By Phil Larson

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) just announced four new resolution agreements for potential violations under the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security rules.  

Two actions involved unencrypted electronic protected health information (ePHI) for stolen laptops.  The message from HHS was pretty clear: they strongly recommend encryption.  While encryption is not technically required under HIPAA, the standard for encryption must be reviewed and documented by entities subject to HIPAA.  As technology increases, it becomes harder and harder to show that a thoughtful review will not lead to any encryption, especially with mobile devices. 

The other two resolution agreements involved a joint action between a hospital and university following a joint breach report from 2010.  The hospital and university operated a shared data network administered together.  An employee attempting to deactivate a server on the network resulted in the ePHI of patients being accessible to internet search engines.  Links to the four resolution agreements are below.     

Concentra Health Services agreed to a $1,725,220 settlement and will adopt a corrective action plan to further show compliance.  This involved one stolen laptop from a therapy center in Missouri.  

• Read the Resolution Agreement

QCA Health Plan, Inc., of Arkansas, agreed to a $250,000 settlement and to correct deficiencies in its HIPAA compliance program. This involved the ePHI of 148 individuals, also from a stolen laptop from a car.  

• Read the Resolution Agreement

New York and Presbyterian Hospital and Columbia University agreed to a $4,800,000 settlement and substantive action plan.  This involved a disclosure of 6,800 individuals including patient status, vital signs, medications, and lab results.

• Read the Resolution Agreement for Columbia University
• Read the Resolution Agreement for New York and Presbyterian Hospital  
  

HIPAA is very complex and enforcement actions continue.  If you have questions on HIPAA compliance, please contact Kinney & Larson.  

Starting next year, applicable "large employers" will need to verify that they provide their full-time employees with the right form of coverage or face an excise tax at the end of the year.   This is sometimes called the 4980H penalty provision because the tax code added that section for this rule.  

A large employer is generally defined as an entity (using control group rules to combine entities) with 100 or more full-time employees or equivalents, measured in 2014.  This number changes to 50 or more full time employees or equivalents after the first year.  A February 2014 Congressional Budget Office (CBO) report estimates that these fees will be over $400 million per week in ten years.  To see a copy of the report, see table B-1 at the following:
  

• February 2014 CBO Report on Affordable Care Act

These rules are complicated, and they included several new transition rules to ease adiministration for the first year of operation.  Those transition rules include:

1.  50 TO 99 LARGE EMPLOYER DETERMINATION.  Large employer status will be determined by how many full-time employee's and full-time employee equivalents your entity employs in the previous calendar year.  This will be measured by your entire organization with special rules to combine related entities.  The threshold will be 50 or more full-time employees or equivalents, but for 2014 determinations, used for 2015 status, the threshold will be 100 or more.  Special rules apply in this case including a certification that your entity meets them when you file your taxes.   

2.  FIRST YEAR AS LARGE EMPLOYER.  Large employer status is determine each year, usually for the prior calendar year.  This determination may come as a surprise for some and they will need time to provide benefits if they did not previously.  For 2015 and future years, an employer that is first determined to be subject to these rules (as a large employer), may not be subject to applicable penalties for January February and March of that year provided they offer qualified coverage by April 1 of that year.  

3.  LARGE EMPLOYER MEASUREMENT.  A special window is allowed to measure whether or not you qualify as a large employer under the shared responsibility rules.  For the rollout year, an employer may measure any consecutive six (6) month window to determine if they meet the required threshold amount of full-time employees or equivalents.  You measure large employer status in the year prior to the year in which you must provide coverage.

5.  SHORTER FULL-TIME MEASUREMENT PERIOD IN 2014.  Different than a large employer measurement as described above in items #1-3, there will also be a measurement to determine who are your current full-time employees for the penalty evaluation.  One method of determining full-time employee status is to use a measurement period, usually 6 or 12 months in the past to determine if someone averages full-time employment and should be offered coverage.  The measurement must happen in 2014 if you were to use this method for 2015 full-time employment status, otherwise your organization will be subject to monthly determinations.  A special transition applies to measurements in 2014 to determine if they are full time in 2015.  The transition rule allows a shorter measurement period if started before July 1, 2014.

6.  70% NO OFFER RELIEF.  There are technically two different penalties for the employer shared responsibility rules.  One is for large employers that do not offer coverage, and one is for large employers that offer coverage but either miss some full-time employees or do not provide the right kind of coverage.  There is a special rule that provides that if you fail to offer too many of your full-time employee's coverage (but you still offer it), you can still be subject to the no offer penalty.  The limit for 2015 will be 70%, for 2016 and later it is 95%.  As an example, if you as an employer offer coverage but miss 31% of your full-time employees, you can be subject to the no-offer penalty in 2015.  Also, please note, if you offer coverage but only miss 29%, you can still be subject to penalties, but the smaller penalties apply

7.  SMALLER PENALTY CALCULATION.   The fail to offer penalty calculation for the employer shared responsibility rules will be calculated by reducing an applicable large employer member’s number of full-time employees by (up to) 30.  For 2015 (including any 2016 calendar months that fall within a 2015 plan year) this number will be reduced by 80 instead of 30.  For example, if an employer does not offer coverage and has 100 full-time employees, the penalty will be calculated for 20 full-time employees (100-80).        

8.   REQUIREMENT TO ADD DEPENDENT COVERAGE.  Normally, to avoid the penalty, plan coverage must also include coverage for dependents as defined by the employer responsibility rules. (Please note these are unique and do not include step children, foster children or other dependents that may qualify for other parts of the IRS Code).  Under this transition relief, an employer that takes steps during its 2014 plan year toward offering dependent coverage will not be subject to an employer shared responsibility payment solely on account of a failure to offer coverage to dependents for that plan year. 

9.  JANUARY PAY PERIOD.  Only for January 2015, coverage may start on the first pay period of the month and still not be subject to the penalty.  Ordinarily, failure to offer coverage any day of the month means a failure for the entire month. 

10.  MULTIEMPLOYER INTERIM GUIDANCE.  Finally, there is also a special rule for multiemployer groups, defined by regulation as plans that (A) more than one employer is required to contribute, (B) which is maintained pursuant to one or more collective bargaining agreements between one or more employee organizations and more than one employer, and (C) which satisfies such other requirements as the Secretary of Labor may prescribe by regulation.  Under this guidance, the employer may not be subject to penalties for employees it is required by the collective bargaining agreement or other related agreement to make contributions for.  

All of these rules are designed to make the transition into compliance easier in the first year.  Almost all of them, with the exception of the first year as a large employer and multiemployer rules above are effective only in the first year of compliance.  If you need help understanding these rules, or other rules for the Affordability Care Act (ACA), please contact Kinney & Larson.