IRS Changing Employee Plans & Exempt Organization Audit Procedures

November 21, 2016

Employee benefit plans and tax-exempt organizations facing Internal Revenue Service (IRS) audits or investigations after April, 2016, their leaders and advisors should prepare for some changes in the practices IRS agents will use to issue and enforce document requests (IDRs) after March 31.

The IRS  Tax Exempt and Government Entities Division (TEGE) just issued updated internal guidance (Guidance) governing the procedures its agents will use to gather information for employee benefit plan and exempt organization examinations including information requests made in connection with:

  • Employee Benefit Form 5500 Examination Procedures
  • Exempt Organizations Pre-Audit Procedures
  • On-Site Examinations
  • Tax Exempt Bonds Examinations
  • Indian Tribal Government Examinations and
  • Federal, State and Local Governments (FSLG) Examinations

The new Guidance follows other recent announcements of changes of IRS employee plan or exempt organization procedures such as recently announced changes in IRS employee plan correction procedures.  See, e.g., IRS Qualified Plan Correction Procedures Changing 1/1/17.

The new procedures defined in the Guidance apply more broadly and take effect April 1, 2017.  The Guidance also requires that TEGE update the following IRMs to specifically reflect the new procedures within the next two years:

  • IRM 4.71.1, Overview of Form 5500 Examination Procedures;
  • IRM 4.75.10, Exempt Organizations Pre-Audit Procedures;
  • IRM 4.75.11, On-Site Examination Guidelines;
  • IRM 4.81.5, Tax Exempt Bonds Examination Program Procedures – Conducting the Examination;
  • IRM 4.86.5, Conducting Indian Tribal Government Examinations; and
  • IRM 4.90.9, Federal, State and Local Governments (FSLG) – Procedures, Workpapers and Report Writing.

Among other things, the new Guidance will require “active involvement” by managers of IRS examiners’ early in the process.  The Guidance also calls for:

  • Taxpayers to be involved in the IDR process.
  • Examiners to discuss the issue being examined and the information needed with the taxpayer prior to issuing an IDR.
  • Examiners to ensure that the IDR clearly states the issue and the relevant information they are requesting.
  • If the taxpayer does not timely provide the information requested in the IDR by the agreed upon date, including extensions, examiners to issue a delinquency notice.
  • If the taxpayer fails to respond to the delinquency notice or provides an incomplete response, for the examiner to issue a pre-summons notice to advise the taxpayer that the IRS will issue a summons unless the missing items are fully provided.
  • For a summons to be issued if the taxpayer fails to provide a complete response to the pre-summons letter by its response due date.

According to TEGE the new procedures set forth in the Guidance are designed to “ensure” that IRS Counsel is prepared to enforce IDRs through the issuance of a summons when necessary while also reinforcing the IRS’ commitment to the respect of taxpayer rights under the Taxpayer Bill of Rights.  TEGE says the updated procedures established in the Guidance will promote these goals by:

  • Providing for open and meaningful communication between the IRS and taxpayers;
  • Reducing taxpayer burdens
  • Providing for consistent treatment of taxpayers;
  • Allowing the IRS to secure more complete and timely responses to IDRs;
  • Providing consistent timelines for IRS agents to review IDR responses; and
  • Promoting timely issue resolution.

While it remains to be seen exactly how well the new procedures will promote these goals in operation, leaders, sponsors, administrators and tax advisors to employee benefit plans and exempt organizations tagged for audits after the Guidelines take effect will want to ensure that they review and fully understand the new procedures as soon as possible after receiving notice of the audit.

A clear understanding of the procedures can help the entities and their representatives to take advantage of all available options for mitigating exposures and liability from the audit as well as to avoid unfortunate missteps that could result in forfeiture of otherwise available tax-related rights and options or otherwise increase the tax and other associated risks and liabilities of the entities or others associated with them arising from the audit.

Along with responding to these tax-related risks, leaders and advisors of employee benefit plan and exempt organizations also need to keep in mind the often substantial non-tax related risks that may arise concurrently or evolve from a TEGE or other tax-related audit or investigation. The often substantial tax and non-tax exposures typically makes it desirable if not necessary to involve experienced legal counsel in the process as soon as possible.

To help respond to the audit and manage its tax and non-tax related risks and, leaders responsible for these entities generally not only will want to seek legal advice within the scope of attorney-client privilege from legal counsel immediately after receiving an IDR or other notice of an audit or investigation, as well as consider periodically consulting experienced legal counsel for assistance in conducting pre-audit assessment of compliance and other compliance and risk management planning.

Early involvement of legal counsel generally is necessary both to understand and manage both the tax and non-tax exposures associated with the audit, as well as to preserve and utilize the potential benefits of attorney-client privilege and other evidentiary privileges that could help to mitigate both the tax and non-tax related risks.  While federal tax rules afford some evidentiary privileges to certain accounting professionals when providing tax representation or advice, the protective scope of such privileges generally are more limited than attorney-client privilege and work product evidentiary privileges and typically do not apply to non-tax matters. As a result, most entities and their leaders will want to consider involvement of legal counsel to maximize privilege protections and non-tax related exposures even if the parties plan for a qualified tax professional or other consultant to play a significant role in assisting them to prepare for and respond to the audit.

About The Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely known for work, teachings and publications.

Ms. Stamer works with health industry and other businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares her thought leadership, experience and advocacy on these and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association; Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Gulf Coast TEGE Council Exempt Organization Coordinator; a founding Board Member and past President of the Alliance for Healthcare Excellence; former board member and Vice President of the Managed Care Association; past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; a member and advisor to the National Physicians’ Council for Healthcare Policy; current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee; current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section; Past Chair of the ABA Health Law Section Managed Care & Insurance Section; a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group; immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council; past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a former member of the Board of Directors, Treasurer, Member and Continuing Education Chair of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment, employee benefits, compensation, and other regulatory and operational risk management. Examples of her many highly regarded publications on these matters include the “Texas Payday Law” Chapter of Texas Employment Law, as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com   or contact Ms. Stamer via email here  or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at SolutionsLawPress.com such as:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please provide your current contact information and preferences including your preferred e-mail by creating or updating your profile here.

NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as an admission.  The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues.  Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein

©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™  All other rights reserved.


DOL Aggressively Targeting Restaurants For Wage & Hour & Child Labor Law Violations

November 3, 2016

Restaurant employers beware! Restaurants are the target of a highly successful, U.S. Department of Labor Wage and Hour Division (WHD) restaurant enforcement and compliance initiative that WHD already has used to nail a multitude of restaurants across the country for “widespread violations” of Fair Labor Standards Act (FLSA) minimum wage, overtime, child labor and other wage and hour laws (WH Law).

Having reportedly found WH Law violations in “nearly every one” of the WH Law investigations conducted against restaurant employers during 2016 and recovered millions of dollars of back pay and penalties from restaurants caught through investigations conducted under its WHD Restaurant Enforcement Initiative, WHD Administrator Dr. David Weil recently confirmed WHD plans to expand the restaurant employers targeted for investigation and other efforts to punish and correct WH Law violations under the Restaurant Enforcement Initiative through 2017 in an October 5, 2016 WHD News Release: Significant Violations In The Austin Restaurant Industry Raise Concerns For Us Labor Department Officials (News Release).

The News Release quotes Administrator Weil as stating:

The current level of noncompliance found in these investigations is not acceptable …WHD will continue to use every tool we have available to combat this issue. This includes vigorous enforcement as well as outreach to employer associations and worker advocates to ensure that Austin restaurant workers receive a fair day’s pay for a fair day’s work.

Given the substantial back pay, interest, civil or in the case of willful violations, criminal penalties, costs of defense and prosecution and other sanctions that restaurant employers, their owners and management can face if their restaurant is caught violating FLSA or other WH Laws, restaurants and their leaders should arrange for a comprehensive review within the scope of attorney-client privilege of the adequacy and defensibility of their existing policies, practices and documentation for classifying, assigning duties, tracking regular and overtime hours, paying workers and other WH Law compliance responsibilities and opportunities to mitigate risks and liabilities from WH Law claims and investigations.

Many Restaurants Already Nailed Through Restaurant Enforcement Initiative

Even before the planned 2017 expansion of its Restaurant Enforcement Initiative, WHD’s enforcement record shows WHD’s efforts to find and punish restaurants that violate WH Laws are highly successful. Restaurant employers overwhelmingly are the employers targeted by WHD in the vast majority of the WH Law settlements and prosecutions announced in WHD News Releases published over the past two years, including aggregate back pay and penalty awards of more than $11.4 million recovered through the following 31 actions announced by WHD between January 1, 2016 and October 31, 2016:

Enforcement Actions Highlight Common Restaurant WH Law Compliance Concerns

Restaurant employers, like employers in most other industries, are subject to a host of minimum wage, overtime and other requirements including the FLSA requirement that covered, nonexempt employees earn at least the federal minimum wage of $7.25 per hour for all regular hours worked, plus time and one-half their regular rates, including commissions, bonuses and incentive pay, for hours worked beyond 40 per week. Employers also are required to maintain accurate time and payroll records and must comply with child labor, anti-retaliation and other WH Law requirements.

The News Release identified some of the common violations WHD uncovered in these investigations included employers:

  • Requiring employees to work exclusively for tips, with no regard to minimum-wage standards;
  • Making illegal deductions from workers’ wages for walkouts, breakages, credit card transaction fees and cash register shortages, which reduce wages below the required minimum wage;
  • Paying straight-time wages for overtime hours worked.
  • Calculating overtime incorrectly for servers based on their $2.13 per hour base rates before tips, instead of the federal minimum wage of $7.25 per hour.
  • Failing to pay proper overtime for salaried non-exempt cooks or other workers;
  • Creating illegal tip pools involving kitchen staff;
  • Failing to maintain accurate and thorough records of employees’ wages and work hours.
  • Committing significant child labor violations, such as allowing minors to operate and clean hazardous equipment, including dough mixers and meat slicers.

Use Care To Verify Tipped Employees Paid Properly

Based on the reported violations, restaurants employing tipped employees generally will want to carefully review their policies, practices and records regarding their payment of tipped employees. Among other things, these common violations reflect a widespread misunderstanding or misapplication of special rules for calculating the minimum hourly wage that a restaurant must pay an employee that qualifies as a tipped employee.  While special FLSA rules for tipped employees may permit a restaurant to claim tips (not in excess of $5.12 per hour) actually received and retained by a “tipped employee,” not all workers that receive tips are necessarily covered by this special rule. For purposes of this rule, the definition of “tipped employee” only applies to an employee who customarily and regularly receives more than $30 per month in tips.

Also, contrary to popular perception, the FLSA as construed by the WHD does not set the minimum wage for tipped employees at $2.13 per hour. On the contrary, the FLSA requirement that non-exempt workers be paid at least the minimum wage of $7.25 per hour for each regular hour worked also applies to tipped employees. When applicable, the special rule for tipped employees merely only allows an employer to claim the amount of the tips that the restaurant can prove the tipped employee actually received and retained (not in excess of $5.13 per hour) as a credit against the minimum wage of $7.25 per hour the FLSA otherwise would require the employer to pay the tipped employee. Only tips actually received by the employee may be counted in determining whether the employee is a tipped employee and in applying the tip credit.  If a tipped employee earns less than $5.13 per hour in tips, the restaurant must be able to demonstrate that the combined total of the tips retained by the employee and the hourly wage otherwise paid to the tipped employee by the restaurant equaled at least the minimum wage of $7.25 per hour.

