Corporate Compliance |

Confirm 2025 Required Defined Contribution & 403(b) Plan Amendments Timely Adopted

December 18, 2025

Defined contribution savings plans and 403(b) annuity plan sponsors, fiduciaries and vendors should use the “2025 Required Amendments List for Qualified and Section 403(b) Plans” to verify their programs are timely updated with all required amendments to avoid tax disqualification exposures.

Notice 2025-60 contains the Internal Revenue Service (“IRS”) 2025 Required Amendments List (“2025 RA List”) for individually designed plans qualified under section 401(a) of the Internal Revenue Code and individually designed plans that satisfy the requirements of section 403(b). The 2025 RA List also applies to pre-approved plans with respect to interim amendments.

Notice 2025-60 will be in IRB: 2025-52, dated: December 22, 2025.

If you have questions or need additional ion information or assistance, contact the author of this update, Cynthia Marcotte Stamer,

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on health and other employee benefits, insurance, healthcare, workforce, HIPAA and other data and technology and other compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, insurance, healthcare , data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

Ms. Stamer is the author of many highly regarded works published by leading professional and business publishers, the ABA, the American Health Lawyers Association, and others. Ms. Stamer also frequently speaks and serves on the faculty and steering committee for many ABA and other professional and industry conferences and conducts leadership and industry training for a wide range of organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see http://www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press™

Solutions Law Press™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press™ resources or training.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by emailing it here.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press.™ For information about licensing for republication, please contact the author directly. All other rights reserved.

Leave a Comment » | 401(k), Corporate Compliance, defined contribution plan, Defined Contribution Plans, Employee Benefits, Employers, enforcement, ERISA, Internal Revenue Code, Retirement Plans, Retirements | Permalink
Posted by Cynthia Marcotte Stamer

Diabetes Costs Remain Key Health Cost Driver

December 10, 2025

Diabetes treatment costs remain a leading health plan and health care cost driver.

Approximately one in four U.S. health care dollars (about 25%) is spent on people with diagnosed diabetes. Of this amount, about 61% of the costs are directly attributable to diabetes itself, with the remainder being general medical costs.

For 2021–2022, treating diabetes among U.S. adults cost an estimated $153.2 billion each year. The average cost per person receiving care was $5,810 per year, with prescription medicines accounting for more than 80 percent of the total.

A recent statistical brief based on data from AHRQ’s Medical Expenditure Panel Survey (MEPS) highlights these costs and how the prevalence of treated diabetes varies by age, income, insurance coverage, and type of care. The report also breaks down spending by service and payment source, offering a closer look at the financial impact of diabetes treatment.

Comments Off on Diabetes Costs Remain Key Health Cost Driver | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Verify ERISA Bonding Compliance

November 25, 2025

Health, retirement and other employee benefit plan fiduciaries, sponsors and service providers should confirm and document that all plan fiduciaries, service providers and other plan workforce members are properly bonded to protect the plan against fraud and dishonesty, as well as avoid incurring liability for breaching the fiduciary responsibility requirements of the Employee Retirement Income Security Act of 1974 (“ERISA”).

ERISA Requires Fidelity Bonding

ERISA imposes fidelity bonding requirements under ERISA §412 and 29 C.F.R. Part 2580 to protect plan assets against loss due to fraud or dishonesty. ERISA §412(a) requires that every fiduciary of an employee benefit plan and every person who ‘handles funds or other property’ of the plan must be bonded against loss resulting from fraud or dishonesty. The Department of Labor (“DOL”) regulations at 29 C.F.R. §2580.412‑6 define handling of funds to include physical contact, power to transfer, ability to sign checks, or supervisory authority over those who handle plan assets.

As ERISA’s bonding requirements are part of ERISA’s fiduciary responsibilities, failure to maintain bonding required by ERISA §412 constitutes a fiduciary breach under ERISA §404(a)(1)(A)-(B), which exposes fiduciaries breaching these obligations to DOL civil penalties, personal liability for losses arising from non‑compliance, and other liabilities.

Who Must Be Bonded

ERISA’s fidelity bonding requirement applies to two categories of persons:

Plan fiduciaries, and

Non‑fiduciaries who ‘handle’ plan funds within the meaning of 29 C.F.R. §2580.412‑6.

For purposes of determining the individuals and entities subject to ERISA’s bonding requirement, keep in mind that ERISA functionally defines a “fiduciary” as including any person that:

Exercises any discretionary authority or discretionary control respecting management of the plan or the management or disposition of its assets,
Renders investment advice for a fee or other compensation, direct or indirect, with respect to any moneys or other property of such plan, or has any authority or responsibility to do so, or
Has any discretionary authority or discretionary responsibility in the administration of such plan. See ERISA Section 3(21).

Consequently, if an individual or entity functionally possesses or exercises authority or responsibility over the plan or its assets, it is a fiduciary subject to the bonding and other fiduciary requirements of ERISA regardless of whether that party is a named fiduciary or disclaims fiduciary status in an agreement.

Likewise, the ERISA bonding requirement for parties that handle funds also is based on the functional realities. Under DOL Regulations, a person is deemed to handle plan assets if their role creates a risk of loss due to fraud or dishonesty. Examples include:

Physical possession of cash, checks, or assets.
Power to transfer assets or negotiate instruments.
Authority to sign checks or initiate electronic fund transfers.
Supervisory authority over individuals who handle assets.

Non‑fiduciary service providers and other members of the plan workforce who do not handle plan funds are not subject to ERISA §412. For instance, DOL Field Assistance Bulletin 2008‑04 states that third‑party administrators that do not control or possess plan assets and cannot authorize disbursements are not required to be bonded. Similarly, other nonfiduciary contractors providing legal, actuarial, consulting, claims‑processing, or IT services fall outside the bonding requirement unless they have direct authority over plan assets. See also 29 C.F.R. §2509.75‑8 without discretionary authority over plan assets generally does not ‘handle’ funds and therefore are not subject to ERISA §412 bonding unless they otherwise are named or function as fiduciaries.

When applying these distinctions for purposes of ERISA’s bonding rules, plan fiduciaries and service providers should look beyond contractual characterizations of the character and nature of the service provider and based their decision regarding whether to require and acquire a bond based on the functional realities. While non‑fiduciary service providers are only required to be bonded if they handle plan funds as defined by ERISA §412 and the DOL regulations, functionally evaluated, certain non‑fiduciary service providers sometimes become subject to bonding if their activities constitute functional “handling” of plan funds. For example:

A payroll vendor that transmits employee contributions is handling assets.
A recordkeeper with authority to initiate distributions must be bonded.

Conversely, a TPA adjudicating claims but without power to pay benefits is not required to be bonded. service providers and others granted functional authority that exposes plan assets to risk of loss are required to be bonded as individuals that handle funds.

When evaluating whether a service provider or other party “handles funds” for purposes of assessing the applicability of the ERISA bonding requirement in investigations or audits, the DOL usually asks if the party or its employees have:

Physical possession of Plan assets?
The power to obtain physical possession of plan assets?
The power to transfer assets?
The authority to disburse Plan funds directly or indirectly?
The authority to endorse checks?
The authority to make investments?

The DOL Enforcement Manual indicates that “handling” of Plan funds is indicated and bonding is required for each individual or party that (a) has any of these authorities or (b) if the assets are held by a corporate trustee, for any service provider or other party that can direct the payment of benefits or direct the investments to be made by the corporate trustee.

Bond Amount and Coverage Requirements

Where ERISA requires a fidelity bond, ERISA §412(a) and 29 C.F.R. §2580.412‑11 require that the fidelity bond must be at least 10% of the amount of plan funds handled by the individual in the preceding plan year, with a minimum of $1,000 and a default maximum of $500,000 per plan (or $1,000,000 for plans holding employer securities under §412(g)).

An ERISA fidelity bond is a specific type of insurance that protects the plan against losses caused by acts of fraud or dishonesty. The fidelity bond required under ERISA specifically insures a plan against losses due to fraud or dishonesty (e.g., theft) by persons who handle plan funds or property. Fraud or dishonesty includes, but is not limited to, larceny, theft, embezzlement, forgery, misappropriation, wrongful abstraction, wrongful conversion, willful misapplication, and other acts. Deductibles or other similar features are prohibited for coverage of losses within the maximum amount for which the person causing the loss is required to be bonded. While obtaining fiduciary liability insurance also generally is recommended, the bonding requirement is not satisfied by the purchase of fiduciary liability.

The fidelity bond purchased must fulfill the specific requirements of ERISA. For instance, the bond should be issued by a bonding company listed in Treasury Circular 570 and must cover the Plan for loss due to fraud or dishonesty as defined in 29 C.F.R. §2580.412‑9. Fiduciaries should confirm the bond provides for payment to the Plan in the event of loss, name the Plan as an “insured” and have the pay over rider attached unless the Plan is the sole insured under the bond. The definition of employee in the bond must cover all persons who “handle” funds including officers, directors, trustees, employees and the other parties required to be covered by the bond. If the bond contains a deductible, an elimination of deductible rider with the respect to the plan also is needed. Since bonds purchased by third party administrators, financial advisors or other plan service providers to meet state law or professional standards generally do not fulfill these and other ERISA requirements, plans generally should require specific contractual assurances to comply with the ERISA bonding requirements and should obtain and confirm the adequacy of the bonds for service providers and others subject to ERISA bonding requirements.

Liability For ERISA Bonding Violations

Failure to secure a fidelity bond under ERISA can lead to significant legal and financial consequences. Plan sponsors and fiduciaries are required by ERISA to obtain a fidelity bond to protect employee benefit plans from losses due to fraud or dishonesty. Noncompliance can lead to a range of consequences, including auditors’ admonitions, court mandates for removal as plan fiduciaries, plan fiduciary personally liability for losses that should have been covered by a fidelity bond, and EBSA administrative penalties for breach of fiduciary duty. See DOL’s Protect Your Employee Benefit Plan With A Fidelity Bond; Getting It Right: Know Your Fiduciary Responsibilities.

Managing Bonding And Bonding Risks

To avoid violating the bonding requirements, fiduciaries and service providers should both review service agreements and the functional realities to confirm whether any party “handles” funds and to ensure compliance with ERISA bonding requirements.

Service providers that engage in the performance of activities that involve or are likely to be recharacterized as involving the exercise of discretion or the handling of funds should give serious consideration to arranging to maintain a fidelity bond that meets ERISA’s requirement, whether or not the service provider acknowledges or disclaims its status as a fiduciary or handler of plan funds.

Since noncompliance with the bonding requirement is a breach of the fiduciary responsibility requirements of ERISA that could render the fiduciary personally liable for unbonded losses, plan fiduciaries generally should conduct and retain a documented analysis capturing their consideration of whether they and other fiduciaries, service providers, and other members of the plan workforce ar required to be bonded and if so, the actions taken to require and monitor compliance with applicable bonding requirements. Examples of best practices include:

Include bonding requirements in plan documents and contracts;
Conduct and maintain a documented assessment of the applicability of the bonding requirements when appointing or renewing the appointment of a fiduciary, third party service provider or workforce member to participate in the management or operations of the plan or its assets; and
Obtain and review bonds obtained to cover fiduciaries and service providers to verify their currency and adequacy;

When the factual realities raise the possibility that an individual or a party might possess or exercise fiduciary discretion or handle funds, fiduciaries generally will want to err in favor of requiring bonding to protect the plan and to protect themselves against the personal liability that can arise under ERISA Section 502(l) for violation of the bonding requirements, unbonded plan losses arising from fraud or loss by the service provider or both.

About the Author

About Solutions Law Press™

Comments Off on Verify ERISA Bonding Compliance | 401(k), Corporate Compliance, ERISA, Fiduciary Responsibility, group health plan, health plan, Health Plans, retirement plan, Retirement Plans, Retirements, self insured health plan | Tagged: business, Finance, investing, personal-finance, retirement-planning | Permalink
Posted by Cynthia Marcotte Stamer

New PBGC Director Sworn In

November 9, 2025

Janet Dhillon was sworn in as the 17th director of the Pension Benefit Guaranty Corporation (“PBGC”) on November 3, 2025.

Dhillon succeeds Gordon Hartogensis, who served as director from May 2019 to April 2024.

Dhillon previously served as acting assistant secretary and principal deputy assistant secretary of the Department of Labor’s Employee Benefits Security Administration (“EBSA”).

From May 2019 to November 2022, Dhillon was a commissioner on the U.S. Equal Employment Opportunity Commission (“EEOC”) and served as its chair from May 2019 to January 2021.

Outside of government, Dhillon served as the general counsel of several Fortune 500 companies, including US Airways Group, Inc., JC Penney Company, Inc., Burlington Stores, Inc. and Dollar Tree, Inc. She began her legal career at the law firm of Skadden, Arps, Slate, Meagher & Flom LLP.

Dhillon earned her Juris Doctor from UCLA School of Law and a Bachelor of Arts from Occidental College in Los Angeles.

PBGC administers two insurance programs designed to safeguard pension plan participants in distressed plans: (1) The Single-Employer Program is financed by insurance premiums, investment income, and assets and recoveries from failed single-employer plans. (2) The Multiemployer Program that insures private sector union pension plans is financed by insurance premiums and investment income. Special financial assistance for financially troubled multiemployer plans is financed by general taxpayer monies.

The overall funded status of multi employer pension plans has improved substantially in recent years, primarily due to the Special Financial Assistance (SFA) program under the American Rescue Plan Act of 2021 (ARPA).

The aggregate funded percentage for all multiemployer plans was an estimated 100% as of mid-2025, up from 97% at the end of 2024.

Without the SFA program, the aggregate funded percentage would be closer to 91%. As of June 30, 2025, 122 plans had received nearly $73 billion in SFA, which has prevented many from becoming insolvent.The financial outlook for the Pension Benefit Guaranty Corporation’s (PBGC) multiemployer program, which was previously projected to run out of money, has stabilized, with a projected solvency date beyond 2063.

While private sector pension fund is stabilizing, funding concerns remain about many public sector pension plans.

The “vast majority” of public plans are considered fragile (funded ratio of 60% to 90%) or distressed (funded ratio below 60%).

Unfunded liabilities for state and local plans have remained above $1 trillion since the 2008 Financial Crisis, standing at an estimated $1.2 trillion in 2025.

As of late 2025 data, states with the most distressed plans (lowest funded ratios) include Illinois, New Jersey, Kentucky, and Mississippi.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on New PBGC Director Sworn In | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Make Plan Terms For Determining Beneficiaries Clear

November 4, 2025

A recent Northern District of Texas ruling reminds life insurance and other benefit plan sponsors, fiduciaries, administrators and insurers of the benefits of including clear, unambiguous beneficiary designations in their plan documents.

The District Court in Metropolitan Life Insurance Co. v. Wallace granted a domestic partner and common-law wife’s summary judgment for ERISA plan life insurance proceeds in an interpleader action brought against the plan.

The action arose after the insured died without designating a beneficiary.

Ambiguous beneficiary designation provisions can expose plans and their fiduciaries to significant cost or expense where the plan doesn’t contain clear rules. In this case, the plan document has clear provisions for determining the beneficiary.

The Court found the plan terms mandated that the plan distribute benefits to a spouse or domestic partner before the deceased’s parents. Accordingly, distribution to the common law spouse or domestic partner was upheld.

For More Information

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, or health care developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating in and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About Solutions Law Press™

Comments Off on Make Plan Terms For Determining Beneficiaries Clear | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Roth Catch-up Contribution Rules Amended For SECURE 2.0 Act of 2022

September 22, 2025

The Department of Treasury and the IRS issued final regulations amending the Roth catch-up contribution regulations under IRC Sections 401(k), 403(b), and 414(v). The regulations provide guidance for retirement plans that permit participants who have attained age 50 to make additional elective deferrals that are catch-up contributions. The regulations reflect statutory changes made by the SECURE 2.0 Act of 2022, including the requirement that catch-up contributions made by certain catch-up eligible participants must be designated Roth contributions.

These final regulations generally apply with respect to contributions in taxable years beginning after December 31, 2026. However, the preamble and Applicability Dates section provide additional details regarding applicability dates.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on Roth Catch-up Contribution Rules Amended For SECURE 2.0 Act of 2022 | Corporate Compliance | Tagged: Employee Benefits, Roth | Permalink
Posted by Cynthia Marcotte Stamer

Stamer Conducting Cybersecurity Jedi Skills Training At ISSA Security Summit 2025 CISO Forum On 9/17

July 24, 2025

The Information Systems Security Association (“ISSA”) – Los Angeles Chapter (“ISSA-LA”) recently confirmed that Solutions Law Press publisher and author Cynthia Marcotte Stamer will conduct “Cybersecurity Jedi Skills Training” at the 2025 Annual Security Summit 2025 ISSA-LA is hosting on September 17-18, 2025, at the Annenberg Beach House in Santa Monica, California.

Under constant threat from potentially draconian operational, financial and legal mayhem from cybercriminals’ ransomware and other cyberattacks, organizations, investors, breach victims, business partners, and federal and state regulators increasingly expect cybersecurity and other IT leaders to defend their organization’s proprietary knowledge, workforce, finance, and other mission critical data and systems cyberthreats from dark web with the skill of Jedi knights. While even the most skilled cyberwarriors can’t render their data and operating systems impenetrable against these attacks, cybersecurity professionals and their organizations should engage in constant training and preparation to protect themselves and their organizations from the fallout that commonly follows from a data or systems breach or failure.

The September 17, 2025, “Cybersecurity Jedi Skills Training” workshop that Ms. Stamer will conduct is designed to help CISOs, Directors of Information Security and other leaders strengthen their cybersecurity prevention and response strategies for enhanced defensibility. Drawing from her decades of experience advising and defending data-reliant organizations and their leaders, her workshop will:

Arm cybersecurity leaders with knowledge about how data, systems, and technology can either promote or undermine legal defensibility, and share basic principles and strategies for designing and using technology and data to advance legal goals and defensibility.
Empower cybersecurity defenders with insights into key cybersecurity, privacy, electronic data, and technology-related traps that impact defense and response strategies.
Highlight how cyber events and violations of computer, securities, antitrust, and other laws can expose organizations and their leaders to criminal, civil, and administrative liability.
Reveal key evidentiary practices and processes to use during compliance, contracting, audits, investigations, governance, incident management, and response, as well as when dealing with government or other investigations, to promote and strengthen defensibility and mitigate risks.

Ms. Stamer has developed the training from her decades of experience helping highly regulated and other performance and data-sensitive organizations and their leaders use the law, process, technology and other legal, risk management and operational tools to promote defensibility, mitigate risk, enhance operational effectiveness, and manage change and uncertainty. The founding and Managing Member of the Cynthia Marcotte Stamer, P.C. law firm, Ms. Stamer has used her extensive legal and operational knowledge to provide practical, client-centric advice, tools and solutions to help a diverse array of U.S. and multinational business, government, and community organizations, to design, manage and defend their people; compensation and benefits; technology, data privacy and security; regulatory compliance; and other operations-critical risks and performances for more than 35 years. She is best known for her work with employer and other workforce, health, employee benefits, insurance, data and technology, financial and government organizations, and their technology and other developers and vendors, all of which bear significant data privacy and security obligations.

Longtime Scribe leading the American Bar Association (“ABA”) JCEB Annual Agency Meeting with the HHS Office of Civil Rights; incoming Intellectual Property Section Information Technology Committee Vice Chair, and a widely published author, speaker and thought leader on cybersecurity and other data and technology use, privacy and protection, Ms. Stamer’s process-oriented work throughout her career continuously has included helping clients use and defend their data and technology practices, investigating and responding to data and technology breaches, events, threats and regulations; and dealing with insurers, federal and state legislators, regulators and investigators on cybersecurity and other data and technology concerns. Her cutting-edge work, scholarship and thought leadership, advocacy and community service have earned her recognition as a “Top Woman Lawyer;” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; “Best Lawyer” in “Labor and employment,” “Tax: ERISA & Employee Benefits,” “Health Care,” and “Business and Commercial Law.” For additional information about Ms. Stamer or her services, see here or contact Ms. Stamer directly.

Ms. Stamer’s “Cybersecurity Jedi Skills Training” is part of two days of professional training and networking that ISSA-LA is presenting at its Annual Security Summit 2025. Founded in 1982 by Sandra Lambert and Nancy King, ISSA-LA is the premier catalyst and community resource in Southern California for improving the practice of information security. A 501(c)(3) organization and the founding Chapter of the ISSA®, ISSA-LA provides various training classes and lectures for information Security and IT professionals throughout the year and at the annual Summit. ISSA-LA meets monthly for dinner and regularly collaborates with other IT and Cybersecurity organizations, having joint meetings and social events with the Women’s Society of Cyberjutsu, the Cloud Security Alliance, and the Association of IT Professionals, to name a few. To register, review the schedule, information about sponsorship, or other details about the Annual Security Summit 2025 or ISSA-LA, see here.

For More Information

About Solutions Law Press™

Comments Off on Stamer Conducting Cybersecurity Jedi Skills Training At ISSA Security Summit 2025 CISO Forum On 9/17 | Corporate Compliance | Tagged: AI, Cyber Security, Cybersecurity, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Delta Pays $8 Million Plus For Misuse Of COVID Payroll Support Funds

July 15, 2025

Employers that collected payments under the COVID-era Department of the Treasury Payroll Support Program (“PSP”) should heed the $8,100,000 Delta Airlines is paying as a reminder to ensure their own compliance with any COVID-19 relief programs.

The Justice Department announced today that Delta Air Lines Inc., headquartered in Atlanta, Georgia, has agreed to pay to resolve allegations that it violated the False Claims Act by awarding compensation to certain corporate officers and employees that exceeded the compensation limits Delta agreed to as part of its participation in the PSP program.

The settlement is an example of some of the aggressive audit and enforcement activities the federal government is now pursuing against recipient of COVID relief funds. recipients of such funds should verify that they can demonstrate compliance with all requirements of the program recipients who discover compliance deficiencies, should seek the advice of experienced counsel to assist in seeking a voluntary resolution for any compliance deficiencies to minimize exposures.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on Delta Pays $8 Million Plus For Misuse Of COVID Payroll Support Funds | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

DOJ Nails Employer For Discriminating In Favor Of Noncitizen Workers

July 15, 2025

The $250,000 a Mississippi employer is paying for discriminating in favor of non-citizen visa holders warns all US employers against discriminating against legally authorized workers based on national origin.

The settlement agreement with H2A Complete II Inc., that the Justice Department announced today reminds US employers not to discriminate among workers, legally authorized to work in the United States in employment practices based differences in the basis of their eligibility to work or national origin.

The settlement resolves charges that H2A Complete II Inc. violated the Immigration and Nationality Act (“INA”) by unfairly favor H-2A visa holders over U.S. workers for agricultural employment opportunities.

The second “Protecting U.S. Workers Initiative” settlement under the second Trump Administration, the settled demonstrates the Administration’s commitment to targeting, investigating, and bringing enforcement actions against employers that intentionally discriminate against U.S. workers due to a preference for temporary visa workers.

Under the settlement, the company will pay $25,000 in civil penalties to the United States, undergo training, revise its employment policies, and not include excessive experience requirements in job postings that are unlawfully aimed at excluding U.S. workers from employment opportunities.

The announcement of the settlement quotes Attorney General Pamela Bondi as stating, “This Department of Justice will continue to protect our country’s workers from unlawful discrimination in favor of foreign nationals.”

“DOJ’s Civil Rights Division is protecting American workers from unlawful discrimination by employers that prefer to hire foreign visa workers instead of U.S. workers,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “Protecting job opportunities for the American workforce is one of our top priorities.”

Although the Trump administration has made protecting US worker jobs, a priority, US employers should keep in mind that federal law, generally prohibits discrimination based on national origin or legal status to work, except where specifically provided by law. Accordingly, employers should be prepared to demonstrate that choices among applicants are made based on merit. employers should not apply a bias in favor of workers of a particular eligibility to work status, such as citizenship, or holding a particular type of visa, unless that status is specifically required by the applicable requirements of law for the position.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on DOJ Nails Employer For Discriminating In Favor Of Noncitizen Workers | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

DB Plan Mortality Tables Updated

July 15, 2025

The Internal Revenue Service (“IRS’) is updating the mortality tables used for defined benefit plans and determining minimum present values for annuity distributions.

Notice 2025-40 specifies updated static mortality tables to be used for defined benefit pension plans under § 430(h)(3)(A) of the Code and section 303(h)(3)(A) of ERISA. This notice also specifies a mortality table for use in determining minimum present value under § 417(e)(3) of the Code and section 205(g)(3) of ERISA for distributions with annuity starting dates that occur during stability periods beginning in the 2026 calendar year.

The Notice is scheduled for publication in IRB: 2025-31, dated July 28, 2025.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on DB Plan Mortality Tables Updated | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Prepare For Marketplace Rule Change Fallout

June 26, 2025

A new Department of Health and Human Services Final Rule will tighten subsidy eligibility and implement other reforms for the the Heathcare Marketplace insurance plans created under the Patient Protection and (“ACA”). Health plan sponsors and providers should take into account the probable effect of enrollment and coverage pattern changes these changes will cause for groups of workers and other individuals currently relying on subsidies to maintain Marketplace coverage in their planning, budgeting and compliance.

The 2025 Marketplace Integrity and Affordability Final Rule (“Rule”) reverses Biden Administration rules that lowered requirements for individuals to receive subsidies to pay costs for purchasing health coverage and eased other requirements for Exchange coverage.

According to the now Trump Administration-led Centers for Medicare & Medicaid Services (“CMS”), improper ACA enrollments enabled by weakened verification processes and expanded premium subsidies triggered widespread fraud. Research shows that in 2024, an estimated 5 million people may have been improperly enrolled, costing taxpayers as much as $20 billion^[1].

To address these concerns, the new Rule:

Repealing the monthly special enrollment period (SEP) for individuals with projected household incomes at or below 150% of the federal poverty level, a policy used by some agents and brokers to improperly enroll ineligible consumers and perform unauthorized plan switching to gain commissions;
Requiring income verifications to ensure people qualify for the premium subsidies they receive;
Conducting eligibility verifications for the majority of enrollments through SEPs, closing loopholes that allowed people to wait to enroll until they needed care and improving the risk pool, which can lower premiums for middle-class families not receiving subsidies;
Reducing advanced payments of the premium tax credit (APTC) by $5 a month for individuals who are auto re-enrolled in fully-subsidized plans without eligibility verification, ensuring consumers are aware of and engaged in their health coverage; and
Standardizing the Annual Open Enrollment Period starting with the 2027 plan year so that it ends by December 31 for all health insurance exchanges, encouraging people to maintain year-round health coverage rather than waiting until they get sick to enroll, which helps keep insurance affordable for everyone.

