IRS Releases 2020 ACA Reporting Forms and Instructions

The IRS recently published the final versions of the 2020 reporting Forms 1094-B and 1095-B, 2020 reporting Forms 1094-C and 1095-C, and instructions for those forms. Forms 1094-B and 1095-B are used by insurers and small self-insured employers to report that they offered MEC. Forms 1094-C and 1095-Cs are used by ALEs to report that they offered minimum value, affordable coverage to their full-time employees. These forms are filed with the IRS, and copies of Forms 1095-B and 1095-C are also distributed to individuals.

This year’s forms feature a few new changes. The Plan Start Month section of Form 1095-C must now be completed. In addition, the penalty for the failure to file a correct information return increased to $280 per return (up from $270 for each incorrect return), and the penalty cap is raised to a total of $3.392 million for a calendar year, up from a cap of $3.339 million in 2019. Finally, the updated draft 1095-C form shows that the affordability safe harbor percentage threshold is 9.78% in 2020, down from the 9.86% threshold in 2019.

The 2020 forms and instructions also require employers to include information concerning Individual Coverage Health Reimbursement Arrangements (ICHRAs), if applicable. The instructions for Form 1094-C state that offers of ICHRA coverage count as offers of minimum essential coverage and both Forms 1095-B and 1095-C have new codes for information concerning ICHRAs offered to employees. Line 8 of Form 1095-B has a new Code G, which identifies ICHRAs as the type of employer-sponsored coverage. Form 1095-C’s Line 14 now has codes to identify the full-time or part-time status of the employee offered an ICHRA, whether the ICHRA was offered to a full-time employee’s spouse or dependents, whether the ICHRA is affordable, and whether the affordability was based upon where the full-time employee lives or works (the ZIP code of the full-time employee’s residence or place of work can be entered on Line 17, if the employee was offered an ICHRA). The employee’s contribution is recorded on Line 15.

As a reminder, the date by which employers must distribute Forms 1095-B or 1095-C to individuals has been extended. 2020 forms must now be distributed to individuals by March 2, 2021 (instead of January 31, 2021). Even though this extension is provided, employers are encouraged to furnish the 2020 statements as soon as they are able. Further, as in prior years, this notice does not extend the date by which employers must file Forms 1094-B/C and 1095-B/C with the IRS. That said, reporting entities must still file Forms 1094-B/C and 1095-B/C with the IRS by March 1, 2021 (as February 28, 2021, falls on a Sunday) if filing by paper, and March 31, 2021, if filing electronically. As noted above, the penalty for failure to comply is $280 per failure. This means that an employer who fails to file a completed form with the IRS and distribute a form to an employee/individual would be at risk for a $560 penalty.

Form 1094-B »
Form 1095-B »
Form 1094-C »
Form 1095-C »
Instructions for Forms 1094-B and 1095-B »
Instructions for Forms 1094-C and 1095-C »

Source: NFP BenefitsPartners

Filed under: Abentras Blog

Tenth Circuit: Employer’s Discretionary Authority Must be Communicated to Plan Participants

On July 24, 2020, in Lyn M v. Premera Blue Cross, et al., the US Court of Appeals for the Tenth Circuit (the “Tenth Circuit”) ruled that an ERISA group health plan administrator was not entitled to a discretionary standard of review because this standard was not adequately disclosed to plan participants. The Tenth Circuit further held that the plan administrator had failed to refer to the applicable medical policy when evaluating the appealed medical claim at issue.

As background, an ERISA plan’s benefit determinations are entitled to a favorable standard of review, known as the arbitrary and capricious standard, if there is language in the plan document granting the plan administrator discretion to interpret the plan and make benefit determinations. This standard involves a more limited judicial review of participant challenges to plan benefit determinations and often results in the disposal of cases at an early stage in the legal process. Absent such language in the plan document, de novo review applies, and the trial court would typically conduct a more independent and thorough review of a participant’s claim.

