Category: Welfare Benefis

IRS Notice 2017-67 Provides Guidance On Qualified Small Employer Health Reimbursement Arrangements

IRS Notice 2017-67 provides guidance on the requirements for providing qualified small employer health reimbursement arrangement (QSEHRA) under section 9831(d) of the Internal Revenue Code (Code), the tax consequences of the arrangement, and the requirements for providing written notice of the arrangement to eligible employees.

The guidance in Notice 2017-67 includes sections on the following topics:
A. Eligible employer
B. Eligible employee
C. Same terms requirement
D. Statutory dollar limits
E. Written notice requirement
F. MEC requirement
G. Proof of MEC requirement
H. Substantiation requirement
I. Reimbursement of medical expenses
J. Reporting requirement
K. Coordination with PTC
L. Failure to satisfy the requirements to be a QSEHRA
M. Interaction with HSA requirements
N. Effective date

In addition, Executive Order 13813 (82 Fed. Reg. 48385, Oct. 17, 2017), directed the Secretaries of the Treasury, Labor, and Health and Human Services to consider revising guidance, to the extent permitted by law and supported by sound policy, to increase the usability of health reimbursement arrangements (HRAs), expand employers’ ability to offer HRAs to their employees, and to allow HRAs to be used in conjunction with non-group coverage. The guidance provided in Notice 2017-67 addresses each of those objectives. The Treasury Department and IRS are expected to issue additional guidance in the future in response to Executive Order 13813.

Background on QSEHRAs

The 21st Century Cures Act (Cures Act), P.L. 114-255, 130 Stat. 1033, was enacted on December 13, 2016. Section 18001 of the Cures Act amends the Code, the Employee Retirement Income Security Act of 1974 (ERISA), and the Public Health Service Act (PHS Act), to permit an eligible employer to provide a QSEHRA to its eligible employees.

Pursuant to section 9831(d)(1), a QSEHRA is not a group health plan, and as a result, is not subject to the group health plan requirements that apply under the Code and ERISA. Generally, payments from a QSEHRA to reimburse an eligible employee’s medical expenses are not includible in the employee’s gross income if the employee has coverage that provides minimum essential coverage (MEC) as defined in Code section 5000A(f). For this purpose, “medical expenses” means expenses for medical care, as defined in section 213(d) (which includes premiums for other health coverage, such as individual health insurance policies).

The Cures Act provides that a QSEHRA is an arrangement that meets the following criteria:

(a) The arrangement is funded solely by an eligible employer, and no salary reduction contributions may be made under the arrangement;

(b) The arrangement provides, after the eligible employee provides proof of coverage, for the payment or reimbursement of the medical expenses incurred by the employee or the employee’s family members (in accordance with the terms of the arrangement);

(c) The amount of payments and reimbursements for any year does not exceed $4,950 ($10,000 for an arrangement that also provides for payments or reimbursements of medical expenses of the eligible employee’s family members (family coverage)); and

(d) The arrangement is generally provided on the same terms (the “same terms requirement”) to all eligible employees of the eligible employer.

To be an eligible employer that may provide a QSEHRA, the employer must not be an applicable large employer (ALE), as defined in Code section 4980H(c)(2) and the regulations thereunder (and, thus, may not be an employer that, generally, employed at least 50 full-time employees, including full-time equivalent employees, in the prior calendar year), and must not offer a group health plan (as defined in section 5000(b)) to any of its employees. Pursuant to Code section 4980H(c)(2), an employer whose workforce increases to 50 or more full-time employees during a calendar year will not become an ALE before the first day of the following calendar year.

EEOC Wellness Regulations Sent to EEOC For Review (AARP v US EEOC)

The United States District Court for the District of DC has concluded in the case of AARP v. United States Equal Employment Opportunity Commission, that the EEOC’s final wellness regulations are arbitrary and capricious, and has therefore sent them back to the EEOC for review. The regulations address the impact of the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA) on employer-sponsored wellness programs.

