Last week the Department of Health and Human Services, DOL and the IRS extended deadlines for multiple items related to health plan administration.  We don’t expect a huge influx of issues from the changes.  However, you should be aware so you don’t inadvertently misinform your employees.    

There were changes made regarding COBRA premium payments and election timeframes but since we have addressed those in a previous post, we won’t address it here.  COBRA administration is outsourced and those impacted are no longer employees so you can direct their questions to your COBRA administrator or to our office.  We’ll also skip the changes made to claims and appeals as that won’t apply to everyone.  That leaves the changes to your benefit program. 

As you are aware, most of the carriers have reduced or even eliminated the minimum number of hours a previously full-time employee must work to be covered by your plan.  Meaning, we can offer coverage to furloughed employees or those that have otherwise reduced hours to below the full-time requirements. 

In addition, the agencies, have decided to disregard the Outbreak Period (the time period between March 1st and at least 60 days after the announced end of the COVID 19 National Emergency) when establishing a deadline to request enrollment in coverage for certain qualifying events.  Meaning, the agencies, added a “pause” to the time frame required for employees to notify you about special enrollment periods, such as marriage or birth of a child.  We are not able to determine the exact end date of the Outbreak Period yet as that is based on an end to the National Emergency (and that had yet to be determined). 

For our examples, we’ll assume the COVID 19 National Emergency ends for the country on June 30th.  This would make the Outbreak Period March 1st to August 29th (60 days following June 30). 

Example 1 – Sally has a baby on March 3rd.  Normally, she would have 30 days to notify us that she would like to add the baby.  However, you are being instructed to disregard the Outbreak Period, therefore she has until September 28th (30 days from the end of the Outbreak Period) to let us know her desire to add her child.

Example 2 – Tom gets married June 1st.  He will have until September 28th to let us know if he intends to enroll his spouse. 

Under these examples, the dependents would be enrolled back to their original eligibility date and the employee would owe those back premiums.  I don’t expect this to become a big issue, however, depending on the employees circumstances it could.  The drawback to employers, other than the inconvenience, is this could have an impact on the group claims.  Normally Tom and Sally would only have 30 days to enroll their dependents.  With the extensions, employees have information about any issues or medical expenditures that have already happened along the way.  Carriers will be responsible to back up, enroll the dependent, and pay any claims incurred. 

Please let us know of any questions you have. 

Employers Get EEO-1 Reporting Reprieve In 2020

May 08 - Posted at 10:05 AM

Employers across the country got a bit of good news today as the federal government announced that the EEO-1 reporting process would be delayed by a year, with the next reporting deadline pushed to March 2021. You are now temporarily spared from having to submit the annual EEO-1 report which requires businesses to submit employment data related to race, ethnicity, gender, and job category. Specifically, your 2019 EEO-1 reports, which we had expected to be due by March 31, 2020 (but which employers could not submit because the portal was not available) are now officially postponed. What do you need to know about this development?

What Happened?

This announcement from the Equal Employment Opportunity Commission (EEOC) acknowledges that the nation’s employers are dealing with “unique and urgent” issues related to the COVID-19 pandemic. “The EEOC recognizes the impact that the current public health emergency is having on workplaces across America and the challenges that both employers and employees alike are now facing,” the announcement said. “Delaying the collections until 2021 will ensure that EEO filers are better positioned to provide accurate, valid and reliable data in a timely manner.”

Employers had begun anticipating that such an announcement was forthcoming. While the filings are generally due by March 31, the EEOC had not yet opened the collection process that would have permitted businesses to submit 2019 data to the agency. Oddly, although the EEOC requested approval from the Office of Management and Budget to renew its authorization to require the reports months ago, the approval was not forthcoming, as stated on the EEO-1 report landing page. Those businesses required to turn in the EEO-1 data – employers subject to Title VII with 100 or more employees and federal contractors with 50 or more employees – were uncertain of their obligations to report the 2019 data until today’s announcement.

Who Else Is Impacted?

Besides the EEO-1, several other related data collection efforts were delayed by today’s announcement. Local unions were given a reprieve for their EEO-3 reports (which collect information on the composition for their workforces by sex and by race/ethnic category), and public elementary and secondary school districts are temporarily spared from completing EEO-5 reports.