In Premera, parents sought medical benefits under the Microsoft Corporation Welfare Plan for their minor child’s psychiatric treatment. The claims administrator, Premera, denied the claim and subsequent appeal as not medically necessary based upon the definition of “medical necessity” in the SPD, rather than the more comprehensive definition in the medical policy.

The district court reviewed Premera’s denial of the appealed claim under the arbitrary and capricious standard because the plan language gave the claims administrator discretionary authority to interpret and administer the plan. Under this standard, the court deferred to the administrator’s determination that the disputed services were not medically necessary, and ruled in favor of Premera and the plan fiduciary, Microsoft Corporation.

On appeal, the Tenth Circuit reversed the district court decision and held that the discretionary standard of review was not applicable because participants had not been notified of this more limited scope of judicial review of their claims. In other words, the plan administrator had not specifically disclosed its discretionary authority in the SPD or other distributed materials or the existence of a document with information about such discretionary authority. Additionally, the Tenth Circuit found that Premera erred in failing to consider the definition of medical necessity in the medical policy.

Accordingly, the case was returned to the district court for review of the claim under the de novo standard of review, thus allowing for a broader judicial analysis of the evidence without deference to the plan administrator’s benefit determinations.

ERISA plan sponsors, particularly those within the Tenth Circuit’s jurisdiction, should be aware of this development. The Tenth Circuit includes districts in Colorado, Kansas, New Mexico, Oklahoma, Utah and Wyoming. Sponsors seeking to benefit from the application of the discretionary standard of review in the event of litigation should consider referencing this standard in the SPD in addition to the plan document. Furthermore, employers should recognize their obligation as plan fiduciaries to oversee claims administrators and ensure their claim review processes and communications adhere to ERISA requirements and the specific plan terms. Plan document providers and/or counsel should be consulted for further assistance.

Lyn M v. Premera Blue Cross, et al. »

Source: NFP BenefitsPartners

Filed under: Abentras Blog

Once Again, IRS Extends ACA Reporting Deadlines and Offers Penalty Relief

On October 2, 2020, the IRS released Notice 2020-76, extending the deadlines for distributing ACA reporting forms to individuals.
As background, the ACA imposes two reporting requirements under Sections 6055 and 6056. Section 6055 requires entities that provide minimum essential coverage to report to the IRS and to covered individuals the months in which the individuals were covered. Section 6056 requires applicable large employers (under the employer mandate) to report to the IRS and full-time employees whether they offered minimum essential coverage that was affordable and minimum value.
This relief is consistent with that offered in previous years. As the IRS has done for the previous reporting years, the date by which employers must distribute Forms 1095-B or 1095-C to individuals has been extended. 2020 forms must now be distributed to individuals by March 2, 2021 (instead of January 31, 2021). Even though this extension is provided, employers are encouraged to furnish the 2020 statements as soon as they are able. Further, as in prior years, this notice does not extend the date by which employers must file Forms 1094-B/C and 1095-B/C with the IRS. That said, reporting entities must still file Forms 1094-B/C and 1095-B/C with the IRS by March 1, 2021 (as February 28, 2021, falls on a Sunday) if filing by paper, and March 31, 2021, if filing electronically.
Despite this relief, the IRS may still seek penalties on employers who fail to comply with the deadlines. The IRS also indicates that employers can no longer request an automatic extension of the due date by which they must distribute the forms to individuals, as the extension they have provided is just as generous. In fact, the IRS will not respond to any such request for an extension. Employers may still request an automatic extension to file the Forms 1094-B/C and 1095-B/C with the IRS, as long as they submit a Form 8809 on or before the due date of those filings.
The IRS also continues to recognize good faith efforts made by employers that file the 2020 forms. Specifically, employers that timely file and distribute their required Forms 1094-B/C and 1095-B/C will not be subject to penalties if the information is incorrect or incomplete. In determining what constitutes a good faith effort, the IRS will take into account whether an employer or other coverage provider made reasonable efforts to prepare for reporting, such as gathering and transmitting the necessary data to a reporting service provider or testing its ability to use the ACA Information Return Program electronic submission process.
Since the intention of this good faith relief was to be transitional relief, the IRS states that this is the last year they intend to provide such relief. Note that this relief does not apply to a failure to timely furnish or file a statement or return, and it does not extend to employer mandate penalties (for large employers that did not offer affordable, minimum value coverage to full-time employees pursuant to the ACA’s employer mandate).
Notably, similar to last year, this notice also provides penalty relief for employers which will allow them to forego distributing the Form 1095-B to individuals. As a reminder, this resulted from the IRS accepting comments on the necessity of the Form 1095-B now that the individual mandate penalty has been zeroed out. So, as long as employers post a notice on their website that the document is available upon request, and then fulfill any such request within 30 days, they can choose not to distribute the Forms 1095-B to covered individuals.
However, employers should note that the penalty relief pertaining to the Form 1095-B is not available for Form 1095-C, but can be applied to employees who are not full-time and only receive a Form 1095-C to meet the Form 1095-B reporting requirement. In other words, those employees who are only receiving a Form 1095-C because the employer uses Part III to comply with Section 6055 no longer have to be provided a Form 1095-C. (Self-insured applicable large employers must still provide and file Form 1095-C to full-time employees and complete Part III of the Form, indicating the covered spouses and dependents of the full-time employees.)
Although the IRS provided similar relief in the past, the agency explains that unless they receive comments to explain why relief related to furnishing statements under Sections 6055 and 6056 continues to be necessary, no relief will be granted in future years. Comments must be submitted by February 1, 2021 (Notice 2020-76 provides instructions on how to do so).
Employers should keep this guidance in mind as they are preparing their ACA filings and distributions for 2020.