CMS says many changes are “temporary” measures set to sunset at the end in 2026 to immediately tamp down on the outflow of funds to ensure that eligibility verification processes work efficiently and allow qualified enrollees to access ACA Exchange coverage without fear of coverage gaps or surprise tax liabilities resulting from the improper actions of third parties.

To ensure federal subsidies for coverage through ACA Exchanges only support the statutory requirements and goals of the ACA, CMS also is:

Prohibiting federal subsidies from being used to help cover the cost of specified sex-trait modification procedures to align an individual’s physical appearance or body with an asserted identity that differs from the individual’s sex; and
Reinstating HHS’ longstanding 2012 interpretation of “lawfully present” to exclude Deferred Action for Childhood Arrivals (DACA) recipients from eligibility and enrollment in ACA Exchange coverage and Basic Health Program (BHP) coverage in States that elect to operate a BHP, including APTC, premium tax credits, and cost-sharing reductions.

CMS says these reforms address “improper enrollments and the improper flow of federal funds implemented during the Biden Administration.

Group health plans, their employer and other sponsors should prepare for potential implications of these changes on their workforce and health plans. These are likely to vary among employers and plans. Possible effects could include:

An increase in the number of uninsured workers or dependents;
Effects on Affordable Care Act and other testing;
New inquiries and requests for special or other enrollment;
Potential new notification and enrollment requirements;
Potential increases in occupational illness, sick or disability leave, absenteeism and presenteeism from uncovered workers; and
More.

Considering these and other effects can help health plans, their sponsors, and employees to prepare for and respond to these effects.

If you have questions or need help with these or other employee benefits concerns, contact the author of this update, Cynthia Marcotte Stamer, who is a Fellow in the American College of Employee Benefits Counsel with decades of employee benefits experience.

More Information Or Help

We hope this update is helpful. For more information about these or other health or other employee benefits, human resources, insurance, or health care legal developments, please contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

About the Author

About Solutions Law Press™

Comments Off on Prepare For Marketplace Rule Change Fallout | Corporate Compliance | Tagged: ACA, Affordable Care Act, Employee Benefits, Employer, Employers, ERISA, Health Care, Health Care Reform, Health Insurance, Health Plans, Human Resources, Insurance, marketplace | Permalink
Posted by Cynthia Marcotte Stamer

Share Ideas About Patient Empowering Health Technology With HHS By 6/16

May 14, 2025

Group health plans, their employer and union sponsors, fiduciaries, insurers, administrators, communications and information technology vendors and participants interested in promoting technologies to help patients control their health and wellness have until June 16, 2025 is to share input with the Centers for Medicare & Medicaid Services (“CMS”) and the Office of the National Coordinator for Health Information Technology (“ONC”) in response to their currently open request for information (“RFI”).

Following up on the CMS Interoperability and Patient Access Final Ruleand part of Secretary Kennedy’s effotts to “Make America Healthy Again,” the agencies are inviting public input on designing a seamless, secure, and patient-centered digital health infrastructure that will help seniors and their families use modern technology to control of their health and well-being, manage chronic conditions, and access care more efficiently.

The RFI invites input from patients, caregivers, providers, payers, technology developers, and other stakeholders on how CMS and ONC can:

Drive the development and adoption of digital health management and care navigation applications;
Strengthen interoperability and secure access to health data through open, standards-based technologies;
Identify barriers preventing the seamless exchange of health information across systems; and
Reduce administrative burden while accelerating progress toward value-based, patient-centered care.

Many employee benefit plans, their sponsors and vendors have extensive experience and interest in the use of mobile applications and other technologies by plan members and their caregivers. Interested parties should consider sharing insights to help promote awareness of helpful designs and to deter investments or mandates of unhelpful technologies.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on Share Ideas About Patient Empowering Health Technology With HHS By 6/16 | Corporate Compliance | Tagged: Employee Benefits, Employer, Employers, ERISA, Health Insurance, Health IT, Health Plans, HIPAA, Human Resources, Patient Empowerment | Permalink
Posted by Cynthia Marcotte Stamer

IRS Reduces Plan Sponsors Required To Request Approval For Special Mortality Table Use In Retirement Plan Funding Calculations

May 7, 2025

The Internal (“IRS”) is limiting the circumstances under which plan sponsors wishing to use special mortality tables to calculate defined benefit plan funding requirements must obtain IRS approval.

Revenue Procedure 2024-32 specifies the procedure by which the sponsor of a defined benefit plan that is subject to the funding requirements of § 430 of the Internal Revenue Code (the “Code”) may request approval from the IRS to use plan-specific substitute mortality tables in accordance with § 430(h)(3)(C) and § 1.430(h)(3)-2 of the Treasury Regulations.

Section 12.02 of Rev. 2024-32 in conjunction with the replacement of the generally applicable mortality tables, certain plan sponsors that wish to continue using plan-specific mortality tables must develop and request Internal Revenue Service (“IRS”) approval for the use of new plan-specific substitute mortality tables for plan years beginning on or after January 1, 2026. Section 303(h)(3)(C) of Employee Retirement Income Security Act of 1974, as amended (“ERISA”) also requires covered plan sponsors to obtain this IRS approval for continued use of new plan-specific mortality tables for purposes of the parallel funding rules of Section 302 of ERISA and the additional funding rules for defined benefit plans (other than multiemployer plans) under ERISA Section 303.

In a regulatory review prompted by President Trump’s Executive Order 14219, Ensuring Lawful Governance and Implementing the President’s “ Department of Government Efficiency” Deregulatory Initiative (Executive Order 14219), the IRS determined these requirements should be simplified. Consequently, Rev. Proc. 2025-21 modifies section 12.02 of Rev. Proc. 2024-32 to provide immediate relief for certain plan sponsors by narrowing the category of plan sponsors required to request approval of new plan-specific substitute mortality tables.

Specifically, Section 12.02 of Rev. Proc. 2024-32 is revised to provide that except for plans using a mortality ratio determined with combined genders, plans with significant coverage changes cannot use a substitute mortality table first approved for use for a plan year that began before January 1, 2025 for a plan year beginning on or after January 1, 2026 when the number of individuals covered by the substitute mortality table is less than 80 percent or more than 120 percent of the average number of individuals in that population over the 12-month periods covered by the experience study regardless whether the actuary makes the certification described in § 1.430(h)(3)2(c)(6)(iii)(A) for plans using a mortality ratio determined with combined genders.
If Substitute Base Tables for a plan (or plans) were developed using the option in Treasury Regulation § 1.430(h)(3)-2(d)(6) to determine a single mortality ratio for both genders in a population, however, the early termination of the permitted use of a substitute mortality table will not apply if the total number of individuals covered by the substitute mortality tables developed using that mortality ratio is not less than 80 percent and not more than 120 percent of the average number of individuals in the population used to determine that mortality ratio over the 12-month periods covered by the experience study, provided that the plan actuary certifies in writing to the satisfaction of the Commissioner that the substitute mortality tables used for the population continue to be accurately predictive of future mortality of that population (taking into account the effect of the change in the population) as described in § 1.430(h)(3)-2(c)(6)(iii)(A).

This change applies to all requests for approval to use plan-specific substitute mortality tables in accordance with § 430(h)(3)(C) for which the first year that the substitute mortality tables would apply begins on or after January 1, 2026.

The IRS officially will publish Revenue Procedure 2025-21 in IRB 2025-22, dated May 27, 2025.

More Information Or Help

About the Author

About Solutions Law Press™

Comments Off on IRS Reduces Plan Sponsors Required To Request Approval For Special Mortality Table Use In Retirement Plan Funding Calculations | Corporate Compliance, Defined Benefit Plans, Employee Benefits, Employer, Employers, retirement plan, Retirement Plans, Retirements, Risk Management | Permalink
Posted by Cynthia Marcotte Stamer

DOJ Sues Medicare Advantage Insurers & CVS Under False Claims Act & Antikickback Statute

May 5, 2025

The Department of Justice is suing three of the nation’s largest health insurance companies — Aetna Inc. and affiliates, Elevance Health Inc. (formerly known as “Anthem”), and Humana Inc., CVS Health Corporation, and three large insurance broker organizations — eHealth, Inc. and an affiliate, GoHealth, Inc., and SelectQuote Inc. for violating the False Claims Act (“FCA”) and Antikickback Statute. In the second complaint of its kind in recent months, the Justice Department complaint in ex rel. Shea v. eHealth, et al., No. 21-cv-11777 (D. Mass. May 5, 2025) accuses the defendants of paying or receiving kickbacks to steer Medicare Advantage enrollees to the defendant insurers.

Medicare Advantage Antikickback & False Claims Rules

Under the Medicare Advantage (“MA”) Program, also known as Medicare Part C, Medicare beneficiaries may choose to enroll in health care plans (MA plans) offered by private insurance companies, like defendants Aetna, Anthem, and Humana. Many Medicare beneficiaries rely on insurance brokers to help them choose an MA plan that best meets their individual needs.

Under the FCA, private parties can file an action on behalf of the United States and receive a portion of the recovery. The FCA permits the United States to intervene in and take over the action, as it has done here. If a defendant is found liable for violating the FCA, the United States may recover three times the amount of its losses plus applicable penalties

In a lawsuit originally filed by a former eHealth employee as a qui tam whistleblower complaint, the Justice Department charges that the defendant insurers paid hundreds of millions of dollars in illegal kickbacks to the defendant brokers in exchange for enrollments into the insurers’ Medicare Advantage plans from 2016 through at least 2021. Rather than acting as unbiased stewards, the Justice Department charges that the defendant brokers allegedly directed Medicare beneficiaries to the plans offered by insurers that paid brokers the most in kickbacks, regardless of the suitability of the MA plans for the beneficiaries.

According to the complaint, the broker organizations incentivized their employees and agents to sell plans based on the insurers’ kickbacks, set up teams of insurance agents who could sell only those plans, and at times refused to sell MA plans of insurers who did not pay sufficient kickbacks.

The Justice Department also alleges that Aetna and Humana each conspired with the broker defendants to discriminate against Medicare beneficiaries with disabilities whom they perceived to be less profitable. Aetna and Humana allegedly did so by threatening to withhold kickbacks to pressure brokers to enroll fewer disabled Medicare beneficiaries in their plans.

The Justice Department further alleges that, in response to these financial incentives from Aetna and Humana, the defendant brokers or their agents rejected referrals of disabled beneficiaries and strategically directed disabled beneficiaries away from Aetna and Humana plans.

Commonwealth Care Alliance Prior Kickback Settlement

The eHealth suit against the defendants is not first of its kind. In January, 2025, the Justice Department announced that MA Program insurer Commonwealth Care Alliance, Inc. (“CCA”) agreed to pay $520,355.65 to resolve allegations that Reliance HMO, Inc. (“Reliance”), a company CCA acquired in 2022, violated the FCA by providing cash payments to induce the referral of Medicare beneficiaries to enroll in Reliance’s Medicare Advantage Plan in violation of the Anti-Kickback Statute after CCA voluntarily self-disclosed the conduct to the U.S. Attorney’s Office.

In April 2019, CMS authorized Reliance to operate a MA plan for Medicare beneficiaries in Michigan, with beneficiaries receiving coverage starting in January 2020. On March 31, 2022, CCA announced the completion of its acquisition of a 70% stake in Reliance. After the acquisition, CCA identified concerns regarding certain marketing-related outreach and payments that Reliance agents had made to personnel at physician practices. In particular, CCA disclosed two schemes.

First, from April 12, 2019, through December 22, 2020, Reliance provided cash payments to healthcare professionals and administrative staff in physician practices, in exchange for providing Reliance with the contact information for patients who had agreed, through executing so-called “permission to contact” cards, to be contacted by Reliance regarding its MA plan offerings.

Second, in November 2019, prior to Reliance’s MA plan becoming active, Reliance paid each of four physicians and physician practices $2,500, which Reliance characterized as advances on “coordination of care” services to be provided by the physicians to beneficiaries when the MA plan became active in 2020.

The Justice Department alleged these payments were intended to induce the referral, recommendation, or arrangement of enrollment of Medicare beneficiaries in Reliance’s MA plan. Such payments, the United States alleges, were impermissible kickbacks in violation of the False Claims Act.

The CCA settlement resolved these charges. The settlement gave CCA credit for voluntarily self-disclosing this conduct to the Justice Department; taking remedial measures, including terminating the employees directly involved with the decision to offer the prohibited payments; and providing the United States with a detailed written statement describing its investigation, along with other supplemental information to assist the United States in its investigation.

Alleged Medicare Advantage Insurer Risk Adjustment Padding

Medicare Advantage insurers also are under investigation by the Justice Department for other alleged abuses. The Justice Department recently has investigated certain Medicare Advantage insurers for alleged manipulation of risk data to increase their capitated payments from Medicare. For Instance, the Justice Department recently sued MA Program insurer Independent Health Association and its affiliate, Independent Health Corporation (collectively, “Independent Health”) for allegedly illegally manipulating risk data used to set risk adjustment rates paid by Medicare to their Medicare Advantage plans in United States ex rel. Ross v. Independent Health Association et al., No. 12-CV-0299(S) (WDNY). To settle the litigation, Independent Health agreed to pay up to $98 million to resolve allegations that it violated the False Claims Act by knowingly submitting or causing the submission of invalid diagnosis codes to Medicare for Medicare Advantage Plan enrollees to increase payments that Independent Health received from Medicare. Under the terms of the settlement, Independent Health promised to make guaranteed payments of $34,500,000 and contingent payments of up to $63,500,000 on behalf of itself and DxID, which ceased operations in 2021. Its Chief Executive Officer separately agreed to pay $2,000,000. In addition, Independent Health entered into a five-year corporate integrity agreement (“CIA”) with HHS-OIG that requires among other things, that Independent Health hire an Independent Review Organization to annually review a sample of Independent Health’s Medicare Advantage patients’ medical records and associated internal controls to help ensure appropriate risk adjustment payments.

The Justice Department touts all of these and other investigations and enforcement actions against Medicare Advantage insurers as demonstrating its commitment to hold Medicare Advantage insurers and brokers accountable for kickbacks or other misconduct. In the Justice Department’s press release about the e-Health litigation, Deputy Assistant Attorney General Michael Granston of the Justice Department’s Civil Division. “We are committed to rooting out illegal practices by Medicare Advantage insurers and insurance brokers that undermine the interests of federal health care programs and the patients they serve.”

Risks For Insurers, Brokers, Health Plans & Fiduciaries

These and other actions send a strong warning to insurers and brokers to abstain from prohibited risk adjustment, kickbacks, or other prohibited conduct. Brokers and insurers also should keep in mind that these activities- whether in connection with the sale of Medicare Advantage or other insurance products Past history demonstrates that these activities carry risks beyond the Antikickback Statute and False Claims Act. They also can create exposures under other federal or state laws. The 2004 bid rigging prosecution of Marsh & McClennon by then New York Attorney General Elliott Spitzer is illustrative. On October 14, 2004, then New York State Attorney General Eliot Spitzer sued Marsh & McClennan and Marsh, Inc. (“Marsh”) for bid rigging and violation of various other state laws through its compensation arrangements between Marsh and several insurance companies, and bidding manipulation by Marsh. The largest U.S. insurance broker at the time, Marsh agreed in January 2005 to pay $850 million and end improper bid-rigging in a civil settlement with Spitzer. Attorney General Spitzer also brought criminal charges against individuals involved, some of which produced several guilty pleas. The last of these criminal prosecutions dragged on until 2011, when the New York Attorney General finally dismissed the remaining criminal charges against former Marsh executive marketing director William Gilman and former Marsh global placement director Edward McNenney. Marsh and others also faced charges in other states and private litigation from the scandal.

Kickbacks or other inappropriate compensation arrangements between insurers, brokers or other plan service providers also can create issues for health plan fiduciaries, sponsors, brokers and advisors. Self-insured health plan sponsors, fiduciaries, administrators and their consultants, brokers and insurers also should keep in mind that practices like those challenged in the Justice Department actions also are likely to raise concerns under the fiduciary responsibility and prohibited transaction rules of the Employee Retirement Income Security Act of 1974 (“ERISA”). Consequently, employer and other plan sponsors, their fiduciaries, and their brokers and advisors may wish to visit with experienced legal counsel about the advisability of conducting due diligence into the past, current, or future plan vendor relationships with their own programs.

The Justice Department is touting the lawsuit as an example of its commitment to hold Medicare Advantage insurers and brokers accountable for kickbacks or other misconduct. In the Justice Department’s press release about the action, Deputy Assistant Attorney General Michael Granston of the Justice Department’s Civil Division. “We are committed to rooting out illegal practices by Medicare Advantage insurers and insurance brokers that undermine the interests of federal health care programs and the patients they serve.”

More Information Or Help

About the Author

About Solutions Law Press™

Comments Off on DOJ Sues Medicare Advantage Insurers & CVS Under False Claims Act & Antikickback Statute | compliance, Corporate Compliance, Discrimination, false claims act, health benefit, Health Benefits, health insurance, health insurance marketplace, health plan, Health Plans, Insurance, insurance fraud, Managed Care, Medicare Advantage, pharmacy | Permalink
Posted by Cynthia Marcotte Stamer

Trump Administration Enforcement Priorities Require Cautious Handling Of Religious Accommodation Requests

May 4, 2025

A $95,000 settlement of a Justice Department religious discrimination lawsuit alerts businesses to use care when handling religious accommodation requests in employment or other aspects of their operations in light of the Trump Administration’s announced enforcement priorities.

The Civil Rights Act of 1964 (“CRA”) prohibits discrimination on the basis of sex, race, color, national origin or religion. The Justice Department warns enforcing the CRA’s religious protections is a Trump Administration priority in its May 2, 2025 announcement of a consent decree settlement of its CRA Title VII religious discrimination lawsuit against the Advanced Science and Technology Education Charter Schools (“ASTEC”) in Oklahoma City, Oklahoma.

The lawsuit alleges ASTEC discriminated against Marcus Rethwill, a former teacher at the school, on the basis of religion, in violation of Title VII of the Civil Rights Act of 1964, by terminating him after denying his request for a religious exemption from ASTEC’s vaccine mandate for employees because he could not provide a clergy letter supporting his request.

Under the consent decree, ASTEC will pay Rethwill $95,000 in monetary damages, revise its anti-religious discrimination policy, and provide mandatory training on the policy to personnel.

The consent decree announcement follows President Trump’s declaration of the protection of religious rights a priority of his second administration. See, e.g., Executive Order 14205—Establishment of the White House Faith Office.

In his February 12, 2025 Executive Order 14202-Eradicating Anti-Christian Bias, President Trump declared:

It is the policy of the United States, and the purpose of this order, to protect the religious freedoms of Americans and end the anti-Christian weaponization of government. …

My Administration will not tolerate anti-Christian weaponization of government or unlawful conduct targeting Christians. The law protects the freedom of Americans and groups of Americans to practice their faith in peace, and my Administration will enforce the law and protect these freedoms. My Administration will ensure that any unlawful and improper conduct, policies, or practices that target Christians are identified, terminated, and rectified.

That Executive Order tasks all federal agencies to root out “anti-Christian bias” from the government.President Trump’s May 1, 2025, Executive Order On The Establishment Of The Religious Liberty Commission declares:

It shall be the policy of the executive branch to vigorously enforce the historic and robust protections for religious liberty enshrined in Federal law.

The Justice Department warns other employers against violating their employees’ religious rights in its announcement of the consent decree. The announcement quotes Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division as warning:

When employees’ religious principles conflict with work rules, they should not be forced to choose between practicing their religion and keeping their jobs if a reasonable accommodation can be made. … Employer policies that rigidly restrict how employees can demonstrate the sincerity of their religious beliefs for religious accommodations are inconsistent with the breadth of Title VII’s protection against religious discrimination.

It also quotes U.S. Attorney Robert J. Troester for the Western District of Oklahoma as stating

No employee should be forced to violate their religious beliefs just to keep their job. …

Employers must take care not to craft or apply policies that require employees to forfeit their religious beliefs or impose unreasonable conditions that question the sincerity of those beliefs.

Other recent Justice Department investigation and enforcement actions clearly signal the Administration’s policy of enforcing religious rights extends beyond employment.

On April 29, 2025, for instance, the Justice Department filed a statement of interest in the private lawsuit, Grace New England v. Town of Weare, alleging that the town violated the Religious Land Use and Institutionalized Persons Act (“RLUIPA”) by threating fines against a small home-based church and its pastor.

The U.S. Department of Veteran Affairs and State Department reportedly have ordered employees to report employees displaying “anti-Christian bias” as part of its effort to implement a sweeping new executive order on supporting employees of Christian faith working in the federal government.

Widely-reported investigations and announced cancelations of federal grants or contracts, efforts to revoke tax-exempt status and other actions against Columbia University, Harvard University and others signal Jewish and other religions also may fall under these protections and that private sector organizations also are targeted for investigation and enforcement. It remains to be seen how the Administration will handle other religious discrimination claims. However organizations also must manage exposures to private federal and state claims.

In response to these investigation and enforcement priorities, all covered organizations should seek the advice of experienced legal counsel about evaluating and managing their own exposures to open past, current and potential future religious discrimination claims.

These efforts generally should include a comprehensive review and update of current policies and training, as well as an evaluation of exposure from open religious accommodation or other religious bias exposures within the scope of attorney-client privilege.

For More Information Or Help

We hope this update is helpful. For more information about these discrimination or other workforce, employee benefits, health care, risk management or compliance, or other challenges or developments, contact the author, Cynthia Marcotte Stamer, via e-mail or telephone at (214) 452-8297.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on religious and other discrimination in connection with her work with employers, health care and life sciences, employee benefits, insurance, education, technology, education, government contractors, and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of employment and other services, employee benefit,, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. She currently serves as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and on its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee. She also has served as Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

Comments Off on Trump Administration Enforcement Priorities Require Cautious Handling Of Religious Accommodation Requests | Civil Rights, compliance, Corporate Compliance, corporate governance, COVID, COVID-19, Diversity, EEOC, employee, Employer, Employers, Employment, Employment Discrimination, Employment Policies, OFCCP, Real Estate, Religious Organization, Religous Discrimination, Restructuring, Retaliation, Supreme Court, Training | Tagged: Corporate Compliance, Disability Discrimination, Discrimination, Employee Benefits, Employer, Employment, employment law, Human Resources, Management | Permalink
Posted by Cynthia Marcotte Stamer

2026 HRA Inflation Adjustments Announced

May 4, 2025

The Internal Revenue Service (“IRS”) published advanced notice of the 2026 inflation adjusted amounts for Health Savings Accounts (“HSAs”) § 223 of the Internal Revenue Code (“Code”) and the maximum amount that may be made newly available for excepted benefit health reimbursement arrangements (HRAs) provided under § 54.9831-1(c)(3)(viii) of the Pension Excise Tax Regulations.

In calendar year 2026, these amounts are as follows:

The annual limitation on deductions under § 223(b)(2) for an individual with coverage under a high deductible health plan for self-only is $4,400 and for family coverage under a high $8,750.
A “high deductible health plan” under § 223(c)(2)(A) will be defined as a health plan with an annual deductible that is not less than $1,700 for self-only coverage or $3,400 for family coverage, and for which the annual out-of-pocket expenses (deductibles, co-payments, and other amounts, but not premiums) do not exceed $8,500 for self-only coverage or $17,000 for family coverage.
For plan years beginning in 2026, the maximum amount that may be made newly available for the plan year for an excepted benefit HRA under Code § 54.9831-1(c)(3)(viii) is $2,200.

Revenue Procedure 2025-19 will be officially published in the May 19, 2025 Federal Register.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer is nationally recognized for her decades of leading edge experience on the design, sponsorship, administration and defense of health and other employee benefit, workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

About Solutions Law Press™

Comments Off on 2026 HRA Inflation Adjustments Announced | Cafeteria Plans, Corporate Compliance, Employee Benefits, Employer, Employers, health benefit, Health Benefits, health Care, health plan, Health Plans, HR, HSA, Human Resources | Tagged: Employee Benefits, Employer, Employers, ERISA, Health Care Reform, Health Insurance, Health Plan, Health Plans, HRA, Human Resources, Medical Coverage | Permalink
Posted by Cynthia Marcotte Stamer

Options For Multiemployer Defined Benefit Plans Filing of Digital Form 15315, Annual Certification

April 30, 2025

The Internal Revenue Service (“IRS”) is now accepting Form 15315 certifications by mail, fax or email.

The IRS Employee Plans Group recently discovered a glitch on its Mobile Friendly Forms webpage impacting the digitalized Form 15315 multiemployer defined benefit plan administrators should use to electronically report the actuarial certification of a multiemployer defined benefit plan’s funding status. Due to the glitch, the electronic form won’t allow administrators to enter a date beyond December 31, 2025, or plan numbers beginning with 0; for example, 002.

In response to this glitch, the IRS now allows filing electronically, by mail or by fax.

Mail the form to:

Department of the Treasury

Employee Plans

CHI-7602 – 25^th Floor

230 S. Dearborn Street

Chicago, IL 60604

Fax the form to:

855-215-7122

Email the form to:

EPCU@IRS.gov with Multiemployer Certification in the subject line.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Board certified in labor and employment law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Ms. Stamer works with these and other highly regulated or data and performance reliant businesses to design, risk manage, and defend their employment and other workforce, data and technology and other operations to promote legal and operational compliance, reduce regulatory and other liability and promote other operational goals.

Additionally, more her ABA involvements include than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

Comments Off on Options For Multiemployer Defined Benefit Plans Filing of Digital Form 15315, Annual Certification | Corporate Compliance, defined benefit plan, Defined Benefit Plans, Employee Benefits, Employer, Employers, IRC, retirement plan, Retirement Plans | Tagged: Employee Benefits, IRS, retirement plan | Permalink
Posted by Cynthia Marcotte Stamer

Stamer Moderates Panel On “Workforce Termination & Severance Around The World” At ABA International Section Meeting May 1

April 29, 2025

Solutions Law Press Publisher and author Cynthia Marcotte Stamer will moderate a program on “Workforce Termination & Severance Around The World” at the American Bar Association (“ABA”) International Law Section 2025 Annual Conference in New York.

Countries’ laws differ for individual and mass employment terminations. During the program, labor and employment lawyers Sandra McCandless, Donald C. Dowling, and Michael Green will examine countries’ laws on termination and severance rights, responsibilities and practices, examine common issues arising when employers terminate in country and ex-patriate workers outside their home countries, and share practical insights and experiences to budget, manage and defend worker separations to minimize legal, operational and liabilities and disruptions in the United States, India, China, Latin America and other regions of the World.