Furthermore, restaurant or other employers claiming a tip credit must keep in mind that the FLSA generally provides that tips are the property of the employee. The FLSA generally prohibits an employer from using an employee’s tips for any reason other than as a credit against its minimum wage obligation to the employee (“tip credit”) or in furtherance of a valid tip pool.

Also, whether for purposes of applying the tip credit rules or other applicable requirements of the FLSA and other wage and hour laws, restaurant employers must create and retain appropriate records and other documentation regarding worker age, classification, hours worked, tips and other compensation paid and other evidence necessary to defend their actions with respect to tipped or other employees under the FLSA and other WH Law rules. Beyond accurately and reliably capturing all of the documentation required to show proper payment in accordance with the FLSA, restaurants also should use care to appropriately document leave, discipline and other related activities as necessary to show compliance with anti-retaliation, equal pay, family and medical leave, and other mandates, as applicable.  Since state law also may impose additional minimum leave, break time or other requirements, restaurants also generally will want to review their policies, practices and records to verify their ability to defend their actions under those rules as well.

Child Labor Rules Require Special Care When Employing Minors

While hiring workers under the age of 18 (minors) can help a restaurant fulfill its staffing needs while providing young workers valuable first time or other work experience, restaurants that hire minors must understand and properly comply with any restrictions on the duties, work hours or other requirements for employment of the minor imposed by federal or state child labor laws.

As a starting point, the legal requirements for employing minors generally greater, not less, than those applicable to the employment of an adult in the same position.  Employers employing workers who are less than 18 years of age (minors) should not assume that the employer can pay the minor less than minimum wage or skip complying with other legal requirements that normally apply to the employment of an adult in that position by employing the minor in an “internship” or other special capacity. The same federal and state minimum wage, overtime, safety and health and nondiscrimination rules that generally apply to the employment of an adult generally will apply to its employment of a worker who is a minor.

Beyond complying with the rules for employment of adults, restaurants employing minors also must ensure that they fully comply with all applicable requirements for the employment of minors imposed under the FLSA child labor rules and applicable state law enacted to ensure that when young people work, the work is safe and does not jeopardize their health, well-being or educational opportunities.   Depending on the age of the minor, the FLSA or state child labor rules may necessitate that a restaurant tailor the duties and hours of work of an employee who is a minor to avoid the substantial liability that can result when an employer violates one of these child labor rules.

The FLSA child labor rules, for instance, impose various special requirements for the employment of youth 14 to 17 years old. See here.  As a starting point, the FLSA child labor rules prohibit the any worker less than 18 years of age from operating or cleaning dough mixers, meat slicers or other hazardous equipment. Depending on the age of the minor worker, the FLSA child labor rules or state child labor laws also may impose other restrictions on the duties that the restaurant can assign or allow the minor to perform.  Restaurants hiring any worker that is a minor must evaluate the duties identified as hazardous “occupations” that the FLSA child labor rules prohibit a minor of that age to perform here as an “occupation” and take the necessary steps to ensure the minor is not assigned and does not perform any of those prohibited activities in the course of his employment.

In addition to ensuring that minors don’t perform prohibited duties, restaurants employing minors also comply with all applicable restrictions on the hours that the minor is permitted to work based on the age of the minor worker.  For instance, the FLSA and state child labor rules typically prohibit scheduling a minor less than 16 years of age to work during school hours and restrict the hours outside school hours the minor can work based on his age.  Additional restrictions on the types of jobs and hours 14- and 15-year-olds may work also may apply.

Compliance with the FLSA child labor rules is critically important for any restaurant or other employer that employs a minor, particularly since the penalties for violation of these requirements were substantially increased in 2010, as Streets Seafood Restaurant learned earlier this year.

According to a WHD News Release, Street’s Seafood Restaurant paid $14,288 in minimum wage and overtime back wages and an equal amount in liquidated damages totaling $28,577 to eight employees, and also was assessed a civil money penalty of $14,125 for FLSA child labor violations committed in the course of its employment of four minors ages 15 to 17. Specifically, investigators found Street’s Seafood Restaurant:

WHD’s announcement of the settlement resolving these child labor laws quotes Kenneth Stripling, director of the division’s Birmingham District Office as stating:

Employing young people provides valuable experience, but that experience must never come at the expense of their safety …Additionally, employers have an obligation to pay employees what they have legally earned. All workers deserve a fair day’s pay for a fair day’s work. Unfortunately, Street’s Seafood violated not only child labor laws, but has also shorted workers’ pay. The resolution of this case sends a strong message that we will not tolerate either of those behaviors.

Restaurants Must Act To Minimize Risks

Beyond WHD’s direct enforcement actions, WHD also is seeking to encourage private enforcement of WH Law violations by conducting an aggressive outreach to employees, their union and private plaintiff representatives, states and others. Successful plaintiffs in private actions typically recover actual back pay, double damage penalties plus attorneys’ fees and costs. The availability of these often lucrative private damages makes FLSA and other WH Law claims highly popular to disgruntled or terminated workers and their lawyers.  When contemplating options to settle claims WH Law claims made by a worker, employers need to keep in mind that WHD takes the position that settlements with workers do not bar the WHD from taking action unless the WHD joins in the settlement and in fact, past settlements may provide evidence of knowingness or willfulness by the employer in the event of a WHD prosecution.  The substantial private recoveries coupled with these and other WHD enforcement and other compliance actions mean bad news for restaurant employers that fail to manage their FLSA and other WH Law compliance.  Restaurant employers should act within the scope of attorney-client privilege to review and verify their compliance and consult with legal counsel about other options to minimize their risk and streamline and strengthen their ability to respond to and defend against audits, investigations and litigation.

Beyond verifying the appropriateness of their timekeeping and compensation activities and documentation, restaurants and staffing or management organizations working with them also should use care to mitigate exposures that often arise from missteps or overly aggressive conduct by others providing or receiving management services or staffing services. All parties to these arrangements and their management should keep in mind that both parties participating in such arrangements bear significant risk if responsibilities are not properly performed.   Both service and staffing providers and restaurants using their services should insist on carefully crafted commitments from the other party to properly classify, track hours, calculate and pay workers, keep records, and otherwise comply with WH Laws and other legal requirements.  Parties to these arrangements both generally also will want to insist that these contractual reassurances are backed up with meaningful audit and indemnification rights and carefully monitor the actions of service providers rendering these services.

About The Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,”“Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely known for work, teachings and publications.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real-time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on these and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment, employee benefits, compensation, and other regulatory and operational risk management. Examples of her many highly regarded publications on these matters include the “Texas Payday Law” Chapter of Texas Employment Law, as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clients on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at http://www.solutionslawpress.com such as:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here.

©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved.


Health Plans, Other Covered Entities Have Continuing Duty To Reevaluate HIPAA Enterprise Risk To PHI & Address Security Risks & Other Compliance Concern On Ongoing Basis

October 27, 2016

Compliance with the Privacy and Security Rules of the Health Insurance Portability & Accountability Act (HIPAA) is a living process that requires employer and other health plans, health insurers, health care providers and healthcare clearinghouses to recurrently reevaluate their HIPAA enterprise risk and timely act to mitigate security threats to electronic (ePHI) and other  protected health information and other HIPAA compliance concerns on an ongoing basis.  That’s the clear take away applicable to all HIPAA-Covered Entities and business associates from the St. Joseph Health Resolution Agreement and Corrective Action Plan (SJH Settlement) and the Oregon Health & Science University Resolution Agreement and Corrective Action Plan (OHSU Settlement) announced by the Department of Health & Human Services Office of Civil Rights (OCR)  in the past 30 days.  Health plans, their sponsors, fiduciaries and vendors, health care providers and health care clearinghouses should carefully heed this message and in response take documented steps to ensure

  • Their existing policies, practices and procedures properly are updated in response to changing guidance and events;
  • They in place the current, comprehensive enterprise risk assessment along with a mitigation plan documenting actions taken to address these risks;
  • Ensure that the organization has and is administering appropriate, documented processes and procedures to ensure that the organization reassesses its enterprise risk assessment and compliance on a timely basis as warranted by changes or other events that could impact ePHI, regulatory developments or other events that might impact its compliance; and
  • Have an appropriate, documented process for oversight by C-level management.

OHSU Charges & Settlement

The OHSU Settlement Agreement announced by OCR on September 23, 2016 requires OHSU to pay a $2.7 million settlement payment and adopt and implement a comprehensive three-year corrective action plan to address “widespread and diverse” HIPAA compliance problems OCR reports uncovering while investigating multiple HIPAA breach reports the large public academic health center and research university centered in Portland, Oregon.

OCR began investigating OHSU after the large public academic health center and research university centered in Portland, Oregon, submitted three HIPAA breach reports affecting thousands of individuals, including two reports involving unencrypted laptops and another large breach involving a stolen unencrypted thumb drive:

  • On March 23, 2013, HHS received notification from OHSU regarding a breach of its unsecured electronic protected health information (“ePHI”) resulting from a stolen laptop computer;
  • On July 28, 2013, HHS received notification from OHSU regarding a breach of its ePHI resulting from storing ePHI at an internet-based service provider without a business associate agreement; and.

These incidents each garnered significant local and national press coverage. OCR’s investigation uncovered evidence of widespread vulnerabilities within OHSU’s HIPAA compliance program, including the storage of the ePHI of more than 3,000 individuals on a cloud-based server without a business associate agreement.  OCR found significant risk of harm to 1,361 of these individuals due to the sensitive nature of their diagnoses.

OCR’s investigation showed the reported breaches resulted from widespread, long-term, systematic and unresolved HIPAA violations by OHSU that OCR attributed to an inadequate commitment to and oversight of HIPAA compliance by OHSU C-level management which resulted in the failure by OHSU to appropriately monitor the adequacy of its ongoing compliance and to assess and address changes in its enterprise-wide risk and compliance obligations on an ongoing basis. OHSU performed risk analyses in 2003, 2005, 2006, 2008, 2010, and 2013, but OCR’s investigation found that these analyses did not cover all ePHI in OHSU’s enterprise, as required by the Security Rule.  While the analyses identified vulnerabilities and risks to ePHI located in many areas of the organization, OHSU did not act in a timely manner to implement measures to address these documented risks and vulnerabilities to a reasonable and appropriate level. OHSU also lacked policies and procedures to prevent, detect, contain, and correct security violations and failed to implement a mechanism to encrypt and decrypt ePHI or an equivalent alternative measure for ePHI maintained on its workstations, despite having identified this lack of encryption as a risk.

OCR concluded that the reported breaches were the result of long-standing, systematic deficiences in OHSU’s  processes and procedures for HIPAA compliance, including the following:

  • While OHSU reportedly performed risk analyses in 2003, 2005, 2006, 2008, 2010, and 2013, OCR says its investigation found that these analyses did not cover all ePHI in OHSU’s enterprise, as required by the Security Rule;
  • While the analyses identified vulnerabilities and risks to ePHI located in many areas of the organization, OHSU did not act in a timely manner to implement measures to address these documented risks and vulnerabilities to a reasonable and appropriate level;
  • OHSU also lacked policies and procedures to prevent, detect, contain, and correct security violations and failed to implement a mechanism to encrypt and decrypt ePHI or an equivalent alternative measure for ePHI maintained on its workstations, despite having identified this lack of encryption as a risk;
  • OHSU failed to comply with its duty under HIPAA to enter into a business associate agreement with a vendor before allowing a vendor business associate to store ePHI; and
  • The absence of meaningful C-suite leadership oversight and commitment to HIPAA compliance.

