It’s (Not) Academic: Cybersecurity Is a Must for Universities and Academic Medical Centers

Cutting-edge research institutions need cutting-edge cybersecurity to protect their IP and critical personal and financial data.  Universities hold vast repositories of valuable information, including student healthcare information, patient information from academic medical centers, and financial and personal data from applicants, donors, students, faculty, and staff.  So it’s no surprise hackers have been targeting universities lately—in fact, at least eight American universities (including Harvard, UC Berkeley, University of Maryland, and Indiana University) have announced cyber intrusions over the past two years.

With the cost of a data breach averaging $3.8 million,[1] universities cannot afford to pretend cybercrime won’t happen to them.  For institutions with health records, the financial costs can be even greater (as high as $360 per record!), due to the high value of health records on the internet’s black market, the “Dark Web.”

But, the dollars may not mean as much as the bad PR—having your institution’s name in national headlines, risking research funding from governments or corporate partners, losing protected and sensitive IP, fielding calls from angry donors, students, and parents whose personal information has been compromised, and defending multiple civil suits—all because the institution failed to assess its cyber liability.  (See additional information on assessing cyber liability).

For major research institutions holding valuable IP, health records, and grants for sensitive research, having a cybersecurity prevention and remediation plan is more than just a good idea, it’s an absolute must.  And these cybersecurity measures must extend beyond mere “compliance.”  The Federal Government will continue to create cybersecurity regulations, but their regulations never will keep up with the risks.  A university’s administration answers to the Federal Government, to its Board, to its donors, to the media, to its students and faculty, and to the general public. None of these constituencies will be calmed by minimal compliance with outdated regulations.

Instead, universities can address their cybersecurity risks with some initial measures to prevent intrusions and to minimize the damage if a hacker does get through:

  • Protections against Insider Threats: Attacks by insiders accounted for more than 50% of the cyberattacks in 2014. To help mitigate these threats, create an insider threat team and build a holistic approach to security—include staff from IT and technology, legal, physical security, and human resources. Emphasize training of employees, faculty, and administrators in basic cybersecurity awareness to instill habits that will better protect the institution.

  • Enhance Network Security Policies and Procedures: Implement security precautions to make a hack more difficult. For example: create enhanced protocols to prevent unauthorized access to devices and systems, including multi-factor authentication; provide broad and frequent updates to computers on-campus and for computers that regularly access campus networks; and prevent access to compromised sites by incorporating controls into your network.

  • Cyber Intrusion TestingWork with a vendor to test the institution’s current cybersecurity vulnerabilities and get advice on how to reduce those vulnerabilities.

  • Corrective Action Plan: —one that includes disclosure and mitigation efforts. Importantly, if an institution holds government contracts or grants, follow the required disclosure protocols for cyber intrusion (note that agencies may differ in their disclosure and mitigation requirements).

  • Cyber Insurance: —particularly those with academic medical centers and/or sensitive research programs—should ensure their policies are large enough to cover a worst-case scenario.While a comprehensive cybersecurity plan will require additional systematic and long-term efforts, taking these steps will at least keep an institution off of a hacker’s list of “low-hanging fruit.”

Copyright © 2015, Sheppard Mullin Richter & Hampton LLP.


[1] Ponemon Institute, Cost of Data Breach Study (2015).  Note this average does not include mega-breaches like those experienced by Home Depot, Target, or Sony Pictures.

 

Let’s Talk Turkey: Wage/Hour and Other Laws to Feast on Over Thanksgiving

We all know that employers do not receive “time off” from applicable employment laws during the holidays. To avoid unnecessary holiday headaches, be mindful of the following issues as you conduct your workplace holiday staffing and planning.

Comply with your Policies and Collective Bargaining Agreements

Remember to abide by the applicable holiday provisions of your policies, agreements, or collective bargaining agreements. Pay for unworked time on recognized holidays; how time worked on holidays is computed or paid; and eligibility requirements for receipt of holiday pay are often a matter of policy or contract. Breaching such provisions—or disparately enforcing them—can give rise to a claim, charge, or grievance.