The Plaintiff in the case, the AARP, argued that permitting incentives of up to 30% of the cost of coverage is an unreasonable interpretation of the term “voluntary” because the incentive is too high to give employees a meaningful choice whether to participate in programs requiring disclosure of ADA-protected information. It further argued that the EEOC’s reversal of its prior position on the meaning of “voluntary”, which precluded incentives, was unsupported, inadequately explained, and thus, arbitrary and capricious.

The court ruled that the EEOC has not justified its conclusion that the 30% incentive level is a reasonable interpretation of voluntariness. Rejecting the EEOC’s argument that 30% is appropriate because it harmonizes the EEOC regulations with HIPAA as amended by the ACA, the court explained that HIPAA’s 30% incentive cap is not intended to serve as an interpretation of the term “voluntary” since voluntariness of participation is not an issue under HIPAA. Moreover, the court pointed out, the EEOC regulations are inconsistent with the HIPAA regulations in other respects. For instance, the EEOC regulations extend the 30% cap to participatory wellness programs to which the HIPAA cap does not apply. While holding that the EEOC made its decision arbitrarily, the court did not vacate the regulations, noting that they have been applicable for eight months. Instead, the court remanded the regulations to the EEOC for reconsideration. For now, the EEOC’s final wellness regulations will remain in effect, pending the EEOC’s review of the regulations.

Background

Wellness programs are regulated in part by the Health Insurance Portability and Accountability Act (HIPAA), as amended by the Affordable Care Act (ACA), as well as by HIPAA’s implementing regulations.

HIPAA prevents health plans and insurers from discriminating on the basis of “any health status related factor,” but allows covered entities to offer “premium discounts or rebates” on a plan participant’s copayments or deductibles in return for that individual’s compliance with a wellness program. A “reward” or incentive may include a discount on insurance costs or a penalty that increases the plan participant’s costs because of non-participation in the wellness program. See 26 C.F.R. § 54.9802-1(f)(1)(i).

The ACA’s amendments to HIPAA, and the accompanying implementing regulations, allow plans and insurers to offer incentives of up to 30% of the cost of coverage in exchange for an employee’s participation in a health-contingent wellness program, a kind of wellness program in which the reward is based on an insured individual’s satisfaction of a particular health-related factor. See Incentives for Nondiscriminatory Wellness Programs in Group Health Plans (“the 2013 HIPAA regulations” or “2013 HIPAA rule”), 78 Fed. Reg. 33,158, 33,180. Neither the ACA nor the 2013 HIPAA regulations impose a cap on incentives that may be offered in connection with participatory wellness programs, which are programs that do not condition receipt of the incentive on satisfaction of a health factor. Id. at 33,167.

However, because employer-sponsored wellness programs often involve the collection of sensitive medical information from employees, including information about disabilities or genetic information, these programs often implicate the ADA and GINA as well. As both the ADA and GINA are administered by EEOC, this brings wellness programs within EEOC’s purview.

The ADA prohibits employers from requiring medical examinations or inquiring whether an individual has a disability unless the inquiry is both job-related and “consistent with business necessity.” 42 U.S.C. § 12112(d)(4)(A). But the ADA makes some allowances for wellness programs: it provides that an employer may conduct medical examinations and collect employee medical history as part of an “employee health program,” as long as the employee’s participation in the program is “voluntary”. Id. § 12112(d)(4)(B). The term “voluntary” is not defined in the statute.

Similarly, GINA prohibits employers from requesting, requiring, or purchasing “genetic information” from employees or their family members. The definition of genetic information includes an individual’s genetic tests, the genetic tests of family members such as children and spouses, and the manifestation of a disease or disorder of a family member. Like the ADA, GINA contains an exception that permits employers to collect this information as part of a wellness program, as long as the employee’s provision of the information is voluntary. Again, the meaning of “voluntary” is not defined in the statute.

