One Way Or Another: Trump NLRB Coming at Joint-Employer Standard from New Angle

President Trump’s newly constituted National Labor Relations Board (NLRB) made waves at the end of last year when it issued a slew of significant decisions, including one that overturned an Obama NLRB decision that relaxed the standard for finding “joint-employment” status between two or more companies.

Many employers celebrated the overturning of the Obama board joint-employer decision, but that celebration was short lived because the NLRB’s inspector general issued a report earlier this year finding that one of the board members who participated in the decision may have had a conflict of interest related to the case. That report caused the agency to roll back the decision and reinstitute the Obama-era joint-employer standard.

Good news for employers: NLRB Chairman John Ring recently announced that the agency is considering rulemaking to modify the standard the board uses when evaluating whether joint-employment exists. In the press release, Ring states: “Whether one business is the joint employer of another business’s employees is one of the most critical issues in labor law today … The current uncertainty over the standard to be applied in determining joint-employer status under the Act undermines employers’ willingness to create jobs and expand business opportunities. In my view, notice-and-comment rulemaking offers the best vehicle to fully consider all views on what the standard ought to be. I am committed to working with my colleagues to issue a proposed rule as soon as possible, and I look forward to hearing from all interested parties on this important issue that affects millions of Americans in virtually every sector of the economy.”

The NLRB historically has preferred setting U.S. labor policy through adjudication of specific cases versus through the rulemaking process, but the Obama board broke from that practice in 2015 when it issued its infamous “ambush election rule.”

It appears the Trump NLRB will be altering the agency’s standard for imposing joint-employment soon – one way or another. Stay tuned.

© 2018 BARNES & THORNBURG LLP
This article was written by David J. Pryzbylski of Barnes & Thornburg LLP

DHS Issues Cybersecurity Strategy

The Department of Homeland Security (“DHS”) released its cybersecurity strategy on May 15, 2018.  The 35-page document sets forth a plan for managing cybersecurity risks through public and private sector collaboration.  By 2023, DHS seeks to have “improved national cybersecurity risk management by increasing security and resilience across government networks and critical infrastructure; decreasing illicit cyber activity; improving responses to cyber incidents; and fostering a more secure and reliable cyber ecosystem through a unified departmental approach, strong leadership, and close partnership with other federal and nonfederal entities.”  The strategy document is broken into five pillars:  risk identification; vulnerability reduction; threat reduction; consequence mitigation; and enable cybersecurity outcomes.  DHS assures that it “will maintain a leadership role, collaborating with other federal agencies, the private sector, and other stakeholders, across all of its cybersecurity mission areas to ensure that cybersecurity risks are effectively managed, critical networks are protected, vulnerabilities are mitigated, cyber threats are reduced and countered, incidents are responded to in a timely way, and the cyber ecosystem is more secure and resilient.”

© Copyright 2018 Murtha Cullina
This article was written by Dena M. Castricone of Murtha Cullina

ERISA’S New Claims and Appeals Procedures for Disability Benefits Claims

“It’s a New Dawn; It’s a New Day; It’s a New Life for Me; and I’m Feeling [not so] Good”

While Nina Simone’s song captures the power of “feeling good,” the effects of an employee’s disability do not feel good for the employee or employer. And if your organization offers employee benefits that require the plan administrator to determine whether a plan participant is disabled, you should confirm that your plans reflect updated claims and appeal procedures.  Regulations finalized back in 2016 are now in effect.

“This Old World is a New World for Me”

Under ERISA, a federal law that applies to most benefit plans that are offered by an employer to its employees, the plan administrator is required to adopt reasonable procedures to govern how participants file claims and appeals, when and how such claims and appeals will be reviewed, and how notification of denials will be provided. The requirements have changed over the years.  Most recently, in December 2016, the U.S. Department of Labor (“DOL”) published a final regulation that revises requirements that apply to disability benefits.  Although the new regulation was final in January 2017, with the change in presidential administration, the DOL delayed its effective date pending consideration of its effects.  Many wondered if this delay would eventually lead to its withdrawal.  However, the DOL announced in 2018 that no further delays would be adopted.  As a result, the final regulations apply to claims involving disability determinations that are filed in ERISA plans on or after April 1, 2018.

“And a Bold World for Me”

The final regulations specifically adopt procedural changes to make the rules for disability claims and appeals more similar to the rules for group health plan claims and appeals. The new rules require changes in operations as well as changes in plan communications.  For instance, if there is new evidence or a new rationale presented on appeal, the claimant may affirmatively respond to the new evidence or rationale before the determination on appeal is made.  If a determination is made that differs from the views of the Social Security Administration or the claimant’s experts, the denial notice should address the difference. And depending on where a claimant lives, the plan may be required to provide notices and disclosures in a culturally and linguistically appropriate manner.  This can include taglines that indicate how to access non-English language assistance; offering a telephone customer assistance hotline that answers questions and provides assistance in filing claims and appeals in a non-English language; and upon request, translating notices into a non-English language.

The stakes for noncompliance are high. Some errors may permit a claimant to request a court’s review without first being required to exhaust the plan’s claim and appeal procedures.  Typically, an ERISA plan is permitted to require a claimant to exhaust the plan’s claims and appeals procedures.  Doing so supports Congress’s desire to permit a plan administrator to exercise its discretion in interpreting and applying plan language.  The potential to shift decision-making power from a plan administrator to a reviewing court emphasizes how important it is for plan sponsors to have their plans reviewed by experienced benefits counsel to ensure compliance.

