September 2016 Visa Bulletin Released

september visa bulletinThis week, the Department of State released the September 2016 Visa Bulletin. Given that visa numbers are issued based on the government fiscal year, we expect to see significant movement again in October 2016; for September 2016, the last month of FY2016, there were only minor changes with regard to movement of final action dates in most of the employment-based categories from the August 2016 Visa Bulletin:

  • The Worldwide EB-1 category remains current, but for individuals born in India and Mainland China, there continues to be a cutoff date in the EB-1 category of Jan. 1, 2010 (a change implemented in the August 2016 Visa Bulletin).

  • The cutoff date for Worldwide chargeability in the EB-2 category is still Feb. 1, 2014, but it is likely to return to current in October 2016 at the start of FY2017. The cutoff date for Mainland China remained constant at Jan. 1, 2010. However, there was significant movement in the EB-2 category for India, which moved forward from Nov. 15, 2004, to Feb. 22, 2005.

  • In the EB-3 category, the cutoff date for Worldwide chargeability, as well as El Salvador, Guatemala, Honduras, and Mexico moved more than a year (from March 15, 2016 to May 1, 2016). The cutoff date for Mainland China stayed constant at Jan. 1, 2010. However, the cutoff date for India in the EB-3 category advanced several months from Nov. 8, 2004, to Feb. 15, 2005, and the cutoff date for the Philippines moved over a year from May 15, 2009, to July 1, 2010.

  • For those in the EB-5 category, the priority date remains current for all applicants other than those born in Mainland China, which maintains a cutoff date of Feb. 15, 2014.

With regards to those seeking to file applications for adjustment of status, the U.S. Citizenship & Immigration Service (USCIS) website indicates that the “Final Action Dates” chart for employment-based applications must be used in determining when an applicant is eligible to file Form I-485.

The September 2016 Final Action Dates for Employment-Based Preference Categories are as follows:

Table, VISA

Finally, the Department of State also determined the Family and Employment preference numerical limits for FY2016, as outlined in Section 201(c) and (d) of the Immigration and Nationality Act (INA) as follows:

Worldwide Family-Sponsored preference limit:          226,000

Worldwide Employment-Based preference limit:        140,338

         TOTAL                                                                     366,338

The per-country limit is fixed at 7 percent of the combined annual limits or 25,644 for FY2016. The dependent area annual limit is fixed at 2 percent of the combined annual limits or 7,327 for FY2016.

©2016 Greenberg Traurig, LLP. All rights reserved.

Rights of HIV-Positive Job Applicants and Employees

Job ApplicantsHIV infection is a disability under the Americans with Disabilites Act. What rights and responsibilities does an employer have in relation to HIV-positive applicants and employees? The EEOC recently clarified its position concerning HIV-positive individuals in the workplace in a press release, as well as documents addressing the rights of HIV-positive workers, including the right to be free from discrimination and harassment, and guidance to physicians in facilitating accommodations for those individuals.more

An HIV-positive applicant/employee can generally keep his or her condition private, unless he or she is requesting a reasonable accommodation, or if there is objective evidence (not based on “myths or stereotypes”) that he or she may be unable to do the job or poses a safety risk. Employers do not have to retain employees who are unable to perform, or who pose a “direct threat” to safety, defined by the EEOC as a significant risk of substantial harm even with a reasonable accommodation.

Of course, the applicant or employee is free to choose to reveal his or her status in response to an employer affirmative action program, and the employer may ask medical questions after a job offer has been made, but before employment begins, if everyone entering the same job category is asked the same questions. An employee may also have to discuss his or her HIV status with an employer in order to establish eligibility under other laws, such as the FMLA.

Physicians are reminded that nothing in the ADA alters legal and ethical privacy obligations to patients, and that they should disclose medical information to an employer only if and as authorized by the patient in a signed release. For example, a patient may request that his or her healthcare provider not disclose a specific diagnosis, in which case the physician may state, generally, that the patient has an “immune disorder,” rather than stating that he or she is HIV-positive. Providers may need to discuss an alternative accommodation with the employer, if an initially proposed accommodation would be too difficult or costly.

