The sweeping threat risk ransomware attacks present for health plans, their fiduciaries, business associate and other service providers, employer and other plan sponsors and their participants and beneficiaries is driven home by the disclosure of United Health Group (“UHG”) subsidiary Change Health to the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) that it now has sent approximately 100 million individuals individual breach notifications that the February 21, 2024, Blackcat 1234 ransomware attack Change Health experienced impacted their electronic personal health information (“ePHI”). With health plans particularly exposed to the rising epidemic of ransomware threats, health plans, their fiduciaries, employer and other health plan sponsors and service providers face growing imperatives to tighten up both their compliance and risk management against these cyber threats.

Health Plans, Their Fiduciaries, Sponsors and Service Providers Face Health Plan Related Cybersecurity Responsibilities & Risks

The UHG Change Health breach and its evolving fallout provides a timely reminder to health plans and insurers, their fiduciaries, plan sponsors, vendors and leaders to ensure their own timely and prudent steps both to respond to fallout from the UHG breach as well as to prevent, prepare for and respond to other future cyber threats direct threats to their own data and systems as well as indirect threats arising from ransomware, malware and other cyber events affecting business associates and other service providers, the plan sponsor, health care providers and other third party systems and data interfacing with their own systems and data.

Health plans and their business associate service providers face detailed responsibilities to prevent access, use, disclosure or destruction of electronic (“ePHI”) and other personally identifiable information (“PHI”) except as allowed by the Health Insurance Portability and Accountability Act (“HIPAA”) and to notify individuals of breaches of their ePHI in accordance with HIPAA’s breach notification rules. As part of these rules, HIPAA also restricts the circumstances that health plans legally can allow employers or their representatives to access or use health plan PHI without a HIPAA-compliant authorization from the applicable individual. The months-long delay in Change Health’s ability to identify the individuals whose ePHI was impacted by the February 21, 2024, breach demonstrates the challenges that ransomware and other malware attacks to their own or their party systems can create for health plans, their fiduciaries and business associates in fulfilling these obligations as well as carrying out other critical plan functions. Aside from dealing with the immediate demands created by the breach, the Change Health breach and other similar events are the type of events that prompt an obligation under the HIPAA Security Rule for health plans and other HIPAA-covered entities to review and update their documented HIPAA Security Risk analyses and resulting safeguards for protecting the destruction, loss of use, unauthorized use or disclosure and other HIPAA required safeguards against future ransomware or other threats. Health plans and their fiduciaries should consult with experienced legal counsel about recommended processes for conducting and documenting this updated analysis.

Beyond these HIPAA mandates, the disruptions to health plan data and operations experienced by many health plans as a result of the UHG/Change Health breach also puts health plan on notice of the potential need for health plans, their fiduciaries and service providers to conduct a documented, prudent analysis of their health plan security, backup and recovery, and other systems to both protect ePHI and other sensitive health plan data and systems from unauthorized destruction, access, and disclosure that could disrupt health plan operations, allow use or disclosure of plan information other than for the exclusive benefit of the health plan, its participants and beneficiaries or both under fiduciary responsibility rules of the Employee Retirement Income Security Act (“ERISA”).

In weighing their fiduciary responsibility to safeguard the health plan, its data and systems against ransomware, malware and other cybersecurity threats, health plans and their fiduciaries should keep in mind that the Department of Labor Employee Benefit Security Administration (“EBSA”) interprets the prudence, exclusive benefit and other ERISA fiduciary responsibility requirements as applying to PHI, financial, and other health plan data and systems. As part of these discretion, or control (“fiduciaries”) generally should take documented steps to ensure their ability to defend the prudence of their efforts to protect health plan data and systems including:

• To prevent disruptions to health plan systems and data from malware or other malicious or other events experienced by their health plan and its sponsors, service providers, and other third parties interfacing with health plan systems that could disrupt health plan enrollment, claims and appeals or other operations as well as against access, use or disclosure except as legally allowed for the exclusive benefit of the health plan participants and beneficiaries and in accordance with HIPAA;
• To implement and administer appropriate contractual, audit, oversight, notification, cyber liability and other coverage and indemnification and other arrangements with business associates and other third parties whose interactions with the health plan create threats to the integrity and security of health plan systems and operations;
• To plan and implement appropriate insurance, indemnity and other arrangement to pay for prudent investigations and other responses necessary to a known or suspected threat or breach impacting its health plan administration, data and systems;
• To plan and implement appropriate monitoring, notification, investigation, response and recovery arrangements to position the health plan to resume and continue timely administration of health plan enrollment, claims, appeals and other operations in the event the health plan or its service providers are impacted by a cybersecurity or other event that impacts health plan data or administrative systems;
• To ensure timely monitoring, notification and response to cyber and other threats to its systems and data to protect the health plan and its participants and beneficiaries from damages arising from cybersecurity and other threats to its systems and data;
• To communicate prudently with participants, beneficiaries and others regarding cybersecurity and other events impacting the security of data and systems; and
• To act prudently to ensure adequate monitoring and response to cybersecurity and other threats to health plan data and systems to prevent and mitigate disruptions to health plan data and systems that could disrupt the orderly and timely administration of their health plan.

Change Health/UHG Breach Highlights Health Plan Cyber Threats & Exposures

The sweeping disruptions to health plan and other operations arising from the UHG/Change Health ransomware attack graphically illustrate how malware and other cyber incidents can trigger catastrophic disruptions in health plan and other health industry operations whether experienced directly by the health plan or from the indirect effects of a cybersecurity event experienced by a third-party interfacing with the health plan.

Health plans are particularly at risk from ransomware, malware and other hacking threats. OCR breach reports confirm ransomware and hacking present the largest cyber-threats for health plans and health care providers. While most OCR HIPAA resolution agreements have involved health care providers, the largest HIPAA breaches and resulting HIPAA resolution payments to date have involved health insurers and their health plans.

Ransomware, hacking and other cyber risks present significant and growing threats to health plans and health care providers. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.

The UHG breach demonstrates ransomware and other breaches can have sweeping liability and operational disruptions that extend beyond the original victim and include but are rarely limited to HIPAA penalties.

In response to the growing threat revealed by this data, OCR increasingly has urged health plans and other covered entities to protect their data and systems against ransomware and other cyberattacks. Choice Health/UHG attack occurred just days after OCR announced the second of two HIPAA resolution agreements since October as well as published a series of other guidance warning covered entities and their business associates to guard against ransomware and other cybersecurity threats as part of their HIPAA obligations prompted by concern over exploding threats.

Historically, most health plans, their sponsors, fiduciaries, and business associates assumed they could rely upon their insurers or other service providers to handle breaches experienced by that vendor impacting their health plans or members. However, OCR HIPAA and EBSA ERISA guidance reflects that health plans and plan fiduciaries need to take prompt documented actions before, during and after an insurer or other plan administrative services provider experiences a cybersecurity incident.

While UHG struggles to recover and defend its actions before Congress, regulators, customers, plan members and patients, providers and others, health plans, their sponsors, fiduciaries, and vendor business associates need to ensure their ability to demonstrate and defend the adequacy of their own breach protections, response, and other compliance.

HIPAA Security & Breach Notification Responsibilities

While most health plans, their sponsors, fiduciaries and vendors expect Change Health and other UHG entities know UHG bears breach notification and other HIPAA responsibilities and to incur liabilities under HIPAA and other federal and state data privacy and cybersecurity laws, many health plan fiduciaries, sponsors, insurers, and administrative or other service providers don’t understand their own responsibilities to prevent and respond to the UHG and other cyber events potentially impacting their health plans under HIPAA. 

Guidance published by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) on March 13, 2023, alerts health plans and health insurers, their fiduciaries and plan sponsors, health care providers, health care clearinghouses, and their business associates (covered entities) against overlooking their own potential HIPAA responsibilities arising from the February 21 Choice Health attack or other similar events.

HIPAA requires covered entities and their business associates to protect the privacy and security of protected health information, to have and enforce HIPAA-compliant business associate agreements, to conduct timely documented risk assessments in response to known or foreseeable security threats, and to provide notice of a breach to OCR, affected individuals and for breaches affecting more than 500 individuals. This responsibility includes both protecting protected health information from unauthorized use or disclosure, as well as to prevent it from improper destruction or unavailability such as can result from a ransomware attack or other disaster.

Under the HIPAA Security Rule, covered entities must conduct documented risk assessments to evaluate and monitor their electronic personal health information (EPHI) and associated systems for potential breaches and other threats that expose EPHA to unauthorized use, access, disclosure, destruction or other compromise.

To fulfill this requirement, the Security Rule requires covered entities and business associates to conduct documented risk assessments impacting their EPHI and to update these risk assessments in response to internal or external events impacting the adequacy of their risk assessments or security safeguards.

While the responsibility of covered entities and business associates to protect EPHI against unauthorized use, access and disclosure from cybercriminals and others receives the most attention, the Security Rule also includes often less discussed responsibility to protect EPHI and related operating systems against destruction or other disruptions from a wide range of threats including ransomware attacks. 

OCR guidance makes clear that OCR views safeguarding EPHI against ransomware and other cybersecurity threats as encompassed in this duty.  As part of these efforts, OCR and other cybersecurity agencies have recommended among other things that covered entities and business associates:

• Routinely take inventory of assets and data to identify authorized and unauthorized devices and software;
• Prioritize remediation of known exploited vulnerabilities’
• Enable and enforce multifactor authentication with strong passwords;
• Close unused ports and remove applications not deemed necessary for day-to-day operations.