© Steptoe & Johnson PLLC. All Rights Reserved.
This article was written by Jamie L. Leary of Steptoe & Johnson PLLC

FCC Streamlines Wireless Environmental Review Process—Part 1: FCC Exempts Wireless Small Cells from Environmental Review Requirements

A high FCC priority is to streamline broadband deployment including the wireless infrastructure necessary to provide service to the public. One FCC proceeding directed to that objective was initiated in April 2017 with a Notice of Proposed Rulemaking (NPRM), Notice of Inquiry (NOI), and Request for Comment (RFC) regarding Accelerating Wireless Broadband Deployment by Removing Barriers to Infrastructure Investment.

The NPRM addressed Pole Attachments, Expediting Copper Retirement, and Streamlining the Section 214(a) Discontinuation of Service process. The NOI addressed possible prohibition of state and local laws inhibiting broadband deployment and pre-emption of state laws governing copper retirement. The RFC addressed common carrier discontinuation of service issues unrelated to wireless infrastructure and the environmental review process.

In November 2017 the FCC adopted a (first) Report and Order (R&O). It concluded that in specified circumstances “replacement of a pole that was constructed with a sole or primary purpose other than supporting communications antennas with a pole that will support such antennas would have no potential to affect historic properties.”  Accordingly, it excluded replacement utility poles from required review under Section 206 of the National Historic Preservation Act (NHPA) if specified conditions are met. Please see my December 5, 2017 blog entry “Is the Road to 5G Paved with Federal and State Pre-emptions of Local Authority?” for a summary of those conditions.

In March 2018, the FCC adopted a Second R&O. In it, the FCC excluded small wireless facilities from National Historic Preservation Act (NPHA) and National Environmental Policy Act (NEPA) review under specified circumstances and also streamlined NHPA and NEPA review for larger wireless facilities. The FCC stated that these actions will make a real difference in promoting U.S. leadership in 5G and can cut the costs of deployment by 80%, trim months off deployment timelines, and incentivize thousands of new wireless deployments thus expanding the reach of 5G and other advanced wireless technologies in the U.S.

The FCC concluded that deployment of small wireless facilities by non-Federal entities do not require historic preservation review under NHPA nor environmental review under NEPA because such deployments are neither an “undertaking” (NHPA) nor a “major Federal action” (NEPA). The Second R&O noted that the FCC last considered whether some wireless facilities could be exempt from these requirements in 2004 when virtually all wireless sites were “macro” sites, but that new small cell sites are materially different in size and in their likelihood of impact on surrounding areas. The FCC concluded that conducting such reviews for small wireless sites would result in costs far exceeding benefits and that the burden would grow exponentially as ever-increasing numbers of small wireless facilities are deployed.

Here is the newly amended FCC rule that specifies the conditions for exclusion from NHPA and NEPA review for small wireless facilities:

Section 1.1312(e): Paragraphs (a) through (d) of this section shall not apply:

  1. to the construction of mobile stations; or

  2. where the deployment of facilities meets the following conditions:

(i)  The facilities are mounted on structures 50 feet or less in height including their antennas as defined in § 1.1320(d), or the facilities are mounted on structures no more than 10 percent taller than other adjacent structures, or the facilities do not extend existing structures on which they are located to a height of more than 50 feet or by more than 10 percent, whichever is greater;

(ii) Each antenna associated with the deployment, excluding the associated equipment (as defined in the definition of antenna in § 1.1320(d)), is no more than three cubic feet in volume;

(iii) All other wireless equipment associated with the structure, including the wireless equipment associated with the antenna and any pre-existing associated equipment on the structure, is no more than 28 cubic feet in volume;

(iv) The facilities do not require antenna structure registration under Part 17 of this chapter;

(v) The facilities are not located on Tribal lands, as defined under 36 CFR § 800.16(x); and

(vi) The facilities do not result in human exposure to radiofrequency radiation in excess of the applicable safety standards specified in § 1.1307(b).

These changes were adopted by the FCC on a 3-2 vote. The changes go into effect on July 2, 2018.

Part 2 will address the actions of the FCC to streamline its environmental review process for larger wireless facilities.

© 2018 Keller and Heckman LLP
This article was written by Michael T. N. Fitch of Keller and Heckman LLP

EMI options – the wait is over!

Since 6 April 2018 companies have been unable to grant new EMI options, because the existing EU state aid approval expired without fresh approval having been received.

So there has been much excitement today at the news that the EU Commission has now given state aid approval, and companies can now grant new EMI options. For companies that granted EMI options since 6 April (e.g. as part of a commercial transaction which could not be delayed) the wait continues as the EU Commission’s press release does not state the date from which their approval applies. We expect this will be indicated in the EU Commission’s formal decision, which has not yet been published. For the majority though, it’s good news and a welcome return to “business as usual”.

The state aid approval will apply as long as the UK is an EU member state, and the EU Commission has indicated that long-term approval of the EMI scheme will need to be dealt with in the EU withdrawal agreement.

