The Internal Revenue Service updated is Disclosure Litigation and Reference Book last revised in April 2000. The 2011 Disclosure & Privacy Law Reference Guide covers the primary disclosure laws that affect the IRS. This includes IRC §§ 6103 and 6110, the Freedom of Information Act (FOIA), and the Privacy Act of 1974), related statutes, and testimony authorization procedures. Guidance on legal matters concerning these disclosure laws is provided by the Office of the Assistant Chief Counsel (Disclosure & Privacy Law). Of course, the IRS is careful to note that its Guide cites to "unpublished" cases which generally should not be cited as authority except under "severely limited circumstances." It also states in the Guide that the result in any case will depend on the applicable facts and the Guide may not be used or cited as authority for setting or sustaining a legal position. However, the Guide appears to be a good resource on these issues.

 

The Office of Civil Rights of the U.S. Department of Health and Human Services (“HHS”) has published its first round of annual reports to Congress under the HITECH (Health Information Technology for Economic and Clinical Health) Act of 2009 to Congress. The first report concerns HHS’s HIPAA (Health Insurance Portability and Accountability Act of 1996) enforcement activity for 2009 and 2010 and the second report focuses on reported or recorded data breaches occurring in 2009 and 2010.  

The HITECH Act contains multiple breach notification requirements for HIPAA-covered entities and their business associates. Covered entities and business associates that create unreadable or indecipherable protected health information, however, are exempt from such requirements. Covered entities must notify individuals and the Secretary of HHS of any breach of unsecured protected health information within 60 days following the discovery of the breach. For breaches involving more than 500 residents of a state, a covered entity must also notify the media in addition to the individuals and the Secretary of HHS. Business associates of covered entities under HIPAA must notify the covered entity of any breach of unsecured protected health information so the covered entity can notify affected individuals. 

As reported by HHS, between September 23, 2009 and December 31, 2010, the HHS Office of Civil Rights received 45 reports of breaches affecting 500 individuals or more in 2009 and 207 reports in 2010, resulting in notification of 7.8 million affected individuals. 

The general causes of breaches of unsecured protected health information included, first and foremost, theft.  27 of the 45 large 2009 incidents involved theft and 17 of those incidents occurred on the premises of a covered entity or its business associates. Likewise, 99 of the 207 incidents in 2010 involved theft, primarily of electronic or paper records, affecting some 2,979,121 people. Types of theft noted by HHS included theft of back-up tapes transported by a vendor of a medical facility, of laptops or desk-top computers at covered entity sites, and of smart phones or flash drives. Other causes of breaches generally involved loss of electronic media or paper records containing protected health information, unauthorized access to, use of or disclosure of protected health information, human error, and improper disposal. Notably, loss of portable electronic devices is a major factor in the loss of electronic media.

With respect to complaints and compliance with HIPAA’s Privacy Rule, HHS reports that from April 14, 2003, the date HIPAA-covered entities were to comply with the Privacy Rule, through December 31, 2010, it received 57,375 complaints and resolved 91% of them.   Through the same time period, HHS investigated 19,161 complaints, achieved corrective action in 66% of them and found no violation in 34%. 

HHS further reports that between April 20, 2005, and December 31, 2010, it investigated 289 complaints of the 803 it received related to HIPAA’s Security Rule, resolving 77% of them and finding no violation in 48%. 

The compliance issues related to the Privacy Rule most investigated included impermissible uses and disclosures of protected health information, lack of safeguards, and denial of individual access. HHS Security Rule investigations focused on a covered entity’s failures to demonstrate adequate policies and procedures to address response or reporting of security incidents, security training, access controls and workstation security.  

The two HHS reports to Congress show a marked improvement in compliance with HIPAA’s Privacy Rule. However, the reports also highlight a continuing vulnerability for covered entities that rely on electronic devices and employee accountability for elements of their privacy and security compliance programs under HIPAA (as we have touched on in previous posts). As noted by HHS, remedial actions for violations include revising policies and procedures; improving physical security; training or retraining workforce members; adopting encryption technologies; changing passwords; performing new risk assessments; and revising business associate agreements to specify required confidentiality protections. The HHS reports remind covered entities and their business associates to review and place appropriate limits on employee access to protected health information and incorporate HHS’s remedial measures into their best practices.