Thus, while HIPAA and its implementing regulations expressly permit the use of incentives in wellness programs, uncertainty existed as to whether the “voluntary” provisions of the ADA and GINA permit the use of incentives in those wellness programs that implicate ADA- or GINA-protected information.

The EEOC previously took the position that in order for a wellness program to be “voluntary,” employers could not condition the receipt of incentives on the employee’s disclosure of ADA- or GINA-protected information. However, in 2016 the EEOC promulgated new rules reversing this position. Those are the rules at issue in this case. The new ADA rule provides that the use of a penalty or incentive of up to 30% of the cost of self-only coverage will not render “involuntary” a wellness program that seeks the disclosure of ADA-protected information. See ADA Rule, 81 Fed. Reg. at 31,133–34. Likewise, the new GINA rule permits employers to offer incentives of up to 30% of the cost of self-only coverage for disclosure of information, pursuant to a wellness program, about a spouses’s manifestation of disease or disorder, which, as noted above, falls within the definition of the employee’s “genetic information” under GINA.2 See GINA Rule, 81 Fed. Reg. at 31,144.

Unlike the 2013 HIPAA regulations, which place caps on incentives only in health-contingent wellness programs, the incentive limits in the new GINA and ADA rules apply both to participatory and health-contingent wellness programs.

IRS Announces 2018 Inflation Adjusted Amounts for Health Savings Accounts (HSAs)

The IRS has announced 2018 HSA limits as follows:

Annual contribution limitation. For calendar year 2018, the annual limitation on deductions for HSA contributions under § 223(b)(2)(A) for an individual with self-only coverage under a high deductible health plan is $3,450 (up from $3,400 in 2017), and the annual limitation on deductions for HSA contributions under § 223(b)(2)(B) for an individual with family coverage under a high deductible health plan is $6,850 (up from $6,750 in 2017).

High deductible health plan. For calendar year 2018, a “high deductible health plan” is defined under § 223(c)(2)(A) as a health plan with an annual deductible that is not less than $1,350 for self-only coverage or $2,700 for family coverage (up from $1,300 and $2,600 in 2017), and the
annual out-of-pocket expenses (deductibles, co-payments, and other amounts, but not premiums) do not exceed $6,650 for self-only coverage or $13,300 for family coverage (up from $6,550 and $13,100 in 2017).

Rev. Proc. 2017-37

Rev. Proc. 2018-18 (revising the previously-published annual limitation on deductions under Code § 223(b)(2)(B) for 2018 for an individual with family coverage under a high deductible health plan from $6,900 to $6,850)

Be Careful Before Denying COBRA to Employee Terminated for Gross Misconduct

The Ninth Circuit Court of Appeals has rendered a decision in Mayes v. WinCo Holdings that reminds employers to be very cautious about denying COBRA coverage based on the gross misconduct exception.

Facts
Defendant grocery store fired the plaintiff, who supervised employees on the night-shift freight crew, for taking a stale cake from the store bakery to share with fellow employees and telling a loss prevention investigator that management had given her permission to do so. The employer deemed these actions theft and dishonesty, and determined that the plaintiff’s behavior rose to the level of gross misconduct under the store’s personnel policies. Therefore, the employer fired the employee and did not offer COBRA coverage to her or her dependents. Plaintiff sued asserting gender discrimination claims under Title VII, a claim under COBRA, and wage claims.

The Law
Under COBRA, an employer does not have to offer COBRA coverage to an employee and their covered dependents if the employee is terminated for “gross misconduct.” Unfortunately, the COBRA statute does not define “gross misconduct,” and court decisions do not provide clear guidance on what that term means.

The Case
The trial court in this case initially ruled in favor of the employer, finding that theft and dishonesty can constitute gross misconduct under COBRA, regardless of the amount involved. The Ninth Circuit reversed, finding that there was sufficient evidence of the employer’s discrimination to allow the discrimination case to go to trial, and reasoning that if the employer fired the plaintiff for discriminatory reasons then that could not constitute termination for gross misconduct. Therefore, if the termination was discriminatory the employee and her dependents would be entitled to COBRA benefits and the employee could prevail on her COBRA claims.