Focusing on the theme Adapting to Today’s International Legal Challenges: A New Era?” the ABA expects more than 600 participants from more than 30 countries around the world to attend the Conference, which runs from from April 28 -May 1, 2025. The Conference will feature a multitude of programs focusing on a wide range of timely international law and policy issues.

Along with the “Workforce Termination & Severance Around The World program that Ms. Stamer is moderating, the International Employment Law Committee Co-Chaired by Ms. Stamer and Nadia Moynihan also is hosting two other programs during the Conference:

Global Outsourcing Strategies: Managing Legal and Operational Risks of Offshore Workers & Services;
AI at Work: Navigating Bias, Diversity, and Legal Boundaries in the Workplace.

Check out the full agenda, registration (including single day rates) and other details of the Conference here.

An management and regulatory affairs attorney Board-Certified in Labor and Employment Law by the Texas Board of Legal Specialization and American College of Employee Benefits Counsel Fellow, Ms. Stamer’s workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership on helping organizations and leaders about manage their internal and external workforce, employee benefits and compensation, regulatory compliance and governmental affairs and other legal and operational practices and risk have earned her recognition as a Fellow in the American College of Employee Benefits Counsel, a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Labor and Employment Law and Health Care Law; a “Best Lawyers” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” and numerous other honors.

For more than 35 years, Ms. Stamer’s work has advised businesses and business leaders about enhancing the effectiveness and defensibility of their operations using employment and other workforce and services management, employee benefits, compensation, performance management, contracting, Federal Sentencing Guideline and other compliance and risk management, investigations, and other legal and operational tools and solutions. While helping businesses define and manage the conduct and performance of their employees, contractors and vendors, she also assists employers and others with compliance with federal and state equal employment, compensation, health and other employee benefits, workplace safety, leave, employment tax, and other labor and employment, privacy and data security, and other laws: advises and assists management to monitor and reengineer workforce, employee benefits, compensation, safety and other policies and practices in response to regulatory, business, economic, and other developments; advises and defends businesses against labor and employment, employee benefit, wage and hour and other compensation, employment tax, fraud, Federal Sentencing Guideline and other regulatory compliance by the Department of Labor agencies, Department of Justice, Securities and Exchange Commission, Federal Trade Commission, Department of Justice, Office of Federal Contracts and Compliance, and other federal agencies; state Departments of Labor and other federal agencies; state workforce and labor, safety, workers’ compensation and other agencies; and employees, contractors, employee benefit plan participants and vendors, and others.

A former lead consultant to the Government of Bolivia on its social security privatization policy with decades of domestic and international government affairs and public policy experience, Ms. Stamer also has extensive experience providing advice to organizations, Congress and state legislators, federal and state regulators, and others about workforce, education, employee benefits, safety, health, insurance and other public policy concerns.

A prolific author and highly sought out thoughtleader, Ms. Stamer also speaks, coaches management and publishes extensively on these and other related matters.

For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see here or contact Ms. Stamer directly via email.

About Solutions Law Press™

Comments Off on Stamer Moderates Panel On “Workforce Termination & Severance Around The World” At ABA International Section Meeting May 1 | Corporate Compliance, Discrimination, EEOC, Employee Benefits, Employer, Employers, Employment Termination, Furlough, Health Benefits, Human Resources, I-9, Internal Investigations, international la, international law, Labor Management Relations, Management, Managment, Reduction in Force | Permalink
Posted by Cynthia Marcotte Stamer

Another Large HIPAA Settlement Warns Health Plans & Other HIPAA Entities To Analyze & Manage Their Hacking & Other Data Susceptibilities

April 24, 2025

Conduct an appropriate risk analysis and take the required steps to protect your electronic health records from phishing and other hacking threats by conducting a thorough risk analysis and otherwise cleaning up your Health Insurance Portability and Accountability Act of 1996 compliance! That’s the clear message to the Department of Health and Human Services Office of Civil Rights (“OCR”) warns health plans and insurers, health care providers, health care clearinghouses (“Covered Entities”) and their business associates (collectively “Regulated Entities”) to learn from the $600,000 HIPAA Privacy, Security, and Breach Notification Rules (“HIPAA Rules”) settlement with Southern California health care network PIH Health, Inc. (“PIH”) the Department of Health & Human Services Office of Civil Rights (“OCR”) announced on April 23, 2025 and the deluge of other ongoing hacking-related HIPAA investigations OCR still is working to resolve.

Phishing & Other Hacking Events Common Cause of Health Plan Breaches

Hacking incidents present a significant cybersecurity threat to health plans and other Regulated Entities’ electronic health and other data. Phishing and other hacking attacks are among the most common types of large breaches reported to OCR every year. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR.

Phishing and other hacking-related breaches regularly result in OCR’s collection of high-dollar settlements and other costly enforcement actions against health plans and other Regulated Entities. See e.g., HHS Office for Civil Rights Settles with L.A. Care Health Plan Over Potential HIPAA Security Rule Violations (September 11, 2023); Voluntary Resolution Agreement Between The United States Department of Health and Human Services, Office for Civil Rights (“HHS”) and UnitedHealthcare Insurance Company (August 24, 2023); Aetna Pays $1,000,000 to Settle Three HIPAA Breaches (October 28, 2020); Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People (September 25, 2020); nthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history (October 15, 2018).

The breach and enforcement actions are continuing in 2025. OCR already has announced numerous hacking-related settlements in the first quarter of 2025. See HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Public Hospital (April 17, 2025); HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology (April 4, 2025); HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Health Fitness Corporation (March 21, 2025); HHS Office for Civil Rights Imposes a $200,000 Penalty Against Oregon Health & Science University; HHS Office for Civil Rights Imposes a $1,500,000 Civil Money Penalty Against Warby Parker in HIPAA Cybersecurity Hacking Investigation (February 20, 2025); HHS Office for Civil Rights Settles HIPAA Phishing Cybersecurity Investigation with Solara Medical Supplies, LLC for $3,000,000 (January 14, 2025); HHS Office for Civil Rights Settles 9th Ransomware Investigation with Virtual Private Network Solutions (January 7, 2025).

Look for more of these enforcement actions to emerge soon. Between January 1 and April 23, 2025 alone, OCR received 161 hacking-related breach reports from Regulated Entities. OCR’s Breach Portal indicates that on April 23, 2025, OCR had a total of 554 open hacking-related breach investigations, 506 involving health care providers, 47 involving health plans, and one involving a health care clearinghouse.

Health plans and other Regulated Entities will want to take appropriate actions to avoid becoming subject to breaches subjecting them to these investigations and enforcement actions, particularly with OCR Acting Director Anthony Archeval warninghealth plans and other Regulated Entities:

Ransomware and hacking are the primary cyber-threats to electronic protected health information within the health care industry. Failure to conduct a HIPAA risk analysis puts this information at risk and vulnerable to future ransomware attacks and other cyber-threats[.]

Duty To Analyze & Manage Hacking & Other Susceptibilities

The HIPAA Privacy, Security, and Breach Notification Rules require Regulated Entities to take specific actions as warranted by their threat susceptibility to protect the privacy and security of electronic protected health information (“ePHI”) from hacking and other improper access, destruction, or disclosure. At the heart of these requirements is the requirement that health plans and other Regulated Entities conduct documented risk analyses of their assessment of the susceptibility information of their ePHI to hacking and other threats. As reflected in the following table of current HIPAA sanctions, violation of these HIPAA requirements exposes a Regulated Entity to significant civil monetary penalties or criminal sanctions.

The HIPAA Security Rule requires a Regulated Entity to conduct an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI” and “[i]mplement policies and procedures to prevent, detect, contain, and correct security violations.” Meanwhile, the HIPAA Breach Notification Rule requires in 45 CFR § 164.402 that a Regulated Entity that experiences an impermissible acquisition, access, use, or disclosure (“breach”) of unsecured ePHI to conduct a documented risk assessment to determine whether the Regulated Entity must notify affected individuals, OCR and in the case of breaches involving the ePHI of 500 or more individuals, the media. OCR interprets these Rules together also to require Regulated Entities experiencing a breach of ePHI or having evidence putting the Regulated Entity on notice of a potential susceptibility creating a risk of a breach as triggering a duty by the Regulated Entity to conduct a Risk Assessment to assess the susceptibility of its ePHI to the risk and the actions reasonably necessary to mitigate it under the Security Rule.

OCR views Risk Analysis as foundational to the protection of ePHI. Consequently, OCR constantly has urged Regulated Entities to fulfill their Risk Analysis obligations since the earliest days of HIPAA in its guidance and educational outreach, as well as by regularly discussing the requirement and role of Risk Analysis deficiencies in creating the circumstances leading to enforcement actions against Regulated Entitles in its civil monetary penalty assessments and HIPAA settlement announcements.

Despite OCR’s constant and ever-rising efforts to promote compliance with the Risk Analysis requirements, however, OCR consistently has found deficiencies in Regulated Entities’ Risk Analysis in its breach investigations and audit findings since these rules became effective. As the number and magnitude of reported breaches of ePHI skyrocketing and massive breaches like those experienced in 2024 by UnitedHealthcare subsidiary Change Health, Ascension and others demonstrating the serious consequences ransomware and other cyberattacks can inflict on health care delivery, payment, and patient privacy, OCR is placing new emphasis on tightening both the requirements for Risk Analysis and its enforcement of compliance with the Risk Analysis requirements.

Look for OCR both to continue zealously to enforce the Risk Analysis and other HIPAA Security Rule compliance and to tighten thesed requirements. On December 27, 2024, for instance, OCR published a notice of proposed rulemaking that proposes to clarify and tighten significantly the Risk Analysis requirements and other elements of the HIPAA Security Rule. Along with proposing these heightened Risk Analysis requirements, OCR announced and now is zealously enforcing the current Risk Analysis requirements through its Risk Analysis Initiative to hold Regulated Entities accountable for failing to fulfill their Risk Analysis responsibilities as part of its heightened efforts to improve Regulated Entities’ fulfillment of their Risk Analysis obligations. Prior to its announcement of the PIH settlement, OCR in recent months announced seven Risk Analysis Initiative settlements, including three in April.

Breaches & Other Security Rule Violations Carry Substantial Liability Risks

Tier	Civil Penalties[1]	Criminal Penalties
1	Lack of Knowledge: $141 – $71,162 per violation	Reasonable Cause or No Knowledge of Violation: Up to 1 year imprisonment
2	Reasonable Cause: $1,424 – $71,162 per violation	PHI Obtained Under False Pretenses: Up to 5 years imprisonment
3	Willful Neglect (corrected within 30 days): $14,232 – $71,162 per violation	PHI Obtained for Personal Gain or with Malicious Intent: Up to 10 years imprisonment
4	Willful Neglect (not corrected within 30 days): $71,162 – $2,134,831 per violation

Most Regulated Entities that OCR accused of violating the HIPAA requirements avoid paying the full amount of authorized civil monetary penalties by accepting OCR settlement offers. As the $600,000 PIH and other settlements demonstrate, however, settlement with OCR allows Regulated Entities to avoid much greater potential civil monetary penalties by paying a much smaller, but still generally significant, settlement amount. As significant as these penalties and settlement costs are, they typically reflect only a small portion of the true cost organizations suffer from a breach. With the average financial consequences suffered by organizations that experience a data breach now approaching $5 million, costs of investigation and recovery from a breach and the associated operational and business disruptions experienced inflict a heavy toll even where OCR allows the health plan or other Regulated Entity to resolve its exposures with no financial settlement or penalty.

Breaches & Other Security Rule Violations Create Substantial Liability For Plans & Their Fiduciaries

While health plan breach notifications generally have lagged far behind provider notifications in number, reported health plan breaches generally have resulted the largest civil monetary penalty or resolution payments largely due to the massive number of individuals affected by these breaches. See e.g., HHS Office for Civil Rights Settles with L.A. Care Health Plan Over Potential HIPAA Security Rule Violations (September 11, 2023); Voluntary Resolution Agreement Between The United States Department of Health and Human Services, Office for Civil Rights (“HHS”) and UnitedHealthcare Insurance Company (August 24, 2023); Health Insurer Pays $5.1 Million to Settle Data Breach Affecting Over 9.3 Million People (January 15, 2021); Aetna Pays $1,000,000 to Settle Three HIPAA Breaches (October 28, 2020); Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People (September 25, 2020); Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People (September 25, 2020); HIPAA Business Associate Pays $2.3 Million to Settle Breach Affecting Protected Health Information of Over 6 million Individual (September 23, 2020); Anthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history (October 15, 2018); Record $16M Anthem HIPAA Settlement Signals Need To Tighten HIPAA Compliance & Risk Management.

PIH Third Hacking Settlement In April

Although OCR’s PIH settlement announcement does not label the settlement as a Risk Analysis Initiative, OCR’s discussion makes clear OCR considered PIH’s failure to fulfill the Risk Analysis requirements a core failure contributing to the breach. The PIH settlement resolves an investigation that OCR conducted after receiving a breach report from PIH in January 2020 about a June 2019 phishing attack. The report stated the attack compromised forty-five of its employees’ email accounts, resulting in the breach of 189,763 individuals’ unsecured ePHI. PIH reported that the ePHI disclosed in the phishing attack included affected individuals’ names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, lab results, medications, treatment and claims information, and financial information.

OCR’s investigation found multiple potential violations of the HIPAA Rules, including:

Failure to use or disclose protected health information only as permitted or required by the HIPAA Privacy Rule.
Failure to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by PIH.
Failure to notify affected individuals, the HHS Secretary, and the media of a breach of unsecured protected health information within 60 days of its discovery.

Under the terms of the resolution agreement, PIH has agreed to implement a corrective action plan that OCR will monitor for two years and pay a $600,000 settlement to OCR. Under the corrective action plan, PIH is obligated to take definitive steps toward resolving potential violations of the HIPAA Rules, including:

Conducting an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI.
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis.
Developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA Rules.
Training its workforce members who have access to PHI on its HIPAA policies and procedures.

The findings of deficiencies in PIH’s risk analysis and requirements that PIH conduct an accurate and thorough risk analysis and implement a risk management plan to address and mitigate identified security risks and vulnerabilities are a recurrent theme in OCR breach investigations. OCR’s recent addition of a Risk Analysis Initiative to its compliance and enforcement priorities heightens the significance of OCR’s inclusion of these findings and requirements in the PIH settlement.

Previous Health Plan Enforcement Actions Confirms Health Plan Face Similar HIPAA Exposures

In January 2021, for instance, OCR announced New York health insurer, Excellus Health Plan, Inc., would pay $5.1 million to settle potential HIPAA violations related to a breach affecting over 9.3 million people. The settlement resulted from OCR’s investigation of a September 9, 2015, breach report that cyber-attackers gained unauthorized access to its information technology systems. Excellus Health Plan reported that the breach began on or before December 23, 2013, and ended on May 11, 2015. The hackers installed malware and conducted reconnaissance activities that ultimately resulted in the impermissible disclosure of the protected health information of more than 9.3 million individuals, including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information. The resolution payment is the second largest collected by OCR to date.

In October, 2020, OCR announced a resolution agreement with Aetna Life Insurance Company and affiliated covered entity (Aetna) where Aetna paid a $1 million resolution payment to settle potential HIPAA violations that arose from Aetna’s filing of hacking related breach reports in 2017 and OCR’s September 2021 announcement of a resolution agreement where Premera Blue Cross (PBC) agreed to pay $6.85 million to OCR (the second largest in OCR history) to settle potential HIPAA violations related to a breach affecting over 10.4 million people. This resolution represents the third largest payment to resolve a HIPAA investigation in OCR history.

In each of these and all subsequent breach enforcement announcements and other guidance, OCR also persistently urges health plans and other regulated entities to perform the required documented risk assessments and take the required actions necessary to guard their ePHI from hackers and other susceptibilities.

Required & Recommended Actions To Promote Defensibility Of Risk Analysis Compliance

With cyberattacks targeting health care and other Regulated Entities soaring and OCR stepping up its scrutiny of Regulated Entities’ Risk Analysis compliance in audits and enforcement actions, each health care provider and other Regulated Entity should review and tighten its Risk Analysis practices and documentation to reduce its susceptibility to potential breaches and to promote its ability to defend its compliance with the Risk Analysis requirements in the event of a breach investigation or audit.

Fulfill Current Risk Analysis Standards

To fulfill the “Risk Analysis” implantation specification, the Security Management Process Standard requires Regulated Entities enforce appropriate administrative, physical, and technical safeguards for the confidentiality, integrity, and security of electronic protected health information (“ePHI”) based on an up-to-date conduct of an up-to-date accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization (“Risk Analysis”).

The Security Rule requires Regulated Entities to document each Risk Analysis in writing, to keep Risk Analysis documentation for six years, and to provide Risk Analysis documentation to OCR upon request.

Among other things, the Risk Analysis implementation standard requires regulated entities adequately to:

Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems.
Integrate Risk Analysis and risk management into the organization’s business processes.
Ensure that audit controls are in place to record and examine information system activity.
Implement regular reviews of information system activity.
Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
Incorporate lessons learned from incidents into the organization’s overall security management process.
Provide workforce members with regular HIPAA training that is specific to the organization and to the workforce members’ respective job duties.

Follow Proposed Rules & Enforcement Actions To Mitigate Risks

The proposed rule published by OCR on December 27, 2024, seeks to clarify and expand the original requirements of the Risk Assessment implementation standard based on OCR’s past HIPAA Security and Breach Rule investigation and enforcement experience. Under the proposed rule, a Regulated Entity’s Risk Analysis also would be required to include:

Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
Require greater specificity for conducting a risk analysis, including a written assessment that contains, among other things:
- A review of the technology asset inventory and network map;
- Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI;
- Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant electronic information systems;
- An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified vulnerabilities; and
- A review of the technology asset inventory and network map.

Other changes included in the proposed rule would further heighten the Risk Analysis and other Security Standard requirements for Regulated Entities. For instance, the proposed rule would require Regulated Entities:

To establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours;
To perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration;
To establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and how the regulated entity will respond to suspected or known security incidents;
To implement written procedures for testing and revising written security incident response plans;
To conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements;
To require business associates to verify at least once every 12 months for covered entities (and that business associate contractors verify at least once every 12 months for business associates) that they have deployed technical safeguards required by the Security Rule to protect ePHI through a written analysis of the business associate’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate;
To encrypt ePHI at rest and in transit, with limited exceptions;
To establish and deploy technical controls for configuring relevant electronic information systems, including workstations, in a consistent manner including deployment of anti-malware protection, removal of extraneous software, and disabling network ports in accordance with the regulated entity’s risk analysis;
Use of multi-factor authentication, with limited exceptions;
Vulnerability scanning at least every six months and penetration testing at least once every 12 months;
Network segmentation;
Separate technical controls for backup and recovery of ePHI and relevant electronic information systems;
To review and test the effectiveness of certain security measures at least once every 12 months, in place of the current general requirement to maintain security measures;
Business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation;
Group health plans to include in their plan documents requirements for their group health plan sponsors to: comply with the administrative, physical, and technical safeguards of the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.

To help Regulated Entities understand and fulfill these responsibilities, OCR alone and in conjunction with the Office of the National Coordinator for Health Information Technology (“ONC”) also has published guidance like the HIPAA Security Risk Assessment (SRA) Tool. OCR guidance reflects that fulfillment of the Tool can help Regulated Entities may help defend but does not guarantee fulfillment of the Risk Assessment requirements, as the adequacy of the Risk Assessment always depends upon the unique facts and circumstances of the Regulated Entity at a particular time. This guidance confirms the importance of conducting timely and appropriate Risk Analysis in a manner that shows the Regulated Entity appropriately evaluated the risks to its e-PHI and acted reasonably in designing, administering, and updating that Risk Analysis to reasonably defend its e-PHI against breaches or other susceptibilities.

Since OCR’s guidance makes clear that the adequacy of a Regulated Entity’s Risk Analysis and other HIPAA Security compliance based on its evaluation and response to known and suspected susceptibility threats as conducted and documented pursuant to the Risk Analysis rule, health care providers and other Regulated Entities should view Risk Analysis as an ongoing process. While the Security Rule does not currently dictate how frequently a regulated entity must perform Risk Analysis, a proposed rule published by OCR on December 27, 2024 seeks to amend the existing Security Rule to expand the requirement to require regulated entities to develop and revise a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI. Although OCR has not officially adopted this and other changes contained in the proposed rule, substantial evidence exists that it already regularly administers the Risk Analysis requirement with the expectation that regulated entities will perform Risk Analysis at least this frequently. For instance, current OCR resolution agreements require impacted organizations to conduct Risk Analysis to identify and address vulnerabilities at least annually, and more frequently as needed in response to signs of potential breach or susceptibility. Likewise, since OCR developed the proposed rule from its past enforcement experience, wise Regulated Entities also will recognize the value of drawing upon the changes set forth in the proposed rule for helpful insights to strengthen the security of their ePHI generally and promoting the defensibility of the adequacy of their Risk Assessments.

Additional Responsibilities & Risks For Health Plan Fiduciaries & Sponsors

Along side the OCR warnings, employment and union sponsored health plans, their sponsors, insurers, business associates and fiduciaries also now face additional pressure to take appropriate steps to security health plan data and timely investigate and report breaches.

prudent steps to secure their health plans’ protected health information and electronic data systems against improper use, access, destruction or disclosure under April, 2021 Employee Benefit Security Administration (“EBSA”) guidance package that for the first time officially recognizes cybersecurity as included in the fiduciary responsibilities of employee benefit plan fiduciaries under the Employee Retirement Income Security Act (“ERISA”) and addition of cybersecurity to its plan audits. As a result, in addition to complying with HIPAA, ERISA-covered health plan fiduciaries and sponsors also should be prepared to demonstrate that plan fiduciaries have taken the steps prudently necessary to guard health and other employee benefit plan data and systems against cybersecurity threats. In light of this guidance health plan fiduciaries and sponsors generally will want to ensure that at minimum, they can demonstrate that the health plan and health plan vendor cybersecurity safeguard meet or exceed the recommendations included in the following guidance materials published by EBSA as part of this cybersecurity announcement and any other steps that are prudent to guard against cybersecurity threats:

Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.
Cybersecurity Program Best Practices: Assists plan fiduciaries and record-keepers in their responsibilities to manage cybersecurity risks.
Online Security Tips: Offers plan participants and beneficiaries who check their retirement accounts online basic rules to reduce the risk of fraud and loss.

In light of this OCR and EBSA guidance, health plan sponsors, fiduciaries and vendors and other HIPAA covered entities and business associates are urged to take documented steps to audit and strengthen as needed their safeguards against hacking and other cybersecurity threats including:

In the case of any health plan or health plan vendor, taking well documented steps to assess and tighten as necessary their health plan systems and data security to meet or exceed the recommendation outlined in the EBSA cybersecurity guidance or otherwise necessary to prudently guard their plans and plan data and systems against cybersecurity threats.
Reviewing and monitoring on a documented, ongoing basis the adequacy and susceptibilities of existing practices, policies, safeguards of their own organizations, as well as their business associates and their vendors within the scope of attorney-client privilege taking into consideration data available from OCR, data regarding known or potential susceptibilities within their own operations as well as in the media, and other developments to determine if additional steps are necessary or advisable.
Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility.
Renegotiating and enhancing service provider agreements to detail the specific compliance, audit, oversight and reporting rights, workforce and vendor credentialing and access control, indemnification, insurance, cooperation and other rights and responsibilities of all entities and individuals that use, access or disclose, or provide systems, software or other services or tools that could impact on security; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; and other relevant matters.
Verifying and tightening technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information and systems.
Conducting well-documented training as necessary to ensure that members of the workforce of each covered entity and business associate understand and are prepared to comply with the expanded requirements of HIPAA, understand their responsibilities and appropriate procedures for reporting and investigating potential breaches or other compliance concerns, and understand as well as are prepared to follow appropriate procedures for reporting and responding to suspected
violations or other indicia of potential security concerns.
Tracking and reviewing on a systemized, well-documented basis actual and near miss security threats to evaluate, document decision-making and make timely adjustments to policies, practices, training, safeguards and other compliance components as necessary to identify and resolve risks.
Establishing and providing well-documented monitoring of compliance that includes board level oversight and reporting at least quarterly and sooner in response to potential threat indicators.
Establishing and providing well-documented timely investigation and redress of reported
violations or other compliance concerns.
Establishing contingency plans for responding in the event of a breach.
Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and requirements.
Preparing and maintaining a well-documented record of compliance, risk, investigation and other security activities.
Pursuing other appropriate strategies to enhance the covered entity’s ability to demonstrate its compliance commitment both on paper and in operation.

Because susceptibilities in systems, software and other vendors of business associates, covered entities and their business associates should use care to assess and manage business associate and other vendor associated risks and compliance as well as tighten business associate and other service agreements to promote the improved cooperation, coordination, management and oversight required to comply with the new breach notification and other HIPAA requirements by specifically mapping out these details.

Leaders of covered entities or their business associates also are cautioned that while HIPAA itself does not generally create any private right of action for victims of breach under HIPAA, breaches may create substantial liability for their organizations or increasingly, organizational leaders under state data privacy and breach, negligence or other statutory or common laws. In addition, physicians and other licensed parties may face professional discipline or other professional liability for breaches violating statutory or ethical standards. Meanwhile, the Securities and Exchange Commission has indicated that it plans to pursue enforcement against leaders of public health care or other companies that fail to use appropriate care to ensure their organizations comply with privacy and data security obligations and the Employee Benefit Security Administration recently has issued guidance recognizing prudent data security practicces as part of the fiduciary obligations of health plans and their fiduciaries.