© Copyright 2018 Squire Patton Boggs (US) LLP
This article was written by Liz Pierson of Squire Patton Boggs (US) LLP

PTO Releases Revised Guidance on Compliance with Mayo/Alice Rule

On April 19, the USPTO released a Memorandum from Robert Bahr, The Deputy Commissioner for Patent Examination Policy, that summarized the support required for a finding if a claim directed to a judicial exception to s. 101 eligibility under Step 2A of the Mayo/Alice analysis chart of MPEP 2106 – a natural phenomenon, an abstract idea or a product of nature [ ed. note “PAIN’]– contains an additional inventive concept that, taken alone or in combination, would not represent well-understood, routine, or conventional [“WRC”] activity. The Memorandum was prompted by the recent decision in Berkheimer v. HP, 881 F.3d 1360 (Fed. Cir. 2018).

At virtually the same time, Director Iancu released a Request for Comments on Determining Whether a claim element is [WRC] for the Purposes of Subject Matter Eligibility, and it pretty much repeats the factors listed in the Bahr Memorandum. For a detailed summary of the factual underpinnings that an examiner must make in order to support a rejection on the basis that a claim directed to a PAIN does not meet the inventive concept requirement because it is WRC, please refer to my post of April 20th.

I criticized the four factors outlined in the Memorandum/Request for using the s. 112 standard that that which is known to the art need not be set forth fully in the specification, as a blaze mark to guide examiners in determining whether the additional elements(s) in the claim are WRC. In other words, if the specification does not give the details of how to measure a biomarker, the examiner can use such facts to support a WRC finding. This relying on material not present in the specification is repeated in Factors 1, 3 and 4. I also criticized Factor 2 as permitting examiners to simply cite to “one or more court decisions discussed in MPEP 2106(5)(d)(2)” as noting the WRC nature of the additional element(s) in the claim, primarily due to the breadth of the summaries of the cases in this section of the MPEP.

The Revised Guidance in the May 8th Presentation (which is available as a slideshow from the PTO) takes these two criticisms to heart. It drops the reference to the value of a s. 112 analysis in Factors relating to the evidence of WRC provided by the specification, the disclosures in the prior art and the ability of the examiner to take official notice of the WRC, which usually will be based upon disclosures in the prior art.

The Revised Guidelines start out by stating that the examiner should conclude that a claim element(s) represents only WRC activity only if he/she can conclude that the element(s) is “widely prevalent or in common use in the relevant industry,” a conclusion that must be supported by factual determinations. Here is a quick run-down of the four “Options” that the examiner can use to demonstrate that a claim directed to PAIN does not contain more than elements that are WRC (These are mostly my words):

  1. Applicant makes a “statement against interest” in the specification or during prosecution that a claim element(s) is conventional, widely prevalent or in common use, or is a commercially available product.

  2. The examiner can cite to one or more court decisions as noting the WRC nature of the additional elements, as reported in MPEP 2106(d)(II). I criticized this as overly broad, especially in view of the fact that there is almost no case law involving diagnostic testing or methods of medical treatment. Interestingly, in Vanda v. West-Ward, the Fed. Cir. stated that the Mayo claims were diagnostic claims. This is a stretch – What condition did they diagnose? The recited patient had been treated with the drug before any sample testing was carried out. However, the revised guidelines make it clear that the additional element in the claim must be the same as the element addressed in the court case, as well as the fact that the case must be on the MPEP list. Vanda v. West-Ward should be added to this list.

  3. The examiner finds prior art publication(s) that demonstrate that the element(s) in questions are WRC, not just in existence at some point in the past. This should come from the prior art located in the search done by the Examiner or disclosed by Applicant.

  4. The examiner is permitted to take official notice of the WRC of the additional element(s) but only to be used when the examiner is certain thereof based upon his/her personal knowledge. For all but the most indisputable WRC, the examiner may be required to provide a declaration under 37 CFR 1.104(d)(2).

If more than one element is present, the examiner must show that the combination of the elements is WRC in the pertinent art. If the examiner cited to a publication not previously of record in response to an argument by applicant, the office action should not be made final.

Comments must be received by Aug. 20, 2018 by submitting them to Eligibilty2018@USPTO.gov.

 

© 2018 Schwegman, Lundberg & Woessner, P.A.
Read more updates on Mayo/Alice on the National Law Review’s Intellectual Property Page.

Federal Circuit Rules That Foreign Defendants Cannot Rely On 28 U.S.C. § 1400(b) To Challenge Venue

After the Supreme Court’s TC Heartland[1] decision reaffirmed 28 U.S.C. § 1400(b) to be “the sole and exclusive provision controlling venue in patent infringement actions,” one important question remained as to whether foreign defendants (especially foreign corporations) in a patent case may invoke that provision to challenge venue.  On May 9, 2018, the Federal Circuit denied HTC Corporation’s attempt to defeat venue based on § 1400(b), and held that provision does not provide an exception to the “long-established rule that suits against aliens are wholly outside the operation of all federal venue law, general and special.”  In re HTC Corp., No. 2018-130, slip op. at 7 (Fed. Cir. May 9, 2018).

In In re HTC Corp., HTC Corporation, a Taiwanese corporation with its principal place of business in Taiwan, petitioned the Federal Circuit for a writ of mandamus seeking dismissal for improper venue pursuant to 28 U.S.C. § 1406(a) of a patent infringement action pending against HTC Corporation in the District of Delaware.  Id. at 2.  The Federal Circuit denied the mandamus petition after finding that HTC Corporation failed to meet each of the three conditions necessary for obtaining such a drastic remedy.  Id. at 3-20.

