with the COVID-19 pandemic, that Mr. Lindsey filed his complaint with OCR exactly 30 days after his e-mailed request before WCCC’s response to the initial request was due and asserted several affirmative defenses it claimed excused WCCC’s failure to provide the medical documents. 

Based on the above findings of fact, OCR calculated the WCCC CMP at the reasonable cause not corrected tier for WCCC’s failure to provide the requested medical records from June 23, 2020, to December 1, 2020.

WCCC also asserted various affirmative defenses and a right of waiver to avoid or mitigate the amount of the WCCC CMP, all of which OCR found unpersuasive.

• Regarding WCCC’s assertion that HIPAA barred imposition of a CMP in this case, as a matter of law, under the HIPAA affirmative defense for a violation not due to willful neglect and timely corrected, OCR determined that the affirmative defense did not apply as WCCC did not timely correct the violation.  
• OCR also rejected WCCC’s assertion that imposition of a CMP under these circumstances would be arbitrary and capricious and violate the Administrative Procedure Act (the Patient’s AttorneyA). 
• OCR likewise found rejected WCCC’s claim that OCR should waive any possible CMP because assessment of the CMP would be excessive as WCCC only failed to timely respond to a single request for records access, submitted amidine the midst of litigation with the requesting party during the COVID-19 pandemic and WCCC’s personnel mistakenly believed that an appropriate, timely response to the complainant’s medical record request had been made through the transfer of the patient to another facility.

After WCCC waived its right to challenge these OCR determinations in an administrative hearing, OCR issued the Notice of Final Determination on January 12, 2024, which OCR publicly announced  on April 1, 2024.

Phoenix CMP Settlement

OCR’s WCCC CMP announcement came only three days after OCR announced a settlement with Phoenix under which OCR accepted and collected $35,000.00 (“Settlement Amount”) from Phoenix in full satisfaction of a $250,000 CMP under a March 30, 2021 Notice of Final Determination issued against Phoenix for willful violation of the Access Rule. 

The Phoenix CMP and resulting settlement arose from OCR’s investigation of a right of access complaint filed against the Oklahoma multi-facility nursing care organization by a patient’s daughter in April 2019 that Phoenix would not provide the daughter, who serves as a personal representative, with a copy of her mother’s medical records. After Phoenix eventually sent the requested records 323 days after the request on January 30, 2020 and only after OCR attempts to get the records through technical assistance and other efforts, OCR notified Phoenix of its intention to impose a $250,000 civil money penalty (“Phoenix CMP”) against Phoenix for willful violation of the Access Rule along with violations of HIPAA’s business associate requirements. 

Rather than accede to OCR’s proposed imposition of the $250,000 Phoenix CMP, however, Phoenix chose to challenge the proposed Phoenix CMP to an administrative law judge (“ALJ”) in the Civil Remedies Division of the Departmental Appeals Board (“DAB”) of HHS. In Decision No. CR6232, the ALJ on February 16, 2023, upheld the Access Rule violations cited by OCR and OCR’s determinations that Phoenix acted with willful neglect in committing the violations, but reduced the Phoenix CMP amount from the $250,000 proposed by OCR to $75,000.

Despite the ALJ’s reduction of the Phoenix CMP, Phoenix then unsuccessfully challenged the ALJ’s determinations. On August 4, 2023, the HHS Departmental Appeals Board upheld the ALJ’s decision to uphold OCR’s determinations that Phoenix acted with willful neglect in violating the Access Rule and imposition of the reduced $75,000 CMP.

When Phoenix threatened to appeal this determination in federal court and presented evidence of “financial hardship, however, OCR agreed “as a compromise based on the unique facts and circumstances of this matter,” to accept in full satisfaction of the $75,000 CMP assessed due and owing by Phoenix under ALJ Decision affirmed by DAB Decision No. 3105 and DAB Decisions  No. CR6232 in return for Phoenix’s payment of the $35,000 Settlement Amount and Phoenix’s agreement not to further challenge OCR’s assessment and to revise its HIPAA Policies and Procedures to address the Access Rule and business associate agreement requirements, training, and other compliance.

Right Of Access Enforcement Takeaways

OCR’s pursuit of CMPs for Access Rule violations against AMR, WCCC and Phoenix, along with the 46 Access Rule settlements announced by OCR before the Phoenix Settlement makes clear OCR takes seriously and stands prepared to assess substantial CMPs against Covered Entities that violate the Access Rule.  