Based on these investigations, OCR concluded that while OHSU initially adopted HIPAA Policies, the reported breaches were the result of a series of widespread and ongoing breaches of HIPAA resulted including the following:

  • From January 5, 2011, until July 3, 2013, OHSU disclosed the ePHI of 3,044 individuals in violation of Privacy Rules §§160.103 and 164.502(a) when workforce members disclosed the ePHI to a third party internet-based service provider without obtaining a business associate agreement or other satisfactory assurance that the internet-based service provider would safeguard the ePHI;
  • From January 5, 2011 until July 3, 2013 OHSU failed to obtain a business associate agreement from an internet-based service provider that was storing ePHI on its behalf as a business associate as required by 45 C.F.R. § 164.308(b);
  • From January 5, 2011 until July 3, 2013 OHSU failed to implement policies and procedures to prevent, detect, contain, and correct security violations as required under Privacy Rule § 164.308(a)(1)(i);
  • From July 12, 2010 to present, OHSU failed to implement a mechanism to encrypt and decrypt ePHI or an equivalent alternative measure for all ePHI maintained in OHSU’s enterprise as required by Privacy Rules §§ 164.312(a)(2)(iv) and 164.306(d)(3)); and
  • From May 29, 2013 until July 3, 2013, OHSU failed to implement policies and procedures to address security incidents in violation of Privacy Rule § 164.308(a)(6)(i).

According to statements made by OCR Director Jocelyn Samuels in OCR’s announcement of the OHSU Settlement, the breaches should not have happened.  “From well-publicized large scale breaches and findings in their own risk analyses, OHSU had every opportunity to address security management processes that were insufficient,” said OCR Director Jocelyn Samuels.  OCR’s announcement also signals that OCR views inadequate commitment and oversight by OHSU’s senior management to have played a key role in the creation and perpetuation of the OHSU violations.  It quotes OCR Director Jocelyn Samuels  as stating,  “This settlement underscores the importance of leadership engagement and why it is so critical for the C-suite to take HIPAA compliance seriously.”

OCR’s announcement of the OHSU Settlement emphasizes its determination that a lack of commitment and oversight by C-level management resulted in the failure by OHSU to periodically perform a comprehensive enterprise risk analysis and to reevaluate and update that analysis and its policies, practices, procedures and training as warranted by changing events and guidance.

To resolve the HIPAA charges, the OHSU Settlement requires OHSU to pay OCR $2,700,000 as well as take a long series of corrective actions detailed in the Corrective Action Plan incorporated into the Settlement Agreement.  The requirements of the Corrective Action Plan both seek to address the specific weaknesses that lead to the breaches of unsecured ePHI reported by OHSU in its breach notifications as well as the broader deficiencies in OHSU’s overall HIPAA compliance practice by requiring among other things that OHSU:

  • Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI at all OHSU facilities and on all systems, networks, and devices that create, receive, maintain, or transmit ePHI;.
  • Develop and present to OCR for approval a comprehensive written risk management plan that explains OHSU’s strategy for implementing security measures sufficient to reduce the risks and vulnerabilities identified in the risk analysis to a reasonable and appropriate level based on OHSU’s circumstances as well as a comprehensive, enterprise-wide plan to implement effective oversight of OHSU workforce members to ensure their adherence to HIPAA Rules and OHSU’s internal privacy and security policies and procedures with specific timelines for their expected completion and compensating controls identified in the interim to safeguard OHSU’s ePHI;
  • Implement and administer the written risk management plan and other safeguards as approved by OCR;
  • Provide updates to OCR about OHSU’s implementation of required encryption including a Mobile Device Management (MDM) solution that ensures all OHSU- owned and personally-owned mobile devices (tablets, smart phones, and other mobile devices) that access ePHI on OHSU’s secure network are encrypted other than mobile devices for which OHSU has granted exceptions based on documented evidence of the implementation of alternative reasonable compensating controls to protect the ePHI on such devices;
  • Report to OCR on OHSU’s efforts to a solution to enforce encryption of ePHI on OHSU-owned and personally- owned devices (laptops, desktops, and medical equipment) connecting to OHSU’s secure wired and wireless networks except for any devices for which OHSU has granted exceptions to the encryption requirement;
  • Report to OCR about its implementation of policies that prohibit the transfer of data containing ePHI from OHSU-owned and personally-owned devices to unencrypted removable storage devices (USB drives and portable hard drives) and implementation of a technical solution that enforces the policies prohibiting transfers of this type when attached to the OHSU secure network, except for any removable storage devices for which OHSU has granted exceptions based on documented evidence of reasonable compensating controls that have been implemented to protect the ePHI on such devices;
  • Send a communication to all members of the OHSU community describing its commitment to enterprise encryption;
  • Prepare to the satisfaction of OCR security awareness training materials needed to implement its security management processing including specific privacy and security awareness related to a) use of internet-based information storage services; b) disclosures to third party entities that require a business associate agreement or other reasonable assurance in place to ensure that the business associate will safeguard the protected health information (PHI) and/or ePHI; c) regarding managers, effective oversight of workforce members’ uses and disclosures of PHI, including ePHI, to ensure the workforce members’ compliance with the Privacy and Security Rules and OHSU’s internal policies and procedures; d) security incident reporting; and e) password management;
  • Initially train all workforce members with access to PHI and/or ePHI with 120 days of OCR’s approval of the training and thereafter ensure that new workforce members are trained with 15 days of hire and that all workforce members subsequently continue to receive training on an on-going basis;
  • Review the security awareness training materials annually, and, where appropriate, update the training to reflect changes in Federal law or HHS guidance, any issues discovered during audits or reviews, and any other relevant developments;
  • Management oversight and supervision of the implementation and administration of the corrective actions required by the Corrective Action Plan and HIPAA compliance; and
  • Management reporting to OCR on its actions and compliance with the Corrective Action Plan.

SJH Settlement

Similarly, the SJH Settlement OCR announced on October 18, 2016 with St. Joseph Health (SJH) requires SJH to pay  a $2.4 million plus settlement payment, conduct an enterprise-wide risk analysis and implement and administer a comprehensive correction plan to settle OCR charges that SJH violated HIPAA by allowing files containing ePHI of 31,800 individuals that SJH created for its participation in the Medicare meaningful use program to be publicly accessible on the internet from February 1, 2011, until February 13, 2012.

A nonprofit integrated Catholic health care delivery system sponsored by the St. Joseph Health Ministry, who through its 24,000 employees and 6,000 physicians provides a range of health care services to more than 137,000 inpatients and 3.6 million outpatients each year at SHS’ 4 acute care hospitals, home health agencies, hospice care, outpatient services, skilled nursing facilities, community clinics and physician organizations located throughout California and in parts of Texas and New Mexico.

OCR’s charges against SJH arose out of OCR’s investigation into a 2012 breach notification report SJS filed with OCR.  On February 14, 2012, SJH reported to OCR that files containing electronic protected health information (ePHI) of 31,800 individuals from five of the SJH hospitals-St. Jude Medical Center, Mission Hospital, Queen of the Valley Medical Center, Santa Rosa Memorial Hospital, and Petaluma Valley Hospital that SJH created for its participation in the meaningful use program were publicly accessible on the internet from February 1, 2011, until February 13, 2012, via Google and possibly other internet search engines.

SJH’s report to OCR indicated that this public access resulted from a configuration within its network server in which PDF files containing following patient information were uploaded: patient names; BMI; blood pressure; lab results; smoking status; diagnoses lists; medication allergies; advance directive status and demographic information (language, ethnicity, race, sex, and birth date). The server SJH purchased to store the files included a file sharing application whose default settings allowed anyone with an internet connection to access them. Upon implementation of this server and the file sharing application, SJH did not examine or modify it. As a result, the public had unrestricted access to PDF files containing the ePHI of 31,800 individuals, including patient names, health statuses, diagnoses, and demographic information  from February 14, 2012 until SJH blocked external access to the ePHI when it shut down the application February 13, 2012.

OCR’s investigation indicated the following potential violations of the HIPAA Rules:

  • From February 1, 2011 to February 13, 2012, SJH potentially disclosed the PHI of 31,800 individuals;
  • Evidence indicated that SJH failed to conduct an evaluation in response to the environmental and operational changes presented by implementation of a new server for its meaningful use project, thereby compromising the security of ePHI;
  • Although SJH hired a number of contractors to assess the risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by SJH, evidence indicated that this was conducted in a patchwork fashion and did not result in an enterprise-wide risk analysis, as required by the HIPAA Security Rule.

To resolve charges resulting from these findings, the SJH Resolution Agreement requires SJH to pay OCR a $2,140,500 settlement payment and adopt a comprehensive corrective action plan which among other things, requires SJH to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures.  SJH’s Chief Executive Officer, Annette M. Walker, is named in the Corrective Action Plan as the SJH authorized representative and contact person responsible for overseeing the CAP implementation.

Among other things, the Corrective Action Plan specifically requires that SJH:

  • Within 240 days, conduct an enterprise-wide analysis and provide a report to OCR which includes a complete inventory of all electronic equipment, data systems, and applications that contain or store ePHI, and prepare and deliver to OCR for review an enterprise-wide risk analysis that identifies all security risks and vulnerabilities that incorporates all electronic equipment, data systems, and applications controlled, administered, or owned by SJH, its workforce members, and affiliated staff that contains, stores, transmits, or receives electronic protected health information (ePHJ);
  • Revise this risk analysis plan as directed by OCR based on its review of the presented risk analysis;
  • Develop and implement to the satisfaction of OCR an organization-wide risk management plan to address and mitigate any security risks and vulnerabilities identified in the risk analysis;
  • Distribute the risk management plan as finally approved by OCR to to workforce members involved with implementation of the plan within 30 days of OCR approval;
  • Revise to OCR’s satisfaction, adopt and implement within 30 days of OCR’s approval compliant HIPAA policies and procedures;
  • Prepare for review of OCR training materials and once approved by OCR, provide initial training to required workforce members, and obtain certification of completion of that training from each required workforce member within 60 days of OCR’s approval of the training and thereafter at least annually as long as the Corrective Action Plan remains in force;
  • Promptly conduct a documented investigation of any information indicating a potential workforce member violation of the new HIPAA policies in the manner required by OCR and if the investigation confirms a violation (Reportable Event), notify OCR of the relevant facts, findings, corrective actions and sanctions imposed against the violating workforce member in the manner required by the Corrective Action Plan;
  • Submit annual report to OCR signed and attested to by an SJH officer, which contains the information and attestations of compliance with the requirements of the Corrective Action Plan in accordance with the Corrective Action Plan;
  • Retain for inspection and copying and provide to OCR upon request all documents and records relating to compliance with this Corrective Action Plan for six (6) years from the Effective Date of the SJH Settlement Agreement.

Take Away For Other Covered Entities & Business Associates

The OHSU and SJH Settlement Agreements send a clear message to all Covered Entities and business associates that they must be prepared to demonstrate not only that their initial adoption and implementation of required HIPAA Privacy and Security policies and safeguards, but also that their organization’s leadership needs to be prepared to demonstrate their commitment to HIPAA compliance by making adequate provision for HIPAA compliance, and appropriately monitoring developments that could impact the adequacy of their existing measures and timely update their systems and security, policies, procedures, training and other relevant safeguards.