Lessons for Employers
An employer terminating someone for violating company policy (such as theft), may be reluctant to offer them COBRA coverage, particularly where the employer’s plan is self-insured and, therefore, the employer sees the potential for large medical claims. However, denying COBRA coverage based on the gross misconduct exception is risky for a number of reasons.

First, if the employer is ultimately found to have denied COBRA incorrectly it is exposed to penalties for failing to offer coverage, and the employee and their dependents can get COBRA coverage retroactive all the way back to the initial termination of coverage. That scenario could happen in the Mayes case.

Second, if a terminated employee foresees having large medical claims, they will have a bigger incentive to sue to secure coverage. If they do file suit for COBRA coverage, they will invariably include other claims attacking the termination decision. Therefore, denying COBRA coverage increases the likelihood of a costly lawsuit challenging the termination decision.

Third, defending a case that includes a COBRA claim is also more difficult than a straight wrongful termination claim. It is easier for a judge to grant an employer summary judgment on a wrongful termination claim, which only affects the employee plaintiff, than it is to uphold a denial of COBRA, which directly affects the employee and her children, who are innocent bystanders. In most cases, therefore, an employer is better off defending a wrongful termination suit alone, and not also defending a claim that the employer failed to offer COBRA coverage.

For these reasons, in most cases discretion is the better part of valor and employers should not invoke the gross misconduct exception.

Some employers may be concerned that offering COBRA coverage after terminating someone for gross misconduct may undermine their defense of the termination decision (on the theory that offering COBRA means the termination must not have been for gross misconduct). This can be mitigated by including a self-serving cover letter on the COBRA offer indicating that while the reasons for termination most likely amount to gross misconduct, the employer is voluntarily choosing to offer the employee and their dependents COBRA coverage.

Qualified Employer Health Reimbursement Arrangements Permitted for Small Employers

The House and the Senate recently passed, and President Obama has signed, the “21st Century Cures Act”, which includes a provision exempting small employer health reimbursement arrangements (HRAs) from the Affordable Care Act’s (ACA’s) group plan rules, and from the excise tax imposed under Code Section 4980D for failure to comply with those rules. See our prior posts on the Section 4980D excise tax here, here and here.

Background

HRAs typically provide reimbursement for medical expenses (which can include premiums for insurance coverage). HRA reimbursements are exclude-able from the employee’s income, and unused amounts roll over from one year to the next. HRAs generally are considered to be group health plans for purposes of the tax Code and ERISA.

The ACA market reforms, which generally apply to group health plans, include provisions that a group health plan (including HRAs) (1) may not establish an annual limit on the dollar amount of benefits for any individual; and (2) must provide certain preventive services without imposing any cost-sharing requirements for these services. Code Section 4980D imposes an excise tax on any failure of a group health plan to meet these requirements.

The IRS has previously distinguished between employer-funded HRAs that are “integrated” with other coverage as part of a group health plan (and which therefore can meet the annual limit rules) and so called “stand-alone” HRAs. A “stand alone” HRA almost certainly does not meet the ACA group coverage mandates.

The New Law

The 21st Century Cures Act provides relief from the Section 4980D excise tax effective for tax years after December 31, 2016 for small employers that sponsor a qualified small employer HRA. In addition, previous transition relief for small employers, i.e. those that are not an Applicable Large Employer (ALE) under the ACA, is extended through December 31, 2016.

Therefore, for plan years beginning on or before December 31, 2016, HRAs maintained by small employers with fewer than 50 employees will not incur the Section. 4980D excise tax even if the plans are not qualified small employer HRAs. For tax years after December 31, 2016, small employer HRAs will need to satisfy the requirements of a qualified small employer HRA.

Qualified Small Employer HRA

A qualified small employer HRA must meet all of the following requirements:

(1) Be maintained by an employer that is not an ALE (i.e., it employs fewer than 50 employees), and does not offer a group health plan to any of its employees.

