Category: Health

OSHA Issues Final Rules for Handling ACA Retaliation Claims

The Department of Labor’s Occupational Safety and Health Administration has published a final rule establishing procedures, time frames and burdens of proof for handling whistleblower complaints under the Affordable Care Act (ACA).

The ACA amended Section 18C of the Fair Labor Standards Act to protect employees from retaliation for receiving federal financial assistance when they purchase health insurance through an Exchange. It also protects employees from retaliation for raising concerns regarding conduct that they believe violates the consumer protections and health insurance reforms found in Title I of the ACA.

This rule establishes procedures and time frames for hearings before Department of Labor administrative law judges in ACA retaliation cases; review of those decisions by the Department of Labor Administrative Review Board; and judicial review of final decisions. Significant provisions in the final rule, and implications for employers include:

  • As with other retaliation claims, the complainant need not prove that the initial complaint, which they allege triggered the retaliation, pertained to an actual violation of law. They only need to show that they had a good faith belief that they were complaining about a violation of law.
  • To establish a prima facie case of retaliation for receiving a subsidy or premium assistance through an Exchange, an employee merely needs to show that an adverse action took place shortly after the protected activity.
  • This will be a very easy burden to meet where the employer has knowledge that the employee was receiving a subsidy or premium assistance. For example:
    • an employee might ask the employer about the coverage available through his employment, for the purpose of applying for a subsidy through the Exchange.
    • in addition, under the ACA, when an exchange provides a premium subsidy it is supposed to notify the employer. This will provide the employer specific notice that the employee has requested or is receiving a subsidy.
    • the employer’s knowledge of the above could prove fatal to the employer’s defense of a retaliation claim, unless the employer scrupulously segregates such knowledge from those making employment decisions.
  • Once a claimant establishes a prima facie case, the burden shifts to the employer to establish by clear and convincing evidence that it would have taken the adverse action even if the protected activity had not occurred. This is a very high standard.

More…

The Final Rule

OSHA’s Affordable Care Act fact sheet provides more information regarding who is covered under the ACA’s whistleblower protections, protected activity, types of retaliation, and the process for filing a complaint.

HHS Announces Two More Significant HIPAA Privacy and Security Settlements

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has announced two more significant settlements in cases of alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) involving electronic protected health information (ePHI). These settlements highlight the need for HIPAA covered entities and their business associates to:

  • Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of their ePHI;
  • Implement policies and procedures and facility access controls to limit physical access to their electronic information systems;
  • Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
  • Assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI;
  • Reasonably safeguard laptops with unencrypted ePHI (or better yet, secure all ePHI);
  • Implement policies and procedures to prevent, detect, contain, and correct security violations; and
  • Obtain satisfactory assurances in the form of a written business associate contract from their business associates that they will appropriately safeguard all ePHI in their possession.

In addition, if it has been more than a few years since you conducted a security and privacy assessment and adopted privacy and security policies and procedures under HIPAA, you should be working on updating that assessment and the resulting policies and procedures. As in many areas, making a good faith effort at compliance is half the job.

Details

In the first case, Advocate Health Care Network (Advocate) agreed to a settlement with OCR for multiple potential HIPAA violations involving ePHI pursuant to which Advocate agreed to pay a $5.55 million settlement and adopt a corrective action plan. This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals whose information was affected by Advocate, one of the largest health systems in the country. OCR began its investigation in 2013, when Advocate submitted three breach notification reports pertaining to separate and distinct incidents involving its subsidiary, Advocate Medical Group (“AMG”). The combined breaches affected the ePHI of approximately 4 million individuals. The ePHI included demographic information, clinical information, health insurance information, patient names, addresses, credit card numbers and their expiration dates, and dates of birth. OCR’s investigations into these incidents revealed that Advocate failed to:

  • Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of its ePHI;
  • Implement policies and procedures and facility access controls to limit physical access to the electronic information systems housed within a large data support center;
  • Obtain satisfactory assurances in the form of a written business associate contract that its business associate would appropriately safeguard all ePHI in its possession; and
  • Reasonably safeguard an unencrypted laptop when left in an unlocked vehicle overnight.