 See e.g., #StopRansomware: ALPHV Blackcat | CISA.

Furthermore, when a breach of results in an unauthorized use, access, disclosure or destruction of EPHI, the HIPAA Breach Notification Rule requires covered entities and their business associates to provide timely notification of the breach to subjects of the breached EPHI and OCR, and if the breach affects more than 500 subjects, to the media.  Concurrently, the HIPAA Security Rule requires health plans and other covered entities to evaluate through documented risk assessments and take appropriate timely action to update their EPHI security as necessary to respond to breaches, potential breaches and other evolving threats to their EPHI and related systems. 

On March 13, 2024, the Office of Civil Rights (OCR) released a “Dear Colleague letter” that warns the February 21, 2024 CH/UHG data breach is likely to trigger HIPAA obligations and investigations for Choice Health and UHG as well as other HIPAA-covered health plans, heath care providers, heath care clearinghouses and business associates.  While stating the investigation currently focuses on Change Healthcare and UHC, for instance, the Dear Colleague Letter warns that OCR anticipates that its response to the February 21, 2024 CH/UHG Attack eventually also will include “secondary” investigations of other health plans, health care providers, health care clearinghouses and business associates “tied to or impacted by this attack.”

In light of these anticipated secondary investigations, OCR’s Dear Colleague letter warns health plans, health care providers, health care clearinghouses, business associates to ensure they timely and properly handle their own potential HIPAA responsibilities arising from the CH/UHG Attack.  The Dear Colleague letter expressly alerts health plans, health care providers and other covered entities and business associates “that have partnered with Change Healthcare and UHG” in anticipation of OCR’s expected secondary investigations to ensure that their own ability to demonstrate their organization meet all required HIPAA responsibilities including that:

• All required “business associate agreements are in place;
• All required breach notifications are provided to HHS, affected persons and in the event of a large breach affecting more than 500 individuals, to the media; and
• All security and other HIPAA responsibilities are met.

The Dear Colleague Letter also directed covered entities and their business associates to the following previously released OCR resources for assistance in understanding their responsibilities for guarding EPHI against ransomware and other cybersecurity threats:

• The OCR HIPAA Security Rule Guidance Material webpage;
• OCR Video on How the HIPAA Security Rule Protects Against Cyberattacks;
• OCR Webinar on HIPAA Security Rule Risk Analysis Requirement;
• HHS Security Risk Assessment Tool;
• Factsheet: Ransomware and HIPAA; and
• Healthcare and Public Health (HPH) Cybersecurity Performance Goals.

Standing alone, the Dear Colleague Letter makes clear that all covered entities partnered with or impacted by disruptions from the CH/UHG attack need to take documented steps to reevaluate and tighten the adequacy of their existing security safeguards as well as their processes for monitoring and responding to evolving ransomware and other cybersecurity threats in anticipation of becoming the target of potential “secondary” OCR investigations arising from the CH/UHG Attack.

While the Dear Colleague Letter specifically references covered entities and business associates “partnered” with Choice Health, OCR’s previously issued guidance warning all covered entities and their business associates to safeguard their EPHI against ransomware and other cybersecurity threats, strongly suggest that all covered entities and business associates should consider the advisability of reevaluating the adequacy of their own EPHI safeguards in light of the heightened ransomware and other cyber threat illustrated by the CH/UHG Attack.  Consequently, all covered entities and business associates partnered with or impacted by the CH/UHG Attack or its resulting distributions specifically, as well as covered entities and business associates generally should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations arising from the Choice Health and other malware events and threats.

Health Plan Data Security & Breach Related ERISA Duties

In addition to any applicable HIPAA responsibilities, fiduciaries and sponsors of employer or union sponsored health plans subject to the Employee Retirement Income Security Act (ERISA) also should consider whether the CH/UHG Attack or the heightened ransomware and other cyber security threats any additional actions are prudently necessary to protect the health plan data, assets or operations.

ERISA generally requires individuals or entities named as fiduciaries or otherwise possessing functional discretionary authority or responsibility or authority over a plan or its assets (fiduciaries) to act prudently to protect and administer the plan and its assets.  Department of Labor Employee Benefit Security Administration (EBSA) guidance published in April, 2021 first officially confirmed its interpretation of ERISA’s duty of prudence as including a duty to utilize prudent cybersecurity safeguards.  Since EBSA published this cybersecurity guidance EBSA also has also added cybersecurity inquiries to its plan fiduciary audits. As a result, in addition to complying with HIPAA, ERISA-covered health plan fiduciaries and sponsors also should be prepared to demonstrate plan fiduciaries acted prudently to comply with HIPAA as well as the following actions to safeguard health and other employee benefit plan data and systems against cybersecurity threats:

• Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.

• Cybersecurity Program Best Practices: Assists plan fiduciaries and record-keepers in their responsibilities to manage cybersecurity risks.
• Online Security Tips: Offers plan participants and beneficiaries who check their retirement accounts online basic rules to reduce the risk of fraud and loss.

In light of this OCR and EBSA guidance, health plan sponsors, fiduciaries and vendors and other HIPAA covered entities and business associates are urged to take documented steps to audit and strengthen as needed their safeguards against hacking and other cybersecurity threats including:

• In the case of any health plan or health plan vendor, taking well documented steps to assess and tighten as necessary their health plan systems and data security to meet or exceed the recommendation outlined in the EBSA cybersecurity guidance or otherwise necessary to prudently guard their plans and plan data and systems against cybersecurity threats.
• Reviewing and monitoring on a documented, ongoing basis the adequacy and susceptibilities of existing practices, policies, safeguards of their own organizations, as well as their business associates and their vendors within the scope of attorney-client privilege taking into consideration data available from OCR, data regarding known or potential susceptibilities within their own operations as well as in the media, and other developments to determine if additional steps are necessary or advisable.
• Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility.
• Renegotiating and enhancing service provider agreements to detail the specific compliance, audit, oversight and reporting rights, workforce and vendor credentialing and access control, indemnification, insurance, cooperation and other rights and responsibilities of all entities and individuals that use, access or disclose, or provide systems, software or other services or tools that could impact on security; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; and other relevant matters.
• Verifying and tightening technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information and systems.
• Conducting well-documented training as necessary to ensure that members of the workforce of each covered entity and business associate understand and are prepared to comply with the expanded requirements of HIPAA, understand their responsibilities and appropriate procedures for reporting and investigating potential breaches or other compliance concerns, and understand as well as are prepared to follow appropriate procedures for reporting and responding to suspected
  violations or other indicia of potential security concerns.
• Tracking and reviewing on a systemized, well-documented basis actual and near miss security threats to evaluate, document decision-making and make timely adjustments to policies, practices, training, safeguards and other compliance components as necessary to identify and resolve risks.
• Establishing and providing well-documented monitoring of compliance that includes board level oversight and reporting at least quarterly and sooner in response to potential threat indicators.
• Establishing and providing well-documented timely investigation and redress of reported
  violations or other compliance concerns.
• Establishing contingency plans for responding in the event of a breach. 
• Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and requirements.
• Preparing and maintaining a well-documented record of compliance, risk, investigation and other security activities.
• Pursuing other appropriate strategies to enhance the covered entity’s ability to demonstrate its compliance commitment both on paper and in operation.

Because susceptibilities in systems, software and other vendors of business associates, covered entities and their business associates should use care to assess and manage business associate and other vendor associated risks and compliance as well as tighten business associate and other service agreements to promote the improved cooperation, coordination, management and oversight required to comply with the new breach notification and other HIPAA requirements by specifically mapping out these details.

Furthermore, while the preemption provisions of ERISA generally insulate health plans and their sponsors from responsibility or liability for complying with state insurance, data security, breach notification or other state law cybersecurity and cyber breach and breach notification laws and rules, health insurers and other health plan service providers generally remain subject to these state law requirements.  Consequently, health insurers, administrative service providers and other health plan vendors also should act promptly to evaluate and ensure their fulfillment of all applicable cybersecurity and data breach mandates under relevant state law.

Leaders of covered entities or their business associates also are cautioned that while HIPAA itself does not generally create any private right of action for victims of breach under HIPAA, breaches may create substantial liability for their organizations or increasingly, organizational leaders under state data privacy and breach, negligence or other statutory or common laws.  In addition, physicians and other licensed parties may face professional discipline or other professional liability for breaches violating statutory or ethical standards.  Meanwhile, the Securities and Exchange Commission has indicated that it plans to pursue enforcement against leaders of public health care or other companies that fail to use appropriate care to ensure their organizations comply with privacy and data security obligations and the Employee Benefit Security Administration recently has issued guidance recognizing prudent data security practices as part of the fiduciary obligations of health plans and their fiduciaries.

Health plans and other covered entities are reminded that appropriate strategic planning and use of attorney-client privilege and other evidentiary tools can critically impact the defensibility of pre-breach, breach investigation and post-breach investigation and decision-making. Because HIPAA, EBSA and other rules typically require prompt investigation and response to known or suspected hacking or other cybersecurity threats, health plans and other covered entities or business associates should seek the assistance of experienced legal counsel to advise and assist in these activities to understand the potential availability and proper use of these and other evidentiary rules as part of the compliance planning process as well as to prepare for appropriate use in the event of a known or suspected incident to avoid unintentional compromise of these protections.