(2) Be provided on the same terms to all eligible employees. For this purpose, small employers may exclude employees who are under age 25, employees have not completed 90 days of service, part-time or seasonal employees, collective bargaining unit employees, and certain nonresident aliens.

(3) Be funded solely by an eligible employer. No employee salary reduction contributions may be made under the HRA.

(4) Provide for the payment of, or reimbursement of, an eligible employee for expenses for medical care (which can include premiums) incurred by the eligible employee or the eligible employee’s family members.

(5) The amount of payments and reimbursements do not exceed $4,950 ($10,000 if the HRA also provides for payments or reimbursements for family members of the employee). These amounts will be adjusted for cost of living increases in the future. An HRA can vary the reimbursement to a particular individual based on variations in the price of an insurance policy in the relevant individual health insurance market with respect to: (i) age or (ii) the number of family members covered by the HRA, without violating this requirement that the HRA be provided on the same terms to each eligible employee.

Coordination With Other Rules

If an employee covered by a qualified HRA does not maintain “minimum essential coverage” within the meaning of Code Section 5000A(f), they will be subject to the individual mandate tax penalty under existing law. Under the new law, their HRA reimbursements will also be taxable income to them.

In addition, for any month that an employee is provided affordable individual health insurance coverage under a qualified HRA, he is not eligible for a premium assistance tax credit under Code Section 36B.

Employer Reporting Requirements

For years beginning after December 31, 2016, an employer funding a qualified HRA must, not later than 90 days before the beginning of the year, provide a written notice to each eligible employee that includes:

(1) The amount of the employee’s permitted benefit under the HRA for the year;

(2) A statement that the eligible employee should provide the amount of the employee’s permitted benefit under the HRA to any health insurance exchange to which the employee applies for advance payment of the premium assistance tax credit; and

(3) A statement that if the employee is not covered under minimum essential coverage for any month, the employee may be subject to the individual mandate tax penalty for such month, and reimbursements under the HRA may be include-able in gross income.

For calendar years that begin after December 31, 2016, employers also have to report contributions to a qualified HRA on their employees’ W-2s.

More… text of the 21st Century Cures Act.

Welfare Benefits Strategies For Small to Mid-Size Employers After The ACA

Lovitt & Touche’s Chris Helin has a great article out detailing two innovative approaches to dealing with the challenges posed to small and mid-sized businesses resulting from the continued rise in rates and coverage mandates under the Affordable Care Act (ACA).

Retention Accounting

Chris explains that “[w]hen you receive a quote from a carrier under a retention accounting contract instead of a fully insured contract, you are given the chance to share in the savings in a good claims year.” These contracts used to be available only to employers with more than 5000 people on their medical plan. They may now be an option even if you have as few as 100 employees on your plan.

Private Marketplace

The second approach is one on which Lovitt & Touche has taken a lead: the Private Marketplace. Not to be confused with the public exchanges, a private marketplace can be custom designed to deliver all of your welfare benefits, including medical, dental, vision, life, and disability. A private marketplace offers several innovations that employers may find attractive, including: (1) you can offer many more than just two or three plan designs within each insurance option; and (2) you can also use a defined contribution strategy and provide a specific dollar amount for each employee to spend.

Even if the ACA is repealed or significantly altered in 2017, these trends will likely continue, and they may be worth a look.

For more information read Chris’s article Here.

 

Arizona’s New Paid Sick Time Law Goes Into Effect July 1, 2017

Arizona voters recently approved Proposition 206, which will increase the minimum wage to $10 per hour, effective as of January 1, 2017, and provides all Arizona employees (other than employees of the federal or state government) paid sick time (PST) as of July 1, 2017.

This post summarizes the key issues that employers will need to address before July 1, 2017. We will be providing more information and will assist clients in drafting a compliant policy in the coming months, as we expect clarification on the notice requirements in rules that will be issued by the Industrial Commission of Arizona (ICA).

