Risky Business

Don't Sweep the Breach Under the Rug! Notification Under the HITECH Act

The Human Equation, Inc.

As more and more personal information ends up being maintained in some form of electronic medium, the concern surrounding data security breaches has never been higher. Since the consequences of a breach can be devastating to those whose information has been compromised, proactive measures must be taken to limit the damage. One such measure involves providing prompt notice to those affected individuals that their sensitive information may have fallen into the wrong hands.

Many states have legislatively adopted this approach in the context of data security breaches involving financial information, such as credit card and social security numbers. Under these laws, organizations are required to promptly notify affected individuals that their financial information has been compromised. Upon receiving such notice, those individuals can then take appropriate measures to prevent the harm that typically flows from a data breach, such as fraudulent charges against credit or identity theft.

The concept of requiring early notice of a data security breach has now found its way into the health care arena. The Health Information Technology for Economic and Clinical Health Act, or the HITECH Act, which was included in the American Recovery and Reinvestment Act of 2009, requires covered entities under the Health Insurance Portability and Accountability Act (HIPAA) to provide notification in the event of a data security breach involving unsecured protected health information. As in the case of breaches involving financial information, the goal of the HITECH Act is to give those individuals whose unsecured protected health information was compromised as much notice as possible so they can take appropriate preventative steps to limit the damage.

The HITECH Act provides that a covered entity, as defined in HIPAA, that “accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, in the case of a breach of such information…notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been accessed, acquired, or disclosed as a result of such breach.” Unsecured protected health information is information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of technologies or methodologies specified by the Secretary of the Department of Health and Human Services (HHS).

Satisfaction of the duty to notify of such a breach, which also applies to a business associate of the covered entity, must be accomplished within a reasonable time. Specifically, the required notification must be made “without unreasonable delay and in no case later than 60 calendar days after the discovery of the breach by the covered entity or the business associate.” Pursuant to the Act, a breach is treated as discovered as of the first day on which it is know to the covered entity or business associate or should reasonably have been known. Knowledge of the breach is imputed to the entity once any person that is an employee, officer, or other agent of the covered entity or business associate, other than the individual committing the breach, knows of the breach. This is the point in which the clock for notification begins to run.

According to the regulations interpreting the HITECH Act, the following elements, written in plain language, must be included in the notification:

• A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
• A brief description of the types of unsecured protected health information that were involved in the breach, such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved;
• Any steps individuals should take to protect themselves from potential harm;
• A brief description of what the involved covered entity is doing to investigate the breach, to mitigate harm, and to protect against further breaches; and
• Contact procedures for individuals to ask questions or to learn additional information, which shall include a toll-free telephone number, an email address, website, or postal address.

The HITECH Act details the different methods for providing notification of a breach. The first method is written notification by first-class mail to the individual at the last known address of the individual. If the individual in question currently agrees to electronic notice, then the notification may be accomplished by electronic mail.

The second method applies in cases in which there is insufficient or out-of-date contact information that precludes written notification. In such cases, substitute notification in a manner that is reasonably calculated to reach the affected individuals may be undertaken by the covered entity. If the breach involves fewer than ten individuals, then the substitute notice may be provided by an alternative form of written notice, telephone, or other means. If the breach involves ten or more individuals, then the substitute notice shall be in the form of either a conspicuous posting for a period of 90 days on the home page of the covered entity’s website, or a conspicuous notice in a major print or broadcast media in geographic areas where the individuals affected by the breach likely reside. These postings must include a toll-free telephone number where individuals can learn whether their unsecured protected health information was included in the breach. The toll-free telephone number must remain active for at least 90 days.

The final method of notification under the HITECH Act applies in cases deemed by the covered entity to require urgency because of possible imminent misuse of the unsecured protected health information. In such cases, the covered entity may provide information to affected individuals by telephone or other means, as appropriate, in addition to providing the required written notification.

In cases involving a breach of more than 500 residents of a state or jurisdiction, a covered entity must notify prominent media outlets serving such state or jurisdiction. Such notification must be accomplished without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. In such cases, the covered entity must also notify the Secretary of the HHS. In the case of breaches involving less than 500 individuals, a covered entity is required to maintain a log or other documentation of such breaches, and, not later than 60 days after the end of each calendar year, the covered entity must provide such information to the Secretary.