ERISA & Other Risks From Untimely Timely Acceptance & Processing of Health Plan Eligibility & Benefit Provisions

Since Change Health shut down its tools and systems CH/UHG Attack has created and continues to cause nationwide disruptions in the ability of pharmacy, physician and other health care providers to submit, and health plans and insurers to receive and process a wide range of health care billing, claims and other transactions because of the widespread integration and use of Choice Health tools in systems health care providers and payers use for the submission, receipt, and processing of health care provider eligibility, billing and other health benefits.  

Along with the liabilities and headaches that the ransomware attack and resulting disruptions create for Choice Healthcare and UHG, delays and other disruptions in the handling of health benefit eligibility, claims processing, notifications and payment by health plans and their administrative services providers arising from can create a host of additional liability headaches health plans, health insurers, their fiduciaries and administrative services providers in addition to those arising directly from the HIPAA and other cybersecurity breach itself.

For ERISA-covered health plans, ERISA generally holds health plans and their fiduciaries accountable for the prudent, timely administration of health plan eligibility, claims and other administrative functions in accordance with the terms of the plan and within the applicable time frames and other requirements of ERISA’s reasonable claims procedure and adverse benefit determination rules.  Health plans and their ERISA plan administrators generally must receive and process claims transactions required by the adverse claim determination regulations and provide participants or beneficiaries with detailed written notifications for any claims not processed and paid within the relevant 72-hour, 15-day or 30-day time period specified by the adverse claim determination rules.  Noncompliance with these requirements both undermines the defensibility of the health plan’s denial of coverage and subjects the plan administrator to liability for EBSA penalties and/or discretionary awards of penalties plus attorneys’ fees and other costs of enforcement to plan participants or beneficiaries for failures to deliver timely notification of the denial.  To the extent that EBSA or a court determines that the failure to timely and appropriately process and pay benefits resulted from a lack of prudence or other breach of ERISA fiduciary duties, fiduciaries are at risk for incurring personal liability for actual damages to the plan or its participants plus attorneys’ fees and other costs of enforcement; EBSA penalties for engaging in a breach of fiduciary duty under ERISA section 502(l); or both.

Beyond these ERISA-related risks, delays in processing and payment of health care provider claims also create potential additional liability for health insurers, health plans and their administrators to the extent the disruptions prevent the timely payment and processing of health benefit claims in violation of health care provider rights under managed care or other provider contracts, prompt pay and surprise billing or other provider legal rights.  Unlike member claims assigned to providers, ERISA generally does not preempt these nonderivative provider rights and claims or the additional state law damages, penalties or other remedies arising under state law against health insurers, health plans and plan administrators found to violate these rules. Consequently, delays in payments to providers also could substantially increase the costs and liabilities that health insurers, health plans, their fiduciaries, administrators, and employers and other sponsors obligated under the plan terms or vendor contracts to pay these costs.

In light of these and other potential risks, health insurers and health plans, their employer, union and other sponsors, fiduciaries, administrative services providers and other vendors should act quickly to investigate and ensure proper management of the fallout from the CH/UHG Attack and the heightened ransomware and other cybersecurity threats it represents.

Along with working with qualified legal counsel to address the potential HIPAA, ERISA and other responsibilities the health plan or insurer, its fiduciaries, service providers and sponsor bear from the CH/UHG Attack and other cyber risks, most parties also will want to evaluate obligations to notify cybersecurity and other liability insurers, seek indemnification from Choice Healthcare, UHG or other potentially culpable parties and evaluate other sensitive data and strategies for mitigation of their health plan and their own resulting liabilities, costs and other consequences.

For Additional Information

We hope this update is helpful. Solutions Law Press, Inc. invites you to receive future updates by registering on  here and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you need have questions or need assistance with this or other cybersecurity, health, benefit, payroll, investment or other data, systems or other privacy or security related risk management, compliance, enforcement or management concerns, to inquire about arranging for compliance audit or training, or need legal representation on other matters,  contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

About the Author 

Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health and other benefit, health care and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

Ms. Stamer is widely recognized and sought out for her knowledge and experience on health, employee benefits and other privacy and security. Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.

A Fellow in the American College of Employee Benefit Counsel, Scribe for the Co-Chair of the American Bar Association (“ABA”) JCEB Annual Agency Meeting with HHS-OCR, ABA International Section Life Sciences and Health Committee and Vice-Chair and Chair Elect of its International Employment Law Committee, Chair of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group Chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee and author of a multitude of highly-regarded publications on HIPAA and other cybersecurity, privacy, technology, employee benefits and health care publications, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• EEOC Publish Guidance Discrimination & Accommodation Duties Applying Vaccine Mandates
• Construction Industry Urged To COVID-19 Safety & Timekeeping Protocols
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• H-2B Application Filing Window For 4/1/24 Opens 1/2/24
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Brett Brenner Appointed EEOC Deputy Chief Operating Officer
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences, No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requirements For Federal Employees, Contractors, International Travelers, Head Start Educators & CMS-Certified Facilities
• Autism Health Plan Exclusions and Limitations May Trigger Mental Health Parity and Addiction Equity Act Liabilities
• Labor Department Shares Resources on PERM and H-2A Program Updates
• Trucking Cos.’ $1.25M Sex Discrimination warns Other Employers
• $167K In Backpay and Penalties Restaurant Paying For FLSA Violations Warns Other Businesses
• $400,000 Settlement Shows Risks Of Mishandling Pregnant Employees

OCR’s warning and referencing of these resources strongly signals that OCR will hold health plans and business associates targeted for OCR investigation after experiencing or being impacted by a breach to demonstrate their fulfillment of these and other requirements. Accordingly, given OCR’s Letter and the continued heightened ransomware and other cyber security risk, health plans and other covered entities and business associates, their fiduciaries, sponsors, and vendors whether or not partnered with or impacted by the Choice Health/UHG should work with experienced legal counsel to conduct documented risk assessments of their systems, exposures, responsibilities and risks taking into account these developments as soon as possible in anticipation of complaint or audit driven investigations due to he UHG/Choice Health and other ransomware, malware and cybersecurity events and threats.

Based on existing OCR guidance, Choice Health/UHG and other known and evolving ransomware and other cyber attacks almost certainly warrant the need for those partnered or impacted by the breach to conduct documented, evaluations of the need to provide breach notification, as well as updated risk assessments. Moreover, given the widespread and continuing exposure to ransom and other cyber security risks referenced in the OCR and other reports, even those covered entities not partnered or impacted also need to conduct updated risk assessments based on the notifications of emerging risks, highlighted by that breach.

Along with updating risk assessments and resulting safeguards, covered entities, and business associates also clearly should ensure that they have and are enforcing up-to-date, business associate agreements, privacy practices and policies, and cyber threat monitoring, defense and response.impacted health plans, their employer and other sponsors, fiduciaries and business associates also should ask legal counsel about the availability of and notification and other requirements to qualify for indemnity or liability insurance coverage of breach-related claims and other options to mitigate or recover liabilities and costs arising from these and other breaches.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

R Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• EEOC Publish Guidance Discrimination & Accommodation Duties Applying Vaccine Mandates
• Construction Industry Urged To COVID-19 Safety & Timekeeping Protocols
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• H-2B Application Filing Window For 4/1/24 Opens 1/2/24
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Brett Brenner Appointed EEOC Deputy Chief Operating Officer
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requirements For Federal Employees, Contractors, International Travelers, Head Start Educators & CMS-Certified Facilities
• Autism Health Plan Exclusions and Limitations May Trigger Mental Health Parity and Addiction Equity Act Liabilities
• Labor Department Shares Resources on PERM and H-2A Program Updates
• Trucking Cos.’ $1.25M Sex Discrimination warns Other Employers
• $167K In Backpay and Penalties Restaurant Paying For FLSA Violations Warns Other Businesses
• $400,000 Settlement Shows Risks Of Mishandling Pregnant Employees

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Health and fitness mobile application developers and other businesses that collect or handle electronic or other health care information that are not subject to the by the Health Insurance Portability and Accountability Act (“HIPAA”) should evaluate their responsibility to comply with the personal health record (“PHR”) breach notification requirements of the recently amended Federal Trade Commission (“FTC”) Health Breach Notification Final Rule (the “HBN Rule”) and if subject to the HBN, ensure their compliance taking into account amendments to the HBN Rule that took effect on July 29, 2024. 

The HIPAA Breach Notification Rule imposes specific requirements on health care providers, health plans, health care clearinghouses and their business associates (“HIPAA Entities”) to protect individually identifiable health information (“PHI”) against improper use, access, disclosure or destruction and to provide breach notification to individuals, the Department of Health and Human Services Office of Civil Rights (“OCR”) and the media if a breach of unsecured electronic protected information happens.