Connecticut Attorney General George Jepsen announced on September 14, 2011, the creation of a Privacy Task Force to help educate the public about data protection requirements and to focus his Office’s response to Internet privacy concerns and data breaches that affect consumers. According to Attorney General Jepsen’s press release, “Internet and data privacy have been among the biggest issues affecting the broad public interest during my first eight months in office” and nearly a dozen investigations have been initiated or pursued regarding security breaches that resulted in the loss of medical and insurance records or personal customer information.

Like nearly all states across the country, Connecticut has a data breach notification law. The State’s Insurance Commissioner has also adopted rules concerning data breach notification requirements for its licensees. Among other laws, the Nutmeg state has also enacted specific protections for Social Security Numbers, employment applications, and personal information, which includes:

information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver’s license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number.  

The Task Force will be responsible for all investigations of consumer privacy breaches, which we are assuming will apply to breaches of any personal information for which notification is required, including patients and employees. The Task Force will also help to educate the public and business community about their responsibilities, which include protecting personally sensitive data and promptly notifying affected individuals when breaches do occur.

Clearly a sign of increased attention to and enforcement of the state’s data security and consumer protection mandates, Connecticut businesses and businesses maintaining personal information of Connecticut residents should revisit their information security programs and data breach response plans to ensure they could withstand the scrutiny of an inquiry by the Attorney General’s office.  

In a novel approach to data breach notification requirements, Texas has amended its breach notification law (Business & Commerce Code, Section 521.053) to require notification to residents of not only Texas, but to residents of each of the 50 states.  The amendment becomes effective September 1, 2012, and applies to “all persons who conduct business in the state,” without further defining what “conducting business” would entail. 

The law was amended to require notification of a breach of system security to any individual whose sensitive personal information was, or is reasonable believe to have been, acquired by an unauthorized person.  A review of the amendment reflects the legislature’s intent to expand the notification requirement by its deletion of the language “resident of this state” from the current data breach notification law. 

This law has obvious far reaching import for residents of the four states which do not currently maintain data breach notification laws (Alabama, Kentucky, New Mexico, and South Dakota).  Under Texas’ law, residents of these states whose personal information is owned, licensed or maintained by a business/employer subject to Texas law would now receive notification of a breach of their personal information. 

Additionally, Texas’ breach notification law does not include a “risk of harm trigger.”  A number of state data breach notification laws only require notification where illegal use of the breached personal information has occurred, or is reasonably likely to occur and that creates a risk of harm to a person.  However, under Texas’ law, notification is required only upon acquisition, without regard to a risk of harm.  While Texas’ amended law appears to include some limiting language on its application to states that have their own breach notification laws, as worded, it is unclear whether this would include states whose risk of harm trigger would not require notification.  Accordingly, for those entities which conduct business in Texas, notification of those affected may be required even if the individual’s home state would not have required notice in the case of low-risk breaches 

The amendment also adds civil penalties for any person who fails to take reasonable actions to comply with the notification requirements.  These penalties are compounded by the number of individuals who are not notified and for each consecutive day notification is not provided, resulting in a maximum fine of $250,000.  Additionally, the amendment makes a violation a misdemeanor, unless the breached information is protected by HIPAA, which would elevate the violation to a felony. 

Companies, especially those that maintain vast amounts of personal information for persons in multiple states, must be aware of the various state laws which potentially impact there business and amendments like those highlighted above. See also recent amendments to the breach notification statutes in California and Illinois.

As we suspected, California’s current governor, Edmund G. “Jerry” Brown, Jr. (D), signed into law S.B. 24, which adds some additional protections to the state’s current data breach notification requirements. The champion of this law and its recent enhancements, State Sen. Joe Simitian (D-Palo Alto), has finally succeeded after a number of prior attempts to pass this measure were vetoed by then-Gov. Arnold Schwarzenegger (R).