What Should Employers Do?

The agency recommended that covered employers should begin preparing to submit EEO-1 data from 2019 and 2020 in March 2021. The announcement said that the EEOC would notify businesses of the precise date that the surveys will open as soon as possible. Those subject to the EEO-3 and the EEO-5 should expect to provide their reports in January 2021. The EEOC said it would be directly reaching out to those businesses subject to the data collection requirements to inform them of the delay, so don’t be surprised to receive a communication in the near future.

By way of reminder, the EEO-1 report no longer includes a pay data component after a September 2019 announcement from the EEOC eliminating the “Component 2” portion of the report. While it is possible that some form of pay data reporting could one day be reinstated through court order or a new streamlined rule from the EEOC, for now there is no obligation to collect and turn over compensation information as part of your annual filing. However, because state legislatures across the country will be taking it upon themselves to fill in the gap now left by the federal government, you should also make it a priority to review your current pay systems and identify and address any areas of pay disparity. Ideally, you would work with counsel to conduct this initial review under the protection of the attorney-client privilege.

May is Mental Health Month

May 07 - Posted at 9:08 AM Tagged: , , ,

Since 1949, Mental Health America and affiliates across the country have led the observance of May is Mental Health Month by reaching millions of people through the media, local events and screenings. They welcome other organizations to join in spreading the word that mental health is something everyone should care about by using the May is Mental Health Month toolkit materials and conducting awareness activities.

While 1 in 5 people will experience a mental illness during their lifetime, everyone faces challenges in life that can impact their mental health. In 2020, their theme of Tools 2 Thrive will provide practical tools that everyone can use to improve their mental health and increase resiliency regardless of the situations they are dealing with. They now believe that these tools – even those that may need to be adapted for the short term because of COVID-19 and social distancing – will be more useful than ever.

 

You can reach their full website here to download their toolkit or let us know and we can send you a copy. 

6 Factors Employers Must Consider When Taking Employees’ Temperatures

May 05 - Posted at 1:00 PM Tagged: , , , , , , , , ,

Employers may be required to take the temperatures of employees when businesses begin to reopen in the coming days and weeks following the expiration of many states’ stay-at-home orders. Screening for fevers is a task never previously undertaken by many companies. Given that many states will require or highly recommend this practice, now is the time for to consider what precautions and procedures to undertake to implement this safety measure.

You should consider these six issues when contemplating whether to take temperatures at your workplace:

  1. Do You Have To Do It?
    Unless required by a local or state order, taking temperatures is not required in most workplaces. Doing so will require extensive planning, training, and could even be quite expensive. In addition, many individuals infected with COVID-19 won’t exhibit any symptoms, and thus temperature screening likely won’t prevent all workers who can transmit the disease from entering your worksite.

    Although the CDC recommends screening employees for fevers of more than 100.4 degrees Fahrenheit, keep in mind some states make recommend different thresholds. If you decide to screen your employees, also plan to check the temperatures of guests, clients, vendors, and contractors to ensure a safe work environment.

  2. Training And Personal Protective Equipment For Those Taking Temperatures
    The safety of all employees is paramount, but those administering temperature screenings will be especially vulnerable to hazards. If you require employees to be within six feet of any individual who may have COVID-19, the Occupational Safety and Health Administration (OSHA) recommends that they wear personal protective equipment (PPE) consisting of some combination of gloves, a gown, a face mask, and/or a face shield or goggles.

    The screening employees should also be trained on the required PPE under OSHA’s PPE standard. You should also prepare a job hazard assessment and PPE certification related to the screening. To the extent that screeners may also be exposed to bloodborne pathogens (BBP), such as mucous or saliva, you should ensure they are properly trained under OSHA’s BBP standard – which requires employers to prepare an exposure control plan.

    Keep in mind that, where not required by a local or state order, the CDC allows employers to screen employees for COVID-19 symptoms, including a fever, without ever touching or interacting with them. You can do so by standing more than six feet away and asking the employee to confirm they don’t have a temperature and making a visual inspection of the employee (e.g., looking for flushed cheeks or fatigue). Only under this method could the employee screener not be required to wear PPE.