The Settlements make clear that Covered Entities and their business associates should ensure that their organization possesses a well-documented current enterprise-wide risk assessment, as well as has in place and is administering as necessary to maintain the currency and adequacy of its risk assessment strong practices for conducting documented evaluations of their own HIPAA security, policies, practices, audits and investigations and other procedures necessary to comply with HIPAA, taking into account recent OCR guidance,  its initiation of its Phase II audit program, the insights offered by OCR’s ever growing list of enforcement actions and compliance tools, as well as changes in systems, documentation, software, equipment or other occurrences within the operations of the Covered Entity or business associate’s operations that could impact the currency and adequacy of its risk assessment or otherwise raise compliance risks.

In this respect, Covered Entities and business associates are encouraged to take special note of the advisability of specifically reviewing and updating their HIPAA policies, practices, business associate agreements, training, oversight and documentation to in response to the guidance and insight that OCR provides, including:

Employer and other health plan sponsors, health plan fiduciaries and business associates, and their service providers also generally will want to consider their responsibilities to provide and enforce employer certifications, as well as the fiduciary obligations health plan fiduciaries under the fiduciary responsibility rules of the Employee Retirement Income Security Act (ERISA). Among other things, wrongful disclosure of PHI to a sponsoring employer or others could violate HIPAA or other plan terms.  Furthermore, Department of Labor officials have indicated stated that a fiduciary’s general fiduciary responsibilities can apply to the protection and administration of PHI and other health plan information as well as create a duty by a responsible fiduciary to prudently investigate and take steps to address breaches or other potential concerns that place PHI at risk.  See, HIPAA Settlement Warns Health Plans, Sponsoring Employers & Business Associates To Manage HIPAA Risks.

Furthermore, as breaches of PHI and other violations of HIPAA also frequently give rise to responsibilities or risks under a broad range of other federal and state laws medical and financial privacy and data security, Medicare and other terms of federal program participation, medical credentialing, licensure and ethics, insurance and Employee Retirement Income Security Act fiduciary responsibilities in the case of health plans, contractual,  tort and other exposures, Covered Entities and their business associates also generally are best served to take into account these other responsibilities and exposures in conjunction with the design and administration of their HIPAA compliance and risk management policies and practices.

Covered Entities and their business associates also should seek advice from legal counsel regarding the adequacy of their compliance, investigatory, training, management oversight, training, reporting, documentation, document retention and other processes and procedures that could reduce risks of HIPAA violations and position the organization to effectively and more efficiently respond to a potential breach, audit, investigation or enforcement action and mitigate the costs and potential liability exposures that increasingly attends these events.  In addition, given the typically high financial, operational and legal costs typically incurred to conduct investigations, report and redress breaches, and respond to OCR audits or investigations, much less make any payments and implement any corrective actions required to settle OCR changes, most Covered Entities and their business associations will want to consider the advisability and adequacy of insurance and other sources of funding or indemnification for the often substantial costs that often attend a HIPAA breach, audit or enforcement event. Since HIPAA violations under certain circumstances also can give rise to felony criminal liability, boards of directors and other leaders of Covered Entities and business associates also will want to ensure that their HIPAA compliance policies and practices also are incorporated and monitored by management as part of their organization’s overall Federal Sentencing Guideline Compliance programs and practices.

About The Author

Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of  “Labor & Employment,”“Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely known for work, teachings and publications on HIPAA and other privacy and data security concerns earned in connection with her more than 28 years’ of involvement advising and representing business and government clients domestically and internationally about workforce and human resources, employee benefits; health care; insurance and financial; privacy and data security and other performance management, regulatory, internal controls and other compliance, risk management, public policy and operational other key concerns.

Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, a Fellow in the American College of Employee Benefit Counsel, past Group Chair and current Defined Contribution Plans Committee Co-Chair, Groups and Substantive Committee and Membership Committee Members, past Welfare Plans Committee Chair and Co-Chair, and former Fiduciary Responsibility Vice Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current ABA International Section Life Sciences Committee Vice Chair, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, former ABA Joint Committee on Employee Benefits Council Representative and Marketing Committee Chair and a prolific author and highly popular speaker and consultant, Ms. Stamer helps management manage.

Ms. Stamer’s legal and management consulting work throughout her nearly 30-year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

As a core component of her work,  Ms. Stamer has worked extensively throughout her career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

Beyond her extensive involvement advising and representing clients on privacy and data security concerns and other health industry matters, Ms. Stamer also has served for several years as a scrivener for the ABA JCEB’s meeting with OCR, the Chair of the Southern California ISSA Health Care Privacy & Security Summit, and an editorial advisory board member, author, program chair or steering committee member, and faculties for a multitude of other programs and publications regarding privacy, data security, technology and other compliance, risk management and operational concerns in the health care, health and other insurance, employee benefits and human resources, retail, financial services and other arenas.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE: Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Council, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com  or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at http://www.solutionslawpress.com such as:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here.

©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™  All other rights reserved.  


New ACA Student Health Insurance Guidance Allows College Payment Of Working Students’ Student Health Insurance Premiums Post 2016

October 21, 2016

Colleges and other institutions of higher education within the meaning of the Higher Education Act of 1965 (schools) may continue until further notice to pay or subsidize student health insurance coverage premiums for students performing work-study or other services for the school as part of their financial aid package without fear of prosecution for violation of the group market reform requirements of the Patient Protection & Affordable Care Act (ACA), according to ACA guidance jointly published by the Departments of Labor (DOL), Health and Human Services (HHS), and the Treasury (collectively, the Tri-Agencies) today.

Many schools have arrangements in place with insurers under which students can purchase individual policies providing health insurance coverage (“student health insurance coverage”), which are individual policies required to comply with the individual market reforms of the ACA other than as provided in the student health insurance guidance issued by HHS. See 45 CFR 147.145.

Of course, the agreement between the college and the student health insurance coverage issuer makes the coverage available for purchase by most if not all students attending the school by paying the specified premium.  In some cases, however, the school might include in a student’s financial aid package a reduction to the cost of coverage of the otherwise applicable premium for student health insurance through a credit, offset, reimbursement, stipend, or similar arrangement (a premium reduction arrangement). If the student also performs services under a workstudy or other relationship, however, Tri-Agency guidance interpreting the Group Market Reforms could present a problem unless qualifies for an exemption from the Tri-Agencies’ interpretation of the Group Market Reforms as prohibited employers from paying or reimbursing individual health insurance policy premiums of employees..

The Tri-Agencies’ first announced their interpretation of the Group Market Reforms as prohibiting employer reimbursement of individual health insurance premiums in 2013.  Technical Release 2013-03 announced that employers sponsoring arrangements under which the employer directly pays or reimburses premiums for employees’ individual health insurance coverage directly, or through a cafeteria plan pre-tax premium program, health flexible spending account arrangement (health FSA), health reimbursement arrangement (HRA),  or other employer arrangement would incur excise taxes liability under section 4980D of the Internal Revenue Code and other penalties and liabilities for violating the ACA Group Market Reform rules.  This Tri-Agency Guidance states that because by their very definition, these arrangements promise to reimburse or pay medical expenses on the employee’s behalf only up to a certain dollar amount each year, employer-sponsored arrangements that pay or reimburse employees for individual health insurance premiums generally violate the prohibition on annual dollar limits under Public Health Services (PHS) Act section 2711 and the requirement to provide certain preventive services without cost sharing under PHS Act section 2713 unless properly integrated with a group health plan that otherwise complies with ACA requirements.  Furthermore, because the Tri-Agencies also construe the ACA market reforms as preventing the integration of EPPs and individual health insurance coverage, the Tri-Agencies’ guidance also states that an arrangement through which an employer reimburses or directly pays the premium for individual coverage violates the ACA market reform rules. Accordingly, unless otherwise exempted from coverage, this Tri-Agency guidance would prohibit schools from reimbursing students providing services to the school for student health insurance premiums.

Under Tri-Agency guidance published in February, 2016, the Tri-Agencies previously announced they would not that a premium reduction arrangement provided by a school to a student fails to satisfy PHS Act section 2711 or 2713 if the arrangement is offered in connection with other student health coverage (insured or self-insured) for a plan year or policy year beginning before January 1, 2017, but until October 21, 2016, did not address the post-2016 treatment of these arrangements .  See Technical Release 2016-01;  Notice 2016-17, Insurance Standards Bulletin, Application of the Market Reforms and Other Provisions of the Affordable Care Act to Student Health Coverage.

Under guidance jointly published October 21, 2016, however, the Tri-Agencies extended their policy of non-enforcement with respect to school student health insurance premium reimbursement arrangements beyond its previously announced December 31, 2016 expiration date.  FAQs About Affordable Care Act Implementation Part 33 (“FAQ 33”) jointly published by the Tri-Agencies states that “pending further guidance, the Tri-Agencies consider it appropriate to further extend the enforcement relief provided in the February 5, 2016 guidance and will not assert that a premium reduction arrangement offered by an institution of higher education fails to satisfy PHS Act section 2711 or 2713 if the arrangement is offered in connection with student health coverage (insured or self-insured).

About The Author

Cynthia Marcotte Stamer is a noted Texas-based management lawyer and consultant, author, lecture and policy advocate, recognized for her nearly 30-years of cutting edge management work as among the “Top Rated Labor & Employment Lawyers in Texas” by LexisNexis® Martindale-Hubbell® and as among the “Best Lawyers In Dallas” for her work in the field of  “Labor & Employment,”“Tax: Erisa & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine.

Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, a Fellow in the American College of Employee Benefit Counsel, past Group Chair and current Defined Contribution Plans Committee Co-Chair, Groups and Substantive Committee and Membership Committee Members, past Welfare Plans Committee Chair and Co-Chair, and former Fiduciary Responsibility Vice Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current ABA International Section Life Sciences Committee Vice Chair, past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, former ABA Joint Committee on Employee Benefits Council Representative and Marketing Committee Chair and a prolific author and highly popular speaker and consultant, Ms. Stamer helps management manage.

Ms. Stamer’s legal and management consulting work throughout her nearly 30-year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

For additional information about this topic or  Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal control and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at http://www.Solutionslawpress.com.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here. ©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™. All other rights reserved.

IMPORTANT NOTICES

These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation in light of the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as an admission.  The author reserves the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues.  Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The presenter and the program sponsor disclaim, and have no responsibility to provide any update or otherwise notify any participant of any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication.

Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein


Manage Retaliation Risks In Response To Updated EEOC Enforcement Guidance, Rising Retaliation Claims

August 31, 2016

U.S. employers, employment agencies, unions, their benefit plans and fiduciaries, and their management and service providers should move quickly to review and strengthen their employment and other practices to guard against a foreseeable surge in employee retaliation claims and judgements likely to follow the August 30, 2016 issuance by the Equal Employment Opportunity Commission (EEOC) of its new final  EEOC Enforcement Guidance on Retaliation and Related Issues and concurrently published Question and Answer Guidance(Guidance).

Updating and superceding 2008 guidance previously set forth in the Retaliation Chapter of the EEOC Enforcement Manual, the Guidance details the EEOC’s current policy for investigating and enforcing the retaliation prohibitions under each of the equal employment opportunity (EEO) laws enforced by EEOC, including Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act (ADEA), Title V of the Americans with Disabilities Act (ADA), Section 501 of the Rehabilitation Act, the Equal Pay Act (EPA) and Title II of the Genetic Information Nondiscrimination Act (GINA) as well as the ADA’s separate “interference” prohibitions, which prohibit coercion, threats, or other acts that interfere with the exercise of ADA rights.  Among other things, the Guidance discusses :

  • What “retaliation means” and the scope of employee activity protected by the prohibitions against retaliation included in all laws enforced by the EEOC as well as the interference prohibitions of the ADA;
  • Legal analysis the EEOC will use to determine if evidence supports a claim of retaliation against an employer or other party;
  • Detailed examples of employer actions that the EEOC says may constitute prohibited retaliation; and
    Remedies available for retaliation.