First, the Federal Circuit found that HTC Corporation failed to demonstrate that it had “no other adequate means to attain the relief [it] desires.”  Id. at 3-7.  The Court noted that “unlike a defendant challenging the denial of a [28 U.S.C.] § 1404(a) transfer motion, a defendant aggrieved by the denial of an improper-venue motion has an adequate remedy on appeal from a final judgment,” namely, by obtaining an appellate “order vacating the judgment . . . and directing the remand of the action to the [appropriate venue].”[2]  Id. at 4-5 (citations omitted).

Next, the Federal Circuit held that HTC Corporation failed to show a clear and indisputable right to the issuance of the writ.  Id. at 7.  The Court examined two Supreme Court decisions directly addressing whether the venue laws protect alien defendants.  In In re Hohorst, the Supreme Court established what the Federal Circuit referred to as the “alien-venue rule.”  150 U.S. 653, 662 (1893) (holding that the venue restriction was “inapplicable to an alien or a foreign corporation sued here, . . . and that, consequently, such a person or corporation may be sued by a citizen of a state of the Union in any district in which valid service can be made upon the defendant”); In re HTC Corp., No. 2018-130, slip op. at 8.  Later in Brunette Machine Works, Ltd. v. Kockum Industries, Inc., the Supreme Court upheld the alien-venue rule, despite the existence of § 1400(b).  406 U.S. 706, 714 (1972) (concluding that the “broad and overriding” principle stated in then-§ 1391(d)[3] “cannot be confined in its application to cases that would otherwise fall under the general venue statutes,” as the statute merely reflected the “long-established rule that suits against aliens are wholly outside the operation of all the federal venue laws, general and special”); In re HTC Corp., No. 2018-130, slip op. at 9-10.

The Federal Circuit further rejected HTC Corporation’s contention that “§ 1400(b) should apply to it because Congress abrogated Brunette—and the alien-venue rule—through the Federal Courts Jurisdiction and Venue Clarification Act of 2011 (‘the 2011 amendments’).”  In re HTC Corp., No. 2018-130, slip op. at 10-11.  The Court noted that § 1400(b) “was not intended to supplant the longstanding rule that the venue laws do not protect alien defendants.”  In re HTC Corp., No. 2018-130, slip op. at 11; see also Brunette, 406 U.S. at 713-14 (“Since the general venue statutes did not reach suits against alien defendants, there is no reason to suppose the new substitute in patent cases was intended to do so”).  The Court then held that the recent “TC Heartland [decision] d[id] not alter this conclusion” because “while § 1400(b) governs venue in patent cases, it governs only to displace otherwise-applicable venue standards, not where there are no such standards due to the alien-venue rule.”  In re HTC Corp., No. 2018-130, slip op. at 12-13.  The Court also found no indication that Congress intended to either “modify the alien-venue rule specifically for patent cases” or “discard the well-established alien-venue rule in favor of generally bringing alien defendants, including foreign corporations . . ., within the protection of the venue laws.”[4]  Id. at 14-15.  Although abiding by the alien-venue rule may create a loophole for a plaintiff to forum shop, the Court emphasized that HTC Corporation’s argument would “create[] a far more unsatisfactory loophole—a complete inability for a patent owner to bring its infringement claims against alien defendants that fall outside the non-residence-based clause of § 1400(b).”  Id. at 19.

Therefore, the Federal Circuit determined that “[w]ith the Supreme Court having spoken on this issue twice [in In re Hohorst and Brunette], this court—without clear guidance from Congress—will not broadly upend the well-established rule that suits against alien defendants are outside the operation of the federal venue laws.”  Id.

Finally, as to the third condition of obtaining the mandamus relief, the Federal Circuit was not convinced that a writ would be warranted in this case “even if [HTC Corporation] had satisfied the first two mandamus requirements,” because HTC Corporation cited no case adopting its interpretation while “characterize[ing] this legal issue as ‘unsettled’ and resulting in ‘inconsistent’ holdings.”  Id. at 20.

Implications

  • In patent infringement actions, venue is now proper in any judicial district for foreign defendants, including foreign corporations.  The foreign defendants cannot rely on § 1400(b) or even the general venue statutes to dismiss or transfer a case pursuant to § 1406(a).
  • Depending on the particular facts in a case, foreign defendants may still seek to transfer the patent infringement action pursuant to § 1404(a).
  • In patent infringement actions against foreign defendants, plaintiffs’ ability to force foreign defendants into an unfavorable forum can give the plaintiffs additional leverage in settlement negations.

[1] TC Heartland LLC v. Kraft Foods Grp. Brands LLC, 137 S. Ct. 1514 (2017).

[2] The Court did recognize that “while an appeal will usually provide an adequate remedy for a defendant challenging the denial of an improper-venue motion, there may be circumstances in which it is inadequate.”  But the Court determined that it was unnecessary to articulate such
circumstances in this case, because HTC Corporation’s “only argument is that it should be able to avoid the inconvenience of litigation by having this issue decided at the outset of its case,” which was rejected by the Supreme Court in Bankers Life & Cas. Co. v. Holland, 346 U.S. 379, 383 (1953) (“[T]he extraordinary writs cannot be used as substitutes for appeals, even though hardship may result from delay and perhaps unnecessary trial.”).  In re HTC Corp., No. 2018-130, slip op. at 6-7. 