Read the Advocate Health Care Network resolution agreement and corrective action plan.

In the second case, the University of Mississippi Medical Center (UMMC) agreed to settle multiple alleged violations of HIPAA. OCR’s investigation of UMMC was triggered by a breach of unsecured ePHI affecting approximately 10,000 individuals. During the investigation, OCR determined that UMMC was aware of risks and vulnerabilities to its systems as far back as April 2005, yet no significant risk management activity occurred until after the breach, due largely to organizational deficiencies and insufficient institutional oversight. UMMC will pay a resolution amount of $2,750,000 and adopt a corrective action plan to help assure future compliance with HIPAA Privacy, Security, and Breach Notification Rules. On March 21, 2013, OCR was notified of a breach after UMMC’s privacy officer discovered that a password-protected laptop was missing from UMMC’s Medical Intensive Care Unit (MICU). UMMC’s investigation concluded that it had likely been stolen by a visitor to the MICU who had inquired about borrowing one of the laptops. OCR’s investigation revealed that ePHI stored on a UMMC network drive was vulnerable to unauthorized access via UMMC’s wireless network because users could access an active directory containing 67,000 files after entering a generic username and password. The directory included 328 files containing the ePHI of an estimated 10,000 patients dating back to 2008. Further, OCR’s investigation revealed that UMMC failed to:

  • implement its policies and procedures to prevent, detect, contain, and correct security violations;
  • implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
  • assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI; and
  • notify each individual whose unsecured ePHI was reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach.

University of Mississippi is the state’s sole public academic health science center with education and research functions. In addition it provides patient care in four specialized hospitals on the Jackson campus and at clinics throughout Jackson and the state. Its designated health care component, UMMC, includes University Hospital, the site of the breach in this case, located on the main UMMC campus in Jackson.

Read the University of Mississippi resolution agreement and corrective action plan.

Significant Changes Proposed for Form 5500

On July 21, 2016 the Department of Labor (DOL), the Internal Revenue Service (IRS) and the Pension Benefit Guaranty Corporation (PBGC) published proposed rules that would make significant revisions to the Form 5500 Annual Return/Report as of the 2019 filing year.

DOL explains in a Fact Sheet that the proposed form revisions and the DOL’s related implementing regulations are intended to address changes in applicable law and in the employee benefit plan and financial markets, and to accommodate shifts in the data the DOL, IRS and PBGC need for their enforcement priorities, policy analysis, rulemaking, compliance assistance, and educational activities.

The major proposed changes are summarized below:

  • Retirement Plan Changes– The new Form 5500 will request more information about participant accounts, contributions, and distributions. It will also ask about plan design features, including whether the plan uses a safe harbor or SIMPLE design and whether it includes a Roth feature. The form will also ask about investment education and investment advice features, default investments, rollovers used for business start-ups (ROBS), leased employees, and pre-approved plan designs. Schedule R will include new questions about participation rates, matching contributions, and nondiscrimination.
  • Group Health Plan Changes– The most significant change for health plans is that all ERISA group health plans, including small plans that are currently exempt from filing, will be required to file a Form 5500. The new filing requirement includes a new Schedule J (Group Health Plan Information), which will list the types of health benefits provided, the plan’s funding method (self insured or fully insured), information about participant and employer contributions, information about COBRA coverage, whether the plan is grandfathered under health care reform, and whether it includes a high deductible health plan, HRA, or health FSA. In addition, most filings (except those for small fully insured plans) would have to provide financial and claims information, disclose stop-loss carriers, third party administrators and other plan service providers, and provide details regarding compliance with HIPAA, GINA, health care reform and other compliance issues.
  • Other Changes– The proposed changes affect many of the existing Form 5500 schedules, including:
    • Schedule C would be revised to coordinate with the service provider fee disclosure rules.
    • Schedule C would be required from some small plans currently exempt from filing it.
    • Schedule H would be expanded to include questions on fee disclosures, annual fair market valuations, designated investment alternatives, investment managers, plan terminations, asset transfers, administrative expenses and uncashed participant checks.
    • Schedule I would be eliminated.
    • Small plans that currently file Schedule I would generally need to file Schedule H.