To provide for notifications of breaches of electronically identifiable health information not covered by HIPAA, the HBN Rule generally requires each vendor of PHRs covered by its rules (“PHR Vendors”) and related entity that discovers a breach of security of unsecured personally identifiable health information (“UPHI”) in a PHR it maintains or provides to notify:

• Each individual who is a citizen or resident of the United States whose unsecured UPHI was acquired by an unauthorized person as a result of the security breach
• The Federal Trade Commission; and
• If the breach involved UPHI of 500 or more residents of such State or jurisdiction is, or is reasonably believed to have been, acquired during such breach, prominent media outlets serving a State or jurisdiction,

Applicability To HBN Rule

Amendments to the HBN Rule that took effect on July 29, 2024, clarify that the HBN Rule breach notification requirements apply more broadly than many parties dealing with PHR and PHR technologies previously understood as well as other requirements of the HBN Rule.  The FTC revised several definitions in the HBN Rule to clarify that it applies health apps and similar technologies not covered by HIPAA by modifying the definition of “PHR identifiable health information” and adding two new definitions for “covered health care provider” and “health care services or supplies.” It also revised the definition of “PHR related entity” to make clear that 1) the HBN Rule covers entities that offer products and services through the online services, including mobile applications, of vendors of personal health records and 2) only entities that access or send UPHR to a personal health record — rather than entities that access or send any information to a personal health record — qualify as PHR related entities;

These changes clarify that the HBN breach notification requirements generally apply to p Providers and developers of websites, mobile applications, or internet-connected devices that provide mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, or diet, or that provides other health-related services or tools and other similar technologies that provide healthcare services and supplies, and related technologies not covered.

Other Changes & Clarifications To HBN Rule

• Breach Of Security: The Final Rule clarifies that a “breach of security” includes an unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or an unauthorized disclosure;
• Clarifying Multiple Sources Of PHR Identifiable Health Information: The FTC clarified what it means for a personal health record to draw PHR identifiable health information from multiple sources;
• Electronic Notification: The FT expanded the allowable use of email and other electronic means of providing clear and effective notice to consumers of a breach;
• Expanding Required Consumer Notice Content:  The amendments to the HBN Rule expand the required content that notifications of breaches must include. For example, the notice would be required to include the name or identity (or, where providing the full name or identity would pose a risk to individuals or the entity providing notice, a description) of any third parties that acquired unsecured PHR identifiable health information as a result of a breach of security;
• Changing Notification Timing: The amendment to the HBN Rule changes the deadline for providing breach notification to the FTC under the rule. For breaches involving 500 or more individuals, covered entities must notify the FTC at the same time they send notices to affected individuals, which must occur without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security; and
• Improving readability: The amendments to the HBN Rule also include changes to improve the rule’s readability and promote compliance.

HIPAA-Covered Breaches

HIPAA Entities are reminded that in addition to its broadly applicable Privacy, Security and Breach Notification Rules, OCR also has promulgated specific guidance about mobile application and related technology. This mobile application guidance, among other things, include risk analysis, configuration to reduce risks, and workforce training on appropriate use when HIPAA Entities use mobile application technologies.

Additionally OCR also has adopted specific requirements on the Use of Online Tracking Technologies by HIPAA Entities to collect and analyze information about how users interact with regulated entities’ websites or mobile applications. While the U.S. District Court for the Northern District of Texas ruled Am. Hosp. Ass’n v. Becerra, — F. Supp. 3d —-, No. 4:23-cv-1110, 2024 WL 3075865 (N.D. Tex. June 20, 2024) ruled unlawful and invalidated the portion of this rule that provides that HIPAA obligations are triggered in “circumstances where an online technology connects (1) an individual’s IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers.” the remainder of that rule remains effective. HIPAA-Entities should ensure compliance with both of these rules as well as all other applicable HIPAA Breach and other rules.

To aid in this process, OCR has published various tools and resources on building privacy and security protections into mobile application technologies including the following:

• Mobile Health Apps Interactive Tool – The Federal Trade Commission (FTC), in conjunction with OCR, the HHS Office of National Coordinator for Health Information Technology (ONC), and the Food and Drug Administration (FDA), have updated the popular Mobile Health Apps Interactive Tool. This tool is designed to help developers of health-related mobile apps, including HIPAA-regulated entities, understand what federal laws and regulations might apply to them. The guidance tool asks developers a series of questions about the nature of their app, including about its function, the data it collects, and the services it provides to users. Based on a developer’s answers to those questions, the guidance tool points the app developer toward detailed information about certain federal laws that might apply. These include the FTC Act, the FTC’s Health Breach Notification Rule, the Health Insurance Portability and Accountability Act (HIPAA) Rules, and the Federal Food, Drug and Cosmetics Act (FD&C Act), Children’s Online Privacy Protection Rule (COPPA), and 21st Century Cures Act and ONC Information Blocking Regulations.
• Health App Use Scenarios & HIPAA – PDF – This guidance details various use scenarios for mHealth applications, and explains when an app developer may be acting as a business associate under the HIPAA Rules.
• Access Right, Apps, and APIs – View frequently asked questions about how the HIPAA Rules apply to covered entities and their business associates with respect to the right of access, apps, and application programming interface (APIs).
• Health Information Technology – View frequently asked questions on HIPAA and health IT.
• Guidance on HIPAA & Cloud Computing – OCR developed guidance to assist HIPAA covered entities and business associates, including cloud services providers (CSPs), in understanding how they can use cloud computing technologies while complying with their HIPAA obligations.

These resources can be helpful for both HIPAA-Entities to comply with HIPAA and non-HIPAA covered entities to comply and manage risks under the HBR Rule.

In the face of these and other Federal and state law rules, all parties dealing with electronic health information should confirm their status under the FTC and OCR Rules and take documented steps to verify, monitor and maintain their compliance with breach notification and other requirements.

About the Author 

Scribe responsible for planning and leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with HHS-OCR for more than a decade and author of many highly regarded publications on HIPAA and other privacy and data security, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of HIPAA and other cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for government contractors and other public and private businesses; managed care and other health and life science, insurance, technology, and other performance and data dependent organizations,

A Fellow in the American College of Employee Benefit Counsel, Immediate Past Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Co-Chair of its International Employment Law Committee, and its Health Care Liaison; Immediate Past Chair of the ABA TIPS Section Medicine & Law Committee; Past Chair of the ABA Managed Care & Insurance Interest Group; Former Chair of the ABA RPTE Employee Benefits & Other Compensation Group and Chair or Co-Chair of its Welfare Benefit Committee for more than 10 years , and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

The more than $560,000 in civil monetary penalties (“CMPs”) collected since March by the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) from three HIPAA-covered entities for failing to respond to medical record requests within 30 days as required by the Health Insurance Portability & Accountability Act (“HIPAA”) right of access rule (“Access Rule”) shows patients, their personal representatives and health care providers, health plans, health care clearinghouses (“Covered Entities”) the seriousness of OCR’s commitment to enforcement of the Access Rule.

On August 2, 2024, OCR announced emergency medical provider American Medical Response (“AMR”) paid a $115,200 civil monetary penalty (“AMR CMP”) for waiting 370 days before delivering medical records requested by a patient’s personal representative.  OCR’s AMR CMP announcement follows its April 1, 2024 announcement Hackensack Meridian Health, West Caldwell Care Center (“Hackensack Meridian Health”) paid a $100,000 CMP (“HMH CMP”) for waiting 161 days to provide medical records requested by a patient’s personal representative and March 29, 2024 announcement of its agreement to accept payment of $35,000 in satisfaction the previously assessed $250,000 CMP against Phoenix Healthcare LLC d/b/a Green County Care Center (“Phoenix”) for Access Rule violations.  With these three actions, OCR collected $565,000 in CMPs for Access Rule violations since March 29, 2024, and has announced a total of 49 high-dollar Access Rule CMP or settlement collections since announcing its Access Rule enforcement initiative in 2019.

OCR’s pursuit of CMPs in excess of $100,000 against each of these three entities for failing to respond to a single request for patient records makes clear OCR’s readiness to investigate and pursue big dollar penalties against Covered Entities for even a single failure to deliver documents to a requesting patient or personal representative. With these HIPAA penalties in addition to the up to the $190 per day per request Labor Department administrative penalty, and discretionary award up to $100 per day plus attorneys’ fee and court cost courts can award suing participants or beneficiaries wrongfully denied timely access to plan information or documents under the Employee Retirement Income Security Act (“ERISA”) health plans, their plan administrators, insurers and fiduciaries should take care to ensure their health plans and their administrators and vendors timely respond to all medical record and otehr requests.

HIPAA Right Of Access Rule

HIPAA’s Privacy Rule right of access (“Access Rule”) is part of the national standards that HIPAA Privacy, Security, and Breach Notification Rules (“Privacy Rule”) require that Covered Entities and their business associates meet for protecting to protect individuals’ protected health information (“PHI”), limit uses and disclosures of PHI, and give individuals the right to timely access and to obtain a copy of their PHI records and certain other rights.  Like other Privacy Rule violations, Access Rule violations can subject a Covered Entity or business associate to expensive HIPAA civil monetary penalties (“CMPs”).

The Access Rule codified in 45 C.F.R. 164.524 generally requires that a Covered Entity to respond to a request from an individual or its personal representative to access or for a copy of protected health information (“PHI”) in any records set of a Covered Entity or its business associate within 30 days of receipt of the individual’s request.  OCR Access Rule guidance makes clear OCR views this deadline as the maximum allowed period

The Covered Entity can respond to a right of access request by granting or denying the request in whole or in part, or if it is unable to provide the records within 30 days for a legitimate reason, the Access Rule allows the Covered Entity a one-time 30-day extension of the response timeframe by sending the requestor a written statement of the reasons for the delay and the date within the extended response deadline by which the Covered Entity will complete its action on the request. 45 C.F.R. § 164.524(b)(2).