While the HITECH Act provides several timelines for providing notification of the breach, a covered entity may be relieved of the strict time requirements if a law enforcement official believes that providing notification of a breach would impede a criminal investigation or cause damage to national security. In such cases, the covered entity may delay providing notification in the manner requested by the law enforcement official.

The regulations interpreting the HITECH Act apply with respect to breaches of unsecured protected health information occurring on or after September 23, 2009. However, the HHS has indicated that it will not begin imposing sanctions for failure to provide the required notice until after February 22, 2010. Thus, covered entities and their business associates have a grace period to update their internal policies and procedures in order to comply with the HITECH Act’s provisions. However, despite this grace period, the implementation of the HITECH Act’s data breach notification provisions should serve to reinforce the principal that hiding the existence of a data breach is often considered the bigger misdeed than the breach itself.

To learn more about HIPAA, please click here.

Oh No, I've Been Served!

By: Anita Setnor Byer, President
Setnor Byer Insurance & Risk

The day was progressing like any other—putting out fires, monitoring production, cultivating new business—until the receptionist announced the presence of an unexpected visitor. The hand you held out for an introductory shake was met with a bundle of paperwork. The confusion created by the unanticipated delivery was momentarily clarified when the visitor mumbled a few parting words: “You’ve been served.”

A brief scan of the documents revealed that a former employee filed a lawsuit in federal court alleging unlawful discrimination. The expected stream of emotions soon follows: bewilderment, denial, fear, anger, and finally pragmatism. Something needs to be done, and since an answer to the complaint must be filed within 20 days, contacting an attorney must be near the top of the list.

Unfortunately, defense attorneys do not typically handle cases on a contingency-fee basis.  Rather, they bill their time hourly, and while many attorneys provide a complimentary phone call, the meter typically starts running shortly thereafter. Clients are ordinarily expected to cut a substantial retainer check before any steps are taken to mount a defense.

Needless to say, defending against an employment practices lawsuit, such as one alleging discrimination or harassment, is a costly proposition. Even if the employer wins the lawsuit, the outcome of the experience will invariably be viewed as a loss. The bill for attorneys’ fees alone will invariably cause financial harm to an organization. For those already struggling through difficult economic times, the harm may be irreversible.

The employer in this hypothetical situation has no choice but to deal with the imminent present since nothing can be done to change the past. However, for those cringing at the thought of personally experiencing this situation in the future, there is one thing that can be done to alter the experience—obtain employment practices liability insurance (EPLI).

EPLI protects employers in the event of such workplace claims as discrimination, wrongful termination, and sexual harassment, as well as other civil wrongdoings, such as wrongful demotion, failure to promote and discrimination by third parties (i.e., clients). Generally, a policy covers eligible losses stemming from such causes of action, as well as associated litigation costs, including attorneys’ fees. And the insurance company will provide the services of attorneys who specialize in defending against such claims, thereby significantly increasing the likelihood that employers will prevail in the event litigation does occur.

Yet, despite these obvious and valuable benefits, many organizations choose to forego purchasing EPLI. Those responsible for protecting their organization from the risk of loss have plenty of reasons for deciding not to purchase EPLI. However, upon closer examination, it is clear that the security afforded by these reasons is illusory. Let’s take a look at a few.

None of my employees would ever sue me. Let’s assume that this is true (although we know it isn’t). Did you know that several equal employment opportunity laws, such as Title VII and the Americans with Disabilities Act, also protect applicants? While some organizations may take comfort in the belief that their employees would never sue, such a perception does not address, much less protect against, the possibility of an employment practices lawsuit being filed by an applicant. Needless to say, those relying on the charity of strangers for security have a significant hole in their risk management umbrella.

Our organization complies with all employment laws. There is little doubt that most organizations have every intention of complying with applicable employment laws, and that they, in fact, make a good faith effort to do so. Unfortunately, this reasoning incorrectly assumes that lawsuits are only filed by those who were actually victims of an unlawful employment practice. In reality, many employers are ultimately found to have not violated the law, yet they were still required to defend their actions in court. Undertaking a defense is expensive, and from a purely economic standpoint, vindication through the judicial system is often not worth the price of admission.