[3] Section 1391(d), at the time, stated that “[a]n alien may be sued in any district.” 28 U.S.C. § 1391(d) (1970).

[4] The Court noted that “Congress made only one clear change to the alien-venue rule in 2011” by “grant[ing] venue protection to alien natural persons having permanent resident status” but implemented “no comparable change with respect to foreign corporations.”  In re HTC Corp., No. 2018-130, slip op. at 13-17. 

© Copyright 2018 Brinks, Gilson & Lione
This article was written by Sen (Alex) Wang and Heidi Dare of Brinks, Gilson & Lione

Commission Overrules Xu v. Epic Systems, Finds Valid Arbitration Agreement or Waiver Bars Prosecution of WFEA Claims Before ERD

In Ionetz v. Menard, Inc., the Wisconsin Labor and Industry Review Commission overruled its previous and highly controversial decision Xu v. Epic Systems, Inc..

In Xu, the commission held that an employee cannot waive his or her right to file a discrimination complaint against his or her employer under the Wisconsin Fair Employment Act (WFEA). It further held that an employee may prosecute his or her WFEA claims on the merits against his or her former employer and that he or she can potentially receive a judgment against the former employer before the Wisconsin Equal Rights Division (ERD), even if he or she waived and released all such claims against his or her employer in a valid severance agreement. The commission based its decision on the conclusion that the ERD is an agency comparable to the Equal Employment Opportunity Commission (EEOC) and that the “language used in the severance agreement . . . was intended to preserve the complainant’s right to file a complaint with the ERD.” Also, the commission incorrectly concluded that, as with federal agencies such as the EEOC, “the complainant cannot be prohibited from . . . filing a complaint with the ERD.”

However, just months later in Ionetz, the commission overruled Xu and held that the law is just the opposite for WFEA claims before the ERDAs declared in Ionetz, “[u]nlike the broad investigative, enforcement and prosecutorial authority granted to EEOC . . . ERD’s statutory authority is limited to that of an adjudicative body charged with deciding particular disputes that are filed with it.” Also, “’unlike the EEOC . . . [ERD] has no independent ability to prosecute claims for violations of the WFEA.” Rather, according to the commission in Ionetz, the ERD’s “only statutory role in enforcing the WFEA is to adjudicate claims between employers and their employees.” (Emphasis in original)

“Consequently, where an employee has agreed to waive his or her discrimination claim against an employer, or to have it adjudicated in another forum [e.g., in arbitration], there remains no ancillary ERD authority that requires protection.” Also, “parties cannot by contract impose obligations on ERD that are inconsistent with the authority granted to it under the WFEA.” Ultimately, “the parties’ agreement to preserve the employee’s right to file a claim with the agency cannot require—or even empower—ERD to investigate or adjudicate claims that have been waived or committed to an alternate forum for resolution.”  The commission then held that ERD was without authority to advance such claims and overruled Xu.

As a result, a valid arbitration agreement or a waiver of claims in a settlement or severance agreement bars prosecution of WFEA claims before the ERD. “[O]nce the individual claim is waived (or . . . required to be submitted to another forum for resolution) there remains no additional investigative, enforcement or other function for ERD to perform.”

© 2018, Ogletree, Deakins, Nash, Smoak & Stewart, P.C., All Rights Reserved.

CMS Pushes for Hospital Price Transparency in Proposed Rule

On April 24, 2018, the Centers for Medicare & Medicaid Services (“CMS”) announced a new proposed rule (CMS-1694-P) (“Proposed Rule”). In an attempt to “empower patients through better access to hospital price information,” CMS plans to alter the requirements previously established by Section 2718(e) of the Affordable Care Act.[1]

Under Section 2718(e), “each hospital operating within the United States shall for each year establish (and update) and make public…a list of the hospital’s standard charges for items and services provided by the hospital.” CMS has previously interpreted Section 2718(e) to require hospitals to either make public a list of standard charges or implement policies for allowing the public to view a list of the standard charges by individual request. It was originally believed by CMS that patients could use such information to compare charges for similar services across hospitals, just as someone “shops around” for the best price in plumbing services. However, CMS contends that Section 2718(e), as is currently written, is insufficient to establish the necessary hospital price transparency.

The Proposed Rule takes Section 2718(e) a step further, and provides that beginning January 1, 2019, CMS will update the guidelines to require hospitals to make available a list of their current standard charges via the Internet in a machine readable format, which requirement a hospital may satisfy by publishing its chargemaster (i.e., a hospital’s comprehensive list of services and charges billable to a hospital patient). In addition to the publication requirement, the Proposed Rule further requires hospitals to update the standard charges they publicize at least annually.

Recently, some states, such as California and Colorado, have also taken steps to promote hospital price transparency. Under California’s “Payers’ Bill of Rights,”[2] California hospitals are required to either post an electronic copy of the charges for its services on the hospital’s website, or make a written or electronic copy available at the hospital’s location. Under Colorado law,[3] a healthcare provider must make available to the public, either electronically or by posting on the provider’s website, the healthcare prices of at least the 15 most common services rendered by the provider. Nevertheless, despite the move toward transparency at the state level, many states still lack extensive hospital price transparency statutes.