Think Beyond your Holiday Policy—Comply with Wage Laws

Be mindful of wage payment laws when you are planning office closures to ensure that you do not run afoul of state requirements governing the time, frequency, and method of paying earned wages. Also, remember that time worked on a holiday should be counted as “hours worked” for purposes of overtime laws, regardless of whether you provide a holiday premium or other benefit.  Further, be careful about making deductions from exempt employees’ salaries for time off around the holidays so as not to jeopardize the exempt status—a company closure for the holidays is not listed among the Department of Labor’s enumerated instances of proper reasons to make deductions under the salary basis rules of the Fair Labor Standards Act.

No Break from Meal and Rest Period Laws

Even if your employees are frantically setting up holiday displays or assisting eager consumers on Black Friday, provide meal and rest periods in accordance with state law. Many states require that employers provide meal and break periods, and the frequency and timing of such periods are often dependent upon the total number of hours worked in a day. For instance, Illinois employers must allow a meal break for employees working 7.5 continuous hours or longer within 5 hours of starting work; New York’s Department of Labor guidelines specify requirements for a “noonday” meal period between 11:00 a.m. and 2:00 p.m., with additional meal periods for shifts extending into specified evening hours.

Also, while bona fide meal breaks of a sufficient duration can generally be unpaid, beware that restrictions, duties, or parameters on such breaks might run afoul of your state’s law and can make a meal period compensable.

A “Blue” Christmas

If your business has operations in one of the few states that impose “Blue Law” requirements for business operations on holidays, then be aware of obligations or restrictions that might apply. For instance, if you operate in Massachusetts, then you might be required to obtain a local permit and/or be subject to extra pay or other standards for employees working on a holiday. In Rhode Island, you might be subject to an overtime pay rate on holidays or other requirements.

Be sure to check your state and local laws to confirm applicable standards.

Accommodate Observation of Holidays Due to Religious Beliefs

Finally, remember that Title VII of the Civil Rights Act of 1964 and many state or local laws require employers to reasonably accommodate employees’ sincerely held religious beliefs, unless doing so would cause an undue hardship. “Religion” can include not only traditional, organized religions such as Judaism, Islam, Christianity, Hinduism, and Buddhism, but also sincerely held religious beliefs that are new, uncommon, not part of a formal church or sect, or only held by a small number of people.

Thus, while your company may be closed on Christmas Day, you may need to allow an employee time off to celebrate a religious holiday that your company does not recognize. Businesses can accommodate in the form of time off, modifications to schedules, shift substitutions, job reassignments, or other modifications to workplace policies or practices.

Illinois: Transgender Locker Room Policy Eludes School District Facing Government Sanctions Under Title IX

An Illinois school district has violated anti-discrimination laws by not allowing a transgender student who identifies as female and is on her high school’s girls’ sports team to change and shower in the girls’ locker room, the United States Department of Education Office of Civil Rights (“OCR”) has held.

The OCR released its findings on November 2, 2015, after completing an extensive investigation of a complaint for unlawful discrimination under Title IX of the Education Amendments of 1972 filed by a transgender female high school student against the Township High School District 211 in Palatine, Illinois. Title IX prohibits discrimination on the basis of sex in any federally funded education program or activity. An entity in violation of Title IX may lose some or all of its Title IX funding.

Schools districts, colleges, and private employers are increasingly at risk of transgender discrimination charges or complaints under laws enforced by the OCR, the Equal Employment Opportunity Commission, the Department of Labor, the Department of Justice, and the Occupational Safety and Health Administration as these agencies develop their policies on transgender issues.

The EEOC, the DOL, and the DOJ have interpreted Title VII of the Civil Right Act’s prohibitions on sex discrimination to bar employment discrimination based on gender identity.

On the employment front, in the seven months between October 2014 and April 2015, EEOC received 505 charges based on sexual orientation discrimination and 112 charges based on gender identity. Moreover, the EEOC’s Strategic Enforcement Plan for 2012-2016 includes the investigation and enforcement of LGBT (lesbian, gay, bisexual, and transgender) sex stereotyping claims .