Understanding and properly responding to the Guidance is critically important for employers and other subject to the EEO laws because in light of the substantial and growing liability exposures retaliation claims present and the likely that the issuance of the Guidance will further fuel these risks.

Even before the EEOC published the Guidance, retaliation and interference exposures were a substantial source of concern for most employers.  Employers, employment agencies and unions caught engaging in prohibited retaliation or intimidation in violation of EEO laws can incur compensatory and (except for governmental employers) punitive damage awards, back pay, front pay, reinstatement into a job or other equitable remedies, injunctive or administrative orders requiring changes in employer policies and procedures, managerial training, reporting to the EEOC and other corrective measures, as well as substantial investigation and defense costs.

These substantial liability exposures have become particularly concerning as retaliation and interference claims also have become increasingly common over the past decade. According to the EEOC, for example, EEO law retaliation charges have remained the most frequently alleged basis of charges filed with the EEOC since 2009 and in Fiscal Year 2015 accounted for 44.5 percent of all employment discrimination charges received by EEOC.
Since the EEOC’s issuance of the Retaliation Regs are likely to encourage additional retaliation or interference claims, employers, employment agencies, unions and their management, service providers and agents should quickly to evaluate the updated guidance provided in the Retaliation Reg and act to mitigate their exposure to retaliation retaliation and interference claims under these EEO laws.

Retaliation Risks Under EEO Laws

Federal EEO laws generally prohibit employers, employment agencies, or unions from punishing or taking other adverse actions against job applicants or employees for “asserting their rights” (often referred to as “protected activity”) to be free from harassment or other prohibited employment discrimination as well as certain other conduct. Such claims generally are referred to as “retaliation claims.”
Prohibited retaliation in violation of EEO laws occurs when an employer, employment agency or union takes a materially adverse action because an applicant or employee asserts rights or engages in certain other activities protected by the EEO laws.

To prevail in a retaliation claim, an applicant, employee or other individual generally must show that:

  • The individual engaged in prior protected activity;
  • The employer, employment agency or union took a materially adverse action; and
  • More likely than not, retaliation caused the adverse action by the employer, employment agency or union.

Persons Protected By EEO Retaliation Rules

EEO retaliation prohibitions protect both applicants and current and former employees (full-time, part-time, probationary, seasonal, and temporary) against retaliation under the EEO laws.  The retaliation prohibitions bar an employer from refusing to hire or otherwise taking adverse action against any current or former applicant or employee because of his EEO complaint or other protected activity under applicable EEO laws.  The EEOC interprets the retaliation rules as prohibiting an employer from giving a false negative job reference to punish a former employee for making an EEO complaint or engaging in other protected activity as well as as prohibiting an employer from refusing to hire or otherwise retaliating or discriminating against an applicant or employee based on a complaint made or other protected activity engaged against any a prior employer.  The Guidance also makes clear that the retaliation prohibitions apply regardless of an applicant or employee’s citizenship or work authorization status.

Protected Activity

“Protected activity” generally means either participating in an EEO process or reasonably opposing conduct made unlawful by an EEO law.

The prohibition against an employer retaliating against an individual for “participating” in an EEO process means that an employer cannot punish an applicant or employee for filing an EEO complaint, serving as a witness, or participating in any other way in an EEO matter, even if the underlying discrimination allegation is unsuccessful or untimely. As a part of these prohibitions, the EEOC says that an employer, employment agency or union is not allowed to do anything in response to EEO activity that would discourage someone from resisting or complaining about future discrimination. For example, depending on the facts of the particular case, it could be retaliation because of the employee’s EEO activity for an employer to:

  • Reprimand an employee or give a performance evaluation that is lower than it should be;
  • Transfer the employee to a less desirable position;
  • Engage in verbal or physical abuse;
  • Threaten to make, or actually make reports to authorities (such as reporting immigration status or contacting the police);
  • Increase scrutiny;
  • Spread false rumors, treat a family member negatively (for example, cancel a contract with the person’s spouse); or
  • Take action that makes the person’s work more difficult (for example, punishing an employee for an EEO complaint by purposefully changing his work schedule to conflict with family responsibilities).

The Guidance clearly states that the EEOC views participating in any capacity in a complaint process or other protected equal employment opportunity as protected activity which is protected from retaliation under all circumstances.  The EEOC views other acts to oppose discrimination also as protected as long as the employee was acting on a reasonable belief that something in the workplace may violate EEO laws, even if he or she did not use legal terminology to describe the issue. EEOC’s view is that protections against retaliation extend to participation in an employer’s internal EEO complaint process, even if a charge of discrimination has not yet been filed with the EEOC. The EEOC also takes the position that participation in the EEO process is protected whether or not the EEO allegation is based on a reasonable, good faith belief that a violation occurred. While an employer is free to bring these to light in the EEO matter where it may rightly affect the outcome, the Retaliation Regs state it is unlawful retaliation for an employer to take matters into its own hands and impose consequences for participating in an EEO matter.

In addition to prohibition for participation in protected activities, EEO law also prohibits retaliation against an individual for “opposing” a perceived unlawful EEO practice.  The EEOC construes prohibition against retaliation for opposition as prohibiting an employer or other covered entity from punishing an applicant or employee for communicating or taking other action in opposition of a perceived EEO violation if the individual acted reasonably and based on a reasonable good faith belief that the conduct opposed is or could become unlawful if repeated.

According to the EEOC, opposition also can be protected even if it is informal or does not include the words “harassment,” “discrimination,” or other legal terminology. A communication or act may be protected opposition as long as the circumstances show that the individual is conveying resistance to a perceived potential EEO violation such as, for example:

  • Complaining or threatening to complain about alleged discrimination against oneself or others;
  • Taking part in an internal or external investigation of employment discrimination, including harassment;
  • Filing or being a witness in a charge, complaint, or lawsuit alleging discrimination;
  • Communicating with a supervisor or manager about employment discrimination, including harassment;
  • Answering questions during an employer investigation of alleged harassment;
  • Refusing to follow orders that would result in discrimination;
  • Resisting sexual advances, or intervening to protect others;
  • Reporting an instance of harassment to a supervisor;
  • Requesting accommodation of a disability or for a religious practice;
  • Asking managers or co-workers about salary information to uncover potentially discriminatory wages;
  • Providing information in an employer’s internal investigation of an EEO matter;
  • Refusing to obey an order reasonably believed to be discriminatory;
  • Advising an employer on EEO compliance;
  • Resisting sexual advances or intervening to protect others;
  • Passive resistance (allowing others to express opposition);
  • Requesting reasonable accommodation for disability or religion;
  • Complaining to management about EEO-related compensation disparities;
  • Talking to coworkers to gather information or evidence in support of a potential EEO claim; or
  • Other acts of opposition.

In order for the protection against opposition to apply, however, the individual must act with a reasonable good faith belief that the conduct opposed is unlawful or could become unlawful if repeated.  Opposition not based on such a good faith belief is not protected. Employers should note that the EEOC takes the position that opposition by an employee could qualify as reasonable opposition protected against retaliation when an employee or applicant complains about behavior that is not yet legally harassment (i.e., even if the mistreatment has not yet become severe or pervasive) or to complain about conduct the employee believes violates the EEO laws if the EEOC has adopted that interpretation, even if some courts disagree with the EEOC on the issue.

Furthermore, an individual opposing a perceived violation of an EEO law is disqualified for protection against retaliation for his opposition unless the individual behaves in a reasonable manner when expressing his opposition. For example, threats of violence, or badgering a subordinate employee to give a witness statement, are not protected opposition.

Subject to these conditions, however, the Guidance states that retaliation for opposing perceived unlawful EEOC practices need not be applied directly to the employee to qualify for protection. If an employer, employment agency or union takes an action against someone else, such as a family member or close friend, in order to retaliate against an employee, the EEOC says both individuals would have a legal claim against the employer.

Moreover, according to the EEOC, the prohibitions against retaliation for participation and opposition apply regardless of whether the person is suffers the retaliation for acting as a witness or otherwise participating in the investigation of a prohibited practice regarding an EEO complaint brought by others, or for complaining of conduct that directly affects himself.

Materially Adverse Action

To fall within EEO law prohibitions against retaliation, the retaliatory actions must be “materially adverse,” which the Guidance defines to include any action that under the facts and circumstances might deter a reasonable person from engaging in protected activity.  This definition of “materially adverse” sweeps broadly to include more than employment actions such as denial of promotion, non-hire, denial of job benefits, demotion, suspension, discharge, or other actions that can be challenged directly as employment discrimination. It also encompasses within the scope of retaliation employer action that is work-related, as well as other actions with no tangible effect on employment, or even an action that takes place exclusively outside of work, as long as it may well dissuade a reasonable person from engaging in protected activity.

Whether an action is materially adverse depends on the facts and circumstances of the particular case. The U.S. Supreme Court has held that transferring a worker to a harder, dirtier job within the same pay grade, and suspending her without pay for more than a month (even though the pay was later reimbursed) were both “materially adverse actions” that could be challenged as retaliation. The Supreme Court has also said that actionable retaliation includes: the FBI’s refusing to investigate death threats against an agent; the filing of false criminal charges against a former employee; changing the work schedule of a parent who has caretaking responsibilities for school-age children; and excluding an employee from a weekly training lunch that contributes to professional advancement.

In contrast, a petty slight, minor annoyance, trivial punishment, or any other action that is not likely to dissuade an employee from engaging in protected activity in the circumstances is not “materially adverse.” For example, courts have concluded on the facts of given cases that temporarily transferring an employee from an office to a cubicle was not a materially adverse action and that occasional brief delays by an employer in issuing refund checks to an employee that involved small amounts of money were not materially adverse.

The facts and circumstances of each case determine whether a particular action is retaliatory in that context. For this reason, the same action may be retaliatory in one case but not in another. Depending on the facts, other examples of “materially adverse” actions may include:

  • Work-related threats, warnings, or reprimands;
  • Negative or lowered evaluations;
  • Transfers to less prestigious or desirable work or work locations;
  • Making false reports to government authorities or in the media;
  • Filing a civil action;
  • Threatening reassignment;
  • Scrutinizing work or attendance more closely than that of other employees, without justification;
  • Removing supervisory responsibilities;
  • Engaging in abusive verbal or physical behavior that is reasonably likely to deter protected activity, even if it is not yet “severe or pervasive” as required for a hostile work environment;
  • Requiring re-verification of work status, making threats of deportation, or initiating other action with immigration authorities because of protected activity;
  • Terminating a union grievance process or other action to block access to otherwise available remedial mechanisms; or
  • Taking (or threatening to take) a materially adverse action against a close family member (who would then also have a retaliation claim, even if not an employee).

ADA Interference Claims

In addition to the need to manage potential exposures for prohibited retaliation, employers, employment agencies and unions also should be careful to manage their exposure to potential liability arising from claims for wrongful interference and individual’s exercise of the disability rights or protections granted under the ADA.