  3. Maintaining Social Distancing
    Not only should screening employees be protected, safety measures should also be taken for workers waiting in line to be screened. This includes ensuring employees stand six feet or more from each other while they wait to have their temperature taken.

  4. Logistics
    You may have to screen 50 or more employees prior to the beginning of each shift. This likely will cause delays and create disruption to normal production activities. Be prepared to create outdoor waiting areas (e.g. tents and other temporary structures) where employees must be in lengthy lines prior to entering the facility. Employee privacy, especially where screening takes place and results are announced, should be accounted for during this time.

  5. Privacy Concerns
    Employee privacy concerns will be prevalent during the employee screening process. The Equal Employment Opportunity Commission (EEOC) has cautioned that employers can ask employees if they are experiencing symptoms of COVID-19, including taking their temperatures, provided that all biomedical information is maintained as a confidential medical record, and separate from the employee’s personnel file. Some states, such as California, require employers to provide a notice to all employees prior to screening them for biomedical data.

    For many businesses, maintaining employee privacy can be challenging as you may not have the experience or knowledge to ensure compliance. To mitigate these issues, and if not required by a governmental order, avoid collecting or storing an employee’s biomedical information to the extent possible. Instead, use an instantaneous-reading thermometer and show the employee their temperature simultaneously with the screening.

  6. Wage Issues
    Keep in mind that employees may claim that their time waiting in line or being screened for a fever before their shift is compensable and thus they should be paid for it. Although no case law or Department of Labor guidance on point currently exists on this topic, it is recommended that you err on the side of paying employees throughout the screening process. This also requires you to implement a system to have employees “clock in” when they get in line for screening and to document their time.

What Should Employers Do?

As you begin the process of reopening, you may want to familiarize yourself with several pieces of information: 

For a more thorough analysis of the many issues you may encounter from a labor and employment perspective, we recommend you review  FP BEYOND THE CURVE: Post-Pandemic Back-To-Business FAQs For Employers and FP Resource Center For Employers.

DOL and IRS Announce Emergency COVID-19 COBRA Rules

May 04 - Posted at 10:49 AM Tagged: , , , , , ,

On April 29, 2020, the Department of Labor (DOL) and the Internal Revenue Service (IRS) announced in a Notice a “pause” in the timelines that affect many COBRA and HIPAA Special Enrollment Period timelines during the National Emergency due to the COVID-19 pandemic.

The National Emergency declaration for COVID-19 was issued on March 13, 2020, and as of the date of this writing, is still in effect. However, for purposes of COBRA in the eyes of the DOL, the “pause” date is set to begin on March 1, 2020. According to the Notice, the period from March 1 through 60 days after the date the National Emergency is declared ended is known as the “Outbreak Period.”

COBRA Timeline Changes During National Emergency

Normally, group health plan Qualified Beneficiaries (QBs) have 60 days from the date of a COBRA qualifying event to elect COBRA coverage, or in the case of a second COBRA qualifying event, to make a new COBRA election. Once a COBRA election is made, the first payment (going back to the date of the COBRA qualifying event) is due no more than 45 days later. After that, plan sponsors must allow at least a 30 day grace period for late COBRA payments.

According to the Notice, all of these timelines are affected. The 60-day election “clock” is paused beginning March 1, 2020 or later until the the end of the Outbreak Period. Similarly, the 45-day first payment “clock” is also paused during the Outbreak Period, as is the 30-day grace period for making COBRA payments.

Example

ABC Company’s group health plan is subject to COBRA continuation coverage. Jane Jetson and her family are covered under ABC’s group health plan. On February 1, 2020 Jane terminates employment at ABC, and on February 5th, Jane receives her COBRA election notice informing her she has 60 days from February 1st to make an election. Normally, that election period would end on April 1, 2020, 60 days from February 1st.

However, with the new DOL/IRS Notice, the “pause” button on the 60 day election period was hit on March 1st, the beginning of the Outbreak Period, so the 60 day clock stops at 29 days and doesn’t resume until the end of the Outbreak Period.  For sake of this example, let’s assume the National Emergency declaration is lifted on May 31, 2020. On July 30, 2020, 60 days after May 31st and thus the end of the Outbreak Period, the “pause” button is lifted and the COBRA election clock restarts for another 31 days to complete the 60 day COBRA election period, which now would end on August 30, 2020.