IRS Notice 2020-76

Source: NFP BenefitsPartners

Filed under: Abentras Blog

Another Federal District Court Invalidates the Current Section 1557 Rules

On September 2, 2020, the US District Court for the District of Columbia issued an injunction against HHS, stopping the agency from enforcing its amendments to its rule implementing Section 1557 of the ACA. The specific amendments subject to the injunction are those that scale back the rule’s prohibition against discriminating on the basis of gender identity or sexual orientation, as well as the insertion of a religious exemption allowing religious organizations to opt out of following the rule when doing so would be inconsistent with their religious beliefs. This is the second federal district court to block these new amendments.

The amendments to the rule implementing Section 1557 were discussed in the June 23, 2020, edition of Compliance Corner.

In this case, Whitman-Walker Clinic v. HHS, a group of organizations that provide healthcare and other services to the LGBTQ community filed suit against HHS within days of the publication of its final rule. The plaintiffs alleged that the agency acted in an arbitrary and capricious way when implementing the amendments to the rule, and that these amendments conflict with Section 1554 of the ACA by creating unreasonable barriers and impeding access to healthcare services to members of the LGBTQ. The plaintiffs also alleged that the final rule violates the First Amendment’s right to free speech, the Fifth Amendment’s guarantees of equal protection and substantive due process, and the Establishment Clause. As a preliminary matter, the plaintiffs asked the court to enjoin the agency from enforcing its final rule while litigation proceeded.

The court considered whether the plaintiffs would likely succeed on the merits of their case. The court concluded that they were likely to both succeed on the merits and suffer irreparable harm on the allegations that HHS acted arbitrarily and capriciously when it stripped out language regarding sexual orientation and gender identity from the definition of “discrimination of the basis of sex.” Although the court did not agree that “gender identity” was included in the original regulation, it did agree that discrimination based upon “sex stereotyping” was prohibited. The court additionally found that the agency improperly incorporated the religious exemption established in Title IX of the Civil Rights Act of 1964 into the final rule. Accordingly, the court issued its injunction. The injunction is effective nationwide.