Appropriate Processes Can Prevent Breaches & Enhance Defensibility

With the continued explosion in ransomware and other cyberthreats heightening the risk of experiencing a breach or other incident likely to draw the attention of OCR, each health plan or other Regulated Entity should take assess and confirm the adequacy of their current Risk Analysis, both to protect its ePHI and to promote its ability to defend its compliance with the HIPAA Security Rule’s Risk Analysis and other requirements in light of OCR’s heightened emphasis on Risk Analysis compliance and enforcement. For purposes of conducting this analysis, Regulated Entities generally will want to use a process like the following to structure their evaluation of their existing Risk Analysis to take advantage of the opportunity to use attorney-client privilege and other evidentiary rules to help protect discoverability of sensitive discussions about possible deficiencies in their existing Risk Analysis and discussions about potential tradeoffs considered in current or future Risk Analysis response:

Engage legal counsel experienced with HIPAA and other cybersecurity-related risks and liabilities to advise and assist your organization in designing and administering your Risk Analysis processes and response within the scope of attorney-client privilege;
Appoint and designate leadership and technical leadership for team responsible for design and administration of your organization’s initial and ongoing cybersecurity Risk Analysis and response (“Cyber-Risk Team”) and process for board and senior management reporting of the Cyber-Risk Team;
Select and engage outside consulting service providers, cyber-liability insurers and other risk service providers expected to participate in the process; work with qualified legal counsel to contract with these business associates to include the business associate agreement and other reassurances required by the HIPAA Privacy, Security and Breach Notification Rule and other performances, cooperation to provide and back services in accordance with agreed-upon protocols in the contract;
Train Cyber-Risk Team in the appropriate processes for working with internal teams, outside service providers, leadership, and designated legal counsel to conduct Risk Analysis, investigation and response using attorney-client privilege and other evidentiary tools and processes to maximize defensibility;
Require the Cyber-Risk Team conduct an updated, document assessment of cyber-risk within scope of attorney-client privilege and work with legal counsel to develop a documented cyber-risk policy that captures analysis and determinations for your justification for the size, scope and timing of your periodic Risk Analysis and rules and processes for interim risk identification, reassessments and response in reaction to potential cyber-risk signs between periodic Risk Analysis for presentation and approval by the Board taking into account the insights from published final and proposed guidance, enforcement actions and industry standards;
Require, oversee and enforce Cyber-Risk Team’s documented administration of the initial and subsequently required Risk Analysis and response pursuant to the adopted cyber-risk policy to identify vulnerabilities and work with legal counsel within the scope of privilege to document your analysis and justifications for addressing identified vulnerabilities and other required actions in response to identified susceptibilities or event;
Review adequacy of incident detection and response arrangements, including reporting and response mechanisms, insurance and indemnification protection, and other critical elements for mitigation and recovery; and
Other actions as warranted based on advice of counsel taking into account emerging threats, guidance, and risk susceptibility.

Although civil monetary penalties or settlements are the most common sanction imposed for HIPAA Security and Breach Notification rule violations, willful and certain other violations of HIPAA can trigger criminal liability subject to the Federal Sentencing Guidelines. Consequently, beyond fulfilling the specific requirements of HIPAA, an adequate Risk Assessment also can be an invaluable tool for helping mitigate Federal Sentencing Guideline exposures of a Regulated Entity and its leaders under the Federal Sentencing Guidelines Organizational Liability rules.

Beyond these specific HIPAA-associated exposures, Regulated Entities and their leaders should keep in mind that HIPAA is likely only one of many laws that define their responsibilities to secure, report, and respond to breaches of ePHI or other sensitive data. Depending on the location, nature and other circumstances, Regulated Entities and their leaders also may have additional responsibilities and liability exposures under a variety of other federal and state laws, ethical or other professional standards, and contractual obligations in addition to those imposed under HIPAA and ERISA. For instance, inadequate data safeguards for ePHI also can trigger liability under the Fair and Accurate Credit Transactions Act, the Federal Trade Commission Act, and various electronic crimes statutes. The Securities and Exchange Commission rules can trigger disclosure and other obligations for publicly traded hospital or other health care providers, insurers, or their business associates. Health care providers, payers and others are likely to face specific additional health care or insurance-specific licensing and ethics rules, as well as other confidential information privacy, cybersecurity and breach reporting obligations and liability under various state statutes and regulations. Regulated Entities and their leaders generally will want to fully evaluate and manage these risks in conjunction with their compliance with the Risk Analysis and other requirements of the HIPAA Security and Breach Notification Rules.

Finally, health plans and other Regulated Entities are reminded that appropriate strategic planning, ongoing diligence in monitoring and responding to security events and susceptibility, and timely and appropriate use of appropriate evidentiary and procedural tools can critically impact the defensibility of pre-breach, breach investigation and post-breach investigation and decision-making. Because HIPAA, EBSA and other rules typically require prompt investigation and response to known or suspected hacking or other cybersecurity threats, health plans and other covered entities or business associates should seek the assistance of experienced legal counsel to advise and assist in these activities to understand the potential availability and proper use of these and other evidentiary rules as part of the compliance planning process as well as to prepare for appropriate use in the event of a known or suspected incident to avoid unintentional compromise of these protections.

The author of this update, Cynthia Marcotte Stamer is nationally known and celebrated for her experience providing advice and representation to health care providers, health insurers, employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, third party administrators, human resources and health plan technology, and other businesses about HIPAA and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information Or Help

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

About Solutions Law Press™

[1] The civil monetary penalty amounts are adjusted annually for inflation. OCR has not yet published the 2025 inflation adjusted amounts.

Comments Off on Another Large HIPAA Settlement Warns Health Plans & Other HIPAA Entities To Analyze & Manage Their Hacking & Other Data Susceptibilities | Corporate Compliance, Cybercrime, Cybersecurity, Data breach, Employer, Employers, ERISA, FACTA, Fiduciary Responsibility, Health Plans, HIPAA, HIPAA, Reporting & Disclosure | Tagged: Cyber Security, Cybersecurity, healthcare, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Health Plans & Other HIPAA-Covered Entities Urged To Strengthen HIPAA Risk Analysis Processes & Documentation In Response To Rising Breach & OCR Enforcement Risks

April 22, 2025

With the financial impact to businesses suffering data breaches in 2024 now averaging nearly $5 million and the announcement by the Department of Health and Human Services Office of Civil Rights (“OCR”) two additional Health Insurance Portability & Accountability Act (“HIPAA”) “Risk Analysis Initiative” settlements in seven days, health plans, health care providers, healthcare clearinghouses (“Covered Entities”) and their business associates (collectively “Regulated Entities”) face a growing imperative to act now to promote the defensibility of their practices under the Risk Analysis and other HIPAA Privacy, Security, and Breach Notification Rule requirements. Coupled with OCR’s steady announcement of enforcement actions like those announced this month against NERAD and others under its Risk Analysis Initiative, OCR clearly health plans and other Regulated Entities to clean up and strengthen their Risk Analysis and other HIPAA Security Rule compliance.

HIPAA Risk Analysis Requirement & OCR Risk Analysis Initiative

The need for Regulated Entities to ensure their fulfillment of HIPAA’s Risk Analysis requirements to prevent and mitigate their legal, financial and operational exposures from breaches of electronic protected health information (“ePHI”) and to defend against a potential OCR Risk Analysis enforcement action or audit is demonstrated by OCR’s announcement of HIPAA Security Rule enforcement actions and settlements with Northeast Radiology, P.C. (NERAD) on April 10, 2025, and Guam Memorial Hospital Authority (“GMHA”) on April 17, 2025, the sixth and seventh under OCR’s recently announced HIPAA “Risk Analysis Initiative” .

Risk Analysis Longstanding HIPAA Requirement

The HIPAA Privacy, Security, and Breach Notification Rules Regulated Entities to meet specific standards to protect the privacy and security of protected health information. Since the HIPAA Security Rule first took effect, risk analysis is one of the four required implementation specifications Regulated Entities must meet under the Security Management Process standard in 45 CFR § 164.308.

To fulfill this Risk Analysis requirement, a Regulated Entity must conduct an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI” and “[i]mplement policies and procedures to prevent, detect, contain, and correct security violations.”

Additionally, in 45 CFR § 164.402 the HIPAA Breach Notification Rule requires a Regulated Entity that experiences an impermissible acquisition, access, use, or disclosure (“breach”) of unsecured ePHI to conduct a documented risk assessment to determine whether the Regulated Entity must notify affected individuals, OCR and in the case of breaches involving the ePHI of 500 or more individuals, the media. As consistently interpreted and applied by OCR, experiencing a breach or the existence of evidence putting the Regulated Entity on notice of a potential susceptibility creating a risk of a breach triggers a duty by the Regulated Entity to conduct a Risk Assessment to assess the susceptibility of its ePHI to the risk and the actions reasonably necessary to mitigate it under the Security Rule.

OCR views Risk Analysis as foundational to the protection of ePHI. As OCR Acting Director Anthony Archeval recently stated to explain OCR’s emphasis on Risk Analysis compliance and enforcement, “Ransomware and hacking are the primary cyber-threats to electronic protected health information within the health care industry. Failure to conduct a HIPAA risk analysis puts this information at risk and vulnerable to future ransomware attacks and other cyber-threats[.]” Consequently, OCR has constantly has urged Regulated Entities to fulfill their Risk Analysis obligations since the earliest days of HIPAA. To promote compliance, OCR persistently has communicated the necessity and importance of the Risk Analysis in guidance and sought to reinforce the consequences of inadequate Risk Analysis by discussing the role of Risk Analysis deficiencies in creating the circumstances leading to enforcement actions against Regulated Entitles in its civil monetary penalty assessments and HIPAA settlement announcements.

OCR Raising Risk Analysis Expectations & Enforcement

Despite OCR’s constant and ever-rising efforts to promote compliance with the Risk Analysis requirements, however, OCR consistently has found deficiencies in Regulated Entities’ Risk Analysis in its breach investigations and audit findings since these rules became effective. As the number and magnitude of reported breaches of ePHI skyrocketing and massive breaches like those experienced in 2024 by UnitedHealthcare subsidiary Change Health, Ascension and others demonstrating the serious consequences ransomware and other cyberattacks can inflict on health plan claims and payment, health care delivery, payment, and patient privacy, OCR is placing new emphasis on tightening both the requirements for Risk Analysis and its enforcement of compliance with the Risk Analysis requirements.

On December 27, 2024, for instance, OCR published a notice of proposed rulemaking that proposes to clarify and tighten significantly the Risk Analysis requirements and other elements of the HIPAA Security Rule. Along with proposing these heightened Risk Analysis requirements, OCR announced and now is zealously enforcing the current Risk Analysis requirements through its Risk Analysis Initiative to hold Regulated Entities accountable for failing to fulfill their Risk Analysis responsibilities as part of its heightened efforts to improve Regulated Entities’ fulfillment of their Risk Analysis obligations. With OCR’s announcement of the NERAD and GMHA enforcement actions on April 10 and April 17, respectively bringing to seven the number of Risk Analysis Initiative enforcement settlements in recent months, health care providers and other Regulated Entities should heed the schooling these and other similarly sanctioned organizations as a call to action to ensure their own Risk Analysis and other HIPAA Privacy, Security and Breach Rule compliance.

NERAD Enforcement Risk Analysis Initiative Enforcement Action & Settlement

The first of two Risk Analysis Initiative settlements announced in seven days in April and the sixth enforcement action and settlement specifically labeled as taken under the “Risk Analysis Initiative,” the NERAD enforcement action and settlement announced April 10, 2025 resolves liabilities for violation of the Risk Analysis Rule arising from OCR’s investigation of a breach of ePHI stored on NERAD’s Picture Archiving and Communication System (“PACS”) server for storing, retrieving, managing, and accessing radiology images.

OCR initiated its investigation of NERAD after receiving a NERAD breach report that between April 2019 and January 2020, unauthorized individuals accessed radiology images stored on NERAD’s PACS server. NERAD notified the 298,532 patients whose information was potentially accessible on the PACS server of this breach. OCR’s investigation found that NERAD had failed to conduct an accurate and thorough Risk Analysis to determine the potential risks and vulnerabilities to the ePHI in NERAD’s information systems.

To avoid potentially much greater HIPAA civil monetary penalties under the terms of the resolution agreement, NERAD paid OCR $350,000 and agreed to implement a corrective action plan that OCR will monitor for two years. Under the corrective action plan, NERAD will take steps to improve its compliance with the HIPAA Security Rule and protect the security of ePHI, including:

Conducting an accurate and thorough Risk Analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its Risk Analysis;
Developing and implementing a written process to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
Developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA Rules; and
Augmenting its existing HIPAA and security training program to all of its workforce members who have access to PHI.

Guam Memorial Hospital Authority Risk Assessment Initiative & Ransomware Enforcement Action

Seven days after announcing the NERAD Risk Analysis enforcement action and settlement, OCR reaffirmed its commitment to enforcement of the Risk Analysis enforcement when it announced its first HIPAA settlement under the new Trump Administration with GMHA, a public hospital on the U.S. Territory, island of Guam, on April 17, 2025.

The seventh Risk Analysis Initiative enforcement action and eleventh ransomware enforcement action announced by OCR, the GMHA settlement arose from OCR’s investigation of two complaints alleging that GMHA impermissibly allowed the disclosure of ePHI of GMHA patients. OCR originally initiated its investigation in response to a January 2019 complaint alleging that GMHA experienced a ransomware attack affecting the ePHI of approximately 5,000 individuals. During the investigation, OCR received another complaint in March 2023 alleging that hackers accessed patient records. OCR’s investigation determined that GMHA had failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI held by GMHA.

Under the terms of the resolution agreement, GMHA paid OCR $25,000 and agreed to implement a corrective action plan that OCR will monitor for three years. In the corrective action plan, GMHA must take a number of steps to ensure compliance with the HIPAA Security Rule and protect the security of ePHI, including:

Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
Develop a written process to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
Develop, maintain, and revise, as necessary, written policies and procedures to comply with the HIPAA Privacy, Security and Breach Notification Rules;
Augment its existing HIPAA and security training program so all workforce members with access to PHI understand the HIPAA requirements and GMHA’s HIPAA policies and procedures;
Enhance workforce security and information access management by reviewing all access credentials that have been granted access to ePHI; and
Conduct breach risk assessments and provide evidence to OCR that all breach notification obligations have been conducted.

Required & Recommended Actions To Promote Defensibility Of Risk Analysis Compliance

With cyberattacks targeting health plan and other Regulated Entities soaring and OCR stepping up its scrutiny of Regulated Entities’ Risk Analysis compliance in audits and enforcement actions, each health plan and insurer and other Regulated Entity should review and tighten its Risk Analysis practices and documentation to reduce its susceptibility to potential breaches and to promote its ability to defend its compliance with the Risk Analysis requirements in the event of a breach investigation or audit.

Fulfill Current Risk Analysis Standards

Among other things, the Risk Analysis implementation standard requires regulated entities adequately to:

Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems.
Integrate Risk Analysis and risk management into the organization’s business processes.
Ensure that audit controls are in place to record and examine information system activity.
Implement regular reviews of information system activity.
Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
Incorporate lessons learned from incidents into the organization’s overall security management process.
Provide workforce members with regular HIPAA training that is specific to the organization and to the workforce members’ respective job duties.

Use Proposed Rules & Enforcement Actions For Additional Guidance To Mitigate Risks

Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
Require greater specificity for conducting a risk analysis, including a written assessment that contains, among other things:
- A review of the technology asset inventory and network map;
- Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI;
- Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant electronic information systems;
- An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified vulnerabilities; and
- A review of the technology asset inventory and network map.

To establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours;
To perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration;
To establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and how the regulated entity will respond to suspected or known security incidents;
To implement written procedures for testing and revising written security incident response plans;
To conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements;
To require business associates to verify at least once every 12 months for covered entities (and that business associate contractors verify at least once every 12 months for business associates) that they have deployed technical safeguards required by the Security Rule to protect ePHI through a written analysis of the business associate’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate;
To encrypt ePHI at rest and in transit, with limited exceptions;
To establish and deploy technical controls for configuring relevant electronic information systems, including workstations, in a consistent manner including deployment of anti-malware protection, removal of extraneous software, and disabling network ports in accordance with the regulated entity’s risk analysis;
Use of multi-factor authentication, with limited exceptions;
Vulnerability scanning at least every six months and penetration testing at least once every 12 months;
Network segmentation;
Separate technical controls for backup and recovery of ePHI and relevant electronic information systems;
To review and test the effectiveness of certain security measures at least once every 12 months, in place of the current general requirement to maintain security measures;
Business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation;
Group health plans to include in their plan documents requirements for their group health plan sponsors to: comply with the administrative, physical, and technical safeguards of the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.

Since OCR’s guidance makes clear that the adequacy of a Regulated Entity’s Risk Analysis and other HIPAA Security compliance based on its evaluation and response to known and suspected susceptibility threats as conducted and documented pursuant to the Risk Analysis rule, health plans and other Regulated Entities should view Risk Analysis as a ongoing process. While the Security Rule does not currently dictate how frequently a regulated entity must perform Risk Analysis, a proposed rule published by OCR on December 27, 2024 seeks to amend the existing Security Rule to expand the requirement to require regulated entities to develop and revise a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI. Although OCR has not yet officially adopted this and other changes contained in the proposed rule, substantial evidence exists that it already regularly administers the Risk Analysis requirement with the expectation that regulated entities will perform Risk Analysis at least this frequently. For instance, current OCR resolution agreements require impacted organizations to conduct Risk Analysis to identify and address vulnerabilities at least annually, and more frequently as needed in response to signs of potential breach or susceptibility. Likewise, since OCR developed the proposed rule from its past enforcement experience, wise Regulated Entities also will recognize the value of drawing upon the changes set forth in the proposed rule for helpful insights to strengthen the security of their ePHI generally and promoting the defensibility of the adequacy of their Risk Assessments.

Suggested Process For Updating & Strengthening Risk Analysis

Engage legal counsel experienced with HIPAA and other cybersecurity-related risks and liabilities to advise and assist your organization in designing and administering your Risk Analysis processes and response within the scope of attorney-client privilege;
Appoint and designate leadership and technical leadership for team responsible for design and administration of your organization’s initial and ongoing cybersecurity Risk Analysis and response (“Cyber-Risk Team”) and process for board and senior management reporting of the Cyber-Risk Team;
Select and engage outside consulting service providers, cyber-liability insurers and other risk service providers expected to participate in the process; work with qualified legal counsel to contract with these business associates to include the business associate agreement and other reassurances required by the HIPAA Privacy, Security and Breach Notification Rule and other performances, cooperation to provide and back services in accordance with agreed-upon protocols in the contract;
Train Cyber-Risk Team in the appropriate processes for working with internal teams, outside service providers, leadership, and designated legal counsel to conduct Risk Analysis, investigation and response using attorney-client privilege and other evidentiary tools and processes to maximize defensibility;
Require the Cyber-Risk Team conduct an updated, document assessment of cyber-risk within scope of attorney-client privilege and work with legal counsel to develop a documented cyber-risk policy that captures analysis and determinations for your justification for the size, scope and timing of your periodic Risk Analysis and rules and processes for interim risk identification, reassessments and response in reaction to potential cyber-risk signs between periodic Risk Analysis for presentation and approval by the Board taking into account the insights from published final and proposed guidance, enforcement actions and industry standards;
Require, oversee and enforce Cyber-Risk Team’s documented administration of the initial and subsequently required Risk Analysis and response pursuant to the adopted cyber-risk policy to identify vulnerabilities and work with legal counsel within the scope of privilege to document your analysis and justifications for addressing identified vulnerabilities and other required actions in response to identified susceptibilities or event;
Review adequacy of incident detection and response arrangements, including reporting and response mechanisms, insurance and indemnification protection, and other critical elements for mitigation and recovery; and
Other actions as warranted based on advice of counsel taking into account emerging threats, guidance, and risk susceptibility.

Beyond these specific HIPAA-associated exposures, Regulated Entities and their leaders should keep in mind that HIPAA is likely only one of many laws that define their responsibilities to secure, report, and respond to breaches of ePHI or other sensitive data. Depending on the location, nature and other circumstances, Regulated Entities and their leaders also may have additional responsibilities and liability exposures under a variety of other federal and state laws, ethical or other professional standards, and contractual obligations. For instance, health plan fiduciaries may risk fiduciary liability under the Employee Retirement Income Security Act of 1974 for failing to prudently secure and protect participate and other health plan data from improper access, use or disclosure. Inadequate data safeguards for ePHI also can trigger liability for brokers, consultants, insurers and others under the Fair and Accurate Credit Transactions Act, the Federal Trade Commission Act, and various electronic crimes statutes. The Securities and Exchange Commission rules can trigger disclosure and other obligations for publicly traded employers and insurers. Regulated Entities and their leaders generally will want to fully evaluate and manage these risks in conjunction with their compliance with the Risk Analysis and other requirements of the HIPAA Security and Breach Notification Rules.

The author of this update, Cynthia Marcotte Stamer is nationally known and celebrated for her experience providing advice and representation to employers, employer and other health plan sponsors, health plans, health plan fiduciaries and administrators, third party administrators, health care and life sciences organizations, human resources and health plan technology, and other businesses about HIPAA and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Cynthia Marcotte Stamer is a Martindale-Hubble AV-Preeminent (highest/top 1%) practicing attorney recognized as a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Health Care Law and Labor and Employment Law; among the “Best Lawyers In Dallas” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law recognized for her experience, scholarship, thought leadership and advocacy on HIPAA and other data and technology use, security and compliance in connection with her work with health care and life sciences, employee benefits, insurance, education, technology and other highly regulated and performance-dependent clients.

Additionally,more her ABA involvements include than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on Health Plans & Other HIPAA-Covered Entities Urged To Strengthen HIPAA Risk Analysis Processes & Documentation In Response To Rising Breach & OCR Enforcement Risks | Corporate Compliance | Tagged: AI, Cyber Security, Cybercrime, Cybersecurity, HIPAA, risk-assessment, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Trump Executive Order Calls For PBM ERISA Fee Disclosure Rules and Other Prescription Drug Reforms

April 17, 2025

Creating greater transparency of the compensation of prescription benefit management (“PBM”) arrangements used in group health plans covered by the Employee Retirement Income Security Act of 1974 (“ERISA”) is one of many new policy directives President Trump directs federal agencies to pursue to promote lower cost access to prescription drugs under his Executive Order on Lowering Drug Prices By Once Again Putting Americans First (the “Executive Order”) signed April 15, 2025. Employer and union-sponsored health plans, their sponsors, fiduciaries and service providers should carefully track and provide appropriate input to the Department of Labor and other federal agencies charged with implementing the new ERISA transparency requirement and other policy changes directed in the Executive Order.

ERISA PMB Transparency Requirements

To improve the transparency of compensation received by PBMs working with ERISA-covered group health plnas, the Executive Order directs the Department of Labor (“DOL”) to propose regulations to make the fee disclosure requirements of ERISA section 408(b)(2)(B) applicable to PBMs by October 12, 2025.

The Executive Order’s directive to the DOL contemplates that DOL will revise its existing regulations under Section 408(b)(2) to prohibit group health plan fiduciaries from allowing PBMs to directly or indirectly receive compensation for their PBM services unless the PBM discloses its compensation from the arrangement in accordace with the fee disclosure requirements that the Executive Order contemplates DOL will add to ERISA section 408(b)(2).

While DOL regulations have required since 2012 that pension plan service providers to disclose direct or indirect compensation under arrangements with ERISA-covered pension plans in order for the service provider compensation to be allowed “reasonable compensation” under ERISA section 408(b)(2), the fee disclosure requirement currently does not apply to PBMs or other service providers to group health plans or other welfare benefit plan arrangements.

Across the intervening years, concern that the lack of transparency and disclosure allows PBMs to receive excessive compensation and engage in conflicts of interest has led employee benefit industry watchdogs, employer and other plan sponsors, plan members, health care providers and others increasingly to urge the DOL to impose fee disclosure requirements on PBMs and other health and welfare benefit plan service providers. The Executive Order yields to these demands by calling upon the DOL to deem a group health plan’s compensation arrangements with PBMs reasonable only where PBMs disclose direct and indirect compensation, including compensation paid among related parties such as subcontractors, in a manner consistent with current Section 408(b )(2) Regulations.

Other Prescription Drug Reforms

The Executive Order also includes numerous other reform directives beyond calling for DOL to make PBMs subject to ERISA’s fee disclosure rules. These included several directives to HHS and certain other agencies that President Trump intends to lower the cost of prescription drugs within and outside the Medicare program.

Medicare & Other Drug Pricing and Coverage Related Prescription Drug Reforms

Many of the policy directives in the Executive Order seek to reform Medicare and other prescription drug cost and coverage.

By April 15, 2026, for instance, the Executive Order directs HHS to develop a better payment model to improve the ability of the Medicare program to obtain better value for high-cost prescription drugs and biological products covered by Medicare, including those not subject to the Medicare Drug Price Negotiation Program.

In addition, the Executive Order:

Directs HHS to work with the Congress to modify the Medicare Drug Price Negotiation Program to align the treatment of small molecule prescription drugs with that of biological products so as to end the distortion that undermines relative investment in small molecule prescription drugs, coupled with other reforms to prevent any increase in overall costs to Medicare and its beneficiaries;
By June 14, 2025,
- Requires HHS to propose changes to the Medicare Drug Price Negotiation Program regulations for the initial price applicability year 2028 and manufacturer implementation of maximum fair price under such program in 2026, 2027, and 2028 to improve the transparency of the Medicare Drug Price Negotiation Program, prioritize the selection of prescription drugs with high costs to the Medicare program, and minimize any negative impacts of the maximum fair price on pharmaceutical innovation within the United States; andRequires HHS to require health centers receiving Public Health Service Act Section 330(e) grants to establish practices to make insulin and injectable epinephrine available at or below the discounted price paid by the health center grantee or sub-grantee under the 340B Prescription Drug Program (plus a minimal administration fee) to low income individuals who have a high cost-sharing requirement for either insulin or injectable epinephrine; have a high unmet deductible; or have no healthcare insurance.Requires the Assistant to the President for Domestic Policy (“APDP”) in coordination with the Secretary, the Director of the Office of Management and Budget (“OMB Director”), and the Assistant to the President for Economic Policy (“APECP”), to provide recommendations to the President on how best to stabilize and reduce Medicare Part D premiums;Requires the HHS Secretary to publish a plan to conduct a survey under the Site-of-Service Price Transparency rules of Social Security Act Section 1833(t)(14)(D)(ii) to determine the hospital acquisition cost for covered outpatient drugs at hospital outpatient departments and propose appropriate adjustments to align Medicare payment with the cost of acquisition, consistent with the budget neutrality requirements; and
- Requires HHS to evaluate and propose regulations to ensure that payment within the Medicare program is not encouraging a shift in drug administration volume away from less costly physician office settings to more expensive hospital outpatient departments.