During FY2014, the EEOC resolved almost 200 charges of discrimination based on applicant/employee HIV status, obtaining more than $825,000.00 for those individuals.

© Steptoe & Johnson PLLC. All Rights Reserved.

Guidance on Ransomware Attacks under HIPAA and State Data Breach Notification Laws

ransomwareOn July 28, 2016, US Department of Health and Human Services (HHS) issued guidance (guidance) under the Health Insurance Portability and Accountability Act (HIPAA) on what covered entities and business associates can do to prevent and recover from ransomware attacks. Ransomware attacks can also trigger concerns under state data breach notification laws.

What Is Ransomware?

Ransomware is a type of malware (malicious software). It is deployed through devices and systems through spam, phishing messages, websites and email attachments, or it can be directly installed by an attacker who has hacked into a system. In many instances, when a user clicks on the malicious link or opens the attachment, it infects the user’s data. Ransomware attempts to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware. After the user’s data is encrypted, the ransomware attacker directs the user to pay a ransom in order to receive a decryption key. However, the attacker may also deploy ransomware that destroys or impermissibly transfers information from an information system to a remote location controlled by the attacker. Paying the ransom may result in the attacker providing the key necessary needed to decrypt the information, but it is not guaranteed. In 2016, at least four hospitals have reported attacks by ransomware, but additional attacks are believed to go unreported.

HIPAA Security Rule and Best Practices

The HIPAA Security Rule requires covered entities and business associates to implement security measures. It also requires covered entities and business associates to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI) the entities create, receive, maintain or transmit and to implement security measures sufficient to reduce those identified risks and vulnerabilities to a reasonable and appropriate level. The HIPAA Security Rule establishes a floor for the security of ePHI, although additional and/or more stringent security measures are certainly permissible and may be required under state law. Compliance with HIPAA’s existing requirements provides covered entities and business associates with guidance on how to prevent and address breaches that compromise protected health information. The new HIPAA guidance specific to ransomware reinforces how the existing requirements can help an entity protect sensitive information.

HHS has suggested that covered entities and business associates frequently back up their documents because ransomware denies access to the covered entity’s and business associate’s data. Maintaining frequent backups and ensuring the ability to recover data from a separate backup source is crucial to recovering from a ransomware attack. Test restorations should be periodically conducted to verify the integrity of backed-up data and provide confidence in an organization’s data restoration capabilities. Because some ransomware variants have been known to remove or otherwise disrupt online backups, entities should consider maintaining backups offline and inaccessible from their networks.

Covered entities and business associates should also install malicious software protections and educate its workforce members on data security practices that can reduce the risk of ransomware, including how to detect malware-type emails, the importance of avoiding suspicious websites and complying with sound password policies.

Lastly, each covered entity or business associate should ensure that its incident response plan addresses ransomware incidents. Many entities have crafted their policies and incident response plans to focus on other more typical daily personal information risks, such as the lost laptop or personal device. A ransomware event should expressly trigger the activities required by the incident response plan, including the requirement to activate the response team, initiate the required investigation, identify appropriate remediation, determine legal and regulatory notification obligations, and conduct post-event review.

Indications of a Ransomware Attack

Indicators of a ransomware attack could include:

  • The receipt of an email from an attacker advising that files have been encrypted and demanding a ransom in exchange for the decryption key
  • A user’s realization that a link that was clicked on, a file attachment opened or a website visited may have been malicious in nature
  • An increase in activity in the central processing unit (CPU) of a computer and disk activity for no apparent reason (due to the ransomware searching for, encrypting and removing data files)
  • An inability to access certain files as the ransomware encrypts, deletes and renames and/or relocates data
  • Detection of suspicious network communications between the ransomware and the attackers’ command and control server(s) (this would most likely be detected by IT personnel via an intrusion detection or similar solution)

What to Do if Subject to a Ransomware Attack?