Continuing with the example and assumptions, if Jane did make her COBRA election to continue coverage on August 30th (the last day to do so), the 45 day clock to make the first payments back to February 1st would begin, and she would have to make all seven months’ payments by October 14, 2020. Of course, by that date she’d also owe payments for September and October as well, although she’d be in the middle of the grace period for October.

HIPAA Special Enrollment Period

Similarly, the 30 day HIPAA Special Enrollment Period (SEP) for qualified changes of status that impacts group health plan enrollment changes is also “paused” until after the end of the Outbreak Period.

Example

Homer Simpson also works for ABC Company, and has elected not to participate in ABC’s group health plan since he has coverage through his spouse Marge’s employer’s group health plan at XYZ Company. On March 15, 2020, Homer and Marge have a baby named Bart, and decide that Homer would like to cover his entire family under ABC’s plan. In normal times, Homer would have 30 days from the date of Bart’s birth to enroll in ABC’s group health plan utilizing the HIPAA SEP.

However, under the DOL/IRS Notice, that 30-day clock is on “pause” until the end of the Outbreak Period. Using the same assumption in the example above, that clock would start on July 30th, and Homer would have until August 30th to enroll his entire family.

Action Items for Plan Sponsors

Plan sponsors will need to pay close attention to this Notice and make proper adjustments in their established COBRA and HIPAA procedures to accommodate it. 

Congratulations to Luann Player!

May 01 - Posted at 10:30 AM Tagged: , , , ,

We are excited to announce the promotion of Luann Player to Vice President of Administrators Advisory Group.

Luann has been with the company for 16 years. While still in college, she quickly advanced from a marketing intern to an insurance and claims specialist and later took on the responsibility as VP of Operations, including overseeing the complete annual renewal process for all clients. She has an immense eye for detail and her passion to get things rights for our clients is unmatched. Luann has been able to play a key role in the company while working remote for AAG from far away places like Hawaii, Texas, and even South Korea!

She has always played a pivotal role at AAG and we are so proud of her growth and accomplishments. Please join us in congratulating Luann!

Florida Governor Amends Safer-At-Home Order And Announces Plan To Reopen State

April 30 - Posted at 3:05 PM Tagged: , , , , , , ,

Florida Governor Ron DeSantis just extended his Safer At Home Order for the State of Florida but announced his plan to gradually re-open the state pursuant to a new Order that will go into effect just after midnight (at 12:01 am) on the morning of May 4, 2020. The new Order initiates the first of three phases to re-open every county in Florida except for Miami-Dade, Broward and Palm Beach counties. Additionally, local governments in Florida will also be able to have more restrictive policies in place if they desire. What do Florida employers need to know?

Essential And Non-Essential Businesses Are Permitted To Operate Pursuant To CDC And OSHA Guidelines

The new Order permits all services and activities currently allowed under the previous Safer-at-Home Order. Any non-essential businesses that were not previously permitted to be open can reopen as long as they also follow CDC and OSHA guidelines. However, The Order contains the following industry specific restrictions:

  • Schools: Schools will remain closed during Phase One and can continue conducting distance learning.
  • Healthcare: Hospitals and senior living facilities are prohibited to have visitors, and those interacting with residents and patients must adhere to strict protocols regarding hygiene. However, elective surgeries can resume, as clinically appropriate at facilities that adhere to Centers for Medicare & Medicaid Services (CMS) guidelines. Additionally, any facility that performs elective procedures must be able to immediately convert for treatment of COVID-19 patients in a surge capacity situation, must have adequate PPE, has not sought government assistance regarding PPE supplies since resuming elective procedures, and has not refused to provide support to and proactively engage with skilled nursing facilities, assisted living facilities, and other long term care residential providers.
  • Hospitality: Sit-down dining establishments can operate at 25% occupancy under strict physical distancing protocols. However, bars will remain closed.
  • Retail: Storefronts may operate at no more than 25% of their building occupancy.
  • Museums and libraries: Can operate at no more than 25% of their building occupancy if permitted by local government. Also, any interactive functions or exhibits including child play areas must remain closed.
  • Miscellaneous: Gyms, movie theatres, and professional services (such as hair salons and barbershops) will remain closed.