Effective Date– The new Form 5500 is expected to be required as of the 2019 plan year filings.

Proposed Rule Making Form 5500 Changes

EEOC Issues Sample Notice For Employers Offering Wellness Programs (to Comply with Recently Issued ADA Rules)

The U.S. Equal Employment Opportunity Commission (EEOC) has posted a sample notice that will help employers who have wellness programs comply with their obligations under the recently issued Americans with Disabilities Act (ADA) rule, which requires employer wellness programs that (1) ask employees about their medical conditions or (2) ask employees to take medical examinations (such as tests to detect high blood pressure, high cholesterol or diabetes) to ensure that:

  • these programs are reasonably designed to promote health and prevent disease,
  • they are voluntary, and
  • employee medical information is kept confidential.

Under the rule, employees must receive a notice describing what information will be collected as part of the wellness program, who will receive it, how it will be used, and how it will be kept confidential.

The obligation to provide the notice goes into effect on the first day of the plan year that begins on or after January 1, 2017.

More…

The EEOC sample notice

A brief question-and-answer document describing the notice requirement

The ADA rule

Background on the ADA rule:

Limited financial and other incentives are permitted as part of voluntary wellness programs under the rule. Permissible incentives under the rule are calculated based on a percentage of the cost of self-only health insurance coverage. However, employers may not:

  • Require employees to participate in a wellness program;
  • Deny or limit their health coverage for non-participation;
  • Retaliate against or interfere with any employee who does not want to participate; and
  • Coerce, threaten, intimidate or harass anyone into participating.

IRS Information Letters Provide Further Guidance on “Employer Payment Plans”

The IRS has released a series of information letters providing further guidance on the application of ACA group health plan market reforms to various types of employer health care arrangements. These information letters provide further definition to when the IRS will consider an arrangement to be an impermissible “employer payment plan” that does not satisfy the ACA market reforms. As previously discussed here and here and here, adopting an impermissible employer payment plan exposes employers to excise taxes under Code § 4980D ($100 per day per affected individual).

I. Opt-Out Arrangements. In Letter 2016-0023 the IRS indicated that if an employer pays additional taxable compensation to employees who forgo coverage under the employer’s group health plan (opt-out payments), due to having other coverage, the employer will not trigger the 4980D excise tax, as long as the amount of additional taxable compensation is unrelated to the cost of the employee’s other coverage.

II. Small Plans Exception. In Letter 2016-0005 the IRS allowed reimbursement of individual policy premiums provided that there is only one “active” employee in the plan. This is because the ACA market reform rules do not apply to a group health plan if the plan has less than 2 participants who are active employees.

III. Relief For S Corporations. Letter 2016-0021 explains that S Corporations may continue to pay for or reimburse premiums for their “2% shareholders-employees” without being subject to Code 4980D excise taxes, until further guidance is issued (this position was previously stated in Notice 2015-17). This relief does not, however, apply to S corporation employees who are not 2% owners.

IV. Beware of Promoters Promising They Can Structure a Plan to Allow Reimbursement of Individual Policy Premiums. In Letter 2016-0019 the Treasury explains that it has been made aware of a number of what it describes as “schemes”, whereby promoters are marketing products that they are claiming will allow employers to reimburse individual health policy premiums without violating the ACA market reforms. Treasury is looking at the information and warns that it disagrees with the promoters’ claims that their product does not impose an annual limit on essential health benefits. Consequently, their product fails to meet the market reforms.