Further, effective April 2015, the DOL’s Office of Federal Contract Compliance Programs requires federal contractors subject to Executive Law 11246 to allow transgender employees to use the restroom and other facilities consistent with their gender identity (See article DOL Releases Regulations Extending Protections to Lesbian, Gay, Bisexual, and Transgender Employees, Applicants).

Finally, the OSHA guidelines require all employers under its jurisdiction to provide a “safe and healthy working environment for all employees” and transgender employees “should have access to restrooms that correspond to their gender identity.”

OSHA recommends that companies should implement written policies to ensure that all employees have “prompt access to appropriate sanitary facilities.” The agency’s best practices guide also recommends providing options from which a transgender employee may choose. These can include single-occupancy gender-neutral facilities and the use of multiple-occupant, gender-neutral restroom facilities with lockable single occupant stalls (See article Restroom Access Should Be Consistent with Employee’s Gender Identity, OSHA Says).

Background

The Township High School District 211 denied a transgender female student access to three separate girls’ locker rooms (“LR”) (including the Physical Education (“PE”) LR, the PE Swim LR, and the Athletics LR). The Student alleged the District discriminated against her based on sex by denying her access to the girls’ locker rooms because of her gender identity and gender non-conformity.

OCR Decision

The OCR found the District violated Title IX for excluding the Student from participation in and denying her the benefits of its education program, providing services to her in a different manner, subjecting her to different rules of behavior, and subjecting her to different treatment on the basis of sex.

“The evidence shows that as a result of the District’s denial of access to the girls LRs, Student A has not only received an unequal opportunity to benefit from the District’s educational program, but also has experienced an ongoing sense of isolation and ostracism throughout her high school enrollment.”

Other than access to the female locker rooms, the OCR found the District treated the Student consistently with her gender identity, including identifying her by her female name and with female pronouns, providing her with full access to girls’ restrooms and allowing her to participate in girls’ sports.

Alternatives Not Acceptable

The District argued it offered the Student alternative changing options, such as permitting her to change with several female friends in an alternative restroom closer to the PE gym and offering her another restroom near the Swim LR.

The OCR found that the alternatives “continued or would continue to exclude [the Student] from the girls’ locker rooms and set her apart from her female classmates and teammates,” particularly as some of the proposed alternative facilities were not comparable to those provided for other girls.

For example, unlike the other female students who used the PE class swim unit, the Student had access only to a rinse shower and was not able to dry her hair because there was no electrical outlet. Furthermore, by not having access to the PE locker room, she was subjected to stigma and different treatment, OCR said, because she occasionally had been late to class or missed class announcements that were made in the girls’ locker room.

Finally, as a result of being denied access to the girls Athletics LR, the Student felt excluded from the team because she missed the informal huddle in the LR before matches, locker room “girl talk,” and the female bonding in the LR. According, the OCR concluded the District denied the Student’s Title IX rights.

Privacy Concerns Unavailing

While acknowledging that it denied the Student access to the female locker rooms, the District argued that it had to balance the Student’s rights and interests with two distinct privacy concerns of other female students:

  • the need to protect female students from “being observed in a state of undress by a biologically male individual,” and

  • the “inappropriateness of allowing young female students to view a biologically naked male in the locker room in a state of undress.”

The OCR found both of these arguments unpersuasive as the District had installed five showers with privacy curtains and five restroom stalls in the girls PE LR, but had not provided private changing areas in the other two LRs.

“The District’s installation and maintenance of privacy curtains in one locker room go a long distance toward achieving such a nondiscriminatory alternative because providing sufficient privacy curtain access to accommodate any students who wish to be assured of privacy while changing would allow for protection of all students’ rights in this context. Those female students wishing to protect their own private bodies from exposure to being observed in a state of undress by other girls in the locker rooms, including transgender girls, could change behind a privacy curtain.”

Given the Student’s willingness to change privately, the OCR said, the District could have provided equal access to all three LRs if it installed additional privacy curtains for any student that wanted privacy.