Every business is required to continue to follow guidelines issued by the CDC and OSHA. These guidelines include:

  • Promoting healthy hygiene practices;
  • Intensifying cleaning, disinfection (e.g., small static groups, no large events);
  • Avoiding non-essential travel, and encouraging alternative commuting and telework;
  • Spacing out seating (more than 6 feet) and staggering gathering times;
  • Restricting use of any shared items and spaces; and
  • Training all staff in above safety-actions.

The CDC also recommends that businesses only reopen after they have implemented safeguards for the ongoing monitoring of employees, including:

  • Encouraging employees who are sick to stay home;
  • Establishing routine, daily employee health checks;
  • Monitoring absenteeism and having flexible time off policies;
  • Having an action plan if a staff member gets COVID-19;
  • Creating and testing emergency communication channels for employees; and
  • Establishing communication with state and local health authorities.

Senior Citizens And Individuals With Significant Underlying Medical Conditions

The Order strongly encourages individuals who are older than 65 and those with significant underlying medical conditions to stay at home. They should take all measures to limit the risk of exposure to COVID-19 such as wearing masks during face-to-face interactions. Additionally, the Order encourages individuals to avoid socializing in groups of more than 10.

Social Distancing And Other Guidelines

Additionally, all persons in Florida should practice social distancing, avoid nonessential travel, and adhere to guidelines from the CDC regarding isolation for 14 days following travel on a cruise or from any international destination and any area with significant presence of COVID-19. The Order also extends Governor DeSantis’ Orders regarding airport screening and isolation of individuals traveling to Florida. Notably, there is an exception for these orders for persons involved in military, emergency, health or infrastructure response or involved in commercial activity.

Criminal Penalties

A violation of the Order is a second-degree misdemeanor which is punishable by imprisonment not to exceed 60 days, a fine not to exceed $500.00 or both.

What Does This Mean For Employers?

Employers with operations in Florida should review the CISA guidance and Miami-Dade County Emergency Order 07-20, and its amendments, to determine if they are deemed essential or non-essential.  

Before reopening, you should have a thorough plan in place to establish a safe and healthy workplace and share that plan to provide employees peace of mind. You should also be prepared to address concerns from older employees and those with underlying significant health conditions regarding whether or not they must come in to work. You should also carefully assess the availability of telework for these employees.

As you begin the process of reopening, you should familiarize yourself with some useful info: 

FAQs For Employers Navigating Relaxed I-9 Verification Requirements

April 28 - Posted at 10:00 AM Tagged: , , , , ,

Although the Department of Homeland Security (DHS) recently relaxed I-9 requirements for employers operating remotely as a result of the COVID-19 crisis, employers are still left with some questions on how to meet their obligations in this uncertain time. 

The Basics: What Are The New Rules?

Under federal guidance, employers are temporarily no longer be required to review an employee’s identity and work authorization documents in the employee’s physical presence.  Instead, inspection of these documents can be conducted remotely (e.g., by video, fax, or email).  

According to the U.S. Citizenship and Immigration Services (USCIS), “if employers are performing inspections remotely (e.g., over video link, fax or email, etc.) they must obtain, inspect, and retain copies of the Section 2 documents within three business day of hire. In addition to completing Section 2, Employers also should enter ‘COVID-19’ in the Additional Information field.”

Then, when “normal operations resume,” all employees whose documents were presented via remote verification must, within three business days, undergo the required “in-person” examination of documents. The person conducting the physical examination should write the words “documents physically examined” in the Additional Information box in Section 2, and should include their name and the date of inspection.  

It is important to keep in mind that the DHS’s relaxed requirements apply only to employers who are operating remotely. According to the guidance, if there are employees physically present at a work location, then you must follow the normal in-person physical inspection rules. However, if newly hired employees or existing employees of an employer who still has employees present at a work location are subject to COVID-19 quarantine or lockdown protocols, “DHS will evaluate this on a case-by-case basis.”

Frequently Asked Questions About The New I-9 Guidance

While employers appreciate the DHS’s temporary relaxation of the in-person document inspection rules, some questions are not addressed by either DHS or USCIS. Here are the most common questions we have seen and the best practices to follow.