It can’t happen to me. Clearly, this age-old rationalization is as wrong in this context as it is in everyday life. According to the Equal Employment Opportunity Commission, the number of employment related claims is on the rise. Hence, it is not only happening, but it is happening in greater numbers. While this increase in claims may be attributed to several factors, including a struggling economy or corporate cutbacks in HR training and monitoring, there is good reason to believe that the increase will continue well into the future.

Consider that the ADA Amendments Act broadened the scope and applicability of the Americans with Disabilities Act. Since more people qualify as disabled under the amended law, more people will be entitled to the ADA’s protection. In practice, this signals the existence of a new and significant risk exposure—an ADA lawsuit—that may not have previously existed. Therefore, the likelihood of falling victim to an employment practices lawsuit is greater now than it was then.

We are a small operation so we don’t have to worry about employee lawsuits.  While employee lawsuits brought against large companies make the headlines, smaller operations should be equally concerned about being sued for an unlawful employment practice. Compared to large corporations, many smaller organizations operate casually and informally. While a collegial atmosphere can make for a more relaxed workplace, it may increase the likelihood that behaviors are not properly monitored or that policies are non-existent or loosely applied. Moreover, smaller organizations often do not have the budget or infrastructure to ensure the proper handling of human resources. Since these factors almost invariably lead to lawsuits, smaller organizations are prime candidates for EPLI.

We have an excellent HR department that ensures compliance with all equal employment opportunity laws. While placing an emphasis on human resources can go a long way toward reducing the risk of being sued for an unlawful employment practice, it is by no means a guarantee. Two things merit discussion on this point. First, unlawful employment practices occur despite top-notch HR departments. Consider that a well-known, publicly traded clothing retailer paid approximately $50 million to settle a class-action discrimination lawsuit despite what was surely a well-qualified HR department. Furthermore, it is important to acknowledge that efforts of the HR department do not always filter down to the entire workforce.

Second, in some situations, the risk of violating an equal employment opportunity law cannot be reduced by the HR department. The recent amendments to the Family & Medical Leave Act’s regulations provide a good example. Until the precise scope and applicability of the regulations are determined by the courts, employers are operating with their best guess as to what the regulations actually require. Unfortunately, this means that some employers, regardless of the quality of their HR department, must defend their actions in court, often at great expense. This reality underscores the importance of EPLI.

There is no room in the budget for EPLI. Certainly, budgetary constraints are always a valid consideration. While many view the premium for EPLI as the budgetary figure worthy of consideration, the real figure is the amount that will have to be paid out in the event a lawsuit is filed. How do the attorney’s fees and the plaintiff’s judgment fit into the budget? A realistic approach to the budget should consider the potential cost of not obtaining EPLI rather than the cost of the premium. When such a calculation is undertaken, purchasing EPLI is almost invariably considered a smart investment.

Although there are many reasons for not purchasing EPLI, once a lawsuit is filed, all of those reasons lose whatever merit they may have had to begin with. There is a world of difference between personally dealing with (and paying for) the defense of an employment practices lawsuit versus forwarding the papers to the insurance company. One option is not only cheaper, but it provides a peace-of-mind that allows the organization’s focus to remain on the continued successful operation of the business. Needless to say, the alternative is much, much worse.

If you would like more information about EPLI, please contact us.

 

Uninsured Motorists: Their Cars May Be Stacked Against You

By: Tiffany Luongo, Esq.
Risk Management Group, Setnor Byer Insurance & Risk

Did you know that by 2010, approximately one in six drivers across the United States may be driving without insurance?  According to a recent study from the Insurance Research Council, the current recession is expected to trigger a sharp rise in the rate of uninsured motorists.  Currently in Florida, 23 percent of all drivers are uninsured, ranking Florida among the top five states with the highest percentage of uninsured motorists, along with New Mexico, Mississippi, Alabama, and Oklahoma. 