In addition to the Proposed Rule’s push toward price transparency, CMS has asked for public comments on a series of questions regarding price transparency, including the following:

  • Should “standard charges” be defined as the average rates for the items on the chargemaster; average rates for groups of services commonly billed together; or the average discount off the chargemaster amount across all payers?
  • What types of information would be most beneficial to patients; how can hospitals best enable patients to use charge information in their decision-making; and how can CMS and providers help third parties create patient-friendly interfaces with these data?
  • Should healthcare providers be required to inform patients how much their out-of-pocket costs for a service will be before those patients are furnished that service?
  • What is the most appropriate mechanism for CMS to enforce price transparency requirements? Should CMS impose civil monetary penalties on hospitals that fail to comply with the publication requirement?

Comments on the Proposed Rule are due by June 25, 2018.


[1] 42 U.S. Code § 300gg-18.

[2] California Health and Safety Code Sections 1339.50-1339.59.

[3] Colorado Revised Statutes Section 25-49-103(I).

Copyright © 2018, Sheppard Mullin Richter & Hampton LLP.

The Hacked & the Hacker-for-Hire: Lessons from the Yahoo Data Breaches (So Far)

The fallout from the Yahoo data breaches continues to illustrate how cyberattacks thrust companies into the competing roles of crime victim, regulatory enforcement target and civil litigant.

Yahoo, which is now known as Altaba, recently became the first public company to be fined ($35 million) by the Securities and Exchange Commission for filing statements that failed to disclose known data breaches. This is on top of the $80 million federal securities class action settlement that Yahoo reached in March 2018—the first of its kind based on a cyberattack. Shareholder derivative actions remain pending in state courts, and consumer data breach class actions have survived initial motions to dismiss and remain consolidated in California for pre-trial proceedings. At the other end of the spectrum, a federal judge has balked at the U.S. Department of Justice’s (DOJ) request that a hacker-for-hire indicted in the Yahoo attacks be sentenced to eight years in prison for a digital crime spree that dates back to 2010.

The Yahoo Data Breaches

In December 2014, Yahoo’s security team discovered that Russian hackers had obtained its “crown jewels”—the usernames, email addresses, phone numbers, birthdates, passwords and security questions/answers for at least 500 million Yahoo accounts. Within days of the discovery, according to the SEC, “members of Yahoo’s senior management and legal teams received various internal reports from Yahoo’s Chief Information Security Officer (CISO) stating that the theft of hundreds of millions of Yahoo users’ personal data had occurred.” Yahoo’s internal security team thereafter was aware that the same hackers were continuously targeting Yahoo’s user database throughout 2015 and early 2016, and also received reports that Yahoo user credentials were for sale on the dark web.

In the summer of 2016, Yahoo was in negotiations with Verizon to sell its operating business. In response to due diligence questions about its history of data breaches, Yahoo gave Verizon a spreadsheet falsely representing that it was aware of only four minor breaches involving users’ personal information.  In June 2016, a new Yahoo CISO (hired in October 2015) concluded that Yahoo’s entire database, including the personal data of its users, had likely been stolen by nation-state hackers and could be exposed on the dark web in the immediate future. At least one member of Yahoo’s senior management was informed of this conclusion. Yahoo nonetheless failed to disclose this information to Verizon or the investing public. It instead filed the Verizon stock purchase agreement—containing an affirmative misrepresentation as to the non-existence of such breaches—as an exhibit to a July 25, 2016, Form 8-K, announcing the transaction.

On September 22, 2016, Yahoo finally disclosed the 2014 data breach to Verizon and in a press release attached to a Form 8-K.  Yahoo’s disclosure pegged the number of affected Yahoo users at 500 million.

The following day, Yahoo’s stock price dropped by 3%, and it lost $1.3 billion in market capitalization. After Verizon declared the disclosure and data breach a “material adverse event” under the Stock Purchase Agreement, Yahoo agreed to reduce the purchase price by $350 million (a 7.25% reduction in price) and agreed to share liabilities and expenses relating to the breaches going forward.

Since September 2016, Yahoo has twice revised its data breach disclosure.  In December 2016, Yahoo disclosed that hackers had stolen data from 1 billion Yahoo users in August 2013, and had also forged cookies that would allow an intruder to access user accounts without supplying a valid password in 2015 and 2016. On March 1, 2017, Yahoo filed its 2016 Form 10-K, describing the 2014 hacking incident as having been committed by a “state-sponsored actor,” and the August 2013 hacking incident by an “unauthorized third party.”  As to the August 2013 incident, Yahoo stated that “we have not been able to identify the intrusion associated with this theft.” Yahoo disclosed security incident expenses of $16 million ($5 million for forensics and $11 million for lawyers), and flatly stated: “The Company does not have cybersecurity liability insurance.”

The same day, Yahoo’s general counsel resigned as an independent committee of the Yahoo Board received an internal investigation report concluding that “[t]he 2014 Security Incident was not properly investigated and analyzed at the time, and the Company was not adequately advised with respect to the legal and business risks associated with the 2014 Security Incident.” The internal investigation found that “senior executives and relevant legal staff were aware [in late 2014] that a state-sponsored actor had accessed certain user accounts by exploiting the Company’s account management tool.”

The report concluded that “failures in communication, management, inquiry and internal reporting contributed to the lack of proper comprehension and handling of the 2014 Security Incident.” Yahoo’s CEO, Marissa Mayer, also forfeited her annual bonus as a result of the report’s findings.