The ADA generally prohibits disability discrimination, limits an employer’s ability to ask for medical information, requires confidentiality of medical information, and gives employees who have disabilities the right to reasonable accommodations at work absent undue hardship and like other EEO laws, prohibits retaliation. In addition to its prohibitions against retaliation, however, the ADA also more broadly prohibits “interference” with statutory rights under the ADA.

Interference is broader than retaliation. The ADA’s interference provision makes it unlawful to coerce, intimidate, threaten, or otherwise interfere with an individual’s exercise of ADA rights, or with an individual who is assisting another to exercise ADA rights.

In addition, the ADA also prohibits employers from interfering with ADA rights by doing anything that makes it more difficult for an applicant or employee to assert any of these rights such as using threats or other actions to discourage someone from asking for, or keeping, a reasonable accommodation; intimidating an applicant or employee into undergoing an unlawful medical examination; or pressuring an applicant or employee not to file a disability discrimination complaint.

Prohibited interference may be actionable under the ADA even if ineffective and even if the person subjected to intimidation goes on to exercise his ADA rights.

  • While acknowledging that some employer actions may be both retaliation and interference, or may overlap with unlawful denial of accommodation, the Guidance identifies the following actions as examples of interference prohibited under the ADA:
  • Coercing an individual to relinquish or forgo an accommodation to which he or she is otherwise entitled;
  • Intimidating an applicant from requesting accommodation for the application process by indicating that such a request will result in the applicant not being hired;
  • Threatening an employee with loss of employment or other adverse treatment if he does not “voluntarily” submit to a medical examination or inquiry that is otherwise prohibited under the statute;
  • Issuing a policy or requirement that purports to limit an employee’s rights to invoke ADA protections (e.g., a fixed leave policy that states “no exceptions will be made for any reason”);
  • Interfering with a former employee’s right to file an ADA lawsuit against the former employer by stating that a negative job reference will be given to prospective employers if the suit is filed; and
  • Subjecting an employee to unwarranted discipline, demotion, or other adverse treatment because he assisted a coworker in requesting reasonable accommodation.

According to the EEOC, a threat does not have to be carried out in order to violate the interference provision, and an individual does not actually have to be deterred from exercising or enjoying ADA rights in order for the interference to be actionable.

Strategies To Help Deter Or Rebut Retaliation Charges

Even though individuals claiming retaliation technically bear the burden of proving more likely than not that he suffered an adverse employment action more probably than not as a result of retaliation, an employer, employment agency or union charged with illegal retaliation frequently need to rebut or undermine a claimant’s evidence of retaliation by having and introducing admissible evidence that it a non-retaliatory reason for taking the challenged action such as evidence that:

  • The employer was not, in fact, aware of the protected activity;
  • There was a legitimate non-retaliatory motive for the challenged action, that the employer can demonstrate, such as poor performance; inadequate qualifications for position sought; qualifications, application, or interview performance inferior to the selectee; negative job references (provided they set forth legitimate reasons for not hiring or promoting an individual); misconduct (e.g., threats, insubordination, unexcused absences, employee dishonesty, abusive or threatening conduct, or theft); or reduction in force or other downsizing;
  • Similarly-situated applicants or employees who did not engage in protected activity were similarly treated;
  • Where the “but-for” causation standard applies, there is evidence that the challenged adverse action would have occurred anyway, despite the existence of a retaliatory motive; or
  • Other credible evidence showing a legitimate, non-discriminatory and non-retalitory motive behind the action.

It is important that employer other other potential defendants in retaliation actions recognize and take appropriate steps to create and retain evidence documenting these or other legitimate business reasons justifying the action prior to taking adverse action.  Many employer or other defendants charged with discrimination or retaliation discover too late that a rule of evidence commonly referred to as the “After Acquired Evidence Doctrine” often prevents an employer or other defendant from using documentation or other evidence of motive created after the adverse action occurs.  Consequently, employer and other potential targets of retaliation claims before taking the adverse action would be wise to carefully collect, document and retain the evidence and analysis showing their adverse action was taken for a legitimate, nonretalitory, nondiscriminatory reason rather than for any retaliatory purpose.

Other Defensive Actions & Strategies

Beyond taking care to document and retain evidence of its legitimate motivations for taking an adverse employment action, employers, employment agencies and unions interested in avoiding or enhancing their defenses against retaliation or interference claims also may find it helpful to:

  • Maintain a written, plain-language anti-retaliation and anti-interference policy that provides practical guidance on the employer’s expectations with user-friendly examples of what to do and not to do;
  • Send a message from top management that retaliation and interference are prohibited and will not be tolerated;
  • Ensure that top management understands and complies with policies against prohibited discrimination, retaliation and interference;
  • Consistently and fairly administer all equal employment opportunity and other policies and procedures in accordance with applicable laws in a documented, defensible manner;
  • Post and provide all required posters or other equal employment opportunity notices;
  • Timely and accurately complete and file all required EEO reports;
  • Clearly communicate orally and in writing the policy against prohibited retaliation and interference, as well as procedures for reporting, investigating and addressing concerns about potential violations of these policies in corporate policies as well as to employees complaining or participating in investigations or other protected activities;
  • Conduct documented training for all managers, supervisors and other employees and agents of the employer about policies against prohibited discrimination, retaliation, and interference including, as necessary, specific education about specific behaviors or situations that could raise retaliation or interference concerns, when and how to report or respond to such concerns and other actions to take to prevent or stop potential retaliation and interference;
  • Establish and administer clear policies and procedures for reporting and investigating claims or other indicators of potential prohibited employment discrimination, retaliation, interference including appropriate procedures for monitoring and protecting applicants and workers who have made claims of discrimination or have a record of involvement in activities that might qualify for corrective action;
  • Review performance, compensation and other criteria for potential evidence of overt or hidden bias or other evidence of potential prohibited retaliation or interference and take documented corrective action as needed to prevent improper bias from adversely corrupting decision-making process;
  • Conduct timely, well-documented investigations of all reports or other evidence of suspected discrimination, retaliation, and interference including any disciplinary, remedial or corrective action taken or foregone and the justification underlying these actions;
  • Obtain and enforce contractual reassurances from recruiting, staffing and other contractors to adhere to, and cooperate with the employer in its investigation and redress of the nondiscrimination, data collection and reporting, anti-retaliation and anti-interference requirements of equal employment opportunity and other laws;
  • Incorporate appropriate inquiries and other procedures for documented evaluating and monitoring that hiring, staffing, performance review, promotion, demotion, discipline, termination and other employment decisions and actions for evidence or other indicators of potential prohibited discrimination, retaliation, interference or other prohibited conduct and take corrective action as necessary based on the evidence developed; and
  • Designate appropriately empowered and trained members of the management of the employer to receive and investigate complaints and other potential concerns;
    Arrange for an unbiased third party review of the adverse action or the performance or other decision criteria, processes and analysis that the employer or other defendant contemplates relying on to decide and implement employment decisions for indicators of potential discriminatory, retaliatory or other illegal or undesirable biasand take corrective action as needed to address those concerns before undertaking employment actions;
  • Evaluate and allocate appropriate funds within the employer’s budget to support the employer’s compliance efforts as well as to provide for the availability of sufficient funds to investigate and defend potential charges or public or private charges of illegal discrimination, retaliation or interference through the purchase of employment practices liablity or other insurance coverages or otherwise;
  • If a manager or other party recommends an adverse action in the wake of an employee’s filing of an EEOC charge or participation in other protected activity, conducting or arranging for an another party to ndependently evaluate whether the adverse action is appropriate;
  • Proactively seek assistance from qualified legal counsel with the design and review of policies, practices and operations, investigation and analysis of internal or external complaints or other concerns about potential prohibited discrimination, retaliation or interference, review and execution of termination, discipline or other workforce events to mitigate discrimination, retaliation or interference risks as well as the defense of EEOC or private enforcement actions; and
  • Be ever diligent in your efforts to prevent, detect and redress actions or situations that could be a basis for retaliation or interference claims.

About The Author

Cynthia Marcotte Stamer is a noted Texas-based management lawyer and consultant, author, lecture and policy advocate, recognized for her nearly 30-years of cutting edge management work as among the “Top Rated Labor & Employment Lawyers in Texas” by LexisNexis® Martindale-Hubbell® and as among the “Best Lawyers In Dallas” for her work in the field of  “Labor & Employment,”“Tax: Erisa & Employee Benefits” “Health Care” and “Business and Commercial Law” by D Magazine.

Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, a Fellow in the American College of Employee Benefit Counsel, past Chair and current committee Co-Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, former Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, a former ABA Joint Committee on Employee Benefits Council Representative and , Ms. Stamer helps management manage.

Ms. Stamer’s legal and management consulting work throughout her nearly 30-year career has focused on helping organizations and their management use the law and process to manage people, process, compliance, operations and risk. Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal control and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at www.Solutionslawpress.com.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile here. ©2016 Cynthia Marcotte Stamer. Non-exclusive right to republish granted to Solutions Law Press, Inc.™. All other rights reserved.


Criminal Conviction Of Plan Trustee, Outside Legal Counsel Shows Risks of Retaliating Against Whistleblowers For Reporting ERISA Violations

August 1, 2016

The U.S. Department of Labor’s just announced successful whistleblower prosecution in Perez v. Scott Brain, et al of an employee benefit plan trustee, and an individual lawyer and her law firm that served as the employee benefit plan’s outside legal counsel of violating the fiduciary responsibility and whistleblower rules of the Employee Retirement Income Security Act of 1974 (ERISA) illustrates why employee benefit plan sponsors, trustees or other fiduciaries, their management, legal counsel, auditors and other service providers must both prudently investigate whistleblower allegations or other evidence of potential wrongdoing involving their employee benefit plans and resist the temptation to retaliate against employees or others for reporting or cooperating in the investigation of alleged improprieties involving an employee benefit plan.

The Brain decision highlights the care that employee benefit plan sponsors, fiduciaries, advisors and service providers and their management must use when responding to allegations or other evidence of wrongdoing relating to an employee benefit plan or its administration, investigating and addressing alleged misconduct or other performance or disciplinary concerns involving parties whose report or involvement in investigations of ERISA or other misconduct could form the basis of a potential ERISA 510 or other retaliation complaint.

The decision also makes clear that outside legal counsel advising an employee benefit plan or its fiduciaries in relation to the investigation or response to charges of ERISA misconduct involving an employee benefit plan must use care to avoid actions that could render them liable for participation in acts of illegal retaliation, violating their duty of loyalty to the plan by allowing themselves to become involved in a conflict of interest when investigating or defending potential wrongdoing involving an employee benefit plan, or engaging in other discretionary actions that could constitute a breach of fiduciary duty in violation of ERISA.

In Perez v. Scott Brain, et al., the U.S. District Court for the Central District of California ruled that Cement Masons Southern California Trust Fund’s trustee and Cement Masons Local 600 business manager, Scott Brain (Brain) and outside trust fund legal counsel, Melissa Cook, violated sections 510 and 404 of ERISA by causing the firing a trust fund employee Cheryle Robbins (Robbins) and an employee of the plan’s third party administrator, Cory Rice (Rice), in retaliation for their involvement in filing an internal complaint about and cooperating with the Labor Department’s Employee Benefit Security Administration’s federal criminal investigation of reports of Brain’s wrongful interference as a trustee with collections and contributions from unionized employers.

In 2011, Robbins, director of the trust funds’ audit and collections department, responded to a federal criminal investigation into Brain’s activities with contractors. The same year, she and Rice, who worked for the third-party administrator to the trust fund, American Benefit Plan Administrators, now, Zenith American Solutions (Zenith), participated in an effort to complain about Brain’s interference with efforts to collect delinquent contributions from contractors. Within weeks of this conduct, Robbins was suspended from her employment with the trust fund. Less than six months later, both Robbins and Rice were fired.

