By Phil Larson

A recent National Labor Relations Board (NLRB) ruling may have implications for the Affordable Care Act (ACA).  The ruling, signed yesterday, held that football athletes at Northwestern "on scholarship" fall squarely into the definition of an employee for purposes of the NLRB.  

The analysis, under Section 2(3) of the National Labor Relations Act provides in relevant part that the term ‘employee’ shall include any employee . . . ” The U.S. Supreme Court has held that in applying this broad definition of “employee” it is necessary to consider the "common law definition" of employee. NLRB v. Town & Country Electric, 516 U.S. 85, 94 (1995). Under this common law definition, an employee is a person who performs services for another under a contract of hire, subject to the other’s control or right of control, and in return for payment. Brown University, 342 NLRB 483, 490, fn. 27 (2004) (citing NLRB v. Town & Country Electric, 516 U.S. at 94). 

The ruling stated that "as the record demonstrates, players receiving scholarships to perform football-related services for the employer under a contract for hire in return for compensation are subject to the employer’s control and are therefore employees under the common law standard."

The common law employee standard is very fact specific.  What this ruling does not disclose, and may not realize, is that this common law standard is also used to determine who is your employee for purposes of the employer fair share requirements under 4980H and for new reporting requirements under 6056, both under the Affordable Care Act (ACA).  It may also come into play for several employment related issues like workers compensation, local disability requirements, overtime etc.  While this decision is likely not enforceable for IRS topics including the ACA, it shows how difficult the simple question of employer status can be.  The question of who is the employer may continue to evolve. 

To view the ruling, click here.   

UPDATE 8/15:  A recent ruling by the NLRB dismissed a petition by the players to unionize.  This decision did NOT rule directly on the question of whether players are employees, instead it meant they declined to exert their jurisdiction in the case.  To view this 8/17/2015 Board Decision, click here.   

Failure to evaluate who your employee's are can have significant ramifications for the ACA and the rules can vary depending on the area of the law.  For example, the DOL may rule that individuals are subject to overtime under the Fair Labor Standards Act (FLSA) which applies a different definition of employee.  If you need help understanding these rules, please contact Kinney & Larson LLP.   

Government organizations are not immune to HIPAA compliance and a county government in Washington recently agreed to a $215,000 settlement and future auditing for perceived violations of HIPAA Privacy, Security and HITECH. Some important reminders from this recently released settlement agreement:  

First, the cost is much higher than the settlement amount.  While this number may seem high or low to you, depending on your size, it is important to know that audits themselves can cost a lot more than any settlement amount.  In addition, audits can end with the agreement to be subject to future auditing for many years.  These costs can quickly add up for organizations that find themselves under the spotlight.  Finally, the impact to the brand image for your organization should not go unnoticed.  

Second, unauthorized access is enough to be a HIPAA violation.  The HIPAA standards to not require that data be used by nefarious people or that the affected individual(s) have to be harmed for a HIPAA violation. Mere access to protected health information in a way not allowed by these rules can lead to violations.

Third, violations can be a very public situation.  Violations under HIPAA, as shown with this resolution agreement, may require your entity to disclose to individuals, the media, and even provide a posting on your home web page about the violation.  See 45 C.F.R. §164.404(d)(2)(ii)(B).  These can all be a part of the new stricter reporting obligations for breach situations.  In addition, as required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.    

Read the resolution agreement

The investigation started in 2012, about six months after being notified of the a potential breach of electronic protected health information (ePHI) on a public web server.

  The initial review found that:

• From approximately September 14, 2011 until September 28, 2011, Skagit County disclosed the ePHI of 1,581 individuals in violation of the Privacy Rule (See 45 C.F.R. §§160.103 and 164.502 (a)) by providing access to electronic protected health information (ePHI) on its public web server;
  
• From November 28, 2011 until present, Skagit County failed to provide notification as required by the Breach Notification Rule (See 45 C.F.R. § 164.404) to all of the individuals for whom it knew or should have known that the privacy or security of the individual’s ePHI had been compromised as a result of the breach incident described in the paragraph above;
  
• From April 20, 2005 until present, Skagit County failed to implement sufficient policies and procedures to prevent, detect, contain, and correct security violations (See 45 C.F.R. § 164.308(a)(1)(i));
  
• From April 20, 2005 until June 1, 2012, Skagit County failed to implement and maintain in written or electronic form policies and procedures reasonably designed to ensure compliance with the Security Rule (See 45 C.F.R. § 164.316(a) and (b)); and
  
• From April 20, 2005 until present, Skagit County failed to provide security awareness and training to all workforce members, including its Information Security staff members, as necessary and appropriate for the workforce members to carry out their functions within Skagit County (See 45 C.F.R. § 164.308(a)(5)).
  
• From April 20, 2005 until present, Skagit County failed to provide security awareness and training to all workforce members, including its Information Security staff members, as necessary and appropriate for the workforce members to carry out their functions within Skagit County (See 45 C.F.R. § 164.308(a)(5)).
  

If you have questions on HIPAA Privacy, Security or HITECH obligations, please contact Kinney & Larson.