  1. How is an employee expected to fill out Section 1?
    The announcement makes clear that employees are still required to fill out their section (Section 1) of the I-9 no later than the first day of employment. But DHS’s announcement is silent on how employees will complete Section 1 of the I-9 if they are operating remotely.

    You can presumably email the Form I-9 to the employee, have the employee complete Section 1, sign, date, scan and email the completed Section 1 back to you. For employees without a home printer and/or scanner, you should consider having them provide Section 1 in the same way they provided their documents (by video, smart phone photo, fax or other electronic method).

    Once operations resume, the employee should bring the original signed Section 1 to your worksite.

  2. If we have a policy of not keeping copies of documents presented as part of the I-9 process, what should we do with our copies of the remotely provided documents after the in-person inspection occurs?
    As noted, the announcement clearly requires employers conducting remote document reviews to keep copies of the documents provided to them (for example, by taking screen shots, pictures of the documents by camera phone, and other methods). But the announcement is silent as to what you should do with those electronic copies of documents after the in-person document review, in the event you do not, as a policy, keep copies of documents submitted as part of the I-9 process.

    The safest course of action is to print out the electronic copies of documents received remotely. But instead of keeping them with the employee’s I-9, keep them in a separate file until DHS clarifies what should be done with them.

  3. Is the employee required to bring in hard copies of the same documents they provided remotely?
    The government has made it clear that you are not supposed to request or even suggest that employees provide any specific document or documents when filling out a Form I-9. Here, the announcement seems to assume employees will bring in for inspection the same document or documents they provided remotely, but does not specifically say so. 

    Because the employee has already made their choice of documents when they provided them remotely, DHS may find it reasonable for you to ask to see hard copies of the same document(s). If the employee refuses or has lost one or more of those document(s), you may consider filling out a new Section 2 and attaching it to the original Section 2, with a brief explanation in the Additional Information field.

  4. What triggers the determination that “normal operations” have resumed?
    The announcement states that within three business days after you resume “normal operations,” the in-person document review must occur. But what if you implement a partial resumption of operations, scaled back operations, or even just start a test run of operations?  What if you call some of your employees in to your worksite in preparation for returning to normal operations? 

    The recommended approach is to determine if the employee is going to be required to physically come into the office as part of the resumption of operations, whether to attend orientation, pre-employment training, or other reason. If the employee is scheduled to come in to the workplace for only a day or two, or even for only a few hours, you should instruct them to bring their original I-9 document(s) with them, and you should conduct the in-person inspection at that time. 

    In short, rather than bank on an argument that Section 2 was not filled out late because “normal operations” had not yet commenced, you should err on the side of doing the document inspection as early in the process as possible (on a case-by case basis), rather than later.

10-Point Plan To Protect Your Business From Zoom-Bombs And Other Videoconferencing Privacy Concerns

April 27 - Posted at 3:35 PM Tagged: , , , , , , , , ,

The COVID-19 pandemic has caused many employers now operating remotely to conduct meetings via video conference – which has created a whole new set of various privacy and cybersecurity concerns. While these remote work tools have facilitated a more personal connection and interactive experience, their use is fraught with privacy concerns you may never have before considered. If your organization is weighing its options or unaware of the risks these services may create, this article provides a 10-point plan to protect your personal and confidential information and ensure you remain compliant with various federal and state privacy laws.  

The Risks of Video Conferencing       

Before diving into the blueprint for compliance, it is first helpful to understand the three main risks of video conferencing.

“Zoom-Bombing”

Since the start of the COVID-19 public health emergency, the FBI has noted a substantial increase in the number of businesses and schools reporting instances of video conference “hijackings” (also known as “Zoom-bombings”). During these hijackings — which generally occur where a video conference link is shared over social media or is not password-protected — uninvited participants have disrupted meetings by interjecting inappropriate language or displaying hateful or pornographic images into business meetings.

Aside from unwanted disruptions, uninvited interlopers pose a more serious threat. Those that choose to remain undetected could lead to the unauthorized disclosure of personal or confidential information.