Other Prescription Drug Reforms

In addition to these predominantly Medicare-focused programs, the Executive Order also orders federal agencies to

Requires the Secretary of Labor to propose regulations pursuant to section 408(b)(2)(B) of the Employee Retirement Income Security Act of 1974 to improve employer health plan fiduciary transparency into the direct and indirect compensation received by pharmacy benefit managers by October 12, 2025;
Requires the APDP, in coordination with the HHS Secretary, the OMB Director, and the APECP, to provide recommendations to the President on how best to promote a more competitive, efficient, transparent, and resilient pharmaceutical value chain that delivers lower drug prices for Americans by June 14, 2025;
Requires the Food and Drug Administration to streamline and improve the Importation Program under the Federal Food, Drug, and Cosmetic Act to make it easier for States to obtain approval without sacrificing safety or quality;
Requires the OMB Director, the APDP, and the Assistant to the President for Economic Policy )”APECP, and HHS Secretary to provide joint recommendations on how best to ensure that manufacturers pay accurate Medicaid drug rebates consistent with section 1927 of the Social Security Act, promote innovation in Medicaid drug payment methodologies, link payments for drugs to the value obtained, and support States in managing drug spending;
Requires the HHS Secretary, through the Commissioner of Food and Drugs, to issue a report providing administrative and legislative recommendations to accelerate approval of generics, biosimilars, combination products, and second-in-class brand name medications; and improve the process through which prescription drugs can be reclassified as over-the-counter medications, including recommendations to optimally identify prescription drugs that can be safely provided to patients over the counter;
Requires HHS, the Department of Justice, the Department of Commerce, and the Federal Trade Commission to conduct listening sessions and issue a report with recommendations to reduce anti-competitive behavior from pharmaceutical manufacturers.

Health plans, their sponsoring employers or unions, fiduciaries, PBM and other service providers, brokers, insurers, auditors, and others involved in the design or oversight of PBM and other group health plan arrangements should monitor closely the DOL and other agency responses to the Executive Order to anticipate and prepare for required changes, as well as to be prepared to identify and timely provide input about proposed rules or other actions to DOL or the otherwise applicable regulatory agency before finalized.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, PBMs, health and other insurers, third party administrators, managed care organizations, health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation; Cynthia Marcotte Stamer is an attorney board certified in labor and employment law by the Texas Board of Legal Specialization, management consultant, author, public policy advocate and lecturer sought out by clients and industry and government leaders for her more than 35 years of health, insurance, employment and employee benefits and other industry management work, thought leadership, public policy and regulatory affairs advocacy, coaching, teaching, and publications on health and other employee benefits, health care, insurance, workforce and other risk management and compliance.

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on Trump Executive Order Calls For PBM ERISA Fee Disclosure Rules and Other Prescription Drug Reforms | Corporate Compliance | Tagged: drug-costs, Drugs, ERISA, Executive Order, Fiduciary Responsibility, Health, Health Insurance, healthcare, healthcare-transparency, Insurance, news, pbm, prescription-drug | Permalink
Posted by Cynthia Marcotte Stamer

6th Risk Analysis Settlement & Other OCR Actions Warn Health Plans & Other HIPAA-Regulated Entities To Tighten Risk Analysis

April 14, 2025

The $350,000 paid by Northeast Radiology, P.C. (“NERAD”) provides the latest warning to health plans, health care providers, healthcare clearinghouses (“Covered Entities”) and their business associates (collectively “Regulated Entities”) they risk costly fines and other costs for failing to maintain the up-to-date risk assessments required by the Health Insurance Portability & Accountability Act (“HIPAA”).

Following up on the five other previous Risk Analysis Initiative enforcement actions and settlements recently announced by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) and OCR’s publication of proposed rules to significantly tighten HIPAA’s Risk Analysis and other requirements, the settlement with medical imaging center NERAD sends a strong warning to health plans and other Regulated Entities to clean up and strengthen their Risk Analysis and other HIPAA Security Rule compliance.

$350,000 NERAD Risk Analysis Settlement Latest Product Of New Enforcement Initiative

The sixth Risk Analysis Initiative enforcement action announced by OCR in recent months, the NERAD settlement resolves an OCR Risk Analysis Initiative enforcement action arising from OCR’s investigation of a breach of ePHI stored on NERAD’s Picture Archiving and Communication System (“PACS”) server for storing, retrieving, managing, and accessing radiology images.

OCR initiated its investigation of NERAD after receiving a NERAD breach report about a breach of unsecured ePHI in March 2020. NERAD reported that between April 2019 and January 2020, unauthorized individuals accessed radiology images stored on NERAD’s PACS server. NERAD notified the 298,532 patients whose information was potentially accessible on the PACS server of this breach. OCR’s investigation found that NERAD had failed to conduct an accurate and thorough Risk Analysis to determine the potential risks and vulnerabilities to the ePHI in NERAD’s information systems.

Conducting an accurate and thorough Risk Analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its Risk Analysis;
Developing and implementing a written process to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
Developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA Rules; and
Augmenting its existing HIPAA and security training program to all of its workforce members who have access to PHI.

OCR Turns Up Heat On HIPAA Risk Analysis Requirements & Enforcement

The HIPAA Privacy, Security, and Breach Notification Rules set forth the requirements that Regulated Entities must follow to protect the privacy and security of protected health information. Since the HIPAA Security Rule first took effect, risk analysis is one of the four required implementation specifications the Security Rule requires to fulfill its Security Management Process Standard’s requirement that regulated entities “[i]mplement policies and procedures to prevent, detect, contain, and correct security violations.”

Written Risk Analysis Longstanding Requirement

Although OCR only recently formally adopted a Risk Analysis Initiative, OCR’s regulatory guidance and enforcement actions have communicated clearly the necessity for each Regulated Entity to possess and maintain an adequate documented Risk Analysis. OCR guidance since has required Regulated Entities to conduct and document the required Risk Analysis to safeguard ePHI and avoid liability under the HIPAA Rule. The importance of fulfillment of the Risk Analysis requirement is driven home by OCR’s recent identification of Risk Analysis inadequacies as a basis for its assessment of civil monetary penalties or required resolution payments to settle HIPAA Security Rule violations following a breach of ePHI.

While the Security Rule does not currently dictate how frequently a regulated entity must perform Risk Analysis, a proposed rule published by OCR on December 27, 2024 seeks to amend the existing Security Rule to expand the requirement to require regulated entities to develop and revise a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI. Although OCR has not adopted this and other changes contained in the proposed rule, substantial evidence exists that it already regularly administers the Risk Analysis requirement with the expectation that regulated entities will perform Risk Analysis at least this frequently. For instance, current OCR resolution agreements require impacted organizations to conduct Risk Analysis to identify and address vulnerabilities at least annually, and more frequently as needed in response to signs of potential breach or susceptibility.

To fulfill the “Risk Analysis” implantation specification, the Security Management Process Standard requires Regulated Entities maintain appropriate administrative, physical, and technical safeguards for the confidentiality, integrity, and security of electronic protected health information (“ePHI”) based on an up-to-date conduct of an up-to-date accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization (“Risk Analysis”).

The Security Rule requires Regulated Entities to document each Risk Analysis in writing, to maintain their Risk Analysis documentation for six years, and to make available Risk Analysis documentation to OCR upon request.

Among other things, the Risk Analysis implementation standard requires regulated entities adequately to:

Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems.
Integrate Risk Analysis and risk management into the organization’s business processes.
Ensure that audit controls are in place to record and examine information system activity.
Implement regular reviews of information system activity.
Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
Incorporate lessons learned from incidents into the organization’s overall security management process.
Provide workforce members with regular HIPAA training that is specific to the organization and to the workforce members’ respective job duties.

OCR Heightens Risk Analysis Enforcement While Proposing Heightened Risk Analysis And Other Security Requirements

The proposed rule published by OCR on December 27, 2024 seeks to significantly broaden these original requirements of the Risk Assessment implementation standard. Under the proposed rule, a Regulated Entity’s Risk Analysis also would be required to include:

Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.
Require greater specificity for conducting a risk analysis, including a written assessment that contains, among other things:
- A review of the technology asset inventory and network map;
- Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI;
- Identification of potential vulnerabilities and predisposing conditions to the regulated entity’s relevant electronic information systems;
- An assessment of the risk level for each identified threat and vulnerability, based on the likelihood that each identified threat will exploit the identified vulnerabilities; and
- A review of the technology asset inventory and network map.

To establish written procedures to restore the loss of certain relevant electronic information systems and data within 72 hours;
To perform an analysis of the relative criticality of their relevant electronic information systems and technology assets to determine the priority for restoration;
To establish written security incident response plans and procedures documenting how workforce members are to report suspected or known security incidents and how the regulated entity will respond to suspected or known security incidents;
To implement written procedures for testing and revising written security incident response plans;
To conduct a compliance audit at least once every 12 months to ensure their compliance with the Security Rule requirements;
To require business associates to verify at least once every 12 months for covered entities (and that business associate contractors verify at least once every 12 months for business associates) that they have deployed technical safeguards required by the Security Rule to protect ePHI through a written analysis of the business associate’s relevant electronic information systems by a subject matter expert and a written certification that the analysis has been performed and is accurate;
To encrypt ePHI at rest and in transit, with limited exceptions;
To establish and deploy technical controls for configuring relevant electronic information systems, including workstations, in a consistent manner including deployment of anti-malware protection, removal of extraneous software, and disabling network ports in accordance with the regulated entity’s risk analysis;
Use of multi-factor authentication, with limited exceptions;
Vulnerability scanning at least every six months and penetration testing at least once every 12 months;
Network segmentation;
Separate technical controls for backup and recovery of ePHI and relevant electronic information systems;
To review and test the effectiveness of certain security measures at least once every 12 months, in place of the current general requirement to maintain security measures;
Business associates to notify covered entities (and subcontractors to notify business associates) upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation;
Group health plans to include in their plan documents requirements for their group health plan sponsors to: comply with the administrative, physical, and technical safeguards of the Security Rule; ensure that any agent to whom they provide ePHI agrees to implement the administrative, physical, and technical safeguards of the Security Rule; and notify their group health plans upon activation of their contingency plans without unreasonable delay, but no later than 24 hours after activation.

Recommended Actions For Health Plans & Other HIPAA-Regulated Entities

Engage legal counsel experienced with HIPAA and other cybersecurity-related risks and liabilities to advise and assist your organization in designing and administering your Risk Analysis processes and response within the scope of attorney-client privilege;
Appoint and designate leadership and technical leadership for team responsible for design and administration of your organization’s initial and ongoing cybersecurity Risk Analysis and response (“Cyber-Risk Team”) and process for board and senior management reporting of the Cyber-Risk Team;
Select and engage outside consulting service providers, cyber-liability insurers and other risk service providers expected to participate in the process; work with qualified legal counsel to contract with these business associates to include the business associate agreement and other reassurances required by the HIPAA Privacy, Security and Breach Notification Rule and other performances, cooperation to provide and back services in accordance with agreed-upon protocols in the contract;
Train Cyber-Risk Team in the appropriate processes for working with internal teams, outside service providers, leadership, and designated legal counsel to conduct Risk Analysis, investigation and response using attorney-client privilege and other evidentiary tools and processes to maximize defensibility;
Require the Cyber-Risk Team conduct an updated, document assessment of cyber-risk within scope of attorney-client privilege and work with legal counsel to develop a documented cyber-risk policy that captures analysis and determinations for your justification for the size, scope and timing of your periodic Risk Analysis and rules and processes for interim risk identification, reassessments and response in reaction to potential cyber-risk signs between periodic Risk Analysis for presentation and approval by the Board taking into account the insights from published final and proposed guidance, enforcement actions and industry standards;
Require, oversee and enforce Cyber-Risk Team’s documented administration of the initial and subsequently required Risk Analysis and response pursuant to the adopted cyber-risk policy to identify vulnerabilities and work with legal counsel within the scope of privilege to document your analysis and justifications for addressing identified vulnerabilities and other required actions in response to identified susceptibilities or event;
Review adequacy of incident detection and response arrangements, including reporting and response mechanisms, insurance and indemnification protection, and other critical elements for mitigation and recovery; and
Other actions as warranted based on advice of counsel taking into account emerging threats, guidance, and risk susceptibility.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, nationally known and celebrated for her experience providing advice and representation on HIPAA and other risk management and compliance to employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, health care and other managed care providers and organizations, human resources and health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on 6th Risk Analysis Settlement & Other OCR Actions Warn Health Plans & Other HIPAA-Regulated Entities To Tighten Risk Analysis | Association Health Plan, Attorney-Client Privilege, church plan, Civil Monetary Penalties, compliance, Corporate Compliance, Cybercrime, Cybersecurity, Data Breach, Data Security, Employee Benefits, Employers, ERISA, GINA, health benefit, Health Benefits, health Care, health insurance, health insurance marketplace, Health IT, health plan, Health Plans, HIPAA, HIPAA, Identity Theft, Managed Care | Tagged: business, Cyber Security, Cybersecurity, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

I-9 & E-Verify Updates Announced

April 9, 2025

Employers should take note of recent changes made by the Citizenship and Immigration Services to the Form I-9, Employment Eligibility Verification and the Department of Homeland Security (“DHS”) Privacy Notice. While the updates don’t require employers to adopt the new I-9 Form until other current forms expire or are revoked, employers should know the changes to ease the administration of their I-9 requirements.

Form I-9

The revised Form I-9 with edition date 01/20/25 and expiration date 05/31/2027 includes minor changes to Form I-9 to align with statutory language.

Key updates include:

Renaming the fourth checkbox in Section 1 to “An alien authorized to work”

Revising the descriptions of two List B documents in the Lists of Acceptable Documents

Adding appropriate statutory language and a revised DHS Privacy Notice to the instructions.

While the revised Form I-9 with an edition date 01/20/25 is now available for download, multiple previous editions remain valid until their respective expiration dates:

Form I-9 (08/01/23 edition) that is valid until 05/31/2027

Form I-9 (08/01/23 edition) that is valid until 07/31/2026 (Employers using this form must update their electronic systems with the 05/31/2027 expiration date by July 31, 2026.)

E-Verify

Also, starting April 3, 2025, E-Verify and E-Verify+ will have updated the Citizenship Status selection during case creation to reflect this statutory language. The selection “A noncitizen authorized to work” will be updated to “An alien authorized to work.”

Employers should note:

If an employee attests on Form I-9 as “A noncitizen authorized to work,” the employer must select “An alien authorized to work” in E-Verify.

E-Verify cases will display “An alien authorized to work,” while employees and employers may continue to see “A noncitizen authorized to work” on Form I-9, depending on the form edition being used.

E-Verify+ participants will see the updated 01/20/25 edition date and 05/31/2027 expiration date reflected in Form I-9NG.

Additionally, E-Verify users creating cases through Web Services applications will see the employee status attestation automatically updated to “An alien authorized to work”—even if the WS application submits “A noncitizen authorized to work” if the employee selected citizenship status number four on Form I-9.

This change does not affect the current Interface Control Agreement (ICA) version 31.1, which already provides the necessary guidance for Web Services developers. WS developers should update their platforms to transmit “An alien authorized to work” instead of “A noncitizen authorized to work” as soon as possible.

The author of this update, Cynthia Marcotte Stamer is an attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and others about I-9 and other workforce, employee benefits, compensation, performance management, reengineering and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on I-9 & E-Verify Updates Announced | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Brokerage President & Marketing Company CEO Indicted In $161M ACA Enrollment Fraud Scheme

March 17, 2025

Mansfield, Texas resident Steven Strong and Florida resident Cory Lloyd face up to 20 year prison sentences if convicted on federal criminal health care fraud charges for their alleged participation in a scheme to submit fraudulent enrollments to fully subsidized Patient Protection & Affordable Care Act insurance plans (“ACA plans”).

ACA plans offer eligible enrollees tax credit subsidies paid by the federal government directly to insurance plans in the form of a payment toward the applicable monthly premium.

According to court documents, Lloyd and Strong conspired to enroll consumers in ACA plans that were fully subsidized by the federal government by submitting false and fraudulent applications for individuals whose income did not meet the minimum requirements to be eligible for the subsidies.

President of a health insurance brokerage, Lloyd allegedly received commission and other payments from an insurance company in exchange for enrolling consumers in the ACA plans.

In turn, Lloyd allegedly paid commissions to marketing company chief executive officer Strong in exchange for consumer referrals.

As alleged in the indictment, Lloyd and Strong targeted vulnerable, low-income individuals experiencing homelessness, unemployment, and mental health and substance abuse disorders, and, through “street marketers” working on their behalf, sometimes offered bribes to induce those individuals to enroll in subsidized ACA plans. Marketers working for Strong’s company allegedly coached consumers on how to respond to application questions to maximize the subsidy amount and provided addresses and social security numbers that did not match the consumers purportedly applying.

As a result of being enrolled in subsidized ACA plans for which they did not qualify, some of these consumers experienced disruptions in their medical care.

The indictment alleges that Lloyd and Strong used misleading sales scripts and other deceptive sales techniques to convince consumers to state that they would attempt to earn the minimum income necessary to qualify for a subsidized ACA plan, even when the consumer initially projected having no income.

Lloyd and Strong also allegedly conspired to bypass the federal government’s attempts to verify income and other information.

Lloyd and Strong allegedly engaged in the scheme to maximize the commission payments they received from insurers, resulting in their companies’ receiving millions of dollars in commissions.

As alleged in the indictment, Lloyd and Strong’s scheme caused the federal government to pay at least $161,900,000 in subsidies.

Cory Lloyd and Steven Strong are each charged with conspiracy to commit wire fraud, three counts of wire fraud, conspiracy to defraud the United States, and two counts of money laundering. If convicted, each faces a maximum penalty of 20 years in prison on each count of conspiracy to commit wire fraud and wire fraud, five years in prison for conspiracy to defraud the United States, and 10 years in prison for each count of money laundering.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, managed care organizations, health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on Brokerage President & Marketing Company CEO Indicted In $161M ACA Enrollment Fraud Scheme | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Construction Company Owner Gets 4 Year Prison Sentence For OSHA, Employment Tax & Worker’s Comp Fraud Involving Undocumented Alien Workers

March 17, 2025

A Florida construction company owner will serve 48 months in prison and forfeit more than $5.5 million as well numerous real properties and cash, and to pay over $55 million in restitution for conspiracy to commit wire fraud, conspiracy to defraud the United States and willful violation of a workplace standard that resulted in the death of an undocumented alien employee and other payroll tax, safety and other fraud.

According to court documents, Manual Domingos Pita owned and operated Domingos 54 Construction, a subcontracting business for the wood framing of new construction homes. Domingos 54 was a shell construction company that Pita used to provide workers, including undocumented aliens, with construction jobs. However, Pita failed to secure the required workers compensation insurance coverage for these employees by falsifying in worker’s compensation insurance applications the number of workers for which he sought coverage. In addition, Pita failed to pay any federal employment taxes on the wages that these workers earned during the course of the scheme between 2018 and 2022. As a result, Pita caused several worker’s compensation insurance companies to sustain a loss of over $22.7 million in premiums that they could have charged had they been aware of the number of workers which they had been manipulated into covering with their policies.

In addition, Pita failed to pay to the IRS over $33.7 million in federal employment taxes on those workers’ wages.

Between February and July 2019, investigators with the Occupational Safety and Health Administration (“OSHA”) issued six citations to Domingos 54 for failure to provide fall protection to workers. Even after being cited for these violations, Pita continued to ignore OSHA requirements. In March 2020, Pita assigned a worker and three other carpenters to install sheeting on the roof of a residential home in windy conditions without providing the required fall-protection gear or ensuring its use. As a result, one of the workers was blown off the roof and died from his injuries.

Pita pleaded guilty to the charges on July 9, 2024. The Federal District court sentenced him on February 20, 2025.

“The defendant in this case engaged in a deliberate scheme to defraud insurance companies, the government and evade taxes, resulting in huge losses to the U.S. Treasury, and to personally enrich himself,” said Acting U.S. Attorney for the Middle District of Florida Sara C. Sweeney. “In addition, flagrant violations of OSHA safety standards put workers at unacceptable risk, ultimately resulting in the death of an employee. My office is committed to federally prosecuting and holding accountable anyone who violates these laws and regulations.”

“Not only does this type of scheme give an illegal advantage over honest competitors, it intends to allow the use of illegal, undocumented labor to achieve that advantage,” said Special Agent in Charge Ron Loecker of IRS Criminal Investigation’s Tampa Field Office. “It’s a blatant form of cheating that undercuts fair competition, costs the government millions of dollars in tax revenue, and skirts our nation’s immigration laws. This case reaffirms our unwavering commitment to prosecuting those who engage in fraud at the expense of workers, taxpayers, and law-abiding businesses.”

The prosecution and conviction reminds construction and other business operators that the Justice Department and federal law enforcement agencies investigate and prosecute payroll tax, safety, worker’s compensation and other crimes by employers even when the impacted workers are undocumented aliens.

For Help With Investigations, Policy Updates Or Other Needs

If your organization would like to learn more about the concerns discussed in this update or seeks assistance auditing, updating, administering or defending its human resources, compensation, benefits, corporate ethics and compliance practices, or other work force or performance-related concerns, please contact management attorney and consultant Cynthia Marcotte Stamer.

An attorney Board-Certified in Labor and Employment Law by the Texas Board of Legal Specialization and American College of Employee Benefits Counsel Fellow, Ms. Stamer’s workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership on helping organizations and leaders about manage their internal and external workforce, employee benefits and compensation, regulatory compliance and governmental affairs and other legal and operational practices and risk have earned her recognition as a Fellow in the American College of Employee Benefits Counsel, a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Labor and Employment Law and Health Care Law; a “Best Lawyers” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” and numerous other honors.

A prolific author and highly sought out thoughtleader, Ms. Stamer also speaks, coaches management and publishes extensively on these and other related matters.

For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see here or contact Ms. Stamer directly.

Other Helpful Resources & Information

If you found this article of interest, you also may be interested in reviewing other Breaking News, articles and other resources like:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication, click here. If you do not wish to receive these updates in the future, unsubscribe by updating your profile here.

NOTICE: These materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice, a substitute for legal advice, an offer or commitment to provide legal advice or an admission. The information and statements in these materials may not address all relevant issues or apply to any particular situation or circumstances. The author reserves the right to qualify or retract any of these statements at any time. and does not necessarily address all relevant issues. Because the law evolves, subsequent developments could impact the currency and completeness of this discussion. The author disclaims and has no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers are urged to engage competent legal counsel for consultation and representation at any time, considering the specific facts and circumstances presented in their unique circumstances. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from using this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. Circular 230 Compliance. The following disclaimer is included to comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein. ©2025 Cynthia Marcotte Stamer. All rights reserved.

Comments Off on Construction Company Owner Gets 4 Year Prison Sentence For OSHA, Employment Tax & Worker’s Comp Fraud Involving Undocumented Alien Workers | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Expect Key Trump Labor Department Policy Rollout To Accellerate As Labor Secretary & Other New Leaders Start Work

March 14, 2025

Employers should prepare for a wave of U.S. Department of Labor (“Labor Department”) guidance and other actions defining and implementing President Trump’s labor and employment policy agenda as new Labor Secretary Chavez-DeRemer and several key politically appointed Labor Department agency leaders took office this week. Employers and contractors impacted by Labor Department rules and enforcement should monitor Labor Department developments for policy or enforcement changes impacting their workforce policies and prepare to respond quickly to new developments.

Secretary of Labor Chavez-Deremer

Chavez-Deremer was sworn in as the new Secretary of Labor on Tuesday, March 11, after the U.S. Senate confirmed her nomination by a vote of 67-32 on March 10. Prior to her nomination by President Trump, Chavez-Deremer served in the House of Representatives for the 5th Congressional District of Oregon, where she served on the House Education and the Workforce Committee. While in Congress, Chavez-DeRemer’s backing for legislation that included provisions easing barriers to union organization earned her a pro-labor reputation won support for her nomination from Democrat Senators Michael Bennet (D-Colo.), Catherine Cortez-Masto (D-Nev.), Ruben Gallego (D-Ariz.), Maggie Hassan (D-N.H.), John Hickenlooper (D-Colo.), Tim Kaine (D-Va.), Mark Kelly (D-Ariz.), Amy Klobuchar (D-Minn.), Jon Ossoff (D-Ga.), Gary Peters (D-Mich.), Jacky Rosen (D-Nev.), Adam Schiff (D-Calif.), Jeanne Shaheen (D-N.H.), Elissa Slotkin (D-Mich.), Mark Warner (D-Va.), Raphael Warnock (D-Ga.), and Sheldon Whitehouse (D-R.I) and opposition from Republican Senators Ted Budd (R-N.C.), Mitch McConnell (R-Ky.), and Rand Paul (R-Ky).

In a memorandum reportedly sent to agency heads within the Department of Labor, Chavez-Deremer reportedly embraced the directives of President Trump’s Department of Government Efficiency (“DOGE”) and instructed department heads to move quickly to review of budgets and identify opportunities for cost savings by eliminating wasteful contract spending, cutting redundancies and cutting low-performing employees. a source told Fox News Digital.

Other Labor Department Agency Heads Starting Work This Week

On March 13, the Department of Labor announced the following political appointees are joining the Department’s leadership team:

Bureau of International Labor Affairs

John Clark will serve as policy advisor to the Bureau of International Labor Affairs. Most recently, he worked on trade, transportation, and China policy matters at a Washington, D.C.-based industry association. Clark is a graduate of the University of Hawaii at Manoa William S. Richardson School of Law and Florida State University.

Employment and Training Administration

Amy Simon will serve as principal deputy assistant secretary of the Employment and Training Administration. Previously, Simon was founder and owner of the boutique consulting firm, Simon Advisory. From 2019 to 2021, she served as chief of staff and acting deputy assistant secretary for the Employment and Training Administration in the first Trump Administration.

Marek Laco will serve as the agency’s chief of staff. Most recently, Laco led workforce development policy as a staff member for the Committee on Education and the Workforce in the U.S. House of Representatives. He has worked for several members of Congress and spent time at the U.S. Department of Education during the first Trump Administration before serving as deputy chief of staff for Rep. Elise Stefanik.

Occupational Health and Safety Administration

Amanda Wood Laihow will serve as the deputy assistant secretary for the U.S. Occupational Safety and Health Administration. Most recently, she served as a commissioner to the U.S. Occupational Safety and Health Review Commission during the first Trump Administration. Wood Laihow was the director of labor and employment policy for the National Association of Manufacturers and served as deputy general counsel on the U.S. Senate Homeland Security and Governmental Affairs Committee and as an assistant general counsel at the U.S. General Services Administration. Wood Laihow holds a J.D. from the University of Maine School of Law and her B.A. in Political Science from the University of New Hampshire.

Michael Asplen will serve as OSHA’s senior policy advisor. He previously served as chief counsel to Commissioner Laihow at the Occupational Safety and Health Review Commission. Before that, he was a counsel at the Consumer Product Safety Commission, managed Littler Mendelson’s Workplace Policy Institute, and was a policy associate at the National Association of Manufacturers. Asplen earned his B.A. in English as St. Mary’s College of Maryland and his J.D. from the Catholic University of America Columbus School of Law.