Employers will likely want to create a new PST policy, which they provide to employees before 7/1/2017, and which explains the employees’ rights to PST under the new Arizona statute.

Coordination with Other Policies

In most cases, employers will want to make their PST policy separate from any existing Paid Time Off (PTO) policy, even though the two policies will refer to each other. In addition, existing PTO policies may need to be refined to ensure they work as smoothly as possible with the new PST requirements.

Your PST policy will need to coordinate with your FMLA leave policies, as the two types of leave may overlap in some instances, but they are not synonymous. Employers should also consider coordinating their PST policy with any self funded short term disability policy, to ensure that they do not have to pay out twice for the same leave (once under the STD policy and once under the PST policy)

PTO Accrual

  • If you are an employer of fewer than 15 employees, employees must be allowed to accrue and use up to 24 hours of PST per year and if you are an employer of 15 employees or more, employees must be allowed to accrue and use up to 40 hours of PST per year (the time is accrued 1 hour for every 30 hours worked)
  • FLSA Exempt employees are presumed to work 40 hours per week; unless they actually work less than 40 hours per week in which case they can accrue PST based on actual hours worked.
  • Time taken for PST can also reduce available PTO (if your PTO policy so provides).

Employees can take PST for Four Broad Reasons:

  • Their own mental or physical illness, injury or health condition, need for diagnosis, treatment or care, or for preventive care
  • Care of a family member with the above
  • Absences necessary due to certain domestic violence, sexual violence, abuse or stalking
  • Certain business closures due to public health emergencies.

Optional Policy Provisions

In adopting a PST policy, employers will need to consider the following (we anticipate providing a checklist in the Spring of next year to help clients draft their policy to incorporate these choices):

  • Define a PST year: Your policy will need to define when the PST year begins. We generally recommend January 1, unless your company uses a different month for the beginning of the work year or your welfare benefits plan year.
  • Define the increments in which the employee can use the accrued PST: may be used in the smaller of either an hourly increment or the smallest increment that your payroll system uses to account for absences or use of other time.
  • Termination of Employment: Will you pay employees out for accrued PST upon separation of employment? Most employers will not pay it out.
  • Carryover of PST or payout unused accrued PST at the end of the year? Employers have the option to pay out unused PST at the end of each year, or to carry it over.
    • We recommend that most employers not payout the unused PST and instead allow the time to carryover each year. The employee will continue to accrue additional PST (up to 24 or 40 additional hours). However, the impact of this is limited because:
      • employees cannot use more than 24/40 hours of PST per year, regardless of how much PST they carry over and end up accruing in the new year, and
      • employers do not have to pay out PST upon termination of employment. The carry over therefore simply allows the employee to have the availability to use PST hours that were accrued and unused during the prior year – i.e. to use PST immediately in the subsequent year, as needed. The financial impact can be limited for most employers if their PTO policy is properly drafted to ensure this time is also deducted from an employee’s PTO bank.
  • Delay Availability of PST for New Hires (after 7/1/2017)? Newly hired employees will accrue PST once they commence employment, however employers may require that they wait until 90 calendar days after they commence employment before they can use any accrued PST.
  • Who in your organization will keep record of the PST? : Employers must keep records for 4 years.
  • Will you allow employees to borrow PST?: Most employers will not allow borrowing of PST. However, many will revise the PTO policies to allow borrowing of PTO, if it is used for PST reasons (thereby increasing the likelihood that you will in fact reduce the amount of PTO available by each hour of PST taken).
  • What Procedures will you Adopt for Requiring Notice before an Employee Takes PST (both foreseeable and non-foreseeable)? (and how will you coordinate that with your current policy for requesting PTO)?
    • If you require notice of the need to use PST, even where the need is not foreseeable, your policy must include the procedures for the employee to provided notice.
  • What circumstances will you require proof of the need for PST (other than a request)?
    • You may request “reasonable documentation” that earned PST is used for a proper purpose only where an employee seeks to use three or more consecutive work days of PST.
    • “Reasonable documentation” is defined as “documentation signed by a health care professional indicating that the earned paid sick time is necessary.”
    • Where three or more consecutive PST days are used in cases of domestic violence, sexual violence, abuse, or stalking, the statute provides alternative forms of reasonable documentation that may be requested, such as a police report, a protective order, or a signed statement from the employee or other individual (a list of which appears in the statute) affirming that the employee was a victim of such acts.
    • If you currently require a doctor’s note for any single-day absence you will need to change that practice.