The court’s 71-page decision chronicles the coordinated retaliatory campaign orchestrated by Brain and Cook that led to Robbins’ suspension and firing by the employee benefit plan as well as the termination of Cook by his employer, Zenith..

With respect to Robbins’ suspension, the court found that the evidence showed Brain and Cook “were very upset with Robbins due to her contact with the [Department of Labor],” and that Brain and Cook “used their positions and influence to cause the other trustees to vote in favor of” suspending Robbins. To do so, the court explained, Brain and Cook “took the lead at the . . . [b]oard meeting with respect to the discussion of Robbins’ contact with the [Department of Labor]” and “created an environment that was hostile to her,” which “caused the trustees to vote to place her on leave.” The court noted that the two “‘set in motion’ the decision by the Joint Board to put Robbins on leave [.]”

As for Rice’s firing, the court explained how Brain and Cook retaliated against Rice by pressuring his employer, Zenith, into firing Rice and manipulating the Zenith relationship to deter Zenith from rehiring Rice in retaliation for his involvement in efforts to make an internal complaint about Brain.

Based upon evidence introduced during a five-day trial, the District Court ruled that Brain, Cook and Cook’s law firm violated ERISA section 510 by suspending and then discharging Robbins, and causing Zenith to refuse to hire Robbins and to discharge Rice in retaliation for their participation in reporting Brian’s misconduct to the General President of the Operative Plasterers’ and Cement Masons’ International Association and because Robbins participated in a federal criminal investigation of Brain.  Specifically, the District Court ruled:

  • Brain, Cook and Cook’s law firm wrongfully retaliated against Robbins in violation of ERISA 510 for her communications with the DOL by placing her on administrative leave; causing the work performed by the department that Robbins previously managed to be outsourced to Zenith and by causing Zenith not to hire Robbins to participate in its work;
  • Brain, Cook and Cook’s law firm wrongfully retaliated against Rice in violation of ERISA 510 by causing Zenith to terminate Cook;
  • Brain breached his fiduciary duty under ERISA 404 by retaliating against Robbins and causing her to be placed on administrative leave and that Cook knowingly participated in that breach.

The court held that Brain and Cook’s retaliatory conduct violated section 510 of ERISA, which prohibits retaliation against whistleblowers for complaining of ERISA violations or cooperating with a governmental investigation of such violations. The court also held that the couple’s retaliation against Robbins breached Brain’s fiduciary duties under ERISA section 404 to the trust funds and that Cook participated knowingly in that breach.

In reaching its decision, the court rejected attorney Cook’s argument that she was somehow immunized from her unlawful conduct because she was an attorney to the trust funds.  Among other things, the court noted the “apparent conflict of interest” Cook had in representing the trust funds while being in an undisclosed “romantic relationship” with Brain, which existed as defendants carried out their retaliatory scheme. Reminding lawyers of their ethical duties in California, the court cited California Rule of Professional Conduct 3-310(B), which the court explained “requires that an attorney disclose to a client any personal relationship or interest that he or she knows, or with the exercise of reasonable diligence should know, could substantially affect her his or her professional judgment in advising the client.”

As punishing for these criminal violations of ERISA, the District Court ordered the permanent removal of Brain as a trustee. It also ordered the permanent barring of Brain, Cook and her law firm from serving the Cement Masons Southern California Trust Funds. In addition, the court ordered Cook and her law firm to repay all attorneys’ fees she billed the trust funds for the actions she took in retaliating against whistleblowers Robbins and Rice.  These criminal sanctions were in addition to the $630,000 civil damage award that the Labor Department previously secured in lost wages and damages for Robbins, Rice and another worker victimized by Brain and Cook in August 2015.

In addition to its successful prosecution of Brain, Cook and Cook’s law firm on these charges, the DOL also had sought, but failed to convince the District Court based on the evidence presented at trial to find Brain, Cook, Cook’s law firm and Brain’s fellow trust fund trustee Local 600 business agent and Joint Board of Trustees member Jaime Briceno guilty of wrongful retaliation against another alleged whistleblower or Briceno of breaching his fiduciary duties under ERISA by failing to prudently investigate Robbins’ allegations against Brain; or by voting to use assets of the Trust Funds to pay the cost of the settlement of the civil action brought by Robbins. The District Court also refused to consider a newly raised charge that Brain breached his fiduciary duty by failing to collect all monies owed to the Trust Funds on the grounds that the Labor Department had failed to timely raise the charge. While the court refused to convict Briceno, Brain, Cook or Cook’s law firm on the additional charges, the Labor Department’s prosecution of these claims illustrates that along with abstaining from retaliating against ERISA whistleblowers, employee benefit plan fiduciaries also should position themselves to defend against potential breach of fiduciary duty claims based on alleged inadequacies in their investigation or response to reports or other evidence of misconduct involving the plan by prudently investigating and acting to redress allegations or other evidence of potential wrongdoing in the administration of employee benefit plans or their assets.

About The Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” in ERISA, Labor and Employment and Healthcare Law by D Magazine for her nearly 30 years of experience and knowledge representing and advising employers, employee benefit plans, their sponsors, fiduciaries, service providers and vendors and others on these and other planning, business transaction and contracting, administration, compliance, risk management, audits, investigations, government and private litigation and other enforcement and other related matters.

past Chair and current committee Co-Chair of the American Bar Association (ABA) RPTE Section Employee Benefits Group, Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, former Chair of the ABA Health Law Section Managed Care & Insurance Interest Group, a former ABA Joint Committee on Employee Benefits Council Representative ,

Ms. Stamer’s legal and management consulting work throughout her nearly 30-year career has focused on helping management manage.  Highly valued for her rare ability to find pragmatic client-centric solutions by combining her detailed legal and operational knowledge and experience with her talent for creative problem-solving,  she de[;pus jer her extensive legal and operational knowledge and experience to help organizations and their management use the law and process to manage people, process, compliance, operations and risk.

As a key part of this work, Ms. Stamer helps public and private, domestic and international businesses, governments, and other organizations and their leaders manage their employees, vendors and suppliers, and other workforce members, customers and other’ performance, compliance, compensation and benefits, operations, risks and liabilities, as well as to prevent, stabilize and cleanup workforce and other legal and operational crises large and small that arise in the course of operations.

Ms. Stamer works with businesses and their management, employee benefit plans, governments and other organizations deal with all aspects of human resources and workforce, internal controls and regulatory compliance, change management and other performance and operations management and compliance. She supports her clients both on a real time, “on demand” basis and with longer term basis to deal with daily performance management and operations, emerging crises, strategic planning, process improvement and change management, investigations, defending litigation, audits, investigations or other enforcement challenges, government affairs and public policy.

Well known for her extensive work with health care, insurance and other highly regulated entities on corporate compliance, internal controls and risk management, her clients range from highly regulated entities like employers, contractors and their employee benefit plans, their sponsors, management, administrators, insurers, fiduciaries and advisors, technology and data service providers, health care, managed care and insurance, financial services, government contractors and government entities, as well as retail, manufacturing, construction, consulting and a host of other domestic and international businesses of all types and sizes. Common engagements include internal and external workforce hiring, management, training, performance management, compliance and administration, discipline and termination, and other aspects of workforce management including employment and outsourced services contracting and enforcement, sentencing guidelines and other compliance plan, policy and program development, administration, and defense, performance management, wage and hour and other compensation and benefits, reengineering and other change management, internal controls, compliance and risk management, communications and training, worker classification, tax and payroll, investigations, crisis preparedness and response, government relations, safety, government contracting and audits, litigation and other enforcement, and other concerns.

Ms. Stamer uses her deep and highly specialized health, insurance, labor and employment and other knowledge and experience to help employers and other employee benefit plan sponsors; health, pension and other employee benefit plans, their fiduciaries, administrators and service providers, insurers, and others design legally compliant, effective compensation, health and other welfare benefit and insurance, severance, pension and deferred compensation, private exchanges, cafeteria plan and other employee benefit, fringe benefit, salary and hourly compensation, bonus and other incentive compensation and related programs, products and arrangements. She is particularly recognized for her leading edge work, thought leadership and knowledgeable advice and representation on the design, documentation, administration, regulation and defense of a diverse range of self-insured and insured health and welfare benefit plans including private exchange and other health benefit choices, health care reimbursement and other “defined contribution” limited benefit, 24-hour and other occupational and non-occupational injury and accident, expat and medical tourism, onsite medical, wellness and other medical plans and insurance benefit programs as well as a diverse range of other qualified and nonqualified retirement and deferred compensation, severance and other employee benefits and compensation, insurance and savings plans, programs, products, services and activities. As a key element of this work, Ms. Stamer works closely with employer and other plan sponsors, insurance and financial services companies, plan fiduciaries, administrators, and vendors and others to design, administer and defend effective legally defensible employee benefits and compensation practices, programs, products and technology. She also continuously helps employers, insurers, administrative and other service providers, their officers, directors and others to manage fiduciary and other risks of sponsorship or involvement with these and other benefit and compensation arrangements and to defend and mitigate liability and other risks from benefit and liability claims including fiduciary, benefit and other claims, audits, and litigation brought by the Labor Department, IRS, HHS, participants and beneficiaries, service providers, and others. She also assists debtors, creditors, bankruptcy trustees and others assess, manage and resolve labor and employment, employee benefits and insurance, payroll and other compensation related concerns arising from reductions in force or other terminations, mergers, acquisitions, bankruptcies and other business transactions including extensive experience with multiple, high-profile large scale bankruptcies resulting in ERISA, tax, corporate and securities and other litigation or enforcement actions.

A former lead consultant to the Government of Bolivia on its Social Security reform law Ms. Stamer also is well-known for her leadership on U.S. health and pension, wage and hour, tax, workforce, tax, education, insurance and other policies critical to the workforce, benefits, and compensation practices and other key aspects of a broad range of businesses and their operations. She both helps her clients respond to and resolve emerging regulations and laws, government investigations and enforcement actions and helps them shape the rules through dealings with Congress and other legislatures, regulators and government officials domestically and internationally. Ms. Stamer works with U.S. and foreign businesses, governments, trade associations, and others on workforce, social security and severance, health care, immigration, privacy and data security, tax, ethics and other laws and regulations. Founder and Executive Director of the Coalition for Responsible Healthcare Policy and its PROJECT COPE: the Coalition on Patient Empowerment and a Fellow in the American Bar Foundation and State Bar of Texas, Ms. Stamer for many years acted as the scribe responsible for leading the Joint Committee on Employee Benefits (JCEB) HHS Office of Civil Rights annual agency meeting and regularly participates in the OCR and other JCEB annual agency meetings, and participates in the development and submission of comments and other input to the agencies on regulatory, enforcement and other concerns. She also works as a policy advisor and advocate to many business, professional and civic organizations.

Author of the thousands of publications and workshops these and other employment, employee benefits, health care, insurance, workforce and other management matters, Ms. Stamer also is a highly sought out speaker and industry thought leader known for empowering audiences and readers. Ms. Stamer’s insights on employee benefits, insurance, health care and workforce matters in Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, Modern Healthcare, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications. Ms. Stamer also regularly serves on the faculty and planning committees for symposia of LexisNexis, the American Bar Association, ALIABA, the Society of Employee Benefits Administrators, the American Law Institute, ISSA, HIMMs, and many other prominent educational and training organizations and conducts training and speaks on these and other management, compliance and public policy concerns.