Summary of Changes

Under S.B. 24, breaches occurring on and after January 1, 2012, that require notification to California residents will have to meet the following additional requirements:

  • The notifications themselves will need to satisfy specific content requirements, such as including a description of the type of information breached, time of breach, and toll-free telephone numbers and addresses of the major credit reporting agencies;
  • If more than 500 California residents are affected by a single breach, an electronic copy of the breach notification must be send to the California Attorney General;
  • If the law’s "substitute notice" provisions are used, notice also must be provided to the Office of Information Security or the Office of Privacy Protection. Substitute notice is permitted when the person or business required to provide the notice demonstrates that (I)(i) the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or (ii) that the affected class of subject persons to be notified exceeds 500,000, or (II) the person or business does not have sufficient contact information. Prior to the change, substitute notice consisted of only email notification, conspicuous posting of the notice on the person or business’ website, and notification to statewide media.

Companies responding to multi-state breaches face significant challenges trying to harmonize the various state law requirements. See, for example, the recent changes to the Illinois statute. Presently, a number of bills are being considered in Congress that would preempt all of the state laws in this area, however, passage of one of these laws does not appear to be imminent. As data breaches go global, similar concerns exist as countries are enacting their own breach notification mandates.

Illinois Governor Pat Quinn approved a measure on August 22, 2011, amending his state’s data breach notification law. The changes, which become effective January 1, 2012, are designed to increase protections for Illinois residents in the following ways:

New information that must be included in breach notifications:

  • the toll-free numbers and addresses for consumer reporting agencies,
  • the toll-free number, address, and website address for the Federal Trade Commission, and
  • a statement that the individual can obtain information from these sources about fraud alerts and security freezes.

Information that may not be included in breach notifications:

  • information concerning the number of Illinois residents affected by the breach.

 

New requirements for "data collectors" that maintain or store, but do not own or license, computerized data:

As with most breach notification statutes, entities that maintain or store certain personal information on behalf of the owner or licensee of that data also have obligations in the event of a breach of the security of that data. Generally, the obligation is to notify the owner of the breach. So, for example, a third party claims administrator or an accounting firm might perform services for ABC Corp. (the owner) requiring the administrator or accounting firm to maintain or store the personal information. If an employee of the administrator or accounting firm loses a laptop containing ABC Corp.’s personal information, or the employee or some third party impermissibly accesses or acquires the information, the administrator or accounting firm would be required to notify ABC Corp. which, in turn, would need to notify the affected individuals.  

As amended, Illinois’ breach notification law requires companies that maintain or store personal information to cooperate with the owner or licensee in matters relating to the breach, by notifying the owner or licensee of: 

  • the date or approximate date of the breach and the nature of the breach, and
  • any steps the entity has taken or plans to take relating to the breach.

However, this cooperation shall not require either (i) the disclosure of confidential business information or trade secrets of the company that maintains or stores the information, or (ii) the notification of an Illinois resident who may have been affected by the breach.

New Mandates for Disposing of Materials Containing Personal Information 

The amended law requires "persons" (including natural persons, corporations, partnerships, associations, or other legal entities, including governmental entities) to dispose of the materials containing personal information "in a manner that renders the personal information unreadable, unusable, and undecipherable." The law provides examples of proper disposal methods: 

  • Paper documents containing personal information may be either redacted, burned, pulverized, or shredded so that personal information cannot practicably be read or reconstructed.
  • Electronic media and other non-paper media containing personal information may be destroyed or erased so that personal information cannot practicably be read or reconstructed.

Companies may engage third parties to carry out the disposal of personal information, provided that third parties performing these services must implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation, and disposal of materials containing personal information. It is recommended that service contracts be carefully drafted to address these issues and appropriate steps be taken to monitor compliance.

Penalties for violations of the disposal requirements can be up to $100 for each individual with respect to whom personal information is disposed, subject to a maximum penalty of $50,000 for each instance of improper disposal.

In a 23-page report, the Acting General Counsel for the National Labor Relations Board summarizes the Board’s positions on social media and labor relations. This report is an interesting read and provides insight into one aspect of drafting social media policies – whether the policy will violate an employee’s right to take part in protected concerted activity.

The report notes that:

Recent developments in the Office of the General Counsel have presented emerging issues concerning the protected and/or concerted nature of employees’ Facebook and Twitter postings, the coercive impact of a union’s Facebook and YouTube postings, and the lawfulness of employers’ social media policies and rules. This report discusses these cases, as well as a recent case involving an employer’s policy restricting employee contacts with the media. All of these cases were decided upon a request for advice from a Regional Director.