IRS Clarifies Tax Treatment of Wellness Program Rewards

The IRS Chief Counsel Advice has issued a Memorandum explaining that an employer may not exclude from an employee’s income under section 105 or section 106:

1) cash rewards paid to an employee for participating in a wellness program; and

2) reimbursements of premiums for participating in a wellness program if the premiums for the wellness program were originally made by salary reduction through a section 125 cafeteria plan.

While coverage by an employer-provided wellness program that provides medical care as defined under section 213(d) is generally excluded from an employee’s gross income under section 106(a), and any section 213(d) medical care provided by the program is excluded from the employee’s gross income under section 105(b), any reward, incentive or other benefit provided by the medical program that is not medical care as defined under section 213(d) is included in an employee’s income, unless it is otherwise excludable as an employee fringe benefit under section 132.

For example, a wellness program that provides employees with a de minimis fringe benefit, such as a tee-shirt, would satisfy the requirements to be an excluded fringe benefit. However, the employer payment of gym membership fees does not qualify as medical care as defined under section 213(d) and would not be excludable from the employee’s income, even if provided through a wellness plan or program, because payment or reimbursement of gym fees is a cash benefit that is not excludable as a de minimis fringe benefit.

In addition, cash rewards received from a wellness program do not qualify as the reimbursement of medical care as defined under section 213(d) or as an excludable fringe benefit under section 132, and therefore are not excludable from an employee’s income.

Finally, the exclusions under sections 106(a) and 105(b) do not apply to reimbursement of a portion of the employee’s premium for the wellness program that was excluded from gross income under section 106(a) (including salary reduction amounts pursuant to a cafeteria plan under section 125 that are applied to pay for such coverage). Accordingly, the reimbursement of such amounts are included in the employee’s gross income.

IRS Chief Counsel Advice Memorandum

US District Court for DC Rules Payment of Some ACA Subsidies are Unconstitutional without Separate Appropriation

The U.S. District Court for the District of Columbia has ruled that certain Affordable Care Act subsidies designed to reduce deductibles, co-pays, and other means of “cost sharing” by insurers cannot be paid unless they are separately appropriated by Congress. U.S. House of Representatives v. Burwell, et al., (2016, DC DC), Civil Action No. 14-1967 (RMC).

The case involves two sections of the Affordable Care Act: 1401 and 1402. Section 1401 provides tax credits to make insurance premiums more affordable, while Section 1402 reduces deductibles, co-pays, and other means of “cost sharing” by insurers. Section 1401 is codified at 26 U.S.C. 36B (in the tax code) and was funded by adding it to a preexisting list of permanently-appropriated tax credits and refunds.

Section 1402 was not added to that list. The court ruled that Section 1402, which is codified in Title 42, which includes federal laws concerning “Public Health and Welfare” cannot be funded through the same, permanent appropriation as Section 1401. Instead, Section 1402 reimbursements must be funded annually.

The Court ruled that by paying out the subsidies without the necessary appropriation, the Administration violated Article I, Section 9, clause 7 of the U.S. Constitution, which provides that “No Money shall be drawn from the Treasury, but in Consequence of Appropriations made by Law . . . .”

The Court enjoined payment of the reimbursements, but stayed its ruling pending appeal. Therefore, the short term effect is that that reimbursements will continue while the case is on appeal. A decision from the US Court of Appeals for the DC Circuit on appeal will likely take months.

More … U.S. House of Representatives v. Burwell, et al., (2016, DC DC), Civil Action No. 14-1967 (RMC).

IRS Announces 2017 Inflation Adjusted Amounts for Health Savings Accounts (HSAs)

The IRS has announced 2017 HSA limits as follows:

Annual contribution limitation. For calendar year 2017, the annual imitation on deductions under § 223(b)(2)(A) for an individual with self-only coverage under a high deductible health plan is $3,400 (up from $3,350 in 2016), and the annual limitation on deductions under § 223(b)(2)(B) for an individual with family coverage under a high deductible health plan is $6,750 (unchanged from 2016).