Insufficient Or Non-Existent Encryption

Many video conferencing companies tout their services’ encryption capabilities. However, these claims should be closely scrutinized. By way of example, the video conferencing platform Zoom has indicated that hosts may “enable an end-to-end (E2E) encrypted meeting.” This was reportedly proven to be untrue. The company was supposedly able to access user data and video conferences in transit and it was reported that it could be compelled to provide access or information to the government if such a request was made.

Additionally, the storage of recorded video conferences creates other issues. Thousands of Zoom conference recordings were recently found on an unsecured online storage platform. Prior to Zoom restricting access to their storage location, anyone with an internet connection could access the private and confidential meetings of countless users. Likewise, if your business does not store its recorded conferences in a secure manner, there is a substantial possibility that an unauthorized individual may gain access to their contents.

Inadequate Privacy

Video conferencing raises privacy issues on two fronts. First, according to a recent California class action lawsuit, video conferencing providers may be improperly using their subscriber’s data. Specifically, as alleged in the suit, California’s privacy law and other state statutes may have been violated if users’ personal information was shared with Facebook without the users’ consent.

End-users may also create privacy issues. Among other things, confidential information may be mistakenly divulged if an employee shares their screen while such information is visible. If an end-user participates in a video conference in a public space, everything that is said and displayed during the conference is disclosed to those around them. Moreover, if an end-user records or takes screenshots of images displayed during the meeting, those items may be improperly disseminated.

Legal Consequences Of A Video Conferencing Breach

If you or your video conference provider has inadequate privacy and cybersecurity policies or procedures, your business may inadvertently run afoul of various federal and state laws. Among other laws, the unauthorized disclosure of your employees’ personal and confidential information may violate:

  • The Health Insurance Portability and Accountability Act (HIPPA) (prohibiting the disclosure of sensitive patient health information without a patient’s knowledge or consent);
  • California’s Consumer Privacy Act (CCPA) (regulating the access to, deletion of, and sharing of personal information collected by businesses); and
  • The European Union’s General Data Protection Regulation (GDPR) (a wide-ranging law that governs how companies collect and manage data).

10-Point Plan To Prevent Video Conferencing Disasters

To avoid potential video conferencing related privacy or cybersecurity breaches when using Zoom or similar platforms, your business should consider employing the following practices:

  1. Review your conference provider’s privacy policy and user agreement. Also ensure you have the most recent version of your video conference provider’s software before you launch a new meeting.
  2. Ensure that your conferences are set as private, not public.
  3. Require passwords for all meetings. And while this seems simplistic, do not post passwords (or meeting links) to social media.
  4. If available, create a waiting room that allows the conference host to individually admit participants. Review all meeting attendees before starting the conference and remove uninvited participants who gain access to the meeting. Once all expected attendees have joined, lock the meeting.
  5. Limit who may share their screen.
  6. Disable cameras and/or mute non-presenting conference participants, and consider disabling private chat.
  7. Prevent attendees from changing user names to conceal identities.
  8. Ensure no confidential or personal information is visible before sharing your screen.
  9. Instruct all participants to refrain from recording or screenshotting any information shared during the meeting.
  10. Review (and if necessary, create or revise) your company telework and IT policies to ensure that employees are aware of the steps they must take to keep the personal and confidential information they possess secure.

Conclusion

In the wake of the COVID-19 pandemic, many employers are relying on video conferencing platforms to conduct meetings and providing remote educational instruction. While Zoom and other video conferencing platforms can provide a valuable interactive experience while social distancing, it is important to educate employees on potential privacy and cybersecurity risks. You must require them to adhere to best practices to ensure the security of remote meetings, protect the privacy of participants, and reduce the risk of intervention by unwanted participants.

Recording Available for AAG’s 2020 Education Seminar

April 23 - Posted at 4:20 PM Tagged: , , , , , ,
The recorded presentation of AAG’s 2020 Educational Seminar on April 23, 2020 is now available for viewing.

Guest Speaker and attorney Keith Hammond, with Hammond Law Center, covered the impact of COVID-19 on businesses in relation to the Families First Coronavirus Response Act (FFCRA) as well as the Emergency Leave Act and CARES Act.

This seminar is also approved for 2 Professional Development Credits (PDCs) with SHRM for all attendees.

Please contact our office for the link to view the presentation or the Activity ID for the PDCs.
© 2024 Administrators Advisory Group, Inc. All Rights Reserved