The Access Rule also contains specific guidance governing the calculation of the allowable fee, if any, the Covered Entity can charge for providing the PHI to a reasonable cost-based fee calculated following the Access Rule.  It also sets forth other requirements about the manner and format in which the Covered Entity must deliver the PHI.

OCR is responsible for implementing the Privacy Rules and enforcing non-criminal violations of its requirements.  When OCR finds violations of the Access Rule or other HIPAA violations, HIPAA as amended by the HITECH Act,¹ generally authorizes OCR to impose and collect a CMP determined based on the following penalty schedule, with adjustments for inflation:

• A minimum of $100 for each violation where the Covered Entity or business associate did not know and, by exercising reasonable diligence, would not have known that it violated the HIPAA provision, provided the total amount of CMPs imposed on the Covered Entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.
• A minimum of $1,000 for each violation due to reasonable cause and not to willful neglect, except that the total amount imposed on the Covered Entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $100,000.
• A minimum of $10,000 for each violation due to willful neglect and corrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $250,000.
• A minimum of $50,000 for each violation due to willful neglect and uncorrected within 30 days, except that the total amount imposed on the covered entity or business associate for all violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.

As required by law, OCR has adjusted the CMP ranges for each penalty tier for inflation.³ The adjusted amounts apply only to CMPs whose violations occurred after November 2, 2015.

$115,200 AMR CMP

According to the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) August 1, 2024 announcement of the AMR CMP, AMR paid OCR the $115,200 AMR CMP after OCR assessed the CMP in a Notice of Final Determination that AMR violated the Access Rule.

The Notice of Final Determination arose from an OCR investigation of a complaint made by an attorney (“the Patient’s Attorney”) on behalf of a patient transported by AMR alleging that AMR failed to provide a patient with timely access to its medical records after many failed attempts by the patient to obtain the records.

According to the Proposed Notice of Determination, the Patient’s Attorney sent AMR a fax on the patient’s behalf on October 31. 2018 asking for copies of a patient’s medical records including, “all billing records pertaining to treatment rendered for 9/15/2015 injury date; Patient Balance Verification; all medical records pertaining to treatment rendered for 9/15/2015 injury date” in electronic format to the patient’s attorney (“access request”). The access request was in writing, signed by the Patient’s Attorney, that clearly identified the Patient’s Attorney and where to send the copy of the Patient’s Attorney’s PHI. The Patient’s Attorney received a fax transmission report reflecting that AMR received her request on October 31, 2018. Although AMR uses an electronic health record (EHR) for its medical records and maintains the Patient’s Attorney’s requested PHI in its HER, it did not respond to this request by November 30, 2018, the date 30 days from receipt.

On November 8, 2018, the Patient’s Attorney also mailed a copy of her October 31, 2018, access request to AMR’s Seattle, Washington office via certified mail and received confirmation of delivery on November 13, 2018 from the United States Postal Service. The Patient’s Attorney also subsequently sent two follow-up requests for the PHI records on January 24, 2019.

Although AMR’s electronic medical record confirmed AMR received these requests, AMR did not respond to the Patient’s Attorney’s request until March 1, 2019, 121 days after the initial request, when AMR sent the Patient’s Attorney an invoice requiring payment of an access fee before AMR would provide the requested records to Complainant.

On March 18, 2019, the Patient’s Attorney then sent AMR another follow-up letter that reiterated the Patient’s Attorney’s multiple access requests and advised AMR that if AMR did not send the PHI to the Patient’s Attorney electronically within seven days the Patient’s Attorney would file a complaint with OCR.  Since AMR failed to deliver the requested records in electronic format within the specified period, the Patient’s Attorney filed a complaint with OCR on July 29, 2019, alleging that AMR violated the Access Rule by failing to provide a copy of the patient’s PHI in response to the Patient’s Attorney’s multiple access requests.

OCR’s October, 2019 investigation found AMR repeatedly failed to timely respond to the patient’s access request even though AMR had procedures in place for processing individuals’ written access requests.

In response to OCR’s investigation, AMR sent the requested records to the Patient’s Attorney on November 5, 2019, 370 days after the Patient’s Attorney’s initial request.

In response to OCR’s investigation, AMR also amended its internal procedures to streamline and better track access requests. OCR notified AMR of the results of OCR’s investigation on August 3, 2021, and offered AMR an opportunity to resolve the matter informally.  Rather than accepting this offer, however, AMR responded to OCR through counsel on August 9, 2021, asking OCR to “reconsider its position” without providing a counteroffer or otherwise engaging in negotiations with OCR. While OCR did not disclose the terms of its proposed offer of resolution, acceptance of this offer presumably would have allowed AMR to resolve the charges for an amount less than the $115,200 CMP ultimately imposed.

OCR then sent an April 15, 2022 Letter of Opportunity (LOO) to AMR, which informed AMR that OCR’s investigation indicated that AMR violated HIPAA’s Access Rule and providing AMR with an opportunity to submit written evidence of mitigating factors and affirmative defenses to this violation as well as evidence to support a waiver of a CMP for violating the Access Rule.  OCR determined AMR’s May 16, 2022 response to the LOO did not support any affirmative defense to the charges or grounds for waiver of the CMP but weighed AMR’s LOO response alleging mitigating factors in determining the amount of the CMP.

Based on these factual findings, OCR sent AMER a Notice of Proposed Determination that announced OCR’s intent to impose the $155,200 AMR CMP for its violation of the Access Rule by failing to provide timely access to the Patient’s Attorney after receiving her lawful requests.

Finding the Reasonable Cause penalty tier applicable for purposes of determining the CMP for  AMR’s Access Rule violation from December 1, 2018, to February 28, 2019, OCR calculated the AMR CMP as follows: $39,680 CMP Calendar Year 2018 (31 days from 12/1/18-12/31/18 at $1,280 per day); plus           $75.520 CMP Calendar Year 2019 (59 days from 1/1/19 to 2//19, at $1,280 per day) = $115,200 Total CMP

While AMR argued that OCR should exercise its discretion and choose not to apply any CMPs because of “multiple mitigating factors, OCR determined AMR’s arguments factually inaccurate and not meriting change of the CMP assessment from the reasonable cause level. Accordingly, OCR refused to reduce the original $115,200 based on alleged mitigating factors. 

After AMR did not challenge the determinations of OCR in the Notice of Proposed Determination within the allowed period, OCR issued the Final Notice of Determination imposing the $115,200 AMR CMP and AMR paid that amount.

Since as early as 2016, OCR has made Access Rule enforcement a priority.  Along with its assessment of the AMR CMP, OCR’s commitment to continued Access Rule enforcement is demonstrated by the 48 other previously announced Access Rule enforcement actions through July 31, 2024. 

$100,000 Hackensack Meridian Health CMP

Before it collected the AMR CMP, on April 1, 2024, OCR already had announced its collection of a $100,000 CMP from a New Jersey skilled nursing facility for violating the Access Rule in April.

Essex Residential Care, LLC, doing business as Hackensack Meridian Health, West Caldwell Care Center (“HMH”) is a skilled nursing facility that provides long-term care and rehabilitation services.

In May 2020, OCR received a complaint alleging that HMH failed to provide a personal representative with access to his mother’s medical records even after HMH received sufficient documentation that the patient’s son who requested the records as his mother’s personal representative.

OCR found that HMH failed to respond timely to a HIPAA right of access request. In September 2023, OCR issued a Notice of Proposed Determination (“HMHPD”) seeking to impose the $100,000 civil money penalty. When HMH waived its right to a hearing and did not contest OCR’s findings, OCR finalized the Notice of Final  Determination imposing the $100,000 CMP.

The OCR investigation found that when Peter Lindsay originally requested copies of the medical records of his mother, Lois Lindsey (“mother”) from WCCC in an April 19, 2020 email, WCCC responded with an April 22, 2020 e-mail denial that requested Mr. Lindsay provide WCCC a copy of a power of attorney, medical proxy or similar document executed by the mother establishing that he was his mother’s personal representative. However, when WCCC still failed to deliver the requested medical records after Mr. Lindsey sent a copy of his mother’s power of attorney via May 23, 2020 e-mail, Mr. Lindsey complained to OCR.

After OCR notified WCCC on October 15, 2020, its investigation of the complaint, WCCC acknowledged that it failed to respond to the complainant’s request for his mother’s medical records within 30 days of receiving the complainant’s written request for the records but still did not deliver the records until December 1, 2020, 161 days after the complainant’s request.

By letter dated March 25, 2022, OCR informed WCCC its investigation found that WCCC failed to provide timely access to protected health information and offered WCCC an opportunity to settle this matter informally.  Although OCR’s letter encouraged WCCC to contact OCR no later than ten days after receipt of the letter, OCR received no response until WCCC responded via e-mail through its attorney on April 29, 2022, that WCCC disagreed with OCR’s proposed resolution, OCR received an email correspondence from the WCCC’s attorney stating WCCC’s disagreement with OCR’s proposed resolution.  OCR then responded by issuing a May 16, 2022 Letter of Opportunity (LOO) informing WCCC that OCR found preliminary indications of non-compliance and providing WCCC with an opportunity to submit written evidence of mitigating factors, affirmative defenses, or waiver factors for OCR’s consideration in determining the CMP amount.