On September 1, 2017, a California federal judge partially denied Yahoo’s motion to dismiss the data breach class actions. Then, on October 3, 2017, Yahoo disclosed that all of its users (3 billion accounts) had likely been affected by the hacking activity that traces back to August 2013. During a subsequent hearing held in the consumer data breach class action, a Yahoo lawyer stated that the company had confirmed the new totals on October 2, 2017, based on further forensic investigation conducted in September 2017. That forensic investigation was prompted, Yahoo’s counsel said, by recent information obtained from a third party about the scope of the August 2013 breach. As a result of the new disclosures, the federal judge granted the plaintiffs’ request to amend their complaint to add new allegations and causes of action, potentially including fraud claims and requests for punitive damages.

The SEC Breaks New Cybersecurity Ground

Just a month after issuing new interpretive guidance about public company disclosures of cyberattacks (see our Post and Alert), the SEC has now issued its first cease-and-desist order and penalty against a public company for failing to disclose known cyber incidents in its public filings. The SEC’s administrative order alleges that Yahoo violated Sections 17(a)(2) & (3) of the Securities Act of 1933 and Section 13(a) of the Securities Exchange Act of 1934 and related rules when its senior executives discovered a massive data breach in December 2014, but failed to disclose it until after its July 2016 merger announcement with Verizon.

During that two-year window, Yahoo filed a number of reports and statements with the SEC that misled investors about Yahoo’s cybersecurity history. For instance, in its 2014-2016 annual and quarterly reports, the SEC found that Yahoo included risk factor disclosures stating that the company “faced the risk” of potential future data breaches, “without disclosing that a massive data breach had in fact already occurred.”

Yahoo management’s discussion and analysis of financial condition and results of operation (MD&A) was also misleading, because it “omitted known trends and uncertainties with regard to liquidity or net revenue presented by the 2014 breach.” Knowing full well of the massive breach, Yahoo nonetheless filed a July 2016 proxy statement relating to its proposed sale to Verizon that falsely denied knowledge of any such massive breach. It also filed a stock purchase agreement that it knew contained a material misrepresentation as to the non-existence of the data breaches.

Despite being informed of the data breach within days of its discovery, Yahoo’s legal and management team failed to properly investigate the breach and made no effort to disclose it to investors. As the SEC described the deficiency, “Yahoo senior management and relevant legal staff did not properly assess the scope, business impact, or legal implications of the breach, including how and where the breach should have been disclosed in Yahoo’s public filings or whether the fact of the breach rendered, or would render, any statements made by Yahoo in its public filings to be misleading.” Yahoo’s in-house lawyers and management also did not share information with its auditors or outside counsel to assess disclosure obligations in public filings.

In announcing the penalty, SEC officials noted that Yahoo left “its investors totally in the dark about a massive data breach” for two years, and that “public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors.” The SEC also noted that Yahoo must cooperate fully with its ongoing investigation, which may lead to penalties against individuals.

The First Hacker Faces Sentencing

Coincidentally, on the same day that the SEC announced its administrative order and penalty against Yahoo, one of the four hackers indicted for the Yahoo cyberattacks (and the only one in U.S. custody) appeared for sentencing before a U.S. District Judge in San Francisco. Karim Baratov, a 23-year-old hacker-for-hire, had been indicted in March 2017 for various computer hacking, economic espionage, and other offenses relating to the 2014 Yahoo intrusion.

His co-defendants, who remain in Russia, are two officers of the Russian Federal Security Service (FSB) and a Russian hacker who has been on the FBI’s Cyber Most Wanted list since November 2013. The indictment alleges that the Russian intelligence officers used criminal hackers to execute the hacks on Yahoo’s systems, and then to exploit some of that stolen information to hack into other accounts held by targeted individuals.

Baratov is the small fish in the group. His role in the hacking conspiracy focused on gaining unauthorized access to non-Yahoo email accounts of individuals of interest identified through the Yahoo data harvest.  Unbeknownst to Baratov, he was doing the bidding of Russian intelligence officers, who did not disclose their identities to the hacker-for-hire. Baratov asked no questions in return for commissions paid on each account he compromised.

In November 2017, Baratov pled guilty to conspiracy to commit computer fraud and aggravated identity theft. He admitted that, between 2010 and 2017, he hacked into the webmail accounts of more than 11,000 victims, stole and sold the information contained in their email accounts, and provided his customers with ongoing access to those accounts. Baratov was indiscriminate in his hacking for hire, even hacking for a customer who appeared to engage in violence against targeted individuals for money. Between 2014 and 2016, he was paid by one of the Russian intelligence officers to hack into at least 80 webmail accounts of individuals of interest to Russian intelligence identified through the 2014 Yahoo incident. Baratov provided his handler with the contents of each account, plus ongoing access to the account.

The government is seeking eight years of imprisonment, arguing that Baratov “stole and provided his customers the keys to break into the private lives of targeted victims.” In particular, the government cites the need to deter Baratov and other hackers from engaging in cybercrime-for-hire operations. The length of the sentence alone suggests that Baratov is not cooperating against other individuals. Baratov’s lawyers have requested a sentence of no more than 45 months, stressing Baratov’s unwitting involvement in the Yahoo attack as a proxy for Russian intelligence officers.

In a somewhat unusual move, the sentencing judge delayed sentencing and asked both parties to submit additional briefing discussing other hacking sentences. The judge expressed concern that the government’s sentencing request was severe and that an eight-year term could create an “unwarranted sentencing disparity” with sentences imposed on other hackers.