Office of Congressional and Intergovernmental Affairs

Joe MacFarlane will serve as senior legislative officer for the department’s Office of Congressional and Intergovernmental Affairs. Most recently, he served as legislative director for Secretary Chavez-DeRemer during her tenure in the U.S. House of Representatives, where he focused on managing the day-to-day legislative operations and team. Before that, he served as legislative assistant for Rep. Rick Crawford focusing on agricultural issues, and as legislative correspondent/staff assistant for the late Rep. Jackie Walorski. A Rochester, New York native, MacFarlane holds bachelor’s degrees in Political Science and International Affairs from the University of Georgia.

Office of Disability Employment Policy

Brian Walsh will serve as a senior policy advisor in the Office of Disability Employment Policy. Before this appointment, he was a labor policy advisor with the Senate Committee on Health, Education, Labor, and Pensions. Walsh served at the White House in the first Trump Administration and the Department of Labor. He holds a B.A. in Political Science from the University of New Orleans and a Master of Public Policy from George Mason University.

Office of Labor-Management Standards

Elisabeth Messenger will serve as director of the department’s Office of Labor-Management Standards. Most recently, she served as executive director of Gevura Fund. She has also held leadership positions at non-profit organizations focused on advancing free market policies and protecting the First Amendment rights of public employees as well as positions with several technology companies. After earning her B.A. in Journalism from the University of South Carolina, her career began in the publicity department of Atlantic Records.

Office of Public Affairs

Courtney Parella will serve as deputy assistant secretary in the department’s Office of Public Affairs. After driving messaging strategy for members of Congress and the Committee on House Administration, she worked on President Trump’s 2020 re-election campaign and at the National Republican Congressional Committee. Most recently, she served as the director of communications for Congressional Leadership Fund and its sister organization, American Action Network.

Aaron Britt will serve as chief of staff in the Office of Public Affairs. He worked on Capitol Hill for four years before his appointment, most recently serving as communications director for former Rep. Lori Chavez-DeRemer and as press secretary for Sen. Chuck Grassley. Britt’s career began in his home state, where he oversaw media relations and strategy at the Republican Party of Iowa during the 2020 election cycle.

Office of the Secretary

Jihun Han will serve as Department of Labor’s chief of staff. He was Secretary Chavez-DeRemer’s chief of staff during her tenure in the U.S. House of Representatives and ran her successful congressional bid in 2022. Han has extensive experience working in local, state, and national politics, including as campaign manager and chief of staff for numerous members and candidates in the Oregon legislature. He also worked in political affairs for the Oregon Association of Realtors and Evergreen Oregon PAC.

Rebecca Wright will serve as the department’s deputy chief of staff. She served as Secretary Chavez-DeRemer’s district director in Oregon and as deputy campaign manager for Christine Drazan’s gubernatorial campaign. She also worked as a senior staffer for the Oregon House Republican Caucus under House Republican Leader Drazan.

Courtney Walter will serve as senior counselor in the Office of the Secretary. She served at the U.S. Department of Labor in the first Trump Administration in various capacities, including as senior counsel in the Office of the Solicitor. Most recently, Walter practiced law in the private sector, focusing on labor and employment matters. She is a graduate of the Pennsylvania State University and Florida International University College of Law.

Colton Duncan will serve as the White House liaison for the U.S. Department of Labor. A political strategist and digital media entrepreneur, he has served as president and CEO of Ninja Digital and as senior advisor to Kari Lake. A native of Lubbock, Texas, Duncan is a proud alumnus of Turning Point USA.

Peyton Smith will serve as director of scheduling in the Office of the Secretary. Most recently, she served as the director of operations to Secretary during her time as representative for Oregon’s 5th District in the U.S. House of Representatives for the 118th Congress. She is a graduate of the University of Georgia and holds a degree in Political Science.

Office of the Solicitor

On Feb. 24, 2025, Jonathan Snare was appointed as deputy solicitor of labor. He is rejoining the department after serving as partner in the Washington, D.C. office of Morgan Lewis & Bockius in the labor/employment practice group from 2009 to 2024. During his tenure at Department of Labor between 2003 and 2009, Snare served in several roles, including acting assistant secretary for OSHA and deputy assistant secretary, as well as deputy solicitor and acting solicitor in 2007. Before joining the department, he was in private law practice in Dallas. A native of Indianapolis, Snare graduated from the University of Virginia and obtained a law degree from Washington & Lee University School of Law.

For Help With Investigations, Policy Updates Or Other Needs

A prolific author and highly sought out thoughtleader, Ms. Stamer also speaks, coaches management and publishes extensively on these and other related matters.

For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see here or contact Ms. Stamer directly.

Other Helpful Resources & Information

If you found this article of interest, you also may be interested in reviewing other Breaking News, articles and other resources like:

Comments Off on Expect Key Trump Labor Department Policy Rollout To Accellerate As Labor Secretary & Other New Leaders Start Work | Corporate Compliance | Tagged: department of labor, donald-trump, Employee Benefits, Employer, Employment, Health Insurance, Health Plans, news, OSHA, politics, project-2025, Safety, Trump, Trump Administration | Permalink
Posted by Cynthia Marcotte Stamer

$200,000 OCR Penalty Shows Health Care Providers & Other HIPAA Entities Risks Of Late Record Access

March 7, 2025

The $200,000 civil monetary penalty [paid by Oregon Health & Science University (“OHSU”) for failing to provide requested medical records shows health care providers, health plans and insurers, and health care clearinghouses (“covered entities”) the perils of violating an individual’s Health Insurance Portability & Accountability Act of 1996 (“HIPAA”) right to timely access. As the 53^rd Department of Health and Human Services Office of Civil Rights (“OCR”) announced HIPAA right of action enforcement action, the penalty reaffirms OCR’s continued strong commitment to the enforcement of HIPAA rights of access against covered entities and demonstrates the potential high cost covered entities can face for noncompliance with these requirements. Like the 52 prior enforcement actions, the OHSU penalty warns health plans and other covered entities to confirm their compliance to avoid incurring similar liabilities.

Thie HIPAA Privacy Rule’s ”Right of Access” provisions require covered entities give requesting individuals or their personal representatives with timely access to requested protected health information. Generally, this means the covered entity must provide protected health information access within 30 days, with the possibility of one 30-day extension if certain requirements are met. HIPAA also prohibits covered entities from charging more than a reasonable, cost-based fee for this record access. This requirement is in addition to any otherwise applicable duty to provide timely access to records imposed by otherwise applicable laws such as rules applicable to health plans and health insurers covered by the adverse benefit determination rules of the Patient Protection and Affordable Care Act (“ACA”) or the Employee Retirement Income Security Act of 1974 (“ERISA”) or health insurers or health care providers under applicable state medical privacy and records laws state insurance laws, and health care providers under applicable state medical practice laws The Privacy Rule also contains specific rules for determining the allowable fees, which typically are more restrictive than often concurrently applicable state laws applicable to health care providers or insurers.

Covered entities also should recognize that covered entities violating the right of access rule face a high likelihood of enforcement by OCR. Patients and other individuals and their personal representatives typically are well informed about their access rights due to HIPAA’s notice of privacy practices and posting requirements. Since right of access violations are one of the most common complaints and OCR frequently finds violations when investigating these complaints,

The $200,000 civil monetary penalty against OHSU along with the undisclosed legal fees and other expenses it incurred in responding to the investigation and enforcement action show the HIPAA liability covered entities can incur for violating the right of assess rule. In September 2024, OCR issued a Notice of Proposed Determination seeking to impose a $200,000 civil monetary penalty. OHSU waived its right to a hearing and did not contest OCR’s imposition of a civil monetary penalty. Accordingly, in December 2024, OCR imposed the $200,000 civil monetary penalty against OHSU in a December 2024 Notice of Final Determination. The OHSU civil monetary penalty arose from OCR’s investigation of a second complaint filed by an individual’s personal representative in January 2021 from the individual’s personal representative. The complaint was one of two OCR received on this matter. In September 2020, OCR resolved the first complaint received in May 2020 after OCR notified OHSU of its potential noncompliance with the Privacy Rule Right of Access provisions. Although OHSU provided part of the requested records in April 2019, OHSU did not provide all of the requested records in August 2021. This was 16 months after the first request for records in April 2019 and nearly a year after OCR previously warned OHSU about its HIPAA obligations in response to the initial complaint. Based on these findings, OCR determined OHSU violated the right of access rule by failing to take timely action in response to the right of access requests.

Along with showing the importance of overall timely compliance with the right of access rule, the OHSU civil monetary penalty also shows covered entities the importance of promptly and completely correcting any violation and their causes that results in a failure by the covered entity (including an employee or business associate responsible for responding to requests) has violated the right of access rule. OCR’s right of access rule investigation and enforcement history against covered entities, including the original complaint against OHSU, demonstrates that OCR seeks settlement with substantially smaller or even no financial payment required if the covered entity promptly and completely fixes the violation in response to OCR’s notice and technical assistance.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, nationally known and celebrated for her experience providing advice and representation on HIPAA and other risk management and compliance to employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, health care and other managed care providers and organizations, human resources and health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on $200,000 OCR Penalty Shows Health Care Providers & Other HIPAA Entities Risks Of Late Record Access | Corporate Compliance | Tagged: business, Health, healthcare, Mental Health, news | Permalink
Posted by Cynthia Marcotte Stamer

$200,000 OCR Penalty Warns Health Plans and Other HIPAA Entities To Timely Provide Records

March 7, 2025

The $200,000 civil monetary penalty [paid by Oregon Health & Science University (“OHSU”) for failing to provide requested medical records shows health plans, health care providers, and health care clearinghouses (“covered entities”) the perils of violating an individual’s Health Insurance Portability & Accountability Act of 1996 (“HIPAA”) right to timely access. As the 53^rd Department of Health and Human Services Office of Civil Rights (“OCR”) announced HIPAA right of action enforcement action, the penalty reaffirms OCR’s continued strong commitment to the enforcement of HIPAA rights of access against covered entities and demonstrates the potential high cost covered entities can face for noncompliance with these requirements. Like the 52 prior enforcement actions, the OHSU penalty warns health plans and other covered entities to confirm their compliance to avoid incurring similar liabilities.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, nationally known and celebrated for her experience providing advice and representation on HIPAA and other risk management and compliance to employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, health care and other managed care providers and organizations, human resources and health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on $200,000 OCR Penalty Warns Health Plans and Other HIPAA Entities To Timely Provide Records | Corporate Compliance, health Care, Health Plans, HIPAA, HIPAA, insurers | Tagged: business, Health, healthcare, Mental Health, news | Permalink
Posted by Cynthia Marcotte Stamer

IRS Allows All Health Plans To Use Website To Fulfill ACA Annual Minimum Essential Coverage Statement Requirement

March 3, 2025

New Guidance Broadens Availability Of Website Alternative To All Health Plans

All health insurers and health plan administrators can now fulfill their obligation under the Patient Protection and Affordable Care Act (“ACA”) to send annual minimum essential coverage statements (“MEC Statements”) by timely posting a notice of the availability of the statements in lieu of providing the MEC statements by sending Internal Revenue Service (“IRS”) Forms 1095-B and 1095-C” to covered persons under guidance issued in IRS Notice 2025-15 on February 21, 2025.As part of the ACA minimum essential coverage mandates, Internal Revenue Code (“Code”) Section 6055 generally requires each health plan providing minimum essential coverage to any individual during a calendar year to notify the covered person named on an application who enrolls one or more individuals in the minimum essential coverage a statement that identifies each covered individual and the individual’s months of coverage. See Treas. Reg. § 1.6055–1(b)(11). While Section 6055 sets the statutory deadline to provide the MEC Notice as the January 31 immediately following the close of the plan year when the plan provides the coverage, Treasury Regulation § 1.6055-1(g)(4) provides an automatic 30-day extension of time in which to furnish these statements. As a result, covered health plans and health insurers must fulfill the annual MEC Statement requirement within 61 days of the close of the calendar year to which the MEC statement applies.

Internal Revenue Service (“IRS”) regulations generally require health plans to use Forms 1095-B and 1095-C to provide the MEC Statement to responsible individuals unless the health plan qualifies under Treasury Regulation § 1.6055-1(g)(4)(ii)(B) to provide the statement in the “alternative manner” of a qualifying website posting described in that Regulation.

Before February 21, 2025, Treasury Regulation § 1.6055-1(g)(4)(ii)(B) only allowed health plans to use the website posting alternative to fulfill their MEC Statement obligations if the individual shared responsibility payment amount under Code section 5000A(c) for the calendar year in which minimum essential coverage is provided is zero. Under IRS Notice 2025-15, however, all health plans and health insurers are permitted to use the alternative manner of a website posting to fulfill the MEC Statement mandate for all post-2023 plan years including the 2024 calendar notices without regard to the amount of the individual shared responsibility payment.

Health plans and health insurers wishing to use the to use the “alternative manner” of a website posting in lieu of Forms 1095-B and 1095-C to fulfill the MEC Statement requirement for 2024 or a subsequent calendar year must post in a location reasonably accessible to all responsible individuals a clear and conspicuous notice stating that responsible individuals may receive a copy of their statement upon request. Additionally, if an individual requests a statement, the health plan must deliver the requested statement within 30 days of the date the health plan receives the request.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, with decades of experience advising employers and other health plan sponsors, health plans, health plan fiduciaries and administrators, health and other insurers, third party administrators, managed care organizations, health plan technology, and other businesses about health plan design, administration, and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

Along with her decades of legal and strategic consulting experience, Ms. Stamer also contributes her leadership and experience to many professional, civic and community organizations. Along with currently serving as Co-Chair of the ABA Real Property Trusts and Estates (“RPTE”) Section Welfare Plan Committee, Co-Chair of the ABA International Section International Employment Law Committee and its Annual Meeting Program Planning Committee, Chair Emeritus and Vice Chair of the ABA Tort Trial and Insurance (“TIPS”) Section Medicine and Law Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, her previous ABA leadership roles include more than a decade of service as a Scribe for the Joint Committee on Employee Benefits (“JCEB”) annual agency meetings with the Department of Health and Human Services and JCEB Council Representative, International Section Life Sciences Committee Chair, RPTE Section Employee Benefits Group Chair and a Substantive Groups Committee Member, Health Law Section Managed Care & Insurance Interest Group Chair, as TIPS Section Medicine and Law Committee Chair and Employee Benefits Committee and Workers Compensation Committee Vice Chair, Tax Section Fringe Benefit Committee Chair, and in various other ABA leadership capacities. Ms. Stamer also is a former Southwest Benefits Association Board Member and Continuing Education Chair, SHRM National Consultant Board Chair and Region IV Chair, Dallas Bar Association Employee Benefits Committee Chair, former Texas Association of Business State, Regional and Dallas Chapter Chair, a founding board member and Past President of the Alliance for Healthcare Excellence, as well as in the leadership of many other professional, civic and community organizations. She also is recognized for her contributions to strengthening health care policy and charitable and community service resolving health care challenges performed under PROJECT COPE Coalition For Patient Empowerment initiative and many other pro bono service involvements locally, nationally and internationally.

About Solutions Law Press™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. Solutions Law Press and its authors reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. Solutions Law Press and its authors disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on IRS Allows All Health Plans To Use Website To Fulfill ACA Annual Minimum Essential Coverage Statement Requirement | ACA, Affordable Care Act, Corporate Compliance, employee, Employee Benefits, Employer, Employers, ERISA, Health Benefits, health insurance, health insurance marketplace, health plan, Health Plans, Premium Subsidies, Reporting & Disclosure | Tagged: business, Employment, Form 1095-C, Form1095-B, Health, Insurance, personal-finance | Permalink
Posted by Cynthia Marcotte Stamer

Stamer To Discuss Emerging Health and Disability Litigation Trends To Watch In January 17 Virtual Welfare Benefit Plan Update

January 14, 2025

Solutions Law Press publisher and attorney Cynthia Marcotte Stamer will discuss tobacco cessation class actions, health plan PBM, excessive fee, antitrust and other selected emerging health and disability plan litigation trends to watch in 2025 as part of the Welfare Plan Update at the American Bar Association Real Property, Probate and Trust Section Employee Plans and Executive Compensation Group will host during its free committee call on January 17, 2025, at 11:30 AM Central Time.

Along with Ms. Stamer’s comments, the Update also will include updates on the mental health partiy final rules and implications of the January 1, 2025 expiration of high deductible health plan telemedicine relief by her fellow Welfare Benefit Committee Co-Chair Jacquelyn M. Abbott and Committee Vice Chair Julia Mader.

Members interested in the meeting are invited to use the following Zoom credentials to connect to the meeting:

Join Zoom Meeting Link: https://americanbar.zoom.us/j/93409339280?pwd=aQcwUtePdkKni1943AJ4UjIaac6F5v.1

Meeting ID: 934 0933 9280, Passcode: 602434

One tap mobile

+13092053325,,93409339280# US

+13126266799,,93409339280# US (Chicago)

About Cynthia Marcotte Stamer

Board Certified in Labor and Employment Law by the Texas Board of Legal Specialization and a Fellow in the American College of Employee Benefits Counsel, Stamer is recognized for her decades of work on leading edge employee benefits, employment, health care and insurance concerns with recognition as a Martindale Hubble “Top Rated Lawyer” and “Legal Leader” in Health Care and Labor and Employment Law; as among the D Magazine “Best Lawyers In Dallas” in Labor & Employment, Tax: ERISA & Employee Benefits, Health Care and Business and Commercial Law.

Stamer has more than 35 years of experience guiding employers, health and other employee benefit and insurance programs and their fiduciaries, managed care, TPAs, PBMs, health care clearinghouses and their service providers; and other managed care and other health and health plan industry clients on program, product, systems and process design, administration, and defense; government and regulatory investigations and affairs; HIPAA and other data and systems privacy, cybersecurity and other integrity; workforce and other service provider credentialing, contracting, and management; government and private investigations, disputes, audits and enforcement; and other compliance, risk management and operations concerns in a wide range of contexts. Her work, and the interests of her clients are enhanced by her continuous involvement in federal and state legislative advocacy, regulatory affairs and government relations on these and other related concerns throughout her career.

In the course of this work, Stamer frequently advises and represents and defends health and other employee benefit plans, their fiduciaries, third party administrators, brokers, insurers, trustees and other plan service providers, debtor plan sponsors and their leaders, auditors, creditors and creditor committees, bankruptcy trustees, on prevention and mitigation of claims, fiduciary, licensing, prompt pay and other contractual, regulatory and other risks and liabilities arising from underfunded or distressed companies and employee benefit plans. She also advises employers, their boards, investors and management, third party administrators, preferred provider organizations, insurers and other plan service providers and others in fiduciary, claims and other audits, investigations and enforcement actions by private litigants, the Department of Labor, Department of Health & Human Services, Internal Revenue Service, Department of Justice, Federal Trade Commission, state insurance, attorneys’ general or other regulator, contractual arising out of workforce and staffing, employee benefit and insurance practices and programs in ongoing operations, corporate or credit transactions, bankruptcy or other situations and serves as special or consulting counsel for bankruptcy and other human resources, benefits, insurance, health care and regulatory compliance and investigation concerns. Stamer also counsels, represents and defends third party administrators, preferred provider and other managed care organizations, brokers and other regulated parties in state insurance and other regulators notice and reporting, investigations, audits, discipline and other enforcement actions.

Past Chair of the ABA RPTE Employee Benefit and Other Compensation Group, the Health Law Section Managed Care and Insurance Interest Group, and the Tort Trial and Insurance Section Medicine and Law Committee, Stamer also contributes her experience and knowledge by serving as Scribe for the American Bar Association (“ABA) Joint Committee on Employee Benefits (“JCEB”) annual agency meeting with the Department of Health and Human Services as well as a leader of employee benefits, human resources, health as an industry thought leader, Stamer also publishes and speaks extensively on health and other employee benefits, compensation, workforce, health care and related regulatory compliance and risk management matters.Her insights on these and other matters appear in publications of the American Bar Association, Bloomberg/BNA, Modern Healthcare, Aging In Place, Spencer Publications, the Wall Street Journal, the Dallas Business Journal, the Houston Business Journal, and many other national and local publications. For additional information about Stamer, her speaking, legal, consulting and other experience and services, or to access other publications by Stamer see CynthiaStamer.com or contact Stamer directly via e-mail or telephone (214) 452-8287.

For more details about the Real Property Probate and Trust Section Employee Benefits and Other Compensation Committee or other employee benefits related committees and activities of the American Bar Association, see the American Bar Association website here.

To receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here and connect with Stamer on Linkedin. For important information concerning this communication click here. If you do not wish to receive these updates in the future, unsubscribe by updating your profile here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides health care, insurance, human resources and employee benefit, data and technology, regulatory and operational performance, and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education. These include extensive resources on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

Comments Off on Stamer To Discuss Emerging Health and Disability Litigation Trends To Watch In January 17 Virtual Welfare Benefit Plan Update | ACA, Claims Administration, Corporate Compliance, Disability, Disability Plans, EBSA, employee, Employee Benefits, Employer, Employers, ERISA, Fiduciary Responsibility, Fringe Benefits, health benefit, Health Benefits, health Care, health insurance, Health Plans, Managed Care | Tagged: business, Employment, Health, High Deductible Health PLan, Human Resources, news, Telemedicine | Permalink
Posted by Cynthia Marcotte Stamer

Immigration Forms Update Impending

January 13, 2025

UICIS has updated the following immigration forms updates:

Form I-854, Inter-Agency Alien Witness and Informant Record-Edition Date: 12/12/24. Starting March 13, 2025, UICIS will accept only the 12/12/24 edition. Until then, you can also use the 04/01/24 edition. You can find the edition date at the bottom of the page on the form and instructions.
Form I-134, Declaration of Financial Support-Edition Date: 12/12/24. Starting March 13, 2025, UICIS will accept only the 12/12/24 edition. Until then, you can also use the 11/09/23 edition. You can find the edition date at the bottom of the page on the form and instructions.

These updates are part of a series of ongoing form updates. Added changes are foreseeable particularly in light of the impending change of administration and the expected immigration changes from the incoming Trump Administration. Impacted parties should ensure use of the appropriate forms in light of these and other changes.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, who has decades of experience advising employers, health care providers, health plans and insurers, third party administrators, managed care and other health care payers and providers, technology, and other businesses about these and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health, insurance, employment and employee benefits and other industry management work, public policy leadership and advocacy, coaching, teachings, and publications including leading-edge work on crisis preparedness, response and recovery.

Author of many highly regarded compliance and risk management tools, training and other resources on health and other employee benefits, health care, insurance, workforce and other risk management and compliance, Ms. Stamer is widely recognized for her thought leadership and advocacy on these matters.

In addition, Ms. Stamer serves as a Scribe for the American Bar Association (“ABA”) Joint Committee on Employee Benefits annual agency meetings with OCR and shares her thought leadership as International Section Life Sciences Committee Vice Chair, and a former Council Representative, Past Chair of the ABA Managed Care & Insurance Interest Group, former Vice President and Executive Director of the North Texas Health Care Compliance Professionals Association, past Board President of Richardson Development Center (now Warren Center) for Children Early Childhood Intervention Agency, past North Texas United Way Long Range Planning Committee Member, and past Board Member and Compliance Chair of the National Kidney Foundation of North Texas, and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her extensive publications and thought leadership as well as leadership involvement in a broad range of other professional and civic organizations.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2025 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Comments Off on Immigration Forms Update Impending | Corporate Compliance | Tagged: Immigration, USics, witness | Permalink
Posted by Cynthia Marcotte Stamer

HHS Grants Limited Southern California Fire Limited Disaster Relief

January 10, 2025

Health plans and insurers, health care providers and other Southern California organizations impacted by the California fires may qualify for temporary waivers or modification of certain Department of Health and Human Services (“HHS”) regulatory requirements under the Declarations of a Public Health Emergency (“PHE”) published by HHS today.

The relief provided by the PHE includes:

An extensive list of resources and guidance to help health plans, health care providers and others to understand and cope with HHS requirements in disaster or other emergency situations such as:

For information about how the HIPAA Privacy Rule applies in a public health emergency, visit the OCR’S HIPAA Emergency Preparedness, Planning, and Response page (www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/index.html) or you may use the HIPAA Disclosures for Emergency Preparedness Decision Tool (www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/decision-tool-overview/index.html).
For information and resources for emergency responders/officials to help ensure individuals have equal access to emergency services, including language access and effective communication, please see this checklist for emergency responders: HHS OCR Emergency Preparedness Checklist for Ensuring Language Access and Effective Communication (www.hhs.gov/sites/default/files/lang-access-and-effective-comm-checklist-for-emergency-responders.pdf).
For information about emergency requirements for long-term care facilities, visit the CMS Emergency Preparedness Rule page (www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/Emergency-Prep-Rule.html)

Health plans and other regulated entities impacted by the fire or other disasters should carefully review this guidance to understand the scope and availability of the current relief. Additionally, health plans, health care providers, business associates and other HHS-regulated entities and providers not currently impacted by today’s or another public health emergency declaration should use this guidance to plan and adopt policies and arrangements in advance of a disaster to provide for their continued ability to fulfill HHS regulatory obligations in the event of an emergency.

Health plans and other HHS-regulated entities should keep in mind the limited duration and scope of the relief provided by this PHE or any other HHS public health emergency declaration. Entities planning to rely on the PHE relief must review the scope, conditions and duration requirements and ensure their ability to defend their continued compliance taking into account these limited waivers and modifications.

Also the PHE guidance documents are not a final agency action, do not legally bind persons or entities outside the Federal government, and may be rescinded or modified in the Department’s discretion. Noncompliance with any voluntary standards (e.g., recommended practices) contained in these documents will not, in itself, result in any enforcement action.

Furthermore, health plans and other HHS regulated entities typically face a myriad of responsibilities beyond those imposed by the HHS. Health plans and other regulated entities should check other agencies disaster declaration webpages to determine whether the agency has issued any specific relief impacting their emergency in response to the broader disaster declaration issued by the Administration. Except to the extent covered by other declared disaster relief, coverage by or compliance with the HHS PHE guidance and policies does not insulate the health plan from potential liability for violating the requirements of the Employee Retirement Income Security Act or other laws creating responsibilities to plan members, providers, the Employee Benefit Security Administration or other agencies or parties other than HHS with respect to the HHS regulatory obligations for which the specific relief is provided in the PHE declaration. Accordingly, health plans, their fiduciaries, plan sponsors and service providers are urged to take necessary steps before, during and after any disaster to position themselves to demonstrate fulfillment of duties of prudence and other applicable responsibilities.