This ruling is part of ongoing litigation and could be appealed, so the ultimate disposition of the final rule is unknown. It should be noted that this is the second federal district court to enjoin this rule. The first case, Walker v. Azar, was discussed in the August 18, 2020, edition of Compliance Corner. Employers that would operate their plans in a manner consistent with the final rules should consult with legal counsel about the implications of this decision. We will keep an eye on developments in this area to see how they may affect the benefits employers provide to their employees.

Whitman-Walker Clinic v. HHS »

Source: NFP BenefitsPartners

Filed under: Abentras Blog

President Issues Executive Order on Healthcare

On September 24, 2020, President Trump issued the Executive Order on An America-First Healthcare Plan, providing a summary of efforts made regarding the efficiency and quality of healthcare in the US, and directives aimed at lowering healthcare costs for Americans.

In an effort to lower healthcare costs, the order directs HHS to:

  • *Maintain and improve upon actions to expand access to affordable prescription drugs, including allowing the importation of drugs from abroad.
  • *Work with Congress on a solution to end surprise medical billing by December 31, 2020. If there is no legislative solution by December 31, 2020, HHS must take administrative action to prevent patients from receiving reasonably unforeseen bills for out-of-pocket expenses.
  • *Update the Medicare.gov Hospital Compare website to provide information regarding billing quality. This includes whether the hospital is in compliance with the Hospital Price Transparency Final Rule (effective January 1, 2021), provides patients with itemized receipts upon discharge, and how often the hospital pursues legal action against patients.
  • In addition, HHS is directed to continue to maintain and improve upon existing processes to reduce waste, fraud and abuse in the healthcare system and to advance the quality of delivery of care for veterans, while continuing to promote medical innovations of conditions impacting Americans (such as COVID-19 and Alzheimer’s disease, among others).

    Further, in response to the order, HHS issued a final rule from the Food and Drug Administration and related guidance, among other items, as noted in its September 24, 2020, press release. The final rule permits importation of certain drugs from Canada in an effort to lower patient drug costs and explains the process for states who wish to do so.

    While the order does not directly impact group health plans, employers should be aware of these developments.

    Executive Order on An America-First Healthcare Plan »
    FDA Final Rule on Importation of Prescription Drugs »
    FDA Guidance on Importation of Prescription Drugs »
    HHS September 24, 2020 Press Release »

    Source: NFP BenefitsPartners

    Filed under: Abentras Blog

    IRS Provides Guidance on SECURE Act Implementation

    On September 2, 2020, the IRS issued Notice 2020-68 to provide guidance regarding certain provisions of the SECURE Act affecting qualified retirement plans, 403(b) plans and IRAs. The guidance, which is in the form of questions and answers (Q&As), is intended to assist plan sponsors and IRA custodians with the implementation of this legislation.

    The SECURE Act, which was enacted on December 20, 2019, introduced significant changes with respect to retirement plan eligibility, contributions and distributions, among other items. (See our January 7, 2020, edition of Compliance Corner for an article detailing the provisions of the act.) Notice 2020-68 provides needed clarification regarding specific sections of this law and the deadlines for adopting related plan amendments.

    First, the notice addresses a new $500 tax credit under Section 105 of the SECURE Act that is available to small businesses (with up to 100 employees who were paid at least $5,000 a year) that newly establish an eligible automatic enrollment arrangement (EACA) to increase qualified plan participation. This one-time credit applies to the three-year period that begins when the EACA feature is first adopted. The $500 credit is available on an employer (as opposed to plan) basis; therefore, each employer participating in a multiple employer plan could be eligible to claim this amount.

    Second, clarification is provided regarding Section 107 of the SECURE Act, which permitted certain changes with respect to IRA contributions and distributions beginning in 2020. Specifically, IRA owners are now allowed to make contributions after attainment of age 70.5, which was previously restricted. However, financial institutions that serve as custodian or trustee are not required to accept such post-age 70.5 contributions. Those that elect to do so must amend their IRA contracts by December 31, 2022, and notify accountholders within 30 days of the amendment adoption or effective date.