Takeaways

Federal government agencies are increasingly examining the purported protections afforded to transgender students and employees, in both the public and private sectors. How to handle transgender issues is still a work-in-progress for the agencies and the entities they regulate. In this case, despite the District’s accommodations and options to provide equal treatment to the Student in all respects other than access to the Locker Room, the OCR nevertheless held its efforts were insufficient. Moreover, states also have laws protecting LGBT individuals (See article Utah Governor Signs Landmark LGBT and Religious Expression Anti-Discrimination Bill).

The following steps can help lower the risk of being under government scrutiny:

  1. closely review and revise EEO (equal employment opportunity), harassment, and transgender policies;

  2. ensure proper sensitivity training of administrators, faculty, and students to foster diverse and inclusive primary, secondary school, and campus environments to avoid stigmatizing transgender students; and

  3. ensure that accommodations for transgender students and employees provide equal access in all respects, as well as balance privacy concerns.

Because of the complexities involved in this area, school districts, colleges, and private sector employers would be well-served to regularly review their policies and practices with counsel to ensure they address specific organizational needs effectively and comply with applicable law.

Jackson Lewis P.C. © 2015

Breaking News: Refusing to Allow an Employee to Rescind His Or Her Voluntary Resignation Can Get You Sued

Here is the scenario. Your employee decides to voluntarily resign. She gives plenty of notice. Before her scheduled end date, the employee provides information relevant to a sexual harassment investigation involving her supervisor. Before the scheduled end date, the employee tries to rescind her employment. The supervisor refuses. Here’s the question: Is the refusal to allow the employee the opportunity to rescind her resignation an “adverse employment action” for purposes of a retaliation claim?

It could be, at least according to the Fifth Circuit Court of Appeals. A similar scenario played out in Porter v. Houma Terreboone Housing Authority. According to the court:

“Just as an at-will employer does not have to hire a given employee, an employer does not have to accept a given employee’s rescission. Failing to do so in either case because the employee has engaged in a protected activity is nonetheless an adverse employment action.”

This is something employers need to be aware of. Remember: thoroughly investigate all work place harassment claims. Also, separate the subject of the investigation from any decisional process regarding the employee’s employment. In a perfect world, the decision-maker would not have any knowledge regarding the employee’s “protected activity.”

© 2015 BARNES & THORNBURG LLP

Health Officials’ Latest Tool in Tool Box – Whole Genome Sequencing

In late October, the Food and Drug Administration (FDA), Centers for Disease Control and Prevention (CDC), along with state and local officials investigated an outbreak of E. coli infections linked to food served at a major fast-casual restaurant chain. Much of the underlying information documenting the outbreak has been derived from an advanced laboratory technique called “whole genome sequencing” (WGS). This is a fairly new instrument in the CDC toolbox. WGS reveals the complete DNA make-up of an organism, thereby enabling health officials to better understand variations both within and between potentially pathogenic species. Such information can then be compared with clinical isolates from sick patients, and, if they match, there may be a reliable link established between the illness and the pathogen. This new technique has the potential to define the scope of a foodborne illness outbreak more quickly and ideally will help to prevent additional cases. Traditionally, this analysis has been done via a process known as pulse-field gel electrophoresis (PFGE). But PFGE has a shortcoming in that it is unable to differentiate between related species of organisms, which can be critical when health officials are trying to delineate the specific source of the outbreak, and want to know whether to recall a product or not.

The FDA cites numerous examples of how it has used WGS: 1

  • To differentiate sources of contamination, even within the same outbreak;

  • To determine which ingredient in a multi-ingredient food harbored the pathogen associated with an illness outbreak;

  • To narrow the search for the source of a contaminated ingredient;

  • As a clue to the possible source of illnesses; and

  • To determine unexpected vectors for food contamination.