In addition to adopting a policy, and posting a required notice (a model of which the ICA will provide), employee pay statements must include or have enclosed a report of PST to include the following:

  • the amount of PST available;
  • the amount of PST taken to date; and
  • the dollar amount of PST paid year to date

We recommend clients wait until March/April of 2017 before drafting their PST policy and updating their PTO policies, because expected ICA rules will likely provide some guidance on the new law that may impact your policy choices. We anticipate providing clients a checklist in the Spring to select the features they would like in a PST, and to draft policies based on those choices. We expect we will be able to provide that service for a low flat fee. Look for details in the Spring.

ERISA Benefits Law Receives Recognition as a Top Tier Law firm in 2017 U.S. News – Best Lawyers® “Best Law Firms” Rankings

Just eight months after opening its doors as a niche ERISA and employee benefits law firm focused on providing the highest quality legal services at the most affordable rates anywhere, ERISA Benefits Law has been recognized as a top tier law firm in the 2017 U.S. News – Best Lawyers® “Best Law Firms” rankings. The firm received a Tier 1 metropolitan ranking in Tucson, Arizona in Employee Benefits (ERISA) Law.

The U.S. News – Best Lawyers “Best Law Firms” rankings are based on a rigorous evaluation process that includes the collection of client and lawyer evaluations, peer review from leading attorneys in their field, and review of additional information provided by law firms as part of the formal submission process.

OSHA Issues Final Rules for Handling ACA Retaliation Claims

The Department of Labor’s Occupational Safety and Health Administration has published a final rule establishing procedures, time frames and burdens of proof for handling whistleblower complaints under the Affordable Care Act (ACA).

The ACA amended Section 18C of the Fair Labor Standards Act to protect employees from retaliation for receiving federal financial assistance when they purchase health insurance through an Exchange. It also protects employees from retaliation for raising concerns regarding conduct that they believe violates the consumer protections and health insurance reforms found in Title I of the ACA.

This rule establishes procedures and time frames for hearings before Department of Labor administrative law judges in ACA retaliation cases; review of those decisions by the Department of Labor Administrative Review Board; and judicial review of final decisions. Significant provisions in the final rule, and implications for employers include:

  • As with other retaliation claims, the complainant need not prove that the initial complaint, which they allege triggered the retaliation, pertained to an actual violation of law. They only need to show that they had a good faith belief that they were complaining about a violation of law.
  • To establish a prima facie case of retaliation for receiving a subsidy or premium assistance through an Exchange, an employee merely needs to show that an adverse action took place shortly after the protected activity.
  • This will be a very easy burden to meet where the employer has knowledge that the employee was receiving a subsidy or premium assistance. For example:
    • an employee might ask the employer about the coverage available through his employment, for the purpose of applying for a subsidy through the Exchange.
    • in addition, under the ACA, when an exchange provides a premium subsidy it is supposed to notify the employer. This will provide the employer specific notice that the employee has requested or is receiving a subsidy.
    • the employer’s knowledge of the above could prove fatal to the employer’s defense of a retaliation claim, unless the employer scrupulously segregates such knowledge from those making employment decisions.
  • Once a claimant establishes a prima facie case, the burden shifts to the employer to establish by clear and convincing evidence that it would have taken the adverse action even if the protected activity had not occurred. This is a very high standard.

More…

The Final Rule

OSHA’s Affordable Care Act fact sheet provides more information regarding who is covered under the ACA’s whistleblower protections, protected activity, types of retaliation, and the process for filing a complaint.