In the June 15, 2022 response to the LOO sent by WCCC’s attorney, WCCC acknowledged receipt of both the April 19, 2020, medical record request and the power of attorney emailed on April 23, 2020.  WCCC also admitted that instead of providing Mr. Lindsay with the requested medical record, WCCC instead sent a copy of the mother’s medical records to another facility to which Ms. Lindsay was transferred. WCCC’s attorney admitted WCCC should have handled the request differently but indicated at the time of the original request, both Mr. Lindsey and his mother were parties to ongoing litigation with WCCC over non-payment for care, that WCCC also was struggling with the COVID-19 pandemic, that Mr. Lindsey filed his complaint with OCR exactly 30 days after his e-mailed request before WCCC’s response to the initial request was due and asserted several affirmative defenses it claimed excused WCCC’s failure to provide the medical documents. 

Based on the above findings of fact, OCR calculated the WCCC CMP at the reasonable cause not corrected tier for WCCC’s failure to provide the requested medical records from June 23, 2020, to December 1, 2020.

WCCC also asserted various affirmative defenses and a right of waiver to avoid or mitigate the amount of the WCCC CMP, all of which OCR found unpersuasive.

• Regarding WCCC’s assertion that HIPAA barred imposition of a CMP in this case, as a matter of law, under the HIPAA affirmative defense for a violation not due to willful neglect and timely corrected, OCR determined that the affirmative defense did not apply as WCCC did not timely correct the violation.  
• OCR also rejected WCCC’s assertion that imposition of a CMP under these circumstances would be arbitrary and capricious and violate the Administrative Procedure Act (the Patient’s AttorneyA). 
• OCR likewise found rejected WCCC’s claim that OCR should waive any possible CMP because assessment of the CMP would be excessive as WCCC only failed to timely respond to a single request for records access, submitted amidine the midst of litigation with the requesting party during the COVID-19 pandemic and WCCC’s personnel mistakenly believed that an appropriate, timely response to the complainant’s medical record request had been made through the transfer of the patient to another facility.

After WCCC waived its right to challenge these OCR determinations in an administrative hearing, OCR issued the Notice of Final Determination on January 12, 2024, which OCR publicly announced  on April 1, 2024.

Phoenix CMP Settlement

OCR’s WCCC CMP announcement came only three days after OCR announced a settlement with Phoenix under which OCR accepted and collected $35,000.00 (“Settlement Amount”) from Phoenix in full satisfaction of a $250,000 CMP under a March 30, 2021 Notice of Final Determination issued against Phoenix for willful violation of the Access Rule. 

The Phoenix CMP and resulting settlement arose from OCR’s investigation of a right of access complaint filed against the Oklahoma multi-facility nursing care organization by a patient’s daughter in April 2019 that Phoenix would not provide the daughter, who serves as a personal representative, with a copy of her mother’s medical records. After Phoenix eventually sent the requested records 323 days after the request on January 30, 2020 and only after OCR attempts to get the records through technical assistance and other efforts, OCR notified Phoenix of its intention to impose a $250,000 civil money penalty (“Phoenix CMP”) against Phoenix for willful violation of the Access Rule along with violations of HIPAA’s business associate requirements. 

Rather than accede to OCR’s proposed imposition of the $250,000 Phoenix CMP, however, Phoenix chose to challenge the proposed Phoenix CMP to an administrative law judge (“ALJ”) in the Civil Remedies Division of the Departmental Appeals Board (“DAB”) of HHS. In Decision No. CR6232, the ALJ on February 16, 2023, upheld the Access Rule violations cited by OCR and OCR’s determinations that Phoenix acted with willful neglect in committing the violations, but reduced the Phoenix CMP amount from the $250,000 proposed by OCR to $75,000.

Despite the ALJ’s reduction of the Phoenix CMP, Phoenix then unsuccessfully challenged the ALJ’s determinations. On August 4, 2023, the HHS Departmental Appeals Board upheld the ALJ’s decision to uphold OCR’s determinations that Phoenix acted with willful neglect in violating the Access Rule and imposition of the reduced $75,000 CMP.

When Phoenix threatened to appeal this determination in federal court and presented evidence of “financial hardship, however, OCR agreed “as a compromise based on the unique facts and circumstances of this matter,” to accept in full satisfaction of the $75,000 CMP assessed due and owing by Phoenix under ALJ Decision affirmed by DAB Decision No. 3105 and DAB Decisions  No. CR6232 in return for Phoenix’s payment of the $35,000 Settlement Amount and Phoenix’s agreement not to further challenge OCR’s assessment and to revise its HIPAA Policies and Procedures to address the Access Rule and business associate agreement requirements, training, and other compliance.

Right Of Access Enforcement Takeaways

OCR’s pursuit of CMPs for Access Rule violations against AMR, WCCC and Phoenix, along with the 46 Access Rule settlements announced by OCR before the Phoenix Settlement makes clear OCR takes seriously and stands prepared to assess substantial CMPs against Covered Entities that violate the Access Rule.  

Like the 46 Access Rule settlements OCR previously announced, the circumstances surrounding the assessment of the AMR CMP and other Access Right Enforcement actions contain several important lessons for Covered Entities and business associates including:

• Ensuring Covered Entities appropriately track and timely respond to access requests is critical;
• Failing to provide timely response to even a single access request can trigger a significant CMP;
• The existence or expectation of a lawsuit or other dispute with the patient or patient’s personal representative does not justify delay or refusal timely to provide requested medical records within 30 days;
• While Covered Entities and business associates have a duty to verify a family member, attorney or other party requesting medical records on behalf of a patient is the personal representative, a Covered Entity is responsible for verifying this and delivering the requested medical records promptly following receipt of a request;
• If a Covered Entity or business associate intends to charge to provide requested medical records in response to an access request, ensure that the proposed charge is calculated following the Access Rule, notification is delivered within 30 days of the original request and deliver the medical records promptly after the payment is received;
• Providing requested medical records to another health care provider or other party does not excuse or substitute for providing the medical records to the requesting patient or personal representative;
• A Covered Entity that fails to meet the 30-day deadline for responding to an access request should fix the problem promptly by delivering the documents as soon as possible and taking documented corrective action to prevent future noncompliance;
• A Covered Entity or business associate that already has not responded within 30 days of receipt of an access request should not withhold delivery of the requested PHI pending the requestor’s payment of the minimal allowed charge that it could have imposed had it timely responded to the access request within 30 days; and
• Consider carefully before declining an offer from OCR to settle through informal resolution.

Covered Entities and business associates also should keep in mind other potentially applicable legal or ethical requirements to provide medical records.  For instance, the Employee Retirement Income Security Act (“ERISA”), state insurance rules and other federal or state laws also may require health plans and their insurers, administrators and others with timely access to medical or other records that also are protected heath information under HIPAA.  Under Section 502 (c) of ERISA, for instance, health plan administrators that fail to provide requested documents and information can become liable for Labor Department penalties of up to $190 per day not to exceed $1,906 per request, discretionary court awards of penalties of up to $100 per day plus attorneys’ fee and court cost to participants or beneficiaries wrongfully denied timely access or both. Covered Entities and business associates should ensure that all applicable deadlines are met and that any charges imposed satisfy all applicable requirements.

Covered Entities and business associates also should keep in mind that the Access Rule is only one of several areas of HIPAA enforcement prioritized by OCR that can trigger costly CMPs. Since HIPAA took effect in April 2003 through April 2024, OCR has:

• Received and resolved 99 percent of the more than 358,975 HIPAA complaints and the more than 1,188 OCR-initiated compliance reviews;
• Required changes in privacy practices and corrective actions in more than 30,839 cases investigated;
• Settled or imposed a civil money penalty in 145 cases resulting in a total dollar amount of $142,663,772.00; and
• OCR referred 2,197 to the Department of Justice (DOJ) for criminal investigation of cases involving the knowing disclosure or obtaining of protected health information in violation of HIPAA.

The compliance issues most often alleged in complaints cumulatively, in order of frequency through April, 2024 have remained consistent across the 20 years since HIPAA became effective.  They include cumulative in order of frequency:

• Impermissible uses and disclosures of protected health information;
• Lack of safeguards of protected health information;
• Lack of patient access to their protected health information;
• Lack of administrative safeguards of electronic protected health information; and
• Use or disclosure of more than the minimum necessary protected health information.

While health care providers are the type of Covered Entity most often subjected to enforcement, OCR data confirms OCR investigations and enforcement has impacted all types of Covered Entities and business associates.  According to this data, the categories of Covered Entities OCR investigations have found to have committed violations are, in order of frequency:

• General Hospitals;
• Private Practices and Physicians;
• Pharmacies;
• Outpatient Facilities; and
• Group Health Plans.