    Additionally, Section 107 of the SECURE Act allows post-age 70.5 IRA owners to exclude from their gross income up to $100,000 of IRA distributions made directly to charities. The excludable amount must be reduced by any post-age 70.5 contributions, and the notice provides specific examples as to how the contribution offset would apply.

    Third, the notice clarifies Section 112 of the SECURE Act, which modified 401(k) eligibility requirements to enable participation by long-term part time workers. Specifically, part-timers who have attained age 21 and completed three consecutive years each with 500 hours of service must be eligible to participate. This change is effective for plan years beginning on or after January 1, 2021. The Q&As explain that 12-month periods beginning prior to this date would not count in determining a part-time employee’s eligibility to participate, but would count towards the employee’s vesting in any employer contributions.

    Fourth, significant guidance is provided with respect to qualified birth or adoption distributions, which are distributions of up to $5,000 from eligible retirement plans made within one year of the birth to or legal adoption of a child by the distributee. Under Section 113 of the SECURE Act, these distributions are taxable, but not subject to the 10% early withdrawal penalty that would normally apply to distributions prior to the age of 59.5. Additionally, the amounts are not subject to the mandatory withholding and notice requirements applicable to eligible rollover distributions, and can be recontributed to an eligible retirement plan or IRA. The Q&As explain that each parent can receive a distribution with respect to the same child and that the $5,000 maximum applies per child in the event of multiple births.

    However, eligible retirement plans are not required to offer qualified birth or adoption distributions. Plans that elect to do so must be amended accordingly and must also accept recontributions of distributed amounts. The recontribution is treated by the receiving plan as if a direct trustee-to-trustee transfer of the funds; future IRS guidance will address the timing aspects. Furthermore, if a plan does not offer qualified birth or adoption distributions, an eligible participant can treat an in-service withdrawal as such and recontribute the amount to an IRA.

    Other issues addressed by the notice include the optional inclusion of difficulty of care payments, which are a type of qualified foster care payment, in the determination of certain retirement contribution limitations. Guidance regarding retirement plan provisions in the Bipartisan American Miners Act of 2019 were also incorporated.

    Finally, the IRS outlines the deadlines for SECURE Act plan amendments. Generally, qualified plans and 403(b) plans must adopt required amendments by the last day of the plan year beginning on or after January 1, 2022. The deadline for governmental plans and collectively bargained plans is the last day of the plan year beginning on or after January 1, 2024. The amendments must be retroactive to the effective date and the plan must operate in accordance with the amendment from such date.

    Employers who sponsor retirement plans should be aware of this supplementary SECURE Act guidance. Comments can be submitted (preferably in electronic form) to the IRS through November 1, 2020, regarding the matters discussed in the notice.

    Notice 2020-68 »

    Source: NFP BenefitsPartners

    Filed under: Abentras Blog

    Second Circuit Holds Employer Liable for Service Provider’s Error

    A recent United States Court of Appeals for the Second Circuit decision reminds employers that fiduciary responsibility under ERISA ultimately lies with the employer, even when the actions of a service provider or third-party administrator (TPA) are in question.

    In Sullivan-Mestecky v. Verizon Communications Inc., the Second Circuit vacated the district court’s dismissal of Sullivan-Mestecky’s claim against Verizon and remanded the claim for further proceedings, among other issues. For reference, authorizes a beneficiary of an employee benefit plan to bring an action to seek equitable relief as a result of fiduciary breaches, which are violations under ERISA. As further background, ERISA requires fiduciaries to act “with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent man acting in a like capacity and familiar with such matters would use.”