A covered entity or business associate that is subject to a ransomware attack may find it necessary to activate its contingency or business continuity plans. Once the contingency or business continuity plan is activated, an entity will be able to continue its day-to-day business operations while continuing to respond to, and recover from, a ransomware attack. The entity’s robust security incident procedures for responding to a ransomware attack should include the following processes to:

Activate the entity’s incident response plan and follow its requirements;

  • Notify the entity’s cyber liability insurer as soon as enough information is available to indicate a possible ransomware attack and within any time period required under the applicable policy;
  • Detect and conduct an analysis of the ransomware, determining the scope of the incident and identifying what networks, systems or applications are affected;
  • Determine the origin of the incident (who/what/where/when), including how the incident occurred (e.g., tools and attack methods used, vulnerabilities exploited);
  • Determine whether the incident is finished, is ongoing or has propagated additional incidents throughout the environment;
  • Contain and eradicate the ransomware and mitigate or remediate vulnerabilities that permitted the ransomware attack and propagation;
  • Recover from the ransomware attack by restoring data lost during the attack and returning to “business-as-usual” operations; and
  • Conduct post-incident activities, which could include a deeper analysis of the evidence to determine if the entity has any regulatory, contractual or other obligations as a result of the incident (such as providing notification of a breach of protected health information), and incorporating any lessons learned into the overall security management process of the entity to improve incident response effectiveness for future security incidents.

Additionally, it is recommended that an entity infected with ransomware consult, early on, with legal counsel who can assist with reporting the incident to the extent it is a criminal matter to law enforcement. Counsel frequently have ongoing contacts within the cybercrime units of the Federal Bureau of Investigation (FBI) or the United States Secret Service that may deploy appropriate resources to address the matter and to supply helpful information. These agencies work with federal, state, local and international partners to pursue cyber criminals globally and assist victims of cybercrime. Counsel can advise on the type of information appropriate to disclose to law enforcement, while taking steps to establish and maintain the attorney-client privilege and, if appropriate, the attorney work product protection. Counsel also can assist in preparing communications (e.g., mandatory notifications and reports to senior executives and boards), advise on potential legal exposure from the incident and provide representation in connection with government inquiries or litigation.

If Ransomware Infects a Covered Entity’s or a Business Associate’s Computer System, Is It a Per Se HIPAA Breach?

Not necessarily. Whether or not the presence of ransomware would be a breach under the HIPAA Privacy Rule or HIPAA Security Rule (the HIPAA Rules) is a fact-specific determination. A breach under the HIPAA Rules is defined as, “…the acquisition, access, use or disclosure of PHI in a manner not permitted under the [HIPAA Privacy Rule] which compromises the security or privacy of the PHI.” A covered entity or business associate should, however, perform a risk assessment after experiencing a ransomware incident to determine if a reportable breach has occurred and to determine the appropriate mitigating action.

If the ePHI was encrypted prior to the incident in accordance with the HHS guidance, there may not be a breach if the encryption that was in place rendered the affected PHI unreadable, unusable and indecipherable to the unauthorized person or people. If, however, the ePHI is encrypted by the ransomware attack, a breach has occurred because the ePHI encrypted by the ransomware was acquired (i.e., unauthorized individuals have taken possession or control of the information), and thus is a “disclosure” not permitted under the HIPAA Privacy Rule.

Thus, in order to determine if the information was acquired and accessed in the incident, additional analysis will be required. Unless the covered entity or business associate can demonstrate that there is a “[l]ow probability that the PHI has been compromised,” based on the factors set forth in the HIPAA breach notification rule, a breach of PHI is presumed to have occurred. If a breach has occurred, the entity must comply with the applicable breach notification provisions under HIPAA and, if applicable, state law.

Does a Ransomware Event Trigger State Data Breach Notification Obligations?

Possibly. In a majority of states, data breach notification requirements are triggered when there is both “unauthorized access” to and “acquisition” of personally identifiable information. Whether a ransomware event meets the access and acquisition elements of these statutes is, as in the HIPAA analysis, a fact-specific determination. If, for example, the hackers were able to move the personally identifiable information from the entity’s network to their own, it is clear that the hackers achieved unauthorized access to and acquisition of the information. State data breach notification laws pertaining to the affected individuals would need to be analyzed and factored into the entity’s overall notification requirements.