Additionally, while Group Health Plans as a group have the fewest compliance violations to date, OCR enforcement data confirms OCR’s investigation and enforcement of Access Rule violations against Group Health Plans, as well as that Group Health Plans and their business associates historically account for violations of the HIPAA security rules for the protection of electronic health information affecting millions of Americans. With OCR’s even further heightening its prioritization of HIPAA’s security rule oversight and enforcement in response to massive breaches of electronic protected health information systems and data that triggered widespread disruptions of care and payment systems reported by UnitedHealthcare Group’s Change Health, Ascension Health, and others, and recent OCR guidance requiring to update their Notices of Privacy Practices, all Covered Entities and their business associates should ensure seize the opportunity to re-verify the defensibility of their organization’s Access Rule, Security Rule and other HIPAA compliance.

For Additional Information

We hope this update is helpful. Solutions Law Press, Inc. invites you to receive future updates by registering on  here and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you need have questions or need assistance with this or other cybersecurity, health, benefit, payroll, investment or other data, systems or other privacy or security related risk management, compliance, enforcement or management concerns, to inquire about arranging for compliance audit or training, or need legal representation on other matters,  contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

About the Author 

Scribe responsible for planning and leading the American Bar Association Joint Committee on Employee Benefits Annual Agency Meeting with HHS-OCR for more than a decade and author of many highly regarded publications on HIPAA and other privacy and data security, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of HIPAA and other cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for government contractors and other public and private businesses; managed care and other health and life science, insurance, technology, and other performance and data dependent organizations,

A Fellow in the American College of Employee Benefit Counsel, Immediate Past Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Co-Chair of its International Employment Law Committee, and its Health Care Liaison; Immediate Past Chair of the ABA TIPS Section Medicine & Law Committee; Past Chair of the ABA Managed Care & Insurance Interest Group; Former Chair of the ABA RPTE Employee Benefits & Other Compensation Group and Chair or Co-Chair of its Welfare Benefit Committee for more than 10 years , and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

The Supreme Court of Texas has issued an emergency order authorizing the modification of deadlines in certain justice courts affected by Hurricane Beryl.

The order states that upon request by local judicial leaders and pursuant to Section 22.0035(b) of the Texas Government Code, justice courts in Fort Bend, Galveston, Harris, Matagorda, and Montgomery counties that have been prevented from complying with a deadline in a civil case because the court’s normal operations have been disrupted by the disaster may:

• Consider the disaster as good cause under Texas Rule of Civil Procedure 500.5 for extending a time period in the Texas Rules of Civil Procedure or local rules, including appeal and new trial deadlines, until July 26, 2024; and
• Postpone statutory deadlines until July 26, 2024, if the court finds that the postponement is necessary to facilitate the orderly resumption of the court’s normal operations.

Read the complete order here.

For More Information

We hope this update is helpful. For more information or help about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of cybersecurity, workforce, technology and other compliance, risk management and mitigation, incident and other investigations, regulatory and government affairs, and other strategic, operational, regulatory and legal and consulting management work for insurance, financial services, employee benefits, managed care and other health and life science, technology, government entities and contractors and other public and private businesses. As part of this work, she has extensively worked, spoken and published on the defensible design, use and management of artificial intelligence and other systems and processes throughout her career.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership with healthcare and life sciences, employment and employee benefits, managed care and insurance, data and technology and other related industries and organizations. Known for her skill combined use of her extensive legal and operational knowledge to help these and other clients develop, operationalize and defend employment, employee benefits, compensation and other staffing and workforce; data, systems and other technology; heath benefit and other healthcare and life science, managed care and insurance; employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational actions and practices. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here. 

IMPORTANT NOTICE

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2024 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

Health care providers, heath plans, health care clearinghouses and their business associates (covered entities) should verify that any online tracking technology used in their or their business partner websites or mobile applications comply with the Department of Health and Human Services, Office of Civil Rights (OCR) updated guidance on “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” published March 18, 2024.

The Guidance reminds covered entities that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules) apply to their use of online tracking technologies like Google Analytics or Meta Pixel, collect and analyze information about how users are interacting with a regulated entity’s website or mobile application.

The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes electronic protected health information (ePHI).

OCR’s information bulletin reminds covered entities that they can only use online tracking technologies provided that the entities comply with their obligations under the HIPAA Rules. Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of ePHI to tracking technology vendors or any other violations of the HIPAA Rules.

OCR’s Bulletin provides a general overview of how the HIPAA Rules apply to covered entities use of tracking technologies. It also updates to the Bulletin include:

• Additional examples of when visits to an unauthenticated webpage may or may not involve the disclosure of ePHI.
• Additional tips for complying with the HIPAA Rules when using online tracking technologies.
• Guidance about OCR’s enforcement priorities in investigations involving regulated entities’ use of online tracking technologies.

Covered entities need to understand that online tracking technologies commonly are included in Website, mobile application, and other Internet based tools. These tools frequently include online tracking even if not specifically requested by the covered entity. 

Covered entities should conduct a documented inventory of all website, mobile app, and other Internet, based tools that they or their business associates use, which includes an assessment of whether those tools include online tracking, or other technologies, covered by the guidance. For any online tools using tracking capability, cupboard entities, must ensure that the tool is designed and administered to comply with the HIPAA requirements. Overed entities also should adopt a process for regularly reevaluating and monitoring compliance with this and other HIPAA security requirements in their Internet based in other electronic applications that collect, use, store, access, or disclose electronic, protected health information.

Along with specifically evaluating the existence and compliance of any online tracking technologies, covered entities, also should reevaluate and reconfirm the adequacy of their electronic security overall. The HIPAA Rules require healthcare providers and other covered entities to regularly conduct documented risk assessments to verify the adequacy of their security safeguards, and to make updates to guard against emerging threats based on these recurrent assessments. The importance of compliance with this ongoing recurrent risk assessment obligation is repeatedly reinforced in each HIPAA settlement announced by OCR. See, e.g., OCR Nails Second HIPAA Covered For Allowing Ransomware Breach.

Covered entities should ensure that they and their business associates maintain compliance with these other HIPAA obligations.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management, or public policy developments, please get in touch with the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author 

Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Author of a multitude of highly regarded publications on HIPAA and other medical record and data privacy and scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Laws Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here, such as:

• California Fast Food Minimum Wage Jumps To $20/Hour 4/1
• Manage Health Plan HIPAA, ERISA & Other Exposures From Change Healthcare Ransomware Attack
• Wage & Hour Takes Aim At Restaurant & Other Hospitality Employers
• Prepare Defenses Against Rising Religious Discrimination Exposures
• Restaurant Pays $167K In Back Wages & Damages For Overtime Violation
• ICE Updates Forms I-942 and I-881
• $160K HIPAA Penalty Warns Health Plans & Other Covered Entities Deliver Timely Protected Health Information Access
• IRS Warns Of Fraudulent Promotion of COVID Employee Retention Credits
• OSHA Enforces Whistleblower Rights Of Worker Terminated For Expressing COVID-19 Safety Concerns
• Children’s Hospital Pays $45K To Resolve COVID Vaccine Religious Discrimination Suit
• Prepare Feedback! Tri-Agencies Plan To Reopen Surprise Billing Proposed Dispute Resolution Rule Comment Period
• EEOC Sexual Harassment Suit Against Texas Car Dealership Warns Other Employers To Manage Risks
• No Surprises Act Independent Dispute Resolution Portal Fully Reopened, New Fees Announced
• No Surprises Act Dispute Resolution Portal For All Covered Health Claims
• Health Plans Warned To Prevent Phishing By 1st Phishing-Related HIPAA Settlement
• Employer’s Overzealous I-9 Documentation Demand Triggers Civil Monetary Penalty
• Texas Private Employer COVID-19 Vaccination Mandates Prohibited Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes;
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Remote Work Role Not Justification For Failure To Accommodate Deaf Applicant, EEOC Charges
• Tri-Agencies Announce New Surprise Billing IDR Fees While Continuing IDR Suspension After Federal Court Ruling
• Surprise Billing IDR Health Plan Dispute Resolution Suspension After Federal Court Ruling Could Impact Plan Renewal Underwriting and Stop-Loss Coverage
• Accommodating Client Racial Preferences, No Excuse For Discriminatory Assignment Of Workers
• Employer’s Refusal To Allow Employee To Undergo Dialysis At Work Triggers EEOC ADA Discrimination & Retaliation Lawsuit
• OSHA Electronic Injury Reporting Requirements Changing January 1, 2024; Confirm Your Organization’s Status and Responsibilities Under New Rules
• Businesses Risk Out-Of-State Lawsuits, Regulation From Registering In Consent To Jurisdiction States and Contractual Consents To Jurisdiction
• EEOC “Level The Playing Field” Campaign Encourages Equal Pay Awareness and Enforcement
• Employers Face 8/30 Deadline To Complete & Document In-Person Inspections Of I-9 Documentation Examined Remotely During COVID-19 Emergency
• $350K Settlement Highlights Need For Plans & Plan Service Providers To Ensure Security, Business Associate & Other HIPAA Requirements Met
• EEOC COVID Guidance, Enforcement Highlights Need To Brace For COVID-Related ADA & Other Claims
• Austin Bar Faces EEOC Pregnancy Discrimination Suit Before Added PWFA Protections Take Effect June 27
• Education Association Union Sued For Race Discrimination
• Biden-⁠Harris Administration Ending COVID-⁠19 Vaccination Requ

The U.S. Equal Employment Opportunity Commission (EEOC) today posted updated and expanded technical assistancerelated to the COVID-19 pandemic, addressing questions about religious objections to employer COVID-19 vaccine requirements and how they interact with federal equal employment opportunity (EEO) laws.