    In this case, Sullivan-Mestecky, as the beneficiary of a life-insurance policy of her mother Kathleen Sullivan, brought suit against Verizon claiming fiduciary breach for failure to pay the entire life insurance benefit. The facts in this case demonstrate that Sullivan received various communications from Aon Hewitt (a service provider on behalf of Verizon) stating that her life insurance coverage “1x pay” amount was $679,700. However, upon Sullivan’s death, only $11,400 was provided as the death benefit, which was consistent with the terms of the plan.

    As it turns out, Aon Hewitt had coded Sullivan’s annual $18,600 income as her weekly income, basing the communicated $679,700 coverage amount on an erroneous salary of $970,920. While the written plan terms were correct, what was repeatedly communicated to Sullivan by Aon Hewitt regarding her coverage amount was incorrect.

    The Second Circuit concluded that Sullivan-Mestecky reasonably pled that Verizon breached its fiduciary duties by failing to provide complete and accurate information regarding the plan (supporting its remand of the claim). The Second Circuit further explained as part of its conclusion that as the plan administrator, Verizon was responsible for assessing Sullivan’s eligibility and for enrolling Sullivan in her benefits plan. Further, when Verizon arranged for Aon Hewitt to communicate with Sullivan about her benefits as the service provider, Verizon was performing a fiduciary function and bound by ERISA’s fiduciary requirement to properly administer the plan. The Second Circuit explains that Aon Hewitt’s negligence is imputed to Verizon, as Aon Hewitt’s principal, and states that “Verizon cannot hide behind Aon Hewitt’s actions to evade liability for the fiduciary breach that occurred here.”

    The outcome of the case serves as a reminder to employers of fiduciary obligations under ERISA, and that such obligations are that of the employer (as the plan administrator) even when utilizing service providers or TPAs. So employers should routinely review and monitor service providers’ work to ensure that it accurately reflects the plans terms.

    Source: NFP BenefitsPartners

    Filed under: Abentras Blog

    DOL Releases Interim Final Rule on Lifetime Income Illustrations

    On August 18, 2020, the DOL announced an interim final rule regarding lifetime income illustrations for participant benefit statements. The rule’s requirements are applicable to defined contribution plans, which would include 401(k) plans.

    As background, the Setting Every Community Up for Retirement Enhancement Act of 2019 (SECURE Act) amended ERISA Section 105 to require an annual income disclosure to be included as part of a participant’s benefit statement. The disclosure is intended to help a participant understand how their account balance translates into monthly income at retirement. As a result, a participant may be better able to prepare for retirement and assess whether current contributions should be increased to achieve retirement income goals.

    Accordingly, the disclosure would reflect the monthly payment amounts the participant would receive if their total account balance were used to provide a single life annuity (SLA) for the participant or a qualified joint and survivor annuity (QJSA) that would also provide a benefit for a surviving spouse. As prescribed by the SECURE Act, the interim final rule sets forth the specific assumptions upon which these lifetime income payments would be based.

    The first assumption is the annuity commencement date, which is the last day of the statement period. For example, if the annual disclosure was included with the fourth quarter statement, the annuity starting date would be December 31. Second, the assumed age on the annuity starting date is 67, which was chosen because it is the Social Security full retirement age of most workers. However, for participants older than age 67, their actual age must be used instead.

    The third assumption focuses upon the specific characteristics of the SLA and QJSA benefits for purposes of the illustrations. The SLA benefit must reflect a single life annuity, which will pay a fixed monthly amount for the life of the participant, with no survivor benefit upon the participant’s death. The QJSA benefit assumes that all participants have a spouse of equal age and provides a 100% survivor annuity, so the same fixed monthly amount would continue for the life of the participant or surviving spouse upon the participant’s death.

    Fourth, the assumed interest rate is the 10 year constant maturity Treasury rate, which was selected because it approximates the rates used by insurers for immediate annuities. Finally, the assumed life expectancies are to be based upon gender neutral mortality tables that are currently used by defined benefit pension plans to determine lump sum payments.