An additional concern in Florida is that drivers are not required to carry Bodily Injury liability coverage, which would pay for personal injuries, including medical bills, lost wages, and pain and suffering costs, caused to others in an automobile accident. If the injuries sustained in an accident are minor, it is possible that Personal Injury Protection (PIP) benefits will provide adequate coverage. However, many drivers sustain injuries that far exceed PIP benefit limits. That’s where Uninsured and Underinsured Motorist (collectively referred to as UM) coverage comes in—it protects a policyholder and other eligible persons from personal injury damages suffered as a result of the negligence of another motorist who either has no Bodily Injury insurance coverage or coverage that is insufficient to compensate injured persons for their damages. UM coverage also applies when injuries are caused by drivers who “hit and run” and remain unidentified. 

UM insurance can be either “stacked” or “non-stacked.” When you purchase UM coverage, you are entitled to “stack” or add together the combined UM coverages of all the automobiles covered by your policy to determine the total amount available. For example, if a policy covers three automobiles, each with $25,000 per person/$50,000 per accident UM limits, the policyholder will have $75,000 per person/$150,000 per accident available in the event of an accident. By contrast, if that same policyholder has non-stacked coverage, then the UM coverage limits of   only the vehicle involved in the accident apply.

It is definitely a wise decision, then, especially in Florida where Bodily Injury liability coverage is not required by law, to also obtain UM coverage. It is generally inexpensive but can prove quite valuable, especially after an experience as traumatic as an automobile accident. To learn more about UM coverage or to inquire about your current limits, please contact us.

Written Job Descriptions under the ADAAA

Does the passage of the ADA Amendments Act of 2008, which went into effect on January 1, 2009, diminish the importance of having detailed, well-written job descriptions for the purpose of helping employers defend against claims brought under the Americans with Disabilities Act (ADA)?

No. In fact, the passage of the ADA Amendments Act of 2008 (ADAAA) greatly increases the importance of job descriptions. The Americans with Disabilities Act (ADA) protects qualified individuals with a disability only if they can perform the essential functions of the job with or without a reasonable accommodation. Individuals who cannot perform the essential job functions are not considered qualified individuals with a disability under the ADA, and therefore are not protected by it. Thus, determining a job's essential functions is critical in determining whether an individual who is applying for or occupying a particular position is protected by the ADA. Despite the significance of this determination, the ADA gives employers considerable discretion in determining which functions are essential to a position. Specifically, the ADA provides that "consideration shall be given to the employer's judgment as to what functions of a job are essential." Moreover, the ADA provides that "if an employer has prepared a written description before advertising or interviewing applicants for the job, this description shall be considered evidence of the essential functions of the job."

Given these provisions, job descriptions have always served as a first line of defense against ADA claims. However, the passage of the ADAAA has made job descriptions even more important because the issue of whether an individual is disabled under the ADA "should not demand extensive analysis." Prior to the ADAAA, employers have generally succeeded in arguing that an individual's impairment does not qualify as a disability under the ADA. Since employers may be limited in making this argument under the ADAAA, establishing that an employee is unable to perform the job's essential functions takes on even greater significance when defending against ADA claims. Thus, employers who fail to prepare detailed, well-crafted, and up-to-date job descriptions may not be able to avail themselves of the defenses afforded by the ADA in the context of essential job functions. Therefore, employers should commit the time and effort to drafting such job descriptions for all positions.

Learn more about the ADA in our course "Understanding the ADA, Ed. 4," recently updated to include changes to the law brought about by the passage of the ADAAA.

Executive Exemption to Overtime Pay Requirement

We recently hired a full-time employee to assist our warehouse manager, who earns a salary of $500 per week, supervises and directs the assistant's work, and has the authority to report on the assistant's performance to management. Since our warehouse manager now supervises an employee, can we classify him as exempt from the Fair Labor Standards Act's overtime pay requirements?

No. Subject to specific exemptions, the Fair Labor Standards Act (FLSA) is the federal law requiring that employees be paid not less than time and one-half the employee's regular rate for time worked over 40 hours in a workweek. One such exemption is the executive exemption, which applies to employees: 1) who are compensated on a salary basis at a rate of not less than $455 per week; 2) whose primary duty is management of the business or of a recognized subdivision of the business; 3) who customarily and regularly direct the work of two or more other employees; and 4) who have the authority to hire or fire other employees or to recommend the hiring, firing, advancement, or promotion of other employees.