Ransomware though is usually designed to extort money from victim entities rather than steal personally identifiable information. If the forensics team can present credible evidence that no personally identifiable information was acquired by the hackers, then these obligations may not be triggered. The forensics team, consistent with the incident response team requirements, should document findings that support a defensible decision under these statutes, in case of a subsequent regulatory investigation or litigation, not to notify affected individuals.

In a minority of states, the data breach notification requirements are triggered when there is simply “unauthorized access” to personally identifiable information. This lower standard may mean that the entity must notify its customers of a data breach even when no personally identifiable information is acquired by a hacker. Entities that maintain personally identifiable information of residents of Connecticut, New Jersey and Puerto Rico, for example, may find themselves in the unfortunate position of having to provide data breach notifications even when the information is not acquired by a hacker.

Finally, if the entity is providing services to a business customer, it will need to determine whether it is obligated to notify the business customer (as owner of the affected personal information) of the ransomware attack, taking into account state data breach notification requirements, contractual obligations to notify the business customer and the overall value of the commercial relationship.

Five Lessons from FOX News and Trump on Sexual Harassment

Donald Trump Fox NewsThe recent accusations of sexual harassment against Roger Ailes at Fox News, and the response of a high-profile candidate for public office about how women should respond to sexual harassment have crystallized into an opportunity to learn from the mistakes of others.

Since the mid-1980s, we’ve all read about sexual harassment and been trained on it. For the last 25 years, I’ve studied it, investigated it, seen it, taught about it, warned about it, developed policies to guard against it, and defended companies accused of it. Here are a few lessons from these recent events:

A Quick Review

If you’ve avoided (whether by choice or by luck) these last few news cycles, former Fox News anchor Gretchen Carlson accused former Fox News Chairman and CEO Roger Ailes of sexual harassment. After an outside investigation and multiple women providing more examples of his alleged slimy behavior, Ailes is now gone. It happened quickly.

Then, in responding to questions about sexual harassment, a high-profile office-seeker went on record saying he hopes his daughter would quit if she were sexually harassed—and seek another career—which is, by all accounts, an impossibly unrealistic option for most women. Another family member, jumping on the grenade, made it worse when he tried to explain that what his dad actually meant was that a “strong” woman would not allow such sexual harassment to continue – implying (whether intentionally or not) either that strong women could control it, or would have the power to find other work.

Enough already. Sexual harassment is personal; it’s sensitive, and it’s complicated.

Five Quick Lessons

  • Lesson 1: Sexual harassment comes in many forms.

In 1986, 30 years ago, the U.S. Supreme Court determined that sexual harassment is a form of sex discrimination. Today, the law recognizes harassment that includes female-on-male, male-on-male, female-on-female, but most often we see the male-on-female harassment. Still.

  • Lesson 2: Most women don’t want to complain about it. Period.

Since the 90s, the research has repeatedly shown that complaining is the leastlikely response from women who were harassed. The more likely responses include (1) avoiding the harasser; (2) downplaying the gravity of it; (3) ignoring it; and (4) taking it head-on.

The EEOC’s recently released Select Task Force Report on the Study of Harassment in the Workplace explains in more detail that most women who are victims of harassment don’t ever complain about it. They just want to fly under the radar. There are a lot of reasons, but that’s for a much longer article in a different format. In sum, usually, it takes courage to complain.

  • Lesson 3: Know when to bring in outsiders.

Fox News did the right thing by bringing in an outside investigator—reportedly an outside law firm—to investigate the Carlson allegations. When the accused is in a position of power (like Ailes), such that other employees might be afraid to tell what they’ve actually experienced or seen, an internal investigator is usually not enough. An outside neutral has no attachment to the accused or accuser, and the results—whatever they are—in most cases, are more likely to be more thorough, more revealing, and more trusted.

Importantly, with an outside law firm as an investigator, you also have more opportunities to protect communications, advice, and other developments under the attorney-client privilege. That process must be carefully handled.

  • Lesson 4: Confidentiality is critical.