HHS Announces Two More Significant HIPAA Privacy and Security Settlements

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has announced two more significant settlements in cases of alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) involving electronic protected health information (ePHI). These settlements highlight the need for HIPAA covered entities and their business associates to:

  • Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of their ePHI;
  • Implement policies and procedures and facility access controls to limit physical access to their electronic information systems;
  • Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
  • Assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI;
  • Reasonably safeguard laptops with unencrypted ePHI (or better yet, secure all ePHI);
  • Implement policies and procedures to prevent, detect, contain, and correct security violations; and
  • Obtain satisfactory assurances in the form of a written business associate contract from their business associates that they will appropriately safeguard all ePHI in their possession.

In addition, if it has been more than a few years since you conducted a security and privacy assessment and adopted privacy and security policies and procedures under HIPAA, you should be working on updating that assessment and the resulting policies and procedures. As in many areas, making a good faith effort at compliance is half the job.

Details

In the first case, Advocate Health Care Network (Advocate) agreed to a settlement with OCR for multiple potential HIPAA violations involving ePHI pursuant to which Advocate agreed to pay a $5.55 million settlement and adopt a corrective action plan. This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals whose information was affected by Advocate, one of the largest health systems in the country. OCR began its investigation in 2013, when Advocate submitted three breach notification reports pertaining to separate and distinct incidents involving its subsidiary, Advocate Medical Group (“AMG”). The combined breaches affected the ePHI of approximately 4 million individuals. The ePHI included demographic information, clinical information, health insurance information, patient names, addresses, credit card numbers and their expiration dates, and dates of birth. OCR’s investigations into these incidents revealed that Advocate failed to:

  • Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to all of its ePHI;
  • Implement policies and procedures and facility access controls to limit physical access to the electronic information systems housed within a large data support center;
  • Obtain satisfactory assurances in the form of a written business associate contract that its business associate would appropriately safeguard all ePHI in its possession; and
  • Reasonably safeguard an unencrypted laptop when left in an unlocked vehicle overnight.

Read the Advocate Health Care Network resolution agreement and corrective action plan.

In the second case, the University of Mississippi Medical Center (UMMC) agreed to settle multiple alleged violations of HIPAA. OCR’s investigation of UMMC was triggered by a breach of unsecured ePHI affecting approximately 10,000 individuals. During the investigation, OCR determined that UMMC was aware of risks and vulnerabilities to its systems as far back as April 2005, yet no significant risk management activity occurred until after the breach, due largely to organizational deficiencies and insufficient institutional oversight. UMMC will pay a resolution amount of $2,750,000 and adopt a corrective action plan to help assure future compliance with HIPAA Privacy, Security, and Breach Notification Rules. On March 21, 2013, OCR was notified of a breach after UMMC’s privacy officer discovered that a password-protected laptop was missing from UMMC’s Medical Intensive Care Unit (MICU). UMMC’s investigation concluded that it had likely been stolen by a visitor to the MICU who had inquired about borrowing one of the laptops. OCR’s investigation revealed that ePHI stored on a UMMC network drive was vulnerable to unauthorized access via UMMC’s wireless network because users could access an active directory containing 67,000 files after entering a generic username and password. The directory included 328 files containing the ePHI of an estimated 10,000 patients dating back to 2008. Further, OCR’s investigation revealed that UMMC failed to:

  • implement its policies and procedures to prevent, detect, contain, and correct security violations;
  • implement physical safeguards for all workstations that access ePHI to restrict access to authorized users;
  • assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI; and
  • notify each individual whose unsecured ePHI was reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach.

University of Mississippi is the state’s sole public academic health science center with education and research functions. In addition it provides patient care in four specialized hospitals on the Jackson campus and at clinics throughout Jackson and the state. Its designated health care component, UMMC, includes University Hospital, the site of the breach in this case, located on the main UMMC campus in Jackson.

Read the University of Mississippi resolution agreement and corrective action plan.