The author of this update, Cynthia Marcotte Stamer is an American College of Employee Benefits Counsel Fellow and attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, who has decades of experience advising health care providers, health plans and insurers, third party administrators, managed care and other health care payers and providers, technology, and other businesses about crisis preparedness and response and other compliance, risk management and operational matters. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

About the Author

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstances at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law-specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on HHS Grants Limited Southern California Fire Limited Disaster Relief | Corporate Compliance, Employer, Employers, health benefit, Health Benefits, health Care, Health Care Fraud, health insurance, health insurance marketplace, Health Plans, HIPAA, HR, Human Resources | Tagged: California Fires, Cybersecurity, Disaster, Health, healthcare, Security, Technology | Permalink
Posted by Cynthia Marcotte Stamer

Auto Industry Businesses Should Tighten Defenses In Response To New Whistleblower Rules

December 20, 2024

Heads up auto industry employers. Department of Transportation’s National Highway Traffic Safety Administration (“NHTSA”) just finalized released final rules outlining its Auto Safety Whistleblower Program procedures that impact motor vehicle manufacturers, part suppliers, and dealerships (“Auto Businesses”).

The final rules define the whistleblower award process, the filing requirements, and the eligibility criteria for potential whistleblowers.

The final rules define a “whistleblower” to include “any Auto Business employee or contractor who voluntarily provides to the NHTSA original information relating to any motor vehicle defect, noncompliance, or any violation or alleged violation of any notification or reporting requirement of 49 U.S.C. Chapter 301, or a regulation thereunder, which is likely to cause unreasonable risk of death or serious physical injury.”

The adoption and promotion of these whistleblower rules and remedies increase exposures for auto businesses to whistleblower claims. Auto industry businesses should take care to ensure they have adopted, communicated, and administer proper processes for maintaining and defending their compliance with defect, detection and reporting, anti-retaliation and other requirements of the rules.

Auto industry employers also should use care to minimize the risk of whistleblower liability to employees who have made reports of defects or engaged in other activity protected by the final rules as well as other activities protected under federal or state law. These actions include but are not limited establishing a well designed, administered and documented compliance program to prevent violations; notification of employees and contractors of your policy of non-discrimination and non-retaliation against individuals for engaging in actions protected by the final rules; maintaining strong documentation to support employment, promotion, demotion, and other employment decisions; using care when addressing employment termination or other employment related evaluations of workers who filed reports or engaged in other protected activity to promote defensibility against whistleblower and retaliation claims; notify workers of procedures for reporting suspicions of retaliation for engaging in protected activity; and other safeguards to strengthen the defensibility of the businesses, actions in the event of a possible claim.

The author of this update, Cynthia Marcotte Stamer is an attorney board certified in Labor and Employment Law by the Texas Board of Legal Specialization, who has worked extensively with auto industry and other businesses business associates on whistleblower and other compliance and risk management. If you have questions or need advice or help evaluating or addressing these or other compliance, risk management, or other concerns, contact her.

For More Information

We hope this update is helpful. For more information about the or other health or other employee benefits, human resources, or health care developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452-8297.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on workforce and other risk management and compliance.

Ms. Stamer’s work throughout her career has focused heavily on working with businesses domestically and internationally on employment, benefits, Federal Sentencing Guidelines and other workforce management, regulatory and public policy and other legal and operational concerns.

Author of many highly regarded compliance, training and other resources on workforce and other risk management and compliance, Ms. Stamer is widely recognized for her thought leadership and advocacy on these matters.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources.

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

©2024 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

Comments Off on Auto Industry Businesses Should Tighten Defenses In Response To New Whistleblower Rules | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

$1.19 Million Penalty Warns Health Plans and Other Covered Entities To Ensure HIPAA Compliance Defensibility Including Service Provider Threats

December 6, 2024

The $1.19 million Health Insurance Portability and Accountability Act (“HIPAA”) penalty imposed on a Florida pain clinic this week sends a clear warning to health plans, health care providers, healthcare clearinghouses and their business associates (“Covered Entities”) to take adequate, documented steps to ensure the defensibility of their own safeguards and other compliance with the HIPAA Security Rule including those from their own current and former workers and service providers.

HIPAA Security Rule

The HIPAA Privacy, Security, and Breach Notification Rules require health plans, health car clearinghouses, and most health care providers, and their business associates (“Covered Entities”) to meet requirements to protect the privacy and security of protected health information (“PHI”). The HIPAA Security Rule included in these rules requires Covered Entities to conduct and maintain documented risk assessments to prove their efforts to comply with detailed national administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic PHI (“ePHI”).

Violation of HIPAA can trigger either civil monetary penalties or criminal penalties under HIPAA. As amended by the the HITECH Act, HIPAA provides for the following civil monetary penalties for HIPAA violations:

A minimum of $100 for each violation where the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000
A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000. Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.
A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
Aminimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR adjusts the CMP ranges for each penalty tier for inflation³ for violations after November 2, 2015.

Along with these potentially substantial civil penalty exposures, HIPAA’s potential criminal penalties make HIPAA compliance a required element of the Federal Sentencing Guideline Compliance programs Covered Entities and their leaders need to mitigate their exposures to organizational liability under the Guidelines.

Additionally HIPAA breaches also may expose Covered Entities and their leaders to potential liability for breach liability under securities, electronic crimes, and other data breach and security laws; Federal Sentencing Guideline and other liability for misappropriation of funds, health care or other fraud and other crimes enabled by inadequate compliance or response; trigger fiduciary and other duties and liabilities under the Employee Retirement Income Security Act of 1974 (“ERISA”) for those acting as named or functional fiduciaries; I create licensing or ethical sanctions; create shareholder, tort or contractual liabilities; trigger public company disclosure and executive compensation clawback responsibilities; and a host of other legal, operational and business partner and public relations headaches.

New $1.19 Million Settlement

The $1.19 million penalty against Pain Clinic for Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute (“Gulf Coast Pain Consultants”) announced December 4, 2024 by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) shows how quickly a Covered Entity found in violation of these rules can rack up substantial civil monetary penalties. Although specifically involving a health care provider, health plans are exposed to the same risks.

The Gulf Coast Pain Management civil monetary penalty arose from OCR’s finding of “systematic” HIPAA Security Rule violations while investigating a breach report that a former contractor for the company impermissibly accessed their electronic record system.

OCR initiated the investigation following the receipt of a breach report filed by Gulf Coast Pain Consultants, which reported that a former contractor impermissibly accessed Gulf Coast’s electronic medical record system to retrieve PHI for use in potential fraudulent Medicare claims.

OCR’s investigation revealed the breach was accomplished by a business consultant independent contractor hired to provide business consulting in 2018, whose contract was terminated prematurely a several months later before the end of the contract term.

After the contract terminated, Gulf Coast did not immediately terminate the former contractor’s system access.

Months later on February 20, 2019, Gulf Coast discovered that on three occasions, between September 7, 2018, and February 3, 2019, the Contractor impermissibly used its access to Gulf Coast’s electronic medical record (“EMR”) system to access the ePHI of approximately 34,310 individuals. On February 21, 2019, Gulf Coast terminated the independent contractor’s access to its systems.

It was later discovered that the Contractor generated medical claims for services that were not actually rendered, resulting in approximately 6,500 false Medicare claims. The Contractor was indicted under 18 U.S.C. §1347 and §1028(a)(1) and was ultimately found not guilty.

On April 5, 2019, Gulf Coast filed a breach report with OCR concerning this incident. The report described that the compromised PHI included names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, chart numbers, insurance information, and primary care information.

OCR’s investigation determined that the impermissible access occurred on three occasions, affecting approximately 34,310 individuals. The compromised PHI included patient names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, chart numbers, insurance information, and primary care information.

Based on the investigation, OCR found four violations by Gulf Coast Pain Consultant of the HIPAA Security Rule, including failures to:

Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems;
Implement procedures to regularly review records of activity in information systems;
Implement procedures to terminate former workforce members’ access to ePHI; and
Implement procedures for establishing and modifying workforce members’ access to information systems.

As often happens, the investigation and other processes leading to the settlement were protracted and expensive.

More than four years after the breach and its report, OCR issued a Notice of Proposed Determination in August 2024 seeking to impose a civil money penalty. After Gulf Coast waived its right to a hearing and did not contest OCR’s findings, OCR issued its Notice of Final Determination imposing the $1,190,000 civil money penalty.

Take Aways

Aside from demonstrating the significant penalties that Covered Entities can face for failing to satisfy HIPAA, the settlement also highlights the need for health plans, their fiduciaries, service providers and other HiIPAA_regulated entities to manage data security threats from contractors and other current and former service providers with access to ePHI and other Security Rule compliance.

“Current and former workforce can present threats to health care privacy and security—risking continuity of care and trust in our health care system,” said OCR Director Melanie Fontes Rainer in its announcement of the penalty. “Effective cybersecurity and compliance with the HIPAA Security Rule means being proactive in reviewing who has access to health information and responding quickly to suspected security incidents.”

OCR recommends that Covered Entities take a number of steps to mitigate or prevent cyber threats including

Integrate risk analysis and risk management into business processes.
Implement regular review of information system activity.
Implement procedures for terminating access to ePHI when the employment of, or other arrangement with, a workforce member ends.
Implement procedures for modifying a user’s right of access to a workstation, transaction, program or process, or an alternative equivalent measure.
A multitude of other risk assessment and mitigation actions required in response to existing and emerging threats arising from time to time as identified and evaluated pursuant to the ongoing conduct of documented risk assessments required by the Security Rule.

Because the Employee Benefit Security Administration views ensuring proper data security and HIPAA compliance an ERISA fiduciary responsibility and includes cybersecurity in its ERISA compliance audits, health plan fiduciaries also face breach of fiduciary duty and other exposures under ERISA.

The author of this update, Cynthia Marcotte Stamer has worked extensively with health plans and insurers, their sponsors and fiduciaries on covered entities and business associates on HIPAA and other compliance and risk management. If you have questions or need advice or help evaluating or addressing your HIPAA or other compliance, risk management, or other concerns, contact her.

For More Information

About the Authok

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on PBM, pharmacy and pharmaceutical and other health care, managed care, insurance, and insured and self-insured contracting, design, administration and regulation..

Author of numerous highly regarded works on PBM and other health plan contracting and design, Immediate Past Chair of the ABA International Section Life Sciences Committee and the Tort Trial and Insurance Practice Section Medicine and Law Committee, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and past Group Chair and current Welfare Benefit Committee Co-Chair of the ABA RPTE Employee Benefits & Other Compensation Group, Ms. Stamer is most widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health and other privacy and data security and other health industry legal, public policy and operational concerns.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with HIPAA and other legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

As a part of this work, she has continuously and extensively worked with domestic and international health plans, their sponsors, fiduciaries, administrators, and insurers; managed care and insurance organizations; third party administrators and other health benefit service providers; hospitals, health care systems and other health care providers, accreditation, peer review and quality committees and organizations; billing, utilization management, management services organizations, group purchasing organizations; pharmaceutical, pharmacy, and prescription benefit management and organizations; consultants; investors; EMR, claims, payroll and other technology, billing and reimbursement and other services and product vendors; products and solutions consultants and developers; investors; managed care organizations, self-insured health and other employee benefit plans, their sponsors, fiduciaries, administrators and service providers, insurers and other payers, health industry advocacy and other service providers and groups and other health and managed care industry clients as well as federal and state legislative, regulatory, investigatory and enforcement bodies and agencies.

Author of many highly regarded compliance, training and other resources on HIPAA and other risk management and compliance, Ms. Stamer is widely recognized for her thought leadership on HIPAA and many other health care, health plan and other health industry matters.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on $1.19 Million Penalty Warns Health Plans and Other Covered Entities To Ensure HIPAA Compliance Defensibility Including Service Provider Threats | Corporate Compliance | Tagged: compliance, Corporate Compliance, Employee Benefits, Employer, Employers, Employment, ERISA, Fiduciary, Fiduciary Responsibility, group health plan, Group Health plans, Health Care, Health Insurance, Health Plan, Health Plans, HIPAA, Human Resources, Independent Contractor, Insurance, Privacy | Permalink
Posted by Cynthia Marcotte Stamer

Workforce Strategies For Avoiding Holiday Liability Hangovers

November 27, 2024

With this week’s Thanksgiving celebrations kicking off the 2024 year-end holiday festivities, wise businesses will proactively act to reduce the risk that their business will start 2025 with a post-holiday workforce liability hangover.

Responsibly managed, company-sponsored and other social celebrations and activities can promote team building, morale, goodwill and other rewards. However, holiday celebrations, staffing disruptions, behaviors and their fallout also can often create attendance, discipline, compliance, safety and other legal and operational responsibilities, risks and costs. Wise business leaders act proactively to mitigate these risks as the nation enters holiday season begins.

Health & Safety

Gatherings, food, game playing, toasting with alcohol, travel and other aspects of company-sponsored and off-duty celebrations can enhance usual or create new accident and illness risks. Holiday socialization, presentism, distractions, staffing disruptions, operational changes and other factors can increase illness and accident risks. Injuries and illnesses suffered on or off the job can create added occupational health and safety and worker’s compensation responsibilities, costs and liabilities, disrupt staffing and productivity, and fuel health care, medical leave, disability, worker’s compensation and other responsibilities and expenses long after the holiday season ends. To help workers enjoy the Holidays safely and avoid these business costs and disruptions, businesses should confirm that their occupational health, safety and injury policies, practices, and staffing fulfill applicable occupational health and safety and workplace accident and injury laws, as well as consider encouraging workers to follow good health and safety practices on and off the job throughout the holiday season.

Employers generally have a duty of care under the Occupational Safety and Health Act (“OSH Act”) and other occupational health and safety laws to provide a safe work environment. The OSH Act requires businesses to recognize and take appropriate steps to keep their workplaces safe. The OSH Act, worker’s compensation, leave and other laws. OSH Act and other workplace safety laws generally require employers to promptly report and investigate workplace accidents and injuries, ensure workers receive timely treatment, and trigger occupational injury and other leave and other duties.

Workplace injuries resulting from unsafe workplace conditions generally trigger expensive penalties and damages, in addition to worker’s compensation or other occupational injury coverage liabilities. The holiday season often exacerbates or adds to the ongoing challenges employers face in maintaining workplace safety and responding to workplace injuries and accidents. Some common sources of additional risks associated with the holiday season include decreased oversight from management holiday absences, heightened worker fatigue and distraction, demand-driven, vacation or illness-related understaffing, expanded use of temporary or contract staffing, and holiday season-associated intoxication. See Holiday Workplace Safety. OSHA offers various recommendations to aid employers in recognizing and managing heightened workplace safety risks during the holiday season. Keeping Workers Safe This Holiday Season. To mitigate their risks from workplace injuries and accidents caused by safety violations and associated violations of investigation, reporting, benefit and other requirements, business leaders should ensure that their organizations identify and manage these additional risks, as well as ensure appropriate staffing and other arrangements are in place to ensure timely response, investigation and reporting of any workplace accidents or injuries during the holiday season.

With outbreaks of the flu, respiratory illnesses and other communicable or infectious diseases that spread from person to person common during the holidays, and holiday gatherings heightening the potential for transmission of the flu or other contagious diseases, businesses also should consider their responsibilities under the OSH Act or other laws to manage contagious disease exposures and spread. For instance, health care and certain other industries may be subject to laws or regulations that impose specific requirements for preventing and responding to contagious diseases, many of which may have been added or changed since the COVID-19 pandemic. Businesses should verify their policies meet or exceed current federal, state, local and contractual requirements as well as are designed to meet their business’ need to manage other contagious disease costs, absences and other disruptions.

Whether or not a business is subject to specific contagious disease management mandates, all businesses generally will benefit from reviewing and communicating their existing contagious disease and related leave and other workforce policies to workers and management to help protect their operations against the costs, operational disruptions and liabilities that often result from contagious disease outbreaks within their workplace. To enhance efforts to deter worker injuries and illnesses, businesses should consider using free resources like the Centers for Disease Control’s Healthy Habits to Prevent Flu and 8 Tips for a Safe and Healthy Holiday Season flyers, workplace posters, payroll stuffers and other communications to remind workers and their families to follow best safety and contagious disease prevention practices during the holidays.

Along with encouraging workers to stay healthy and safe during the Holidays, businesses should also consider providing documented reminders and take other steps to encourage workers to provide timely notice of illnesses and injuries and verify appropriate management coverage and arrangements to ensure that management team absences don’t disrupt the business’ timely delivery of Family and Medical Leave Act, occupational injury and other notifications, coverage for absences, provision of benefits, and other performance of other responsibilities in response to injury and illness reports despite holiday associated absences or hours of operation impacting the employing business or its responsible vendors.

Businesses also should verify their workplace safety, contagious disease and leave policies are designed and administered to prevent and mitigate exposure for unlawful OSH Act and worker’s compensation retaliation, disability discrimination against legally protected employees with chronic or other disabilities under the Americans with Disabilities Act (“ADA”), denial of leave or other violations of the Family and Medical Leave Act leave, notice and other requirements; and ADA and other privacy and confidentiality laws.

Alcohol & Other Conscious Altering Substance Consumption

The increased prevalence of holiday season celebrations and vacations often fuels an increase in consumption of alcohol, marijuana, and other consciousness-altering substances. This consumption can fuel a host of risks and headaches for businesses. Businesses concerned about these risks should act proactively to mitigate these risks.

When addressing business-related alcohol consumption, many businesses will want to consider not only alcohol and other conscious altering consumption at business-related events as well as potential costs that may arise from off-duty excess alcohol consumption. Whether resulting from on or off-duty consumption, excess alcohol, marijuana or other conscious altering consumption, whether on or off duty, can undermine productivity, create attendance and discipline issues, and fuel a host of other risks even when it does not result in a specific accident or injury.

Impaired judgment from alcohol or other intoxication in the workplace or at other events often fuels or contributes to employees or others exhibiting or subjecting employees to inappropriate sexual advances or other discriminatory statements, violent behavior, suicidal behavior or other problematic conduct requiring workplace investigations and discipline.

Most businesses also recognize that accidents caused by alcohol or other intoxication at work or work-related functions create substantial liability exposures for the company under the OSH Act and other occupational safety laws, as well as to workers and any third parties injured by a drunken employee, business associate, client or guest.

Businesses risk “dram shop” or other claims or other liability if employees or guests impaired by alcohol or other substances consumed at company-sponsored or associated events or operating company vehicles or equipment injure others.

Beyond this third-party liability, businesses also may incur significant worker’s compensation, health or disability benefit-related benefit costs if an employee is injured or injures another worker in an alcohol-related accident.

The potential headaches are even greater where the business is a health care, education, automobile sales, trucking and other transportation, or another business subject to or that has voluntarily adopted specific drug and alcohol-free, drug and alcohol testing and other related regulatory or contractual requirements. Businesses subject to these requirements should ensure appropriate arrangements for timely drug and alcohol testing, reporting, and other compliance with these requirements during the holiday season to avoid regulatory or contractual penalties for noncompliance. Companies administering substance abuse testing must comply with applicable mandates while also ensuring that their processes incorporate appropriate protocols to comply with disability discrimination, accommodation and confidentiality requirements of the Americans With Disabilities Act (“ADA”). See, e.g., ADA May Require Employers To Accommodate Employees Testing Positive For Legally Prescribed Medications

Also, because workers engaged in these industries generally risk loss of licensure, certification or other credentials required to perform their jobs for engaging in or failing to report certain alcohol or substance-related offenses or conduct, even off-duty consumption can create staffing headaches for an employer if a worker becomes temporarily or permanently disqualified to work as a result of a substance-related infraction. Consequently, businesses in industries affected by these heightened requirements have a heightened interest in educating and reminding workers to behave legally and responsibly when deciding if and when to consume alcohol or other conscious-altering substances.

Accordingly, virtually all businesses can benefit from encouraging employees to be responsible when consuming alcohol in both business and non-business functions and in planning and hosting holiday functions.

Businesses that serve alcohol at company functions or anticipate that employees will attend other business functions where alcohol will be served need to consider the potential liability risks that may result if the alcohol-impaired judgment of an employee or other guest causes him to injure himself or someone else. A company anticipates an employee or guest might consume alcohol at a company-sponsored or another business event and should adopt and enforce clear policies to prohibit and prevent individuals from over-imbibing and from driving under the influence. Many businesses also find it beneficial to suggest, require or offer at company expense alternate transportation for employees to use when leaving a company or business-related event where the employee consumed alcohol.

Businesses concerned with these liability exposures should take steps to manage the potential risks that commonly arise when employees, clients or other guests consume alcohol at company-sponsored events or while attending other business-associated festivities. To minimize these risks at company-sponsored events, many companies elect not to serve or limit alcohol consumed by workers and served to guests at company sponsored events and other business functions.

To help prevent intoxication from fueling inappropriate behavior at company celebrations where alcohol might be consumed or present, businesses, at a minimum, should remind employees that company policies prohibiting intoxication apply to company-sponsored social and business events. Some practical tips for hosting safe holiday gatherings include:

Management and other leaders should communicate expectations and set a good example.
Reduce opportunities for intoxication by prohibiting or restricting and monitoring the amount of alcohol available and served.
Offer a plentiful supply of a variety of nonalcoholic drinks—water, juices, sparkling sodas. Nonalcoholic drinks provide guests with alternatives to alcohol. They also may help counteract the dehydrating effects of alcohol, slow the rate of alcohol absorption into the body and may reduce the peak alcohol concentration in the blood.
Provide a variety of healthy foods and snacks. Food consumption can slow the absorption of alcohol and reduce the peak level of alcohol in the body by about one-third. Food can also minimize stomach irritation and gastrointestinal distress the following day.
Encourage guests to help keep each other safe by monitoring and assign a team to monitor attendees for potential overconsumption or other signs of intoxication. With appropriate pre-consumption notification to attendees, some businesses even require or encourage attendees consuming alcohol to take a breathalyzer test before departure to minimize the risk that an intoxicated guest will be arrested or involved in an accident after departing the party.
Help your guests get home safely by arranging reliable transportation by using designated drivers and taxis. Anyone getting behind the wheel of a car should not have ingested any alcohol.

Because holiday-associated alcohol consumption and other stresses also tend to fuel increased depression, domestic violence and other stress-associated behaviors, many businesses also find it beneficial to redistribute information about employee assistance programs (EAPs).

Businesses also may want to review the adequacy of existing health, disability, accident and dismemberment, group legal services and other benefit programs, liability insurance coverage and employment policies to protect and promote the company’s risk management and workforce coverage objectives. Businesses can experience unfortunate surprises if they don’t anticipate the implications of these provisions on their employment policies, leave and benefit, safety and other workplace programs and liability insurance and indemnification obligations and costs. Maintaining and reminding workers about policies regarding alcohol consumption or intoxication, accident and traffic offense notifications, privacy waivers, or other policies enhancing accident investigation and response, or other strategic policies can help deter and facilitate investigation and response to on and off-duty accidents or other risk-creating events.

Many employee assistance (“EAP”) health and disability programs incorporate special provisions affecting injuries arising from inappropriate alcohol use as well as offer coverage and benefits to aid employees and family members affected by mental health or substance abuse-related conditions. Changes in regulatory mandates and expanded enforcement of federal group health plan mental health and substance abuse coverage mandates make it important to ensure that employment-based health coverage complies with these requirements. Similarly, many businesses increasingly qualify for preferential rates or discounts on liability policies based upon representations that the business has in effect certain alcohol and drug use or other risk management policies and practices. Reviewing these policies now to become familiar with any of these requirements and conditions can also be invaluable in helping a business respond effectively if an employee or guest is injured in an alcohol-related accident.

Discrimination & Harassment Liability Risks

Businesses should also manage exposures to religious, sex and other discrimination risks linked with the holiday season.

Businesses should critically review their scheduling and other holiday season plans and practices for potential prohibited discrimination or other insensitivity. Businesses should use care to handle carefully requests for religious-based scheduling changes, particularly in light of changes in judicial precedent and regulations in recent years. Leave policies should disclose policies for scheduling and holiday leave clearly and include appropriate, updated policies and procedures for requesting religious accommodation. Companies also should consider seeking advice from legal counsel before denying a faith-based request for a schedule change in light of the latest guidance or recent court decisions precedent.

Business-sponsored or connected holiday or year-end parties, communications, gifts, and other December festivities and observances should be designed to reflect appropriate sensitivity to sexual harassment and religious and other cultural diversity risks. Businesses should exhibit sensitivity and alert their workforce to their expectation that members of their workplace exhibit respect and sensitivity to differences in religious practices and observances among their employees, business associates and friends. Management and other workers should use care to plan social gatherings to be inclusive and to accommodate differences in cultural, religious and other differences. Businesses also should be sensitive to the potential that workers of alternative faiths may feel discriminated against if holiday observances focus unduly on a particular religion to exclude their faith. Businesses also should use care to manage other discrimination exposures in the planning of holiday festivities, gift exchanges, and other activities. Businesses also should be vigilant in watching for signs of inappropriate patterns of discrimination in the selection of employees invited to participate in company-connected social events and off-duty holiday gatherings sponsored by managers and supervisors.

A good starting point is reminding employees, business partners and customers that the company expects employees, business partners and other guests to adhere to company rules against sexual harassment, religious and cultural and other inappropriate discrimination at company-sponsored and other gatherings involving other employees or business associates. Businesses also should remind employees that the company does not expect or require that employees submit to unwelcome sexual, religious, or other inappropriate harassment or discrimination when participating in parties or other social engagements with fellow employees, customers or other business partners and of the procedures to follow to report any concerning events. Even a simple e-mail reminder to employees that the company expects them to be familiar with and comply with these policies and can help promote compliance and provide helpful evidence if an employee or other celebrant steps over the line.

To enhance the effectiveness of these reminders, a business should consider adopting and sharing specific guidance to educate workers about its policies, including examples to illustrate company-sponsored and other off-duty holiday-associated activities of particular concern.

Businesses also should recognize that whether or not company-sponsored, the fraternization inherent in holiday parties and other celebrations where employees celebrate with other employees, clients, suppliers or other business associates can lower inhibitions and obscure the line between appropriate and inappropriate social and business behavior. With or without alcohol, some employees, clients or business associates may misinterpret the festive social atmosphere of holiday celebrations. Some employees, clients or business associates make unwelcome sexual advances, make sexually suggestive or other inappropriate statements, or engage in other actions that expose the business to sexual harassment or other employment discrimination, harassment or retaliation liability. To help deter inappropriate or risky conduct, businesses should consider providing reminders that company prohibitions and rules about sexual harassment, discrimination, fraternization and other inappropriate conduct remain in effect during the holiday season, including when planning or attending holiday celebrations or other events hosted by the business, business partners and clients, and even private management sponsored events and observances.