    Explanations must also be provided to participants that describe how the illustrative payments were calculated and that emphasize the portrayed estimates are not guarantees. Model language is provided for this purpose. Plan administrators can either insert the eleven model provisions into their existing statement formats or attach one of the Model Benefit Statement Supplements as an addendum.

    Significantly, the rule provides ERISA liability relief to plan sponsors and fiduciaries for providing lifetime income illustrations that conform to the specified requirements. This relief was intended to address sponsor concerns of potential participant lawsuits if their actual monthly payments at retirement were less than the statement projections.

    Defined contribution plan sponsors should be aware of the interim final rule’s requirements and consult with their service providers regarding incorporation of the disclosures in participant benefit statements. The rule is effective one year from publication in the federal register and applies to benefit statements provided after such date.

    Interim Final Rule »
    Fact Sheet »

    Source: NFP BenefitsPartners

    Filed under: Abentras Blog

    IRS Updates Employer Shared Responsibility Questions and Answers

    Employer Shared Responsibility Q&As On August 19, 2020, the IRS updated its guidance on the employer mandate (also known as employer shared responsibility).

    The Q&A updates reflect index adjustments to penalties and the affordability percentage for calendar year 2021. The employer shared responsibility payment, which is the penalty an applicable large employer must pay if it does not offer minimum essential coverage to at least 95% of its full-time employees, is now the product of $2,700 (which is up from $2,570 in 2020) multiplied by the number of full-time employees employed for the calendar year. The penalty for failing to offer affordable coverage or coverage that does not provide minimum value, which is computed separately for each month, is the product of $4,060 (up from $3,860 in 2020) multiplied by the number of full-time employees who received premium tax credits in that month. The update also confirms that the percentage used to determine whether coverage is affordable (the affordability threshold) for plan years beginning in 2021 is now 9.83% (up from 9.78% for plan years beginning in 2020).

    As a reminder, the draft 2020 versions of the ACA employer shared responsibility reporting forms were discussed in the July 21, 2020, edition of Compliance Corner.

    Employers should be aware of these updates when determining premiums for 2021 and preparing their employer shared responsibility reporting forms for the calendar year 2021.

    Source: NFP BenefitsParters

    Filed under: Abentras Blog

    Stolen Laptop Leads to $1M Settlement for HIPAA Covered Entity

    Lifespan Health System Affiliated Covered Entity (Lifespan ACE), a Rhode Island based non-profit health system comprised of hospitals and other healthcare providers, agreed to pay $1,040,000 to HHS’s Office of Civil Rights (OCR) and to implement a corrective action plan in order to resolve an investigation into potential violations of HIPAA. The investigation arose from the theft of an unencrypted laptop.

    Specifically, in April 2017, an affiliated hospital employee’s laptop was stolen. The laptop reportedly had the electronic protected health information (ePHI) of over 20,000 individuals including patient names, medical record numbers, and medication information. The breach was reported to OCR, which oversees enforcement of the HIPAA Privacy and Security rules.

    OCR’s investigation found a failure to encrypt ePHI on laptops after Lifespan ACE’s internal polices had determined encryption was reasonable and appropriate. There also wasn’t a business associate agreement in place with Lifespan ACE’s parent company and business associate, Lifespan Corporation.

    The breach resulted in a settlement in which Lifespan ACE agrees to pay OCR $1,040,000, implement encryption within 90 days, revise its policies and procedures, and be monitored by OCR for two years.

    OCR Director Roger Severino cautioned “laptops, cellphones, and other mobile devices are stolen every day, that’s the hard reality. Covered entities can best protect their…data by encrypting mobile devices to thwart identity thieves.”

    Employer plan sponsors should review their policies and procedures for compliance. While encryption is still not required of covered entities or business associates, employers should consider it as an effective defense against a breach of privacy information.

    OCR Press Release »
    Resolution Agreement »

    Source: NFP BenefitsPartners

    Filed under: Abentras Blog