The use of techniques such as WGS reflects FDA’s shift toward a broader preventative-centric approach to food safety. This approach can be associated the Food Safety Modernization Act (FSMA), signed into law on January 4, 2011, which requires comprehensive, science-based preventive controls across the food supply.2 FSMA provides the FDA with new enforcement authorities designed to achieve higher rates of compliance with prevention-based and risk-based food safety standards, and to better respond to and contain problems when they do occur. Lastly, the law also gives the FDA important new tools to hold imported foods to the same standards as domestic foods and directs FDA to build an integrated national food safety system in partnership with state and local authorities.

WGS also has been employed in the context of recent illness outbreaks associated with products regulated by the Food Safety and Inspection Service (FSIS), which oversees the safety of meat and poultry. In some circumstances involving FSIS, the regulated industry has found itself on the receiving end of confusing scientific input, as regulatory recommendations based upon PFGE analysis were subsequently negated by WGS data.

A shift to WGS may allow health officials to more quickly and more precisely connect the dots during an outbreak, and use of this tool may also benefit the regulated community. The enhanced precision of WGS may provide the regulated community with a new ability to prevent being falsely labeled as the source of the outbreak. Under the prior testing regime, PFGE tests were often unable to differentiate between related species of organisms, and as a result, regulators were at times forced to cast an overly wide net to capture the source of an outbreak. The new WGS technique provides authorities with a more precise and accurate tool. But, as circumstances with FSIS suggest, companies may also encounter confusion over growing pains associated with the movement from one generation of technology to another. We will continue to monitor the development and use of new tools and techniques the FDA, FSIS, and other federal agencies are using to prevent and respond to food safety issues.


1 Food and Drug Administration, Examples of How FDA Has Used Whole Genome Sequencing of Foodborne Pathogens For Regulatory Purposes, (last visited Nov. 9, 2015).
2 FDA Food Safety and Modernization Act, Pub. L. No. 111-353, 124 Stat. 3885 (2001). 

Employers: Twitter is Going Crazy Over #InternationalMensDay Hashtag

This will be a short post. Earlier this week we posted an article that discussed the need for employers to stay on top of what is trending on the Internet. Why? Because trending topics can sometimes lead to controversial discussions that might not be consistent with an employer’s EEO Policy. As a result, we explained that it would be prudent to understand what may be the current topic being discussed around the watercooler. Here is a follow up to that article:  The #InternationalMensDay hashtag is currently trending on Twitter (right now at 114K tweets). What is the relevance of this topic to employers? A quick search shows that a lot of the content posted can be construed as inappropriate and/or discriminatory (although presumably meant to be humorous).  It’s the middle of the work day where we are – so we can only presume a lot of this content is being posted by employees in the workplace.

Remember: Title VII and many state laws prohibit discrimination based on gender. The more questionable content generated in the workplace, the better chance an employee can argue there is evidence of a  convincing mosaic of discrimination tolerated by the employer. Be sure to remind employees of your company’s EEO policy if you come across any inappropriate content and/or discussions. And, as always, be sure to stay on top of trends that may have an impact in the workplace.

ARTICLE BY  Peter T. Tschanz of Barnes & Thornburg LLP
© 2015 BARNES & THORNBURG LLP

Best Practices for Creating Landing Pages That Convert

Landing pages — dedicated web pages that a visitor to your website, blog, social media post or e-newsletter is guided to after clicking on a link — are critical when it comes to converting those visitors into qualified leads.

landing pages internetIf you have been directing traffic to the home page of your website, you are missing a big opportunity to capture more leads. Landing pages have been proven to more than double conversion rates when compared with website home pages. This is because they are created specifically for converting leads, featuring specialized content and offers that appeal to a targeted audience.

To make your landing pages pay, you need to know the basics about how to create a highly effective landing page.  Here are 10 steps you need to take in developing landing pages for your law firm:

  1. Have a singular goal.  You want your landing page to do just one job for you — get the visitor to download that free report, sign up for a seminar, subscribe to your newsletter, etc.  Don’t clutter them up with multiple offers.  One page.  One job.

  2. Use a single, relevant visual.  Choose an illustration or photo that is relevant to your offer.

  3. No false endorsements.  Don’t create false endorsements for your offer.  Avoid cheesy endorsement copy that turns visitors off.