Gift Giving, Gratuities & Social Entertainment

The exchange of social invitations, gifts and gratuities during the holiday season or at other times throughout the year also can raise various concerns. Businesses should adopt and communicate clear policies and procedures governing both giving and receiving social invitations, gifts, and other benefits. Businesses should review applicable governmental regulations, contractual requirements, and customer and vendor policies for requirements that could impact the offering, receipt, reporting or other handling of gifts, social invitations or other activities. Businesses also should design policies to ensure that they collect and retain sufficient documentation from employees, officers, consultants, customers, and vendors to monitor compliance and other legal and operational risks associated with social entertainment, gifts, and other similar benefits, to report tax deductions and income arising from these activities appropriately, and to meet other compliance obligations. Businesses should review and update current business policies affecting social entertainment, gifting and other similar activities for opportunities to promote compliance and mitigate risks.

As with other holiday observances, all gifts, gratuities and social entertainment must adhere to applicable laws, regulations and company policies regarding bribery, conflict of interest or other inappropriate inducements or rewards. Companies should implement and enforce appropriate policies for the offering and provision of and recordkeeping and reporting of these perks.

Gifts, gratuities and entertainment practices also must not discriminate inappropriately based on sex, religion or other protected status and must reflect appropriate sensitivity to potential religious, sex, race, or other protected status. A business that anticipates workplace or work-connected private festivities might include white elephant or other gift exchanges may wish to specifically include a reminder to exercise care to avoid selecting a gift that may be sexually suggestive, insensitive to religious, cultural or other differences or otherwise offensive.

Businesses also should confirm that all applicable tax implications arising from the giving or receiving of gifts are appropriately characterized, documented and reported in accordance with applicable tax, referral, conflict of interest and other requirements.

In addition to ensuring proper tax documentation and reporting, businesses also need to ensure and retain documentation of the propriety of invitations, gifts and other benefits. Social entertainment and gift-giving activities intended to show appreciation or support marketing efforts can create significant legal or relationship risks if not properly tailored to avoid regulatory or contractual prohibitions or appearances of impropriety. Government contractors, government officials, health care providers, nonprofits, public companies and an amazingly broad range of other entities often must comply with specific statutory, regulatory, contractual or ethical requirements affecting the giving or receiving of invitations, gifts or other preferences. An ill-conceived social invitation, gift, or other benefit that violates these restrictions may expose both givers and recipients to legal prosecution, program disqualification and other serious legal risks.

In addition to these externally imposed legal mandates, many businesses have established their own conflict of interest, social entertainment, gift giving or other policies to minimize the risk that employee loyalty or judgment will be comprised by gifts offered or received from business partners or other outsiders. Employees, officers and contractors of businesses maintaining these policies may face termination or other significant discipline for violating these requirements. Accordingly, businesses offering social invitations, gifts and other benefits to valued vendor or customer relationships risk must be sensitive to these organizationally imposed requirements.

Timekeeping, Performance, Attendance & Time Off

Businesses also commonly face a range of year-end timekeeping, attendance and time off, pay, compensation and productivity concerns. The winter cold and flu season and other post-celebration illnesses, vacations, and winter weather inevitably combine to fuel a rise in absenteeism and competing requests for time off during the holiday season. Improperly designed or out-of-date timekeeping and reporting, leave and attendance, investigations, privacy and other workplace policies can exacerbate management of these challenges and their costs. Further complications can arise when dealing with employees suspected of mischaracterizing the reason for their absence or otherwise gaming the company’s time off policies. Meanwhile, performance and productivity concerns also become more prevalent as workers allow holiday shopping, personal holiday preparations, and other personal distractions to distract their performance.

Managing staffing needs and tracking and administering timekeeping, overtime and other pay, paid and unpaid time off and other attendance, compensation and absence administration while maintaining compliance with legally protected or other legitimate requests for excused time off by employees can present major headaches for businesses and their management. Recent changes in federal, state and local paid and other protected leave mandates add additional traps for the unprepared. Businesses concerned with these challenges ideally will review their policies and practices to ensure their organizations have in place well-designed policies and practices concerning timekeeping, overtime and other pay, attendance and time off, productivity and performance that comply with the Fair Labor Standards Act and other compensation, timekeeping, leave, reporting, investigations, privacy and other federal, state and local laws. Businesses should exercise care when addressing productivity and attendance concerns to investigate and document their investigation before imposing discipline. Businesses also should ensure that their policies are appropriately and even-handedly administered. They also should exercise care to follow company policies, to maintain time records for non-exempt workers, to avoid inappropriately docking exempt worker pay, and to provide all required notifications and other legally mandated rights to employees taking medical, military or other legally protected leaves. In the event it becomes necessary to terminate an employee during December, careful documentation can help the business to defend this decision. The increasing prevalence of worker classification challenges by federal and state agencies and plaintiff’s attorneys also makes it important for businesses to take steps to require and preserve access to documentation be able to demonstrate compliance with these and other applicable legal obligations by staffing and other contract labor suppliers.

Timely Investigation, Notification & Reporting

Businesses faced with allegations of discrimination, sexual harassment or other misconduct or potential business liabilities arising during holiday seasons should also take steps to ensure that appropriate staffing and other arrangements to ensure their organization’s ability to promptly investigate, if necessary, take appropriate corrective action to address complaints or other concerns arising during the holiday season around management or other time off.

Delay in investigation or redress of accidents, discrimination or other concerns can increase the liability exposure of a business presented with a valid complaint and complicate the ability to defend charges that may arise against the business. Additionally, delay also increases the likelihood that a complaining party will seek the assistance of governmental officials, plaintiff’s lawyers or others outside the corporation in the redress of his concern.

If a report of an accident, act of discrimination or sexual harassment or other liability related event arises, businesses should take steps to ensure that management responsible for responding to these and other occurrences are property trained or otherwise supported to carry out these responsibilities in an appropriate, defensible manner as well as to provide timely notification as needed to any government entities, contract partners, insurers, agencies or other parties. Injuries occurring at company related functions often qualify as occupational injuries subject to worker’s compensation and occupational safety laws. Data breaches and various other events may trigger notification or other disclosure obligations to meet statutory, contractual or other requirements. Likewise, automobile, cyber, employment practices and other liability policies often require covered parties to notify the carrier promptly upon receipt of notice of an event or claim that may give rise to coverage, even though the carrier at that time may not be obligated to tender a defense or coverage at that time. Ensuring appropriate, timely response can play a critical role in promoting defensibility, mitigating liability or preserving coverage or indemnification rights.

For Help With Investigations, Policy Updates Or Other Needs

If your organization would like to learn more about the concerns discussed in this update or seeks assistance auditing, updating, administering or defending its human resources, compensation, benefits, corporate ethics and compliance practices, or other performance-related concerns, please contact management attorney and consultant Cynthia Marcotte Stamer.

An attorney Board-Certified in Labor and Employment Law by the Texas Board of Legal Specialization, Ms. Stamer’s work focuses on helping management manage performance, legal compliance and operational risks.

Ms. Stamer also speaks, coaches management and publishes extensively on these and other related matters.

Her work, thought leadership and scholarship on helping organizations manage people, operations and risk have earned her recognition as a Fellow in the American College of Employee Benefit Counsel, a “Top Woman Lawyer,” “Top Rated Lawyer,” and “LEGAL LEADER™” in Labor and Employment Law and Health Care Law; a “Best Lawyers” in “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law.”

For additional information about Ms. Stamer and her experience or to access other publications by Ms. Stamer see here or contact Ms. Stamer directly.

Other Helpful Resources & Information

If you found this article of interest, you also may be interested in reviewing other Breaking News, articles and other resources like:

Comments Off on Workforce Strategies For Avoiding Holiday Liability Hangovers | ADA, Civil Rights, compliance, Corporate Compliance, directors, Disability, Disability Discrimination, Disability Leave, Disability Plans, Discrimination, Drug & Alcohol, Drug Testign, Drug Testing, EEOC, Emergency, Employer, Employers, Employment, Employment Discrimination, Employment Policies, enforcement, family leave, FLSA, FMLA, FMLA, Fringe Benefits, health benefit, Health Benefits, Health Plans, HR, Human Resources, Leave, medical leave, Overtime, religious accommodation, Religous Discrimination, Risk Management, Safety, Sex Discrimination, Sexual Harassment, Worker, Workers' Compensation, workfirce, Workforce, workplace violence | Tagged: ADA, Discrimination, Drug Testing, Employee Benefits, Employer, Employers, Employment, employment law, Health Insurance, Health Plan, Health Plans, holidays, Human Resources, Labor, OSHA, Safety, workers comp | Permalink
Posted by Cynthia Marcotte Stamer

AHIP Survey Shows Workers Value Employer-Provided Health Coverage

November 26, 2024

Public support and appreciation for employer-sponsored healthcare continues to run high, according to the results of a national online survey of 1,000 people with employer-provided coverage conducted by the research firm LSG on AHIPA from July 10-19, 2024. The survey results reflect employer-provided health coverage remains an important tool for employee recruitment and retention and widespread opposition to public policy changes that would replace employer-provided coverage with government-provided benefits or tax employer-provided coverage or benefits.

AHIP commissioned the survey to understand the perceptions, priorities, and expectations of consumers with employer-provided coverage about their current coverage and benefits, employers, and public policy impacting their coverage and compare their attitudes against results of a survey conducted in April 2023. LSG reports the survey has a margin of error of +/- 3% and was balanced to national demographics for gender, age, and region. AHIP announced the results of the survey on November 13, 2024.

According to AHIP, 50% of Americans received their health coverage from employer-provided plans. The survey responses revealed:

A growing majority of consumers (75%,+12% since April 2023) are satisfied with their current employer-provided coverage.
66% (+12%) are satisfied with the current health insurance system overall
Comprehensive coverage, affordability, and choice of providers their plans provide are key factors in creating this satisfaction
71% (+12%) feel the quality of their current health plan is high
74% (+6%) prefer to get their coverage through their employer over a federal or state government program
Costs remain a top consumer concern and a leading source of plan dissatisfaction, 66% (+13%) of respondents reported that what they currently pay for their coverage overall is reasonable and helps to lower their health care costs
While unhappy with coverage costs, 63% of respondents identified the comprehensiveness of coverage as a greater priority than affordability (31%).
Benefits most valued by respondents were emergency care (65%), prescription drugs (63%), and preventive care (57%).
88% of respondents reported their health plan covers preventive
services (88%), provides access to top providers (78%), and gives them financial peace of mind if something bad were to happen (75%).
53% of respondents reported feeling employer-provided coverage is effectively meeting children’s mental health needs and 61% reported believing the need for mental health care for children will increase.
67% of respondents reported considering it important for health insurance plans to cover telehealth services
76% of respondents reported believing it’s important for the federal government to maintain the COVID-19 telehealth flexibilities for patients

The survey also reflects the continued value of employer-provided health coverage in attracting and retaining employees. Sixty-one percent of respondents said health coverage plays an impactful role in employee recruitment and 80% reported health coverage was a reason for staying in their current position. Once informed that the average company pays 70-80% of the cost of coverage, a majority of respondents (71%) reported having a more favorable impression of companies that provide their employees with health insurance benefits.

The satisfaction and support from the study reflect likely opposition by workers to changes proposed by some politicians to change the current tax treatment of employer-provided coverage to tax employee health benefits. The survey found a growing majority oppose taxing employee health benefits (58%, +6%), and an even greater majority would be less likely to vote for a lawmaker who supports taxing them (63%).

Review the complete report of survey results here.

If you have questions about health plan design, administration or defense, contact the author of this update, Cynthia Marcotte Stamer.

More Information

We hope this update is helpful. For more information about the these or other legal, management or regulatory concerns, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.

About the Author

Management attorney and operations consultant Cynthia Marcotte Stamer uses a client objective oriented approach to help businesses, governments, associations and their leaders manage people, performance, risk, legislative and regulatory affairs, data, and other essential elements of their operations.

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35+ years of workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership. As a part of this experience, Miss Stamer has experience assisting clients with auditing, compliance, investigation and defense SCA, Davis-Bacon, Fair Labor Standards Act and other pay, benefits, compensation and fringe benefit concerns.

A Fellow in the American College of Employee Benefit Counsel, Vice Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, Ms. Stamer’s work throughout her 35 year career has focused heavily on working with government contractors, health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. As an ongoing component of this work, she regularly advises, represents and defends businesses on Guideline Program and other compliance, risk management and other internal and external controls in a wide range of areas and has published and spoken extensively on these concerns.

Ms. Stamer also is widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on workforce, compensation, and other operations, risk management, compliance and regulatory and public affairs concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving, and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access of this publication.

Comments Off on AHIP Survey Shows Workers Value Employer-Provided Health Coverage | Corporate Compliance | Tagged: Employee Benefits, Employer, Employers, Employment, ERISA, Health, Health Insurance, Health Plans, healthcare, Human Resources, Insurance, Medicare | Permalink
Posted by Cynthia Marcotte Stamer

$100,000 Penalty Warning To Fulfill HIPAA Access Requirements

November 21, 2024

The $100,000 penalty paid by a mental health facility alerts health plans, health care providers and health care clearinghouses (“covered entities”) to the perils of failing to timely deliver health records access as required by the Health Insurance Portability and Accountability Act (“HIPAA”).

The $100,000 civil monetary penalty against California mental health provider Rio Hondo Community Mental Health Center (“Rio Hondo”) announced by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) on October 19, 202 is the fifty-first OCR enforcement action under its HIPAA Right of Access enforcement initiative.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rules’ right of access provisions generally require covered entities to provide individuals access to their protected health information within 30 days, with the possibility of one 30-day extension and prohibits charging more than a reasonable, cost-based fee for this access.

The penalty against Rio Hondo resolves an OCR investigation into Rio Hondo over a failure to provide a patient with timely access to their medical records. OCR enforces the right of access and other requirements of the HIPAA Privacy Rule.

OCR launched an investigation after receiving a complaint from a patient that Rio Hondo did not provide timely access to their medical records, despite multiple requests in writing and by telephone.

OCR’s investigation found that it took nearly seven months from the time the patient first requested the records until Rio Hondo provided them.

The patient made multiple telephone calls in July and August 2020, regarding the status of her request, but still did not receive the requested records until it produced the records in response to the investigation.

The late delivery of the records access did not end the enforcement action. Based on the facts, OCR found that Rio Hondo failed to take timely action in response to the patient’s right of access in accordance with the HIPAA Privacy Rule.

In July 2024, OCR issued a Notice of Proposed Determination to impose a $100,000 civil monetary penalty. After Rio Hondo waived its right to a hearing and did not contest the findings of OCR’s Notice of Proposed Determination, OCR issued a Notice of Final Determination imposing the penalty.

OCR’s announcement of the penalty includes a strong warning to other covered entities to comply with HIPAA’s access requirements. It quotes OCR Director Melanie Fontes Rainer. As stating:

Ensuring patients’ rights to timely access to medical information continues to be a HIPAA enforcement priority. Healthcare providers are legally obligated to provide patients with timely access to their medical records. If they fail to provide that access, OCR will not hesitate to do everything in its power, including imposing civil monetary penalties, to ensure compliance with the law.”

While this penalty applied to a health care provider, health plans also are required to comply with the right of access rules.

With OCR promising to continue to prioritize enforcement, all covered entities should take documented steps to confirm the adequacy of their existing processes to ensure compliance with OCR’s Right of Access guidance and other applicable federal and state legal and ethical requirements like the Employee Retirement Income Security Act (“ERISA”) claims and appeals and Patient Protection and Affordable Care Act (“ACA”) adverse benefit procedures applicable to health plans and State ethical and statutory medical records delivery requirements applicable to providers. Health care providers also should consider including processes for tracking and monitoring access requests in these processes that provide for review every 30 days.Covered entities should keep records of these efforts for the six-year period required by HIPAA’s record retention rules.

Covered entities that receive follow up access requests or otherwise discover a potential failure to timely provide access should engage a HIPAA knowledgeable attorney for help and advice. Obviously, covered entities should correct any oversight promptly by delivering the records access. However legal counsel can assist by helping the covered entity assess if a violation actually occurred, avoid added violations or inflammatory communications or actions that could enhance exposures to complaints or penalties and suggest actions to help mitigate risks of an OCR investigation and penalties. For instance, past enforcement actions suggest a covered entity should consider foregoing requiring payment of charges HIPAA otherwise might allow for the records access to avoid further delay of access that could heighten penalty exposures. Covered entities also should document their delivery of access and their investigation and corrective actions addressing the source of the compliance failure.

The author of this update, Cynthia Marcotte Stamer has worked extensively with health plans on HIPAA, ERISA, the ACA on these and other HIPAA and other compliance and risk management. If you have questions or need advice or help evaluating or addressing your HIPAA compliance or other concerns, contact her.

For More Information

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for her more than 35 years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications including leading edge work on PBM, pharmacy and pharmaceutical and other health care, managed care, insurance, and insured and self-insured contracting, design, administration and regulation..

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

NOTICE: These statements and materials are for general information and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at the particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law constantly and often rapidly evolves, subsequent developments that could impact the currency and completeness of this discussion are likely. The author and Solutions Law Press, Inc. disclaim and have no responsibility to provide any update or otherwise notify anyone of any fact or law specific nuance, change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Comments Off on $100,000 Penalty Warning To Fulfill HIPAA Access Requirements | ACA, Association Health Plan, Brokers, Claims, Claims Administration, Corporate Compliance, corporate governance, Electronic Medical Record, Employee Benefits, enforcement, ERISA, Fiduciary Responsibility, health benefit, Health Benefits, health Care, health centers, health insurance, health insurance marketplace, Health IT, health plan, Health Plans, HIPAA, Human Resources, Managed Care | Permalink
Posted by Cynthia Marcotte Stamer

Hospital’s $14K FMLA Backpay Payment Cautionary Lesson For Other Businesses

November 15, 2024

Employers subject to the Family and Medical Leave Act (“FMLA”) should avoid getting nailed like Methodist Family Health by the U.S. Labor Department denying federally-protected family leave.

The Labor Department announced November 14, 2024 that Methodist Family Health paid $14,082 to resolve charges from an investigation by the Wage and Hour Division that found Methodist Family Health prematurely terminated a worker out on family medical leave in violation of the FMLA.

The Labor Department found the worker qualified for 12 weeks of protected leave for a serious medical condition and parental leave after their child’s birth, but the employer terminated the worker after nine weeks of leave.

The employer erroneously limited the worker’s amount of protected leave based on the combined use of leave between the worker and the worker’s spouse,who is also employed by the company.

In announcing the back pay award, Wage and Hour District Director Hanz Grünauer warned, “The U.S. Department of Labor will defend worker protections and flexibilities protected by law and pursue all available remedies when those rights are violated.”

To help workers identify and report FMLA violations to the Labor Department, it offers a search tool for workers to file online complaints, search for back wages collected by the Labor Department workers think they may be owed, and understand and enforce other rights.

If you have questions about or need FMLA or other employment, benefits or compensation compliance assistance or defense, contact the author of this update, Cynthia Marcotte Stamer.

More Information

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35+ years of workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership. As a part of this experience, Miss Stamer has experience assisting clients with auditing, compliance, investigation and defense of FMLA and other leave, SCA, Davis-Bacon, Fair Labor Standards Act and other workforce, leave, pay, benefits, compensation and fringe benefit concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Comments Off on Hospital’s $14K FMLA Backpay Payment Cautionary Lesson For Other Businesses | Corporate Compliance | Permalink
Posted by Cynthia Marcotte Stamer

Encourage Health Plan Members To Reevaluate Health FSA & HSA Contributions For 2025 Annual Limit Increases

November 10, 2024

Employment based health plans and their employer sponsors should encourage plan members to consider increasing the amount of their discretionary employee contributions to health savings accounts (“HSAs”) and health flexible spending account plans during their annual enrollment period to take full advantage of annual increased contribution limits for 2025 when completing their annual enrollment elections to take full advantage of potentially available tax-savings.

On May 10, 2024, the Internal Revenue Service (“IRS”) announced the 2025 maximum contribution limits for HSAs, the maximum Health Reimbursement Accounts (HRA) excepted benefit amount, and the minimum deductible and maximum out-of-pocket (“OOP”) expense limits under High-Deductible Health Plans (HDHP) in Rev. Proc. 2024-25.

2025 Inflation Adjusted HSA, HDHP, And HRA Amounts

The following adjustments apply to the calendar year 2025.

Annual HSA Contribution Maximum

$4,300 for single coverage, up $150 from $4,150 in 2024;
$8,550 for family coverage ($250 increase from $8,300 i 2024)
The annual catch-up contribution for HSA-eligible individuals aged 55 or older remains $1000.

2025 HDHP Minimum Deductible

$1,650 for single coverage ($50 increase from $1,600 in 2024)
$3,300 for family coverage ($100 increase from $3,200 in 2024)

HDHP Maximum Out-Of-Pocket

$8,300 for single coverage ($250 increase from $8,050 in 2024)
$16,600 for family coverage ($500 increase from $16,100 in 2024)

Health plans, health plan fiduciaries, service providers and administrators can help ensure both the health plan members and their sponsor realize the full tax benefits by ensuring plan enrollment and other communications are updated to communicate the limits as well as the importance for plan members to take into account annual increases in the limits when making their enrollment choices.

If you have questions about these or other health plan design or administration or need SCA compliance assistance or defense, contact the author of this update, Cynthia Marcotte Stamer.

More Information

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35+ years of workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership. As a part of this experience, Miss Stamer has experience assisting clients with auditing, compliance, investigation and defense SCA, Davis-Bacon, Fair Labor Standards Act and other pay, benefits, compensation and fringe benefit concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Comments Off on Encourage Health Plan Members To Reevaluate Health FSA & HSA Contributions For 2025 Annual Limit Increases | Corporate Compliance | Tagged: Finance, HSA, investing, personal-finance, retirement | Permalink
Posted by Cynthia Marcotte Stamer

Federal Services Contractors & Subs Should Verify SCA Compliance

October 31, 2024

Businesses contracting or subcontracting with the federal government should verify their worker classification, pay and benefit practices comply with applicable federal prevailing wage, benefit and other requirements to avoid incurring expensive lesions like the one Crystal Enterprises Inc. is learning after a U.S. Department of Labor Wage and Hour Division (“WHD”) investigation determined its practices violated the McNamara-O’Hara Service Contract Act (“SCA”).

SCA Prevailing Wage & Fringe Benefit Mandates

SCA contract clauses require contractors and subcontractors performing services under federal prime contracts in excess of $2,500 to pay service employees in various classes no less than the local prevailing wages and fringe benefits for corresponding work on similar projects in the area or the rates (including prospective increases) contained in a predecessor contractor’s collective bargaining agreement. The SCA also requires these businesses to ensure they apply proper job classifications, rates of pay, benefits and prerequisites when paying workers on their federal contracts and keep appropriate documentation to prove compliance.

The SCA generally applies to contracts entered into by federal and District of Columbia agencies that have as their principal purpose furnishing services in the U.S. through the use of “service employees.” The definition of “service employee” includes any employee engaged in performing services on a covered contract other than a bona fide executive, administrative, or professional employee who meets the exemption criteria set forth in 29 CFR Part 541.

However, the SCA does not apply to certain types of contract services. The contracts exempt from SCA coverage include:

Contracts for construction, alteration, or repair, including painting, and decorating, of public buildings or public works (these are covered by the Davis-Bacon Act);
Work required in accordance with the provisions of the Walsh-Healey Public Contracts Act;
Contracts for transporting freight or personnel where published tariff rates are in effect;
Contracts for furnishing services by radio, telephone, telegraph, or cable companies subject to the Communications Act of 1934;
Contracts for public utility services;
Employment contracts providing for direct services to a federal agency by an individual or individuals;
Contracts for operating postal contract stations for the U.S. Postal Service;
Services performed outside the U.S. (except in territories administered by the U.S., as defined in the Act); and
Contracts subject to administrative exemptions granted by the Secretary of Labor in special circumstances because of the public interest or to avoid serious impairment of government business.

SCA Violations Costly

Violations of the SCA can trigger costly consequences. Violations can result in liability to workers for unpaid wages and benefits as well as the withholding of contract payments in sufficient amounts to cover wage and fringe benefit underpayments, contract termination and liability for any resulting costs to the government, legal action to recover the underpayments, and debarment from future contracts for up to three years.

The Crystal Enterprises enforcement action illustrates one of these costly surprises that businesses violating these rules can incur. Crystal Enterprises is paying $109,127 in back wages employees to resolve exposures from a WHD investigation that concluded it failed to pay required prevailing wage and health and welfare benefits to 55 employees working at a U.S. Air Force training center dining facility on Eglin Air Force Base in Florida under a subcontract to perform full food services at the training center dining facility on the Base. The investigation found by doing so, WHD also concluded Crystal Enterprises also paid workers lower rates of pay for holidays and sick leave and vacation time used.

Federal Services Contractors Must Manage Compliance

Federal contractors subject to the SCA should take documented efforts to verify compliance and avoid common mistakes including:

Underpayment of service workers due to misclassification;
Erroneously considering workers exempt without regard to 29 C.F.R. Part 541 rules;
Failure to make timely payment of wages or fringe benefit contributions;
Lack of proper recordkeeping when cash payments are made to satisfy fringe benefit requirements;
Failure to notify service employees of the applicable wage and fringe benefit requirements, or failure to post the “Notice to Employees Working on Government Contracts” at a prominent and accessible place at the worksite;
Failure to use the conformance procedure for unlisted classes of employees;
Failure to segregate and keep records on hours spent on contract work and non-contract work for employees who do both; and
Failure to implement rate increases (if any) in a new wage determination in a multi-year contract subject to annual appropriations.

If you have questions about or need SCA compliance assistance or defense, contact the author of this update, Cynthia Marcotte Stamer.

More Information

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35+ years of workforce and other management work, public policy leadership and advocacy, coaching, teachings, scholarship and thought leadership. As a part of this experience, Miss Stamer has experience assisting clients with auditing, compliance, investigation and defense SCA, Davis-Bacon, Fair Labor Standards Act and other pay, benefits, compensation and fringe benefit concerns.

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press, Inc.™

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

Comments Off on Federal Services Contractors & Subs Should Verify SCA Compliance | compensation, Corporate Compliance, Employee Benefits, Employer, Employers, Fringe Benefit, Fringe Benefits, Government Contractors | Permalink
Posted by Cynthia Marcotte Stamer