Like the 46 Access Rule settlements OCR previously announced, the circumstances surrounding the assessment of the AMR CMP and other Access Right Enforcement actions contain several important lessons for Covered Entities and business associates including:

• Ensuring Covered Entities appropriately track and timely respond to access requests is critical;
• Failing to provide timely response to even a single access request can trigger a significant CMP;
• The existence or expectation of a lawsuit or other dispute with the patient or patient’s personal representative does not justify delay or refusal timely to provide requested medical records within 30 days;
• While Covered Entities and business associates have a duty to verify a family member, attorney or other party requesting medical records on behalf of a patient is the personal representative, a Covered Entity is responsible for verifying this and delivering the requested medical records promptly following receipt of a request;
• If a Covered Entity or business associate intends to charge to provide requested medical records in response to an access request, ensure that the proposed charge is calculated following the Access Rule, notification is delivered within 30 days of the original request and deliver the medical records promptly after the payment is received;
• Providing requested medical records to another health care provider or other party does not excuse or substitute for providing the medical records to the requesting patient or personal representative;
• A Covered Entity that fails to meet the 30-day deadline for responding to an access request should fix the problem promptly by delivering the documents as soon as possible and taking documented corrective action to prevent future noncompliance;
• A Covered Entity or business associate that already has not responded within 30 days of receipt of an access request should not withhold delivery of the requested PHI pending the requestor’s payment of the minimal allowed charge that it could have imposed had it timely responded to the access request within 30 days; and
• Consider carefully before declining an offer from OCR to settle through informal resolution.

Covered Entities and business associates also should keep in mind other potentially applicable legal or ethical requirements to provide medical records.  For instance, the Employee Retirement Income Security Act (“ERISA”), state insurance rules and other federal or state laws also may require health plans and their insurers, administrators and others with timely access to medical or other records that also are protected heath information under HIPAA.  Under Section 502 (c) of ERISA, for instance, health plan administrators that fail to provide requested documents and information can become liable for Labor Department penalties of up to $190 per day not to exceed $1,906 per request, discretionary court awards of penalties of up to $100 per day plus attorneys’ fee and court cost to participants or beneficiaries wrongfully denied timely access or both. Covered Entities and business associates should ensure that all applicable deadlines are met and that any charges imposed satisfy all applicable requirements.

Covered Entities and business associates also should keep in mind that the Access Rule is only one of several areas of HIPAA enforcement prioritized by OCR that can trigger costly CMPs. Since HIPAA took effect in April 2003 through April 2024, OCR has:

• Received and resolved 99 percent of the more than 358,975 HIPAA complaints and the more than 1,188 OCR-initiated compliance reviews;
• Required changes in privacy practices and corrective actions in more than 30,839 cases investigated;
• Settled or imposed a civil money penalty in 145 cases resulting in a total dollar amount of $142,663,772.00; and
• OCR referred 2,197 to the Department of Justice (DOJ) for criminal investigation of cases involving the knowing disclosure or obtaining of protected health information in violation of HIPAA.

The compliance issues most often alleged in complaints cumulatively, in order of frequency through April, 2024 have remained consistent across the 20 years since HIPAA became effective.  They include cumulative in order of frequency:

• Impermissible uses and disclosures of protected health information;
• Lack of safeguards of protected health information;
• Lack of patient access to their protected health information;
• Lack of administrative safeguards of electronic protected health information; and
• Use or disclosure of more than the minimum necessary protected health information.

While health care providers are the type of Covered Entity most often subjected to enforcement, OCR data confirms OCR investigations and enforcement has impacted all types of Covered Entities and business associates.  According to this data, the categories of Covered Entities OCR investigations have found to have committed violations are, in order of frequency:

• General Hospitals;
• Private Practices and Physicians;
• Pharmacies;
• Outpatient Facilities; and
• Group Health Plans.

Additionally, while Group Health Plans as a group have the fewest compliance violations to date, OCR enforcement data confirms OCR’s investigation and enforcement of Access Rule violations against Group Health Plans, as well as that Group Health Plans and their business associates historically account for violations of the HIPAA security rules for the protection of electronic health information affecting millions of Americans. With OCR’s even further heightening its prioritization of HIPAA’s security rule oversight and enforcement in response to massive breaches of electronic protected health information systems and data that triggered widespread disruptions of care and payment systems reported by UnitedHealthcare Group’s Change Health, Ascension Health, and others, and recent OCR guidance requiring to update their Notices of Privacy Practices, all Covered Entities and their business associates should ensure seize the opportunity to re-verify the defensibility of their organization’s Access Rule, Security Rule and other HIPAA compliance.