  4. Use simple design.  Keep your design simple with minimal, impactful copy that consists of a headline, subhead and bullet points that make the content easy to scan.

  5. Quick load.  Be sure your landing page loads quickly; you only have a few seconds for it to pop up or your visitor will lose interest and click off.

  6. Compelling copy.  The worse thing you can do is bore your visitor.  Your copy needs to be readable, believable and lead the visitor quickly to your ultimate goal.

  7. Eyes on the prize.  Write and design your land page with your singular goal in mind.  Do not clutter the content with irrelevant prose.

  8. Inform and educate.  Don’t waste the visitor’s time by not delivering anything of benefit.  And don’t ask for too much information — a name and an email address should be sufficient.

  9. Be truthful.  If you have actual testimonials that would be appropriate, use them but be sure you are not making any false promises or guarantees.

  10. Provide value.  Make it clear what the value and benefits of redeeming your offer will provide to your visitor.  If they are entrusting you with their information, you need to let them know it is a fair exchange for what you are providing with the offer.

© The Rainmaker Institute, All Rights Reserved

P3 Legislation in Florida – Public Private Partnerships

On September 24-25, Miami-Dade County held a P3 Institute entitled “The P3 Pipeline: A Forum for the Private Sector.” Among the topics discussed at the Institute was a measure currently before the Florida Legislature that, if enacted, will make the P3 procurement process easier for all parties involved.

Two bills, House Bill 97 and House Bill 95, have advanced to House committees and are moving through the legislative process. HB 97, known as “Public Records and Public Meetings,” is currently in the State Affairs Committee. HB 95, a companion bill known simply as “Public-Private Partnerships,” is in the Appropriations Committee. Approval by all required legislative committees is a necessary step before these bills can be introduced in the 2016 legislative session.

If it passes, HB 97 would exempt unsolicited P3 proposals by responsible public entities from public records and public meeting requirements for a specified time period. HB 95, a corollary bill, revises provisions regarding responsible public entities and unsolicited proposals for qualified projects. In doing so, HB 95 expands the list of entities authorized to conduct P3s to include state universities, special districts, school districts (rather than school boards), and institutions included in the state college system.

On a related note, the bills’ sponsor, Representative Greg Staube (R-Sarasota), has stated that several state legislators (without naming the legislators specifically) are discussing the possibility of a centralized state office that could offer Public Private Partnership procurement expertise to Florida counties. The office could be housed in an existing state agency, like the Department of Management Services or Enterprise Florida, to save money.

Article By Albert E. Dotson, Jr. & Leah Aaronson of Bilzin Sumberg Baena Price & Axelrod LLP

© 2015 Bilzin Sumberg Baena Price & Axelrod LLP

Supreme Court to Decide Whether Government can Freeze a Defendant’s Lawful Assets Pre-Conviction

Whether the government can freeze all of a defendant’s assets before trial, even where those assets are not tainted by any connection to alleged federal offenses, thereby preventing a defendant from paying for his own defense, will be decided by the U.S. Supreme Court in Luis v. United States, No. 14-419.

The federal Mandatory Victims Restitution Act of 1996 (“MVRA”) requires that defendants convicted of crimes committed by “fraud or deceit” compensate victims for the full amount of the victims’ losses. Often, however, by the time there is a conviction, criminal defendants do not have any assets to satisfy those judgments. Seeking to address this problem, the United States has invoked the Fraud Injunction Act to freeze legitimate assets pre-conviction to pay a later judgment.

The Fraud Injunction Act statute authorizes a “restraining order” against assets when a person is “alienating or disposing of property, or intends to alienate or dispose of property” that is “obtained from” or “traceable to” certain federal offenses. In such cases, the statute permits a court to prohibit the use of tainted property “or property of equivalent value” before trial to ensure that sufficient assets are available to satisfy any judgment.