The government is going to the mat for Baratov’s victims.  On May 8, 2018, the government fired back in a supplemental sentencing memorandum that reaffirms its recommended sentence of 8 years of imprisonment. The memorandum contains an insightful summary of federal hacking sentences imposed on defendants, with similar records who engaged in similar conduct, between 2008 and 2018. The government surveys various types of hacking cases, from payment card breaches to botnets, banking Trojans and theft and exploitation of intimate images of victims.

The government points to U.S. Sentencing Guidelines Commission data showing that federal courts almost always have imposed sentences within the advisory Guidelines range on hackers who steal personal information and do not earn a government-sponsored sentence reduction (generally due to lack of cooperation in the government’s investigation). The government also expands on the distinctions between different types of hacking conduct and how each should be viewed at sentencing. It focuses on Baratov’s role as an indiscriminate hacker-for-hire, who targeted individuals chosen by his customers for comprehensive data theft and continuous surveillance. Considering all of the available data, the government presents a very persuasive argument that its recommended sentence of eight years of imprisonment is appropriate. Baratov’s lawyers may now respond in writing, and sentencing is scheduled for May 29, 2018.

Lessons from the Yahoo Hacking Incidents and Responses

There are many lessons to be learned from Yahoo’s cyber incident odyssey. Here are some of them:

The Criminal Conduct

  • Cybercrime as a service is growing substantially.

  • Nation-state cyber actors are using criminal hackers as proxies to attack private entities and individuals. In fact, the Yahoo fact pattern shows that the Russian intelligence services have been doing so since at least 2014.

  • Cyber threat actors—from nation-states to lone wolves – are targeting enormous populations of individuals for cyber intrusions, with goals ranging from espionage to data theft/sale, to extortion.

  • User credentials remain hacker gold, providing continued, unauthorized access to online accounts for virtually any targeted victim.

  • Compromises of one online account (such as a Yahoo account) often lead to compromises of other accounts tied to targeted individuals. Credential sharing between accounts and the failure to employ multi-factor authentication makes these compromises very easy to execute.

The Incident Responses

  • It’s not so much about the breach, as it is about the cover up. Yahoo ran into trouble with the SEC, other regulators and civil litigants because it failed to disclose its data breaches in a reasonable amount of time. Yahoo’s post-breach injuries were self-inflicted and could have been largely avoided if it had properly investigated, responded to, and disclosed the breaches in real time.

  • SEC disclosures in particular must account for known incidents that could be viewed as material for securities law purposes.  Speaking in the future tense about potential incidents will no longer be sufficient when a company has actual knowledge of significant cyber incidents.

  • Regulators are laying the foundation for ramped-up enforcement actions with real penalties. Like Uber with its recent FTC settlement, Yahoo received some leniency for being first in terms of the SEC’s administrative order and penalty. The stage is now set and everyone is on notice of the type of conduct that will trigger an enforcement action.

  • Yahoo was roundly applauded for its outstanding cooperation with law enforcement agencies investigating the attacks. These investigations go nowhere without extensive victim involvement. Yahoo stepped up in that regard, and that seems to have helped with the SEC, at least.

  • Lawyers must play a key role in the investigation and response to cyber incidents, and their jobs may depend on it. Cyber incident investigations are among the most complex types of investigations that exist. This is not an area for dabblers and rookies. Organizations need to hire in-house lawyers with actual experience and expertise in cybersecurity and cyber incident investigations.

  • Senior executives need to become competent in handling the crisis of cyber incident response. Yahoo’s senior executives knew of the breaches well before they were disclosed. Why the delay? And who made the decision not to disclose in a timely fashion?

  • The failures of Yahoo’s senior executives illustrate precisely why the board of directors now must play a critical role not just in proactive cybersecurity, but in overseeing the response to any major cyber incident. The board must check senior management when it makes the wrong call on incident disclosure.

The Litigation

  • Securities fraud class actions may fare much better than consumer data breach class actions. The significant stock drop coupled with the clear misrepresentations about the material fact of a massive data breach created a strong securities class action that led to an $80 million settlement.  The lack of financial harm to consumers whose accounts were breached is not a problem for securities fraud plaintiffs.

  • Consumer data breach class actions are more routinely going to reach the discovery phase. The days of early dismissals for lack of standing are disappearing quickly.  This change will make the proper internal investigation into incidents and each step of the response process much more critical.

  • Although the jury is still out on how any particular federal judge will sentence a particular hacker, the data is trending in a very positive direction for victims. At least at the federal level, hacks focused on the exploitation of personal information are being met with stiff sentences in many cases. A hacker’s best hope is to earn government-sponsored sentencing reductions due to extensive cooperation. This trend should encourage hacking victims (organizations and individuals alike) to report these crimes to federal law enforcement and to cooperate in the investigation and prosecution of the cybercriminals who attack them.

  • Even if a particular judge ultimately goes south on a government-requested hacking sentence, the DOJ’s willingness to fight hard for a substantial sentence in cases such as this one sends a strong signal to the private sector that victims will be taken seriously and protected if they work with the law enforcement community to combat significant cybercrime activity.

Copyright © by Ballard Spahr LLP
This post was written by Edward J. McAndrew of Ballard Spahr LLP.