The expanded technical assistance provides new information about how Title VII of the Civil Rights Act of 1964 applies when an applicant or employee requests an exception from an employer’s COVID-19 vaccination requirement that conflicts with their sincerely held religious beliefs, practices, or observances. Title VII prohibits employment discrimination based on race, color, religion, sex, and national origin.

“This update provides employers, employees, and applicants with important assistance when navigating vaccine-related religious accommodation requests,” said EEOC Chair Charlotte A. Burrows. “Title VII requires employers to accommodate employees’ sincerely held religious beliefs, practices, and observances absent undue hardship. This update will help safeguard that fundamental right as employers seek to protect workers and the public from the unique threat of COVID-19.”

The key updates to the technical assistance are summarized below:

• Employees and applicants must inform their employers if they seek an exception to an employer’s COVID-19 vaccine requirement due to a sincerely held religious belief, practice, or observance.
• Title VII requires employers to consider requests for religious accommodations but does not protect social, political, or economic views, or personal preferences of employees who seek exceptions to a COVID-19 vaccination requirement.
• Employers that demonstrate “undue hardship” are not required to accommodate an employee’s request for a religious accommodation.

The EEOC is providing this information to the public as many employers are requiring employees to be vaccinated against COVID-19 as a condition of their employment.  

This technical assistance answers COVID-19 questions only from the perspective of the EEO laws. Other federal, state, and local laws come into play regarding the COVID-19 pandemic for employers, employees, and applicants. As new developments occur, the EEOC will consider any impact they may have on EEOC’s COVID-19 technical assistance and will provide additional updates and assistance to the public as needed.

More information about the civil rights implications of the COVID-19 pandemic is available in the record of the EEOC’s April 28, 2021hearing on that topic.  Employers and others involved in administering the workplace should carefully monitor developments and manage risks amid the evolving regulatory and workplace environment.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and Vice-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on heath benefit and other healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. At her career, she has worked extensively with healthcare and other employers to manage discrimination and other workplace and employee benefit compliance and risks. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here,

IMPORTANT NOTICE ABOUT THIS COMMUNICATION

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

NOTICE: These statements and materials are for general informational and educational purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstances at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules make it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access to this publication. 

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™

After February 5, 2024, a new Texas law will prohibit Texas private employers from requiring employees get Covid – 19 vaccinations.

Senate Bill 7 bans private employers from requiring COVID-19 vaccines in the workplace. The new law will take effect on February 6, 2024. The law contains no exceptions for healthcare providers such as hospitals. Instead, the law allows healthcare and other employers previously to require unvaccinated staff to wear masks and other protective equipment.

Chapter 81B of the Texas Health and Safety Code already prohibits state and local governments from adopting workplace vaccine mandates. Provisions of the new law prohibiting private employer COVID-19 vaccination mandates will be incorporated in the newly created Chapter 81D. Accordingly, Texas law will prohibit all public and private employers from imposing workforce Covid – 19 vaccinations after February 5, 2024.

During the Covid – 19 pandemic, federal law, mandated workplace vaccination mandates for hospitals, government contractors, and various other organizations. During the course of the pandemic, these mandates were substantially eviscerated by a series of court decisions, and other regulatory modifications before ultimately being suspended or withdrawn by the close of the pandemic. Although the limitation and suspension of these federal mandates as an explicit requirement eliminated noncompliance with the mandates as a basis for per se prosecution under these requirements, it did not fully eliminate potential employer exposure for failing to require vaccination under federal law., Advocates for vaccination have argued that requiring vaccination during a period of contagion for Covid – 19 or other contagious diseases may be required to comply with the general duty clause under the Occupational Health & Safety Act. Since the abatement of Covid – 19 pandemic, this risk has been lessof a concern to most employers.

With Covid – 19 infection rates rising in recent months, however, employers generally will want to evaluate and document their policies and efforts to protect their workers from Covid – 19 and other highly contagious diseases in their workplaces taking account mandates, safety standards, and specific statute like the new Texas vaccination ban well to mitigate potential federal, occupational health and safety act, liability, exposures and costs and operational disruptions that typically follow an outbreak in their workplaces.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and VIce-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her labor and employment, employee benefit, health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions for Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as:

• Texas Private Employer COVID-19 Vaccination Mandates Effective February 6, 2024
• Pizza Operator Faces Prison Time For Failing To Pay Employment Taxes
• New HIPAA Resolution Agreement Warns Health Plans & Other HIPAA-Covered Entities To Manage Media Relations, Access & Disclosure
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning

• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• Labor Department Mutual of Omaha Group Companies Warns Insurers, Plans To Timely Decide Insurability In ERISA-Covered Life, Disability & Other Plans
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Business Leaders Serve Jail Time For Employment Tax Crimes   
• Salary Threshold Increases Require Employer Review Of Salaried Worker FLSA Exemption Qualification  
• Salary Threshold Increases Require Employer Review Of Salaried Worker FLSA Exemption Qualification  

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.

A Maryland restaurant owner faces up to five years in prison after he pleaded guilty l to willfully failing to pay employment taxes withheld from his employees’ wages today. One of a long list of criminal tax enforcement actions this year, the convictions demonstrates the risk business owners and operators run for willfully failing to properly withhold and pay employment taxes.

According to court documents and statements made in court, Francesco Illiano owned and operated two restaurants and a property management company that employed over 100 people. Illiano was responsible for collecting, accounting for and paying the income and Social Security and Medicare taxes withheld from the wages of employees of the three companies he controlled. From at least April 2014 to July 2016, the Justice Department says Illiano did not pay the withholdings to the IRS. Illiano had previously been assessed a Trust Fund Recovery Penalty for not paying more than $1.4 million in taxes withheld from employees of five Green Turtle restaurants he owned in 2011 and 2012. In total, Illiano caused a tax loss to the IRS of over $1.7 million.

Illiano is scheduled to be sentenced on March 6, 2024. Under the U.S. Sentencing Guidelines, he faces a maximum penalty of five years in prison as well as a period of supervised release, restitution and monetary penalties.

Business leaders should heed the conviction as a reminder of the importance of proper employment tax withholding and payment.

For More Information

We hope this update is helpful. For more information about these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297. 

Solutions Law Press, Inc. invites you to receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

About the Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 35 plus years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.

A Fellow in the American College of Employee Benefit Counsel, Co-Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee and VIce-Chair Elect of its International Employment Law Committee, Chair-Elect of the ABA TIPS Section Medicine & Law Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, and Chair of the ABA Intellectual Property Section Law Practice Management Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading-edge work, scholarship and thought leadership on healthcare and life science, managed care and insurance and other workforce and staffing, employee benefits, safety, contracting, quality assurance, compliance and risk management, and other legal, public policy and operational concerns in the healthcare and life sciences, employee benefits, managed care and insurance, technology and other related industries. She speaks and publishes extensively on these and other related compliance issues.

Ms. Stamer’s work throughout her career has focused heavily on working with health care and managed care, life sciences, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns. Scribe for the ABA JCEB Annual Meeting with the HHS Office of Civil Rights, her experience includes extensive involvement throughout her career in advising health care and life sciences and other clients about preventing, investigating and defending EEOC, DOJ, OFCCP and other Civil Rights Act, Section 1557 and other HHS, HUD, banking, and other federal and state discrimination investigations, audits, lawsuits and other enforcement actions as well as advocacy before Congress and regulators regarding federal and state equal opportunity, equity and other laws. 

For more information about Ms. Stamer or her labor and employment, employee benefit, health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here. 

About Solutions for Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also may be interested in reviewing some of our other Solutions Law Press, Inc.™ resources available here such as: 

• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• Reviewing Newly Released 2024 Income Tax Tables Helpful For 2024 Benefit & Withholding Planning
• IRS Announces 2024 HFSA, MSA, HDHP & Other Tax Inflation Adjustments Impacting 2024 Benefit, Withholding & Other Tax Planning
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• OCR Video Touts HIPAA Compliance To Avoid Costly HIPAA Penalties & Manage Cybersecurity Risks
• Work Opportunities Tax Credit Available For Certain Hires Through 2025
• DOL Sues 7-11 Franchise Owners Association Head for FLSA Pay, Record Keeping Violations
• IRS Shares Voluntary Correction Program Updates & Tips
• Labor Department Mutual of Omaha Group Companies Warns Insurers, Plans To Timely Decide Insurability In ERISA-Covered Life, Disability & Other Plans
• $80,000 Penalty Confirms Health Plans Exposure For Violating HIPAA Access Rights
• $4.4 Million Warning About Proper Billing On Government Projects
• OSHA Proposing To Expand Third Parties Allowed To Accompany Employees During Inspections
• Employers Should Prepare for Proposed DOL Rules To Disqualify Additional 4 Million Workers For FLSA Exempt Status
• Use Of New Form I-9 Employment Eligibility Verification Form Released 8/1 Permitted Now; Mandatory After 11/1
• Business Leaders Serve Jail Time For Employment Tax Crimes   
• Salary Threshold Increases Require Employer Review Of Salaried Worker FLSA Exemption Qualification  
• Salary Threshold Increases Require Employer Review Of Salaried Worker FLSA Exemption Qualification  

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.

©2023 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ For information about republication, please contact the author directly. All other rights reserved.