For Additional Information

We hope this update is helpful. Solutions Law Press, Inc. invites you to receive future updates by registering on  here and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you need have questions or need assistance with this or other cybersecurity, health, benefit, payroll, investment or other data, systems or other privacy or security related risk management, compliance, enforcement or management concerns, to inquire about arranging for compliance audit or training, or need legal representation on other matters,  contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

About the Author 

Scribe responsible for planning and leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with HHS-OCR for more than a decade and author of many highly regarded publications on HIPAA and other privacy and data security, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of HIPAA and other cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for government contractors and other public and private businesses; managed care and other health and life science, insurance, technology, and other performance and data dependent organizations,

A Fellow in the American College of Employee Benefit Counsel, Immediate Past Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Co-Chair of its International Employment Law Committee, and its Health Care Liaison; Immediate Past Chair of the ABA TIPS Section Medicine & Law Committee; Past Chair of the ABA Managed Care & Insurance Interest Group; Former Chair of the ABA RPTE Employee Benefits & Other Compensation Group and Chair or Co-Chair of its Welfare Benefit Committee for more than 10 years , and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

The Supreme Court of Texas has issued an emergency order authorizing the modification of deadlines in certain justice courts affected by Hurricane Beryl.

The order states that upon request by local judicial leaders and pursuant to Section 22.0035(b) of the Texas Government Code, justice courts in Fort Bend, Galveston, Harris, Matagorda, and Montgomery counties that have been prevented from complying with a deadline in a civil case because the court’s normal operations have been disrupted by the disaster may:

• Consider the disaster as good cause under Texas Rule of Civil Procedure 500.5 for extending a time period in the Texas Rules of Civil Procedure or local rules, including appeal and new trial deadlines, until July 26, 2024; and
• Postpone statutory deadlines until July 26, 2024, if the court finds that the postponement is necessary to facilitate the orderly resumption of the court’s normal operations.

Read the complete order here.

For More Information

We hope this update is helpful. For more information or help about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for insurance, financial services, employee benefits, managed care and other health and life science, technology, government entities and contractors and other public and private businesses. As part of this work, she has extensively worked, spoken and published on the defensible design, use and management of artificial intelligence and other systems and processes throughout her career.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Health care providers, heath plans, health care clearinghouses and their business associates (covered entities) should verify that any online tracking technology used in their or their business partner websites or mobile applications comply with the Department of Health and Human Services, Office of Civil Rights (OCR) updated guidance on “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” published March 18, 2024.

The Guidance reminds covered entities that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules) apply to their use of online tracking technologies like Google Analytics or Meta Pixel, collect and analyze information about how users are interacting with a regulated entity’s website or mobile application.

The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes electronic protected health information (ePHI).

OCR’s information bulletin reminds covered entities that they can only use online tracking technologies provided that the entities comply with their obligations under the HIPAA Rules. Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of ePHI to tracking technology vendors or any other violations of the HIPAA Rules.

OCR’s Bulletin provides a general overview of how the HIPAA Rules apply to covered entities use of tracking technologies. It also updates to the Bulletin include:

• Additional examples of when visits to an unauthenticated webpage may or may not involve the disclosure of ePHI.
• Additional tips for complying with the HIPAA Rules when using online tracking technologies.
• Guidance about OCR’s enforcement priorities in investigations involving regulated entities’ use of online tracking technologies.

Covered entities need to understand that online tracking technologies commonly are included in Website, mobile application, and other Internet based tools. These tools frequently include online tracking even if not specifically requested by the covered entity. 

Covered entities should conduct a documented inventory of all website, mobile app, and other Internet, based tools that they or their business associates use, which includes an assessment of whether those tools include online tracking, or other technologies, covered by the guidance. For any online tools using tracking capability, cupboard entities, must ensure that the tool is designed and administered to comply with the HIPAA requirements. Overed entities also should adopt a process for regularly reevaluating and monitoring compliance with this and other HIPAA security requirements in their Internet based in other electronic applications that collect, use, store, access, or disclose electronic, protected health information.

Along with specifically evaluating the existence and compliance of any online tracking technologies, covered entities, also should reevaluate and reconfirm the adequacy of their electronic security overall. The HIPAA Rules require healthcare providers and other covered entities to regularly conduct documented risk assessments to verify the adequacy of their security safeguards, and to make updates to guard against emerging threats based on these recurrent assessments. The importance of compliance with this ongoing recurrent risk assessment obligation is repeatedly reinforced in each HIPAA settlement announced by OCR. See, e.g., OCR Nails Second HIPAA Covered For Allowing Ransomware Breach.

Covered entities should ensure that they and their business associates maintain compliance with these other HIPAA obligations.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• California Fast Food Minimum Wage Jumps To $20/Hour 4/1
• Manage Health Plan HIPAA, ERISA & Other Exposures From Change Healthcare Ransomware Attack
• Wage & Hour Takes Aim At Restaurant & Other Hospitality Employers
• Prepare Defenses Against Rising Religious Discrimination Exposures
• Restaurant Pays $167K In Back Wages & Damages For Overtime Violation
• ICE Updates Forms I-942 and I-881
• $160K HIPAA Penalty Warns Health Plans & Other Covered Entities Deliver Timely Protected Health Information Access
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences, No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requ