Social media clearly is an important issue for the Board and this memorandum likely is not its last word on the rules that will shape employer policy concerning the use of this media. The following discussion summarizes the memorandum and its effects on social media policy.

See related articles concerning NLRB activity concerning social media.

Continue Reading NLRB Acting General Counsel Issues Opinion On Social Media and the NLRA

Connecticut joins five other states (Hawaii, Illinois, Oregon, Washington, and Maryland) in limiting what credit report information employers may use in making hiring or employment decisions. Other states have considered similar measures.

Under the new law, effective October 1, 2011, employers (including their agents, representatives or designees) may not demand that an employee or prospective employee consent to a credit report as a condition of employment unless:

  1. the employer is a financial institution, 
  2. the credit report is required by law,
  3. the employer reasonably believes that the employee has engaged in specific activity that constitutes a violation of the law related to the employee’s employment, or
  4. such report is "substantially related to the employee’s current or potential job" or the employer has a bona fide purpose for requesting or using information in the credit report that is substantially job-related and is disclosed in writing to the employee or applicant.

For purposes of this law, a credit report is a report that contains information about the employee’s or prospective employee’s credit score, credit account balances, payment history, savings or checking account balances or savings or checking account numbers. The report will be treated as being "substantially related to the employee’s current or potential job," where the position:

  • is a managerial position which involves setting the direction or control of a business, division, unit or an agency of a business,
  • involves access to customers’, employees’ or the employer’s personal or financial information other than information customarily provided in a retail transaction,
  • involves a fiduciary responsibility to the employer, including, but not limited to, the authority to issue payments, collect debts, transfer money or enter into contracts,
  • provides an expense account or corporate debit or credit card,
  • provides access to certain confidential or proprietary business information, including trade secret information under certain circumstances; or
  • involves access to the employer’s nonfinancial assets valued at $2,005 or more, including, but not limited to, museum and library collections and to prescription drugs and other pharmaceuticals.

Employees or prospective employees who believe the law has been violated may file a complaint. Employers could be liable for $300 in civil penalties for each inquiry that violates the law.

In addition to affecting the traditional employee-employer relationship, this law (and those cited above) may affect the practice of requiring employees of a company’s vendors to jump through certain hoops before coming on-site. Increasingly, company A, when it utilizes the services of employees of company B (such as for back office processing or health care staffing needs) will require company B to ensure its employees undergo certain background checks and other certification procedures and tests. Those arrangements need to consider these limitations on the kinds of inquiries that can be made by employers.

. . . A Potential Headache for Employers of Younger Workers

Retail, entertainment, hospitality and other industries that traditionally employ large numbers of younger workers may soon get dragged into criminal proceedings because of “sexting” by their younger workers. Florida has joined 20 other states — Alaska, Arkansas, California, Hawaii, Indiana, Iowa, Kansas, Mississippi, Nevada, New Jersey, New York, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Texas, and Guam — which have all enacted similar legislation addressing teen sexting. Because employees frequently transmit these materials using their employer’s networks, criminal prosecutions under these laws may require employers to respond to discovery requests and subpoenas, or permit searches pursuant to warrants obtained by law enforcement authorities, which, in turn, may unexpectedly trigger disciplinary proceedings.

On June 21, 2011, Florida Governor Rick Scott signed into law H.B.75/S.B. 888. Under this law, which will take effect beginning October 1, 2011, a minor (anyone under the age of 18) commits the criminal act of “sexting” if he or she knowingly uses a computer, cell phone, or other transmission device (1) to transmit or distribute to another minor a photograph or video of any person which depicts nudity; or (2) possesses such photograph or video which was transmitted or distributed by another minor, unless the photograph was unsolicited, the minor took reasonable steps to report the photograph or video to their legal guardian, school official, or law enforcement, and the minor did not transmit or distribute the video or photograph to a third party. A minor’s first offense is considered noncriminal and is punishable by 8 hours or community service or a $60 fine. The minor’s second offense is a misdemeanor in the first degree, punishable with imprisonment not to exceed one year or a $1,000 fine; and the minor’s third offense is a felony of third degree, punishable with up to five years’ imprisonment or a $5,000 fine.