In 2012, the federal government charged Sila Luis with conspiracy to commit Medicare fraud – a scheme allegedly amounting to over $45 million, stemming from claims for home health services that were neither medically necessary nor actually performed. Using the Fraud Injunction Act, the federal government asked the district court to freeze all of Luis’s assets, including those that were not even allegedly obtained through fraud, totaling approximately $15 million. The district court agreed to impose the freeze. .

Luis then requested that the district court release her untainted assets so she may retain her lawyer. The district court denied the request, explaining that, because the government could locate “only a fraction of the assets” Medicare had paid Luis’s companies, her “untainted” assets also could be frozen. The district court likened Luis’s situation to that of a bank robber indicted for stealing $100,000; That is, if the robber has already spent the allegedly stolen money which he could not use to hire his preferred lawyer in any case, he also should not be able to spend a different $100,000 he “just happens” to have to hire the lawyer he wants.

Luis appealed the district court’s decision, arguing she was being deprived of her Fifth Amendment right to due process of law and her Sixth Amendment right to counsel of her choosing. The Court of Appeals for the Eleventh Circuit, in Atlanta, upheld the district court’s denial of her request to release her legitimate assets, stating that Luis’s arguments were foreclosed by the U.S. Supreme Court’s decision in Kaley v. United States (2014) and other decisions.

In Kaley, the Supreme Court held that when the government, following a grand jury indictment, restrains tainted assets needed to retain a lawyer, the Fifth and Sixth Amendments do not require a pretrial hearing at which the defendant can challenge a grand jury’s finding of probable cause.

Luis asked the Supreme Court to review the case. The Court agreed to do so and recently heard argument. A decision is expected by next June.

Article By Ramsay C. McCullough of Jackson Lewis P.C.

Jackson Lewis P.C. © 2015

Substantial OSHA Penalty Increases Are Coming

Line GraphOSHA penalties are going up.  EPA’s penalties are going up, too.  However, while EPA penalties have been going up modestly every four years to take inflation into account, OSHA penalties have not increased in 25 years.  Maximum OSHA penalties may jump as much as about 78 percent next year.  For a provision quietly tucked away in budget legislation, this packs quite a punch.

The Legislative Change

On November 2, 2015, President Obama signed into law the Bipartisan Budget Act of 2015.[1]  Section 701 of that legislation is the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (the 2015 Adjustment Act).  The 2015 Adjustment Act amends the Federal Civil Penalties Inflation Adjustment Act of 1990[2] to remove the OSHA exemption to the requirement that civil monetary penalties be periodically increased to account for inflation.  The amendment also changed the frequency of the inflation increases from “once every 4 years”[3] to “every year.”

In addition, the new law entitles OSHA to a single “catch up” penalty increase to account for the lack of periodic penalty increases, which “shall take effect no later than August 1, 2016.”  OSHA is authorized to calculate this initial increase based on the percentage difference between the Consumer Price Index (CPI) in October 2015 and the CPI in October of the calendar year that the civil penalty was last adjusted under any different law.[4]  In this instance, because OSHA penalties have not been adjusted since 1990, the catch-up penalty increase will be based on the October 1990 CPI as compared to the October 2015 CPI.

Based on the October 2015 CPI, the percentage difference is expected to be about 78 percent.[5]  In the catch-up adjustment, $7,000 OSHA penalties could increase to as much as approximately $12,471, and $70,000 OSHA penalties could increase to as much as approximately $124,710.  If OSHA rounds those numbers, the likely maximums would be $120,000 and $12,000.

Past Efforts to Raise Maximum OSHA Penalties

Under section 17 of the Occupational Safety and Health Act of 1970 (OSH Act), OSHA penalties for “willful” or “repeat” violations have a maximum civil penalty of $70,000 but not less than $5,000 for each willful violation.[6]  Penalties for “serious” violations have a maximum of $7,000 per violation.  Those figures have remained static since 1990 despite repeated efforts to increase them.