Although the employee in this situation appears to satisfy the first, second, and fourth requirements of the executive exemption, he clearly fails to satisfy the third requirement. The warehouse manager directs the work of only one employee, the newly-hired assistant, rather than the required minimum of two employees. Accordingly, the warehouse manager does not qualify for the executive exemption. While in some cases the facts clearly support the conclusion that the employee in question does not qualify for the executive exemption, as in this one, determining eligibility in other situations may require a detailed and fact-specific inquiry. This is especially true in cases in which either an evaluation of the employee's primary duties or of the employee's authority over subordinates is an issue. Employers who improperly classify an employee as exempt when that employee does not in fact qualify for the executive exemption face a much higher risk of being sued for unpaid overtime compensation and stand a much greater chance of losing that suit.

Importance of Employee Performance Appraisals

Some of my mid-level supervisors have a habit of hastily and inattentively preparing performance appraisals for employees they supervise. Might their carelessness eventually prove harmful if an employee terminated for cause files a discrimination lawsuit against my company?

Yes. Several federal laws make it illegal for an employer to discriminate against an employee, including Title VII of the Civil Rights Act, the Americans with Disabilities Act, and the Age Discrimination in Employment Act. Under such laws, an aggrieved employee may file a lawsuit to recover potentially significant damages from a former employer, and, in some of these lawsuits, the employee's performance appraisals may be the most significant pieces of evidence supporting his or her case. Supervisors who do not take seriously their responsibility to complete performance appraisals properly may place their employers in jeopardy of either losing a discrimination lawsuit or may increase the difficulty of successfully defending against such a lawsuit. If a supervisor automatically gives all employees average or above-average grades and gives little thought to each employee's actual job performance, then a company's assertion that the employee was in fact terminated for cause may ring hollow with a jury. Similarly, if a supervisor routinely gives other employees below-average grades, then the company would be forced to explain to a jury why these employees were not terminated for the same reason as the plaintiff.

By allowing employers to identify which employees are doing a good job, which employees need to improve, and which employees must be terminated for performance-related reasons, job performance appraisals serve an important purpose in any organization. If a supervisor is considering terminating an employee because of poor performance, then appraisals of the employee's work, or other documentation of his or her inadequate job performance, should reflect the poor quality of the individual's work. When supervisors fail to evaluate employees' work honestly and appropriately, they not only set a bad example and damage employee morale, but they also place their organization in greater jeopardy of losing a discrimination lawsuit.

Notice of Work-Related Fatality

Do employers have seven days to notify the Occupational Safety and Health Administration of a work-related incident that has resulted in the death of an employee?

No. All employers covered by the Occupational Safety and Health Act of 1970 are required to notify the Occupational Safety and Health Administration (OSHA) within eight (8) hours after the death of any employee from a work-related incident. This requirement also applies to any work-related incident resulting in the in-patient hospitalization of three or more employees. Employers must provide this notice by telephone or in person at the OSHA Area Office nearest to the site of the incident. Employers may also notify OSHA by using the toll-free central telephone number, 1-800-321-OSHA. For each incident, an employer must provide OSHA with the name of the establishment; the location of the incident; the time of the incident; the number of fatalities or hospitalized employees; the necessary contact information; and a brief description of the incident.

In addition to notifying OSHA, employers in some states may have additional notification requirements following the death of an employee. For example, in Florida, an employer must report the fatality by telephone or telegraph within twenty-four hours to the Department of Financial Services. In Minnesota, employers have forty-eight hours to report a death or serious injury that occurred during the course of employment to the state commissioner. Given such variations in reporting requirements, employers should consult with a licensed professional in their jurisdiction to determine all applicable reporting requirements before the need ever arises.

Welcome to our Blog, Risky Business

In an effort to provide our clients with valuable information to assist in their efforts to assess. minimize and prevent unintended and accidental loss, we're pleased to introduce our Blog, Risky Business.  You will hear from our in-house team of specialists as well as subject matter experts on a variety of topics, ranging from employment practices to organizational governance.  We will have our risk management team on standby to respond to inquiries regarding insurance language, coverage needs and altlernative solutions.  We hope to hear from you.

Enjoy Reading,

Anita Setnor Byer

President

www.setnorbyer.com