High deductible health plan. For calendar year 2017, a “high deductible health plan” is defined under § 223(c)(2)(A) as a health plan with an annual deductible that is not less than $1,300 for self-only coverage or $2,600 for family coverage (both unchanged from 2016), and the
annual out-of-pocket expenses (deductibles, co-payments, and other amounts, but not premiums) do not exceed $6,550 for self-only coverage or $13,100 for family coverage (also unchanged from 2016).

Rev. Proc. 2016-28

OCR Launches Phase 2 of HIPAA Audit Program

As a part of its continued efforts to assess compliance with the HIPAA Privacy, Security and Breach Notification Rules, the HHS Office for Civil Rights (OCR) has begun its next phase of audits of covered entities and their business associates.

In its 2016 Phase 2 HIPAA Audit Program, OCR will review the policies and procedures adopted and employed by covered entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. These audits will primarily be desk audits, although some on-site audits will be conducted.

The 2016 audit process begins with verification of an entity’s address and contact information. An email is being sent to covered entities and business associates requesting that contact information be provided to OCR in a timely manner. OCR will then transmit a pre-audit questionnaire to gather data about the size, type, and operations of potential auditees; this data will be used with other information to create potential audit subject pools.

The OCR’s detailed audit protcol is available here.

If an entity does not respond to OCR’s request to verify its contact information or pre-audit questionnaire, OCR will use publically available information about the entity to create its audit subject pool. Therefore an entity that does not respond to OCR may still be selected for an audit or subject to a compliance review.

To learn more about OCR’s Phase 2 Audit program, click on one of the links below:

When Will the Next Round of Audits Commence?

Who Will Be Audited?

On What Basis Will Auditees Be Selected?

How Will the Selection Process Work?

How Will the Audit Program Work?

What if an Entity Doesn’t Respond to OCR’s Requests for Information?

What is the General Timeline for an Audit?

What Happens After an Audit?

How Will Consumers Be Affected?

Will Audits Differ Depending on the Size and Type of Participants?

Will Auditors Look at State-Specific Privacy and Security Rules in Addition to HIPAA’s Privacy, Security, and Breach Notification Rules?

Who is Responsible for Paying the On-Site Auditors?

IRS Notice 2015-87 Provides Further Guidance on the Application of ACA Market Reforms to Employer Payment Plans, Employer Mandate and COBRA

On December 16, 2015, the Department of Treasury and IRS issued Notice 2015-87 which provides further guidance on the application of the market reforms that apply to group health plans under the Affordable care Act (ACA) to various types of employer health care arrangements. The notice includes guidance that covers:

(1) health reimbursement arrangements (HRAs), including HRAs integrated with a group health plan, and similar employer-funded health care arrangements; and

(2) group health plans under which an employer reimburses an employee for some or all of the premium expenses incurred for an individual health insurance policy, such as a reimbursement arrangement described in Revenue Ruling 61-146, or an arrangement under which the employer uses its funds to directly pay the premium for an individual health insurance policy covering the employee (collectively, an employer payment plan). The notice supplements the guidance provided in Notice 2013-54; FAQs about the Affordable Care Act Implementation (Part XXII) issued by the Department of Labor on November 6, 2014; Notice 2015-17; and final regulations implementing the market reform provisions of the ACA published on November 18, 2015.

iconsee our previous post on this topic.

Notice 2015-87 also clarifies certain aspects of the employer shared responsibility provisions of § 4980H, and clarifies the application of the COBRA continuation coverage rules to unused amounts in a health flexible spending arrangement (health FSA) carried over and available in later years pursuant to Notice 2013-71, and conditions that may be put on the use of carryover amounts.