For example, in 2009, a Senate bill and a House bill,[7] both entitled the Protecting America’s Workers Act, would have amended section 17 of the OSH Act with one-time maximum civil penalty increases.  The $70,000 “willful” violation maximum would have been increased to $120,000 but not less than $8,000 (up from $5,000).  The penalties for “serious” violations would have increased from a maximum of $7,000 to a maximum of $12,000, and penalties for “serious” violations that result in employee fatalities would have been increased to a maximum of $50,000 but not less than $20,000 for employers with more than 25 employees.  The proposed legislation did not pass either House of Congress.[8]  This year, updated versions of the Protecting America’s Workers Act were introduced which would make the same adjustments in penalties.[9]

After more than 25 years and extensive legislative effort, OSHA penalties are poised for a significant initial increase, due to a provision added to an appropriations bill without hearings or debate.

Implications for State OSHAs

About half the states have their own enforcement programs under OSHA-approved state plans, even though they generally enforce OSHA’s standards.  Thus, the statutory increase in federal OSHA’s maximum penalties will not directly impact state OSHA programs, whose maximum penalties are set by state law.  However, this federal increase is expected to lead to state increases as well.  Under section 18 of the OSH Act, state plans must be “at least as effective” as those of federal OSHA.[10]  Lower state maximum penalties are not likely to be seen as being “as effective” as federal maximums.

EPA Penalties Are Going Up Too

Under the Federal Civil Penalties Inflation Adjustment Act of 1990, EPA penalties have increased every four years.  Between 1996 and 2013, four adjustments of EPA’s statutory civil payment amounts were implemented.[11]  Annual inflation adjustments will now be required.  In recent years inflation has been low, so the next increase will likely be relatively modest.


[1] Bipartisan Budget Act of 2015, Pub. L. 114-74.

[2] Id at § 701.  Prior to the amendment, Section 4(1) read: “by regulation adjust each civil monetary penalty provided by law within the jurisdiction of the Federal agency, except for any penalty (including any addition to tax and additional amount) under the Internal Revenue Code of 1986, the Tariff Act of 1930, the Occupational Safety and Health Act of 1970, or the Social Security Act, by the inflation adjustment described under section 5 of this Act[.]”  H.R. 3019, 104th Cong. (1996).

[3] H.R. 3019, 104th Cong. (1996) (“The head of each agency shall, not later than 180 days after the date of enactment of the Debt Collection Improvement Act of 1996 [Apr. 26, 1996], and at least once every 4 years thereafter[.]”) (emphasis added).

[4] This initial catch-up adjustment may not exceed 150 percent of the amount of the civil monetary penalties as of the date that the 2015 Adjustment Act was enacted.

[5] The October 1990 CPI is 133.5 and the October 2015 CPI is 237.838.  For more information on CPI figures and calculations, click here.

[6] 29 U.S.C. § 666.

[7] S. 1580, 111th Cong. (2009); H.R. 2067, 111th Cong. (2009).

[8] In addition, civil penalties for OSHA were subsequently included in proposed mine safety legislation, which was similarly unsuccessful. See H.R. 5663; Beveridge & Diamond, P.C., OSHA Legislation Gets Boost from Mine Safety Bill (Aug. 17, 2010). 

[9] S. 1112, 114th Cong. (2014); H.R. 2090, 114th Cong. (2014).

[10]  29 U.S.C. § 666.

[11] As described in the most recent (2013) EPA notice raising maximum penalties,  “EPA’s initial adjustment to each statutory civil penalty amount was published in the Federal Register on December 31, 1996 (61 FR 69360), and became effective on January 30, 1997 (‘the 1996 Rule’). EPA’s second adjustment to civil penalty amounts was published in the Federal Register on February 13, 2004 (69 FR 7121), and became effective on March 15, 2004 (‘the 2004 Rule’). EPA’s third adjustment to civil penalty amounts was published in the Federal Register on December 11, 2008 (73 FR 75340), as corrected in the Federal Register on January 7, 2009 (74 FR 626), and became effective on January 12, 2009 (‘the 2008 Rule’)”; and the fourth adjustment was published in the Federal Register on November 6, 2013.  78 Fed. Reg. 66643 (Nov. 6, 2013)