Ms. Stamer also is active in the leadership of a broad range of other professional and civic organizations. For instance, Ms. Stamer serves on the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and as an editorial advisor and contributing author of many other publications. Her leadership involvements with the American Bar Association (ABA) include year’s serving many years as a Joint Committee on Employee Benefits Council representative; ABA RPTE Section current Practice Management Vice Chair and Substantive Groups & Committees Committee Member, RPTE Employee Benefits & Other Compensation Committee Past Group Chair and Diversity Award Recipient, current Defined Contribution Plans Committee Co-Chair, and past Welfare Benefit Plans Committee Chair Co-Chair; Past Chair of the ABA Health Law Section Managed Care & Insurance Interest Group and a current member of its Healthcare Coordinating Council; current Vice Chair of the ABA TIPS Employee Benefit Committee; International Section Life Sciences Committee Policy Vice Chair; and a speaker, contributing author, comment chair and contributor to numerous Labor, Tax, RPTE, Health Law, TIPS, International and other Section publications, programs and task forces. Other selected service involvements of note include Vice President of the North Texas Healthcare Compliance Professionals Association; past EO Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division; founding Board Member and President of the Alliance for Healthcare Excellence, as a Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; the Board President of the early childhood development intervention agency, The Richardson Development Center for Children; Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee; a former Southwest Benefits Association Board of Directors member, Continuing Education Chair and Treasurer; former Texas Association of Business BACPAC Committee Member, Executive Committee member, Regional Chair and Dallas Chapter Chair; former Society of Human Resources Region 4 Chair and Consultants Forum Board Member and Dallas HR Public Policy Committee Chair; former National Board Member and Dallas Chapter President of Web Network of Benefit Professionals; former Dallas Business League President and others. For additional information about Ms. Stamer, see CynthiaStamer.com or contact Ms. Stamer via email here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

 

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Go here to register to receive other Solutions Law Press, Inc. updates and announcements about other upcoming briefings, training or other programs, products, services, and activities or to learn more about Solutions Law Press, Inc., its publications, programs and training, PROJECT COPE: Coalition on Patient Empowerment community service and education projects, event management and other resources and services.

For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2016 Cynthia Marcotte Stamer, P.C. Non-exclusive license to republish granted to Solutions Law Press, Inc. All other rights reserved.

 


Health Plans & Other HIPAA Entities Should Learn From $2.75M UMMC HIPAA Settlement

July 28, 2016

Employers, insurers and other health plan sponsors or issuers (health plans), health care providers, healthcare clearinghouses (covered entities) and their business associates should reevaluate the adequacy of their practices and procedures for the protection of electronic protected health information (ePHI) on or accessible through laptops or other mobile devices in light of the $2.75 million penalty and other schooling the Department of Health and Human Services Office for Civil Rights (OCR) just gave the University of Mississippi (UM) Medical Center (UMMC) documented in a July 7, 2016 Resolution Agreement and Corrective Action Plan (Resolution Agreement) resolving OCR charges of multiple violations of the privacy, security and breach notification requirements of the Health Insurance Portability and Accountability Act (HIPAA) OCR says it uncovered while investigating UMMC’s breach notification report to OCR of the loss a laptop containing 328 files containing the ePHI of an estimated 10,000 patients.

UMMC Report of Missing Laptop Leads To Multiple Charges & Resolution Agreement

Mississippi’s sole public academic health science center, UMMC provides patient care in four specialized hospitals on the Jackson campus and at clinics throughout Jackson and the State as well as conducts medical education and research functions.  Its designated health care component, UMMC, includes University Hospital, the site of the breach in this case, located on the main UMMC campus in Jackson.

The settlement agreed to by UMMC stems from charges resulting from an OCR investigation of UMMC triggered by a breach of unsecured electronic protected health information (“ePHI”) affecting approximately 10,000 individuals.

Like many prior resolution agreements previously announced by OCR, UMMC’s HIPAA woes came to light after a laptop went missing.  OCR learned of the breach and opened its investigation in response to a March 21, 2013 notification UMMC filed with OCR.  UMMC made the breach notification to comply with HIPAA’s Breach Notification Rule requirement that health care providers, health plans and healthcare clearinghouses (Covered Entities) timely notify affected individuals, OCR and others of breaches of unsecured ePHI.

UMMC’s breach notification disclosed that UMMC’s privacy officer had discovered a password-protected laptop containing ePHI of thousands of UMMC patients missing from UMMC’s Medical Intensive Care Unit (MICU). UMMC additionally reported that based on its investigation, UMMC believed that the missing laptop likely was stolen by a visitor to the MICU who had inquired about borrowing one of the laptops.

After discovering the loss, UMMC disclosed the breach to local media and on its website and notified OCR of the breach but apparently did not individually notify the subjects of the missing ePHI.

In keeping with its announced policy of investigating all breach reports impacting 500 or more individuals, OCR opened an investigation into UMMC’s breach report.  Based on this investigation, OCR concluded that while the laptop apparently was password protected, UMMC had breached the Security Rules because ePHI stored on a UMMC network drive was vulnerable to unauthorized access via UMMC’s wireless network because users could use a generic username and password to access an active directory containing 67,000 files including 328 files containing the ePHI of an estimated 10,000 patients.

While OCR’s investigation confirmed that UMMC had implemented policies and procedures pursuant to the HIPAA Rules, OCR’s additionally found that the theft of the laptop that prompted UMMC’s breach report resulted from broad deficiencies in UMMC’s implementation and administration of these policies and its practices.

Based on these findings, OCR charged UMMC with the following HIPAA violations:

  • From the compliance date of the Security Rule, April 20, 2005, through the settlement date, UMMC violated 45 C.F.R. §164.308(a)(1)(i) by failing to implement policies and procedures to prevent, detect, contain, and correct security violations, including conducting an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all of the ePHI it holds, and implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level;
  • From January 19, 2013, until March 1, 2014, UMMC violated 45 C.F.R. §164.310(c) by failing to implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
  • From the compliance date of the Security Rule, April 20, 2005, to March 14, 2013, UM violated 45 C.F.R. § 164.312 (a)(2)(i) by failing to assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI including, for example, allowing workforce members to access ePHI on a shared department network drive through a generic account, preventing UMMC from tracking which specific users were accessing ePHI; and
  • While UMMC provided notification on UMMC’s website and in local media outlets following the discovery of the reported breach of unsecured ePHI,, UMMC violated the Breach Notification Rule by failing to notify each individual whose unsecured ePHI was reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach.

Finally, OCR determined that UMMC was aware of risks and vulnerabilities to its systems as far back as April 2005, yet took no significant risk management activity until after the breach, due largely to organizational deficiencies and insufficient institutional oversight.

To resolve these charges, UMMC agrees in the Resolution Agreement to pay OCR $2.75 million and implement a comprehensive compliance plan which among other things, requires UMMC to conduct a sweeping review and correct its HIPAA privacy, security and breach notification policies and their implementation and administration to comply with HIPAA as well as implement and administer detailed management and OCR oversight and reporting processes over the implementation and administration of these procedures.

Lessons For Other Covered Entities From UMMC Resolution Agreement

The UMMC charges and Resolution Agreement contains several key lessons for other covered entities and their business associates, which OCR’s July 21, 2016 announcement warns other covered entities and business associates to heed..

Certainly, the $2.75 million settlement amount reaffirms that covered entities and their business associates risk substantial liability for failing to properly assess and protect the security of ePHI in accordance with HIPAA’s Privacy and Security Rule.

Furthermore, the charges and Resolution Agreement also adds a new twist to OCR’s now well established to stiffly sanction covered entities and their business associates that fail appropriately assess and address risks to the security of their ePHI on or accessible from laptops or other mobile devices. Through previous resolution agreements and guidance, OCR has made clear that it interprets the HIPAA Security Rule as generally requiring that covered entities and business associates encrypt all laptops or other mobile devices containing ePHI.  The UMMC charges and Resolution Agreement makes clear that the responsibility to protect ePHI on or accessible through laptops or other mobile devices does not end with encryption.  Rather, the Resolution Agreement makes clear that covered entities and their business associates also must take appropriate, well-documented steps to monitor, assess, identify, and timely and effectively address other potential risks to the security of the ePHI.

The Resolution Agreement makes clear that these additional responsibilities include, but are not necessarily limited to ensuring that proper safeguards are implemented and enforced to secure access not only to the ePHI contained on the laptop as well as other data bases and systems containing ePHI accessible through the laptop.  In this respect, the Resolution Agreement particularly highlights the need for covered entities and their business associates to assess risks and take appropriate steps:

  • To safeguard the physical security of laptops and other mobile devices;
  • To prevent the use of generic or other unsecure passwords to access ePHI on or accessible through the laptop or other mobile device;
  • To establish and administer appropriate, well-documented processes for assessing and addressing the adequacy of safeguards for and potential threats to the security of ePHI both initially and on an ongoing basis in a manner that meaningfully assesses the actual risks and effectiveness of safeguards against these risks, including those resulting from nonadherence to required safeguards and practices such as the sharing of passwords, changing systems or circumstances, and other developments that potentially threaten the adequacy of ePHI security.

Furthermore, OCR’s July 21, 2016 press release concerning the Resolution Agreement also sends a clear message to all covered entities and business associates that OCR views HIPAA as requiring organizations not only to adopt written policies and procedures that comply on paper or in theory with HIPAA, but also to take steps to monitor and maintain the effectiveness of their safeguard by continuously assessing and monitoring their HIPAA risks and acting as necessary to ensure that required safeguards of protected health information and ePHI and other HIPAA requirements are effectively implemented and administered in operation as well as form.

In OCR’s Press Release announcing the Resolution Agreement, OCR Director Jocelyn Samuels. Stated, “We at OCR remain particularly concerned with unaddressed risks that may lead to impermissible access to ePHI.”  She also warned “In addition to identifying risks and vulnerabilities to their ePHI, entities must also implement reasonable and appropriate safeguards to address them within an appropriate time frame.”

Additionally, the Resolution Agreement also illustrates need for covered entities and business associates to timely provide all individual and other notifications and otherwise fully comply with all requirements of the Breach Notification Rules.

Since the risk of a breach is ever-present even for Covered Entities and business associates exercising the highest degree of care to safeguard PHI and maintain compliance with HIPAA, Covered Entities and business associates are wise to take steps to position themselves to be able to demonstrate the adequacy of both their written policies and procedures and the effectiveness of their implementation and enforcement including ongoing documented practices for assessing, monitoring and addressing security risks and other compliance concerns as well as prepare to comply with the breach notification requirements in the event they experience their own breach of unsecured ePHI.

About The Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section,  the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past  Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

Ms. Stamer’s health industry experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

Ms. Stamer also is known for her experience in HIPAA and other privacy and data security and breach concerns.  The scribe for ABA JCEB annual agency meeting with OCR for many years, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical  staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

Solutions Law Press, Inc.™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Go here to register to receive other Solutions Law Press, Inc. updates and announcements about other upcoming briefings, training or other programs, products, services, and activities or to learn more about Solutions Law Press, Inc., its publications, programs and training, PROJECT COPE: Coalition on Patient Empowerment community service and education projects, event management and other resources and services.

For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2016 Cynthia Marcotte Stamer, P.C. Non-exclusive license to republish granted to Solutions Law Press, Inc. All other rights reserved.