Of course, sexting is not only an issue for minors. It is fast becoming an easy and well-utilized mechanism for sexual and other workplace harassment. Accordingly, employers should review and update their anti-harassment policies to include a prohibition of harassment via e-mail, text messaging, or use of social networking sites; and they should review their electronic communications policies to include a prohibition against using any employer-provided electronic device to transmit or retain any sexually suggestive or explicit pictures, texts, videos or any other derogatory material regarding race, ethnicity, age, disability, religion, or any other protected category. Employers should also educate and train employees on the revised policies and continue to enforce all policies in a fair and consistent manner. At the same time, employers should remain mindful of any limitations on such policies (as written or as applied) that may be imposed under the National Labor Relations Act.

Disclosure to management by the company’s in-house physician of an employee’s alleged “lie” (or at least significant omission) made months earlier on a post-job offer medical questionnaire violated the Americans with Disabilities Act’s confidentiality provisions, a federal District Court in Maine held last week. Blanco v. Bath Iron Works Corp., D. Me., No. 2:10-cv-00429.

Medical professionals are becoming a fixture at many workplaces, whether they be occupational nurses or full scale on-site health clinics. As reported by the L.A. Times on July 3, 2011, 15% of U.S. companies with 500 or more employees had health centers last year, up from 11% the year before, and companies with 20,000 or more employees were even more likely to have clinics. However, having these resources on site can raise a range of workplace law risks, not the least of which concerns confidentiality.

In the Maine case, following his job offer, Mr. Blanco completed a pre-placement medical screening, which included filling out and signing a “Medical Surveillance History Questionnaire,” administered by the employer’s in-house physician. He did not reveal on that form that he had Attention Deficit Hyperactivity Disorder (ADHD). Mr. Blanco received good reviews for the first few months of his employment, but when he was moved to a different position, his performance began to wane. During a meeting with his manager, he attributed his poor performance to his ADHD and not long after requested a reasonable accommodation.

Mr. Blanco was referred to the same in-house physician who administered the Medical Surveillance History Questionnaire. Rather than explore the substance of his request, the physician interrogated Mr. Blanco concerning the ADHD omission on the Questionnaire. He explained that he did not understand the questions to ask about mental or emotional issues, such as ADHD. The physician refused to provide an accommodation, or even address the issue, and shortly after the physician informed management of Mr. Blanco’s omission from the Questionnaire, he was fired.

In refusing to dismiss Mr. Blanco’s complaint under the Americans With Disabilities Act and the state anti-discrimination law, the Court rejected two interesting arguments raised by the employer:

  1. Employees that lie should not be able to get protection under the ADA’s medical information confidentiality protections; and,
  2. As a policy matter, these kind of misstatements put in-house physicians “in a pickle.” The court allowed, “If the revealed condition places the employee and his co-workers at risk, the doctor’s conflicting loyalty would become a safety issue."

In each case, however, the Court said it didn’t matter to its decision that the employee may have lied on the medical questionnaire. The Court simply pointed to the statutory language, which it found clear and controlling. The court stated:

The Court agrees that whether he lied is not dispositive since the confidentiality provision does not apply only to truthful information. But this does not assist the Defendants. The ADA clearly protects the confidentiality of Mr. Blancos’ response if truthful and the ADA still protects its confidentiality if not. In other words, there is no prevarication exception to the ADA’s confidentiality mandate for employment entrance examinations, much less for information the company doctor perceives is inaccurate. It is the information, accurate or not, that the statute protects.

In response to the conflicting loyalty argument, the Court reasoned:

The brief answer, however, is that these policy arguments do not trump the statutory language. Congress, not this Court, is a policy-making body, and the Court is duty-bound to follow the law as enacted by Congress. Congress may or may not have considered whether to carve out a disclosure exception for instances where the employer concludes that the employee lied or misrepresented his pre- employment medical or mental condition. In any event, there is no such exception in the statute.

More than ever, businesses are realizing that comprehensive approaches to disability and leave management not only can mitigate compliance and litigation concerns, but also can enhance employee productivity and, therefore, profit margins. For these companies, on-site health clinics, occupational health clinics, and in-house physicians can be attractive options. However, as this case makes clear, employers need to be mindful of the workplace law risks. The ADA may be one source of such risks.