When employees report harassment, the law compels employers to investigate. We know investigations can be messy and trigger unexpected consequences. Practically, it makes sense to protect those who complain and those about whom complaints are made. Some sexual harassment (like the allegations against Ailes) is severe, while other accusations are more tame. In some cases, there really is no evidence of a hostile work environment and no evidence of harassment. Everyone needs to be protected.

For those of you chiding me for the NLRB’s sweeping decisions against blanket confidentiality rules, I know, I know. But, after being on the front lines of these investigations, confidentiality is critical to protecting everyone in an investigation, and to prevent retaliation.

Notably, even the EEOC’s Select Task Force acknowledges the need for the EEOC and NLRB to “jointly clarify and harmonize the interplay of the National Labor Relations Act and federal EEO statutes with regard to the permissible confidentiality of workplace investigations, and the permissible scope of policies regulating workplace social media usage.”

  • Lesson 5: Update your policies.

Good employers have good policies that encourage people to come forward. The EEOC’s Select Task Force Report emphasized that a modern, updated policy will include the following elements:

    • Clear explanation of prohibited conduct, including examples
    • Promises to protect against retaliation
    • Complaint process that provides multiple, accessible avenues of complaint
    • Promises to protect the confidentiality of harassment complaints to the extent possible
    • Processes for a prompt, thorough, and impartial investigation
    • Promises to take immediate, proportionate corrective action when harassment has occurred

Promises to respond appropriately to behavior that might not be legally actionable “harassment,” but that which—left unchecked—might lead to harassment

The Select Task Force Report also lists a host of other recommendations, including updating training. Practically, even the best of policies may not have prevented the conduct that Ailes is accused of committing, but let’s take this opportunity to try.

Distracted Driving vs. DUI: The Legal Consequences

Distracted DrivingWith the explosion of cell phones in the consumer marketplace, texting and driving has emerged as a national health crisis for individual motorists, the public, and the courts. In 2013, 10 percent of all fatal crashes involved distraction, resulting in the deaths of 3,154 people. Additionally, it is estimated that another 424,000 people were injured in accidents involving distracted drivers.1 In addition to texting while driving, other types of distracted driving include talking on cell phones, eating, using in-dash electronics, and any other activity that takes a driver’s attention away from the road.2

In response to the problems presented by texting and driving, 46 states and the District of Columbia have instituted laws forbidding the action, criminalizing texting and driving as at least an infraction.3 At the same time, other forms of distracted driving, including using social media applications such as Twitter, Facebook, LinkedIn, SnapChat and recently, Pokemon Go, have emerged as major problems in their own right.4 In a study recently completed by Liberty Mutual Insurance, a survey of 2,500 teenagers revealed that almost 70 percent admitted to using social media apps while they drive.5 In another survey completed by the National Safety Council of 2,409 drivers of all ages, 74 percent of those who were surveyed indicated that they would use Facebook while they drove.6

Distracted Driving vs. DUI: Levels of Impairment

A 2006 study looked at the impairment levels of people who were using cell phones versus people who were intoxicated while driving. The University of Utah researchers used a driving simulator and compared study participants who were talking on their cell phones versus those who were legally intoxicated. The researchers looked at results using the simulator involving 49 adult participants who ranged in age from 22 to 45. They first obtained baseline driving results, then looked at driving while using cell phones and finally, driving with blood alcohol concentrations of 0.08 percent over a 3-day period.7 By looking at data obtained from driving profiles the researchers created using 10-second epochs, the researchers found that cell phone users, regardless of whether or not they were using hands-free or handheld devices, showed greater levels of driver impairment than did the drivers who were intoxicated by alcohol.8

Injury and Fatality Statistics for Distracted Driving Vs. Drunk Driving

The Centers for Disease Control and Prevention reports that distracted driving injures 1,161 people and kills eight every day in the U.S.9 By comparison, the agency reports that 28 people are killed every day in accidents involving drunk drivers.10 While the percentages of people using cell phones while driving has increased, drinking and driving has decreased.11, 12

Overview of State Laws: Distracted Driving vs. DUI Penalties in California and Alaska

The penalties for texting and driving vary from state to state. While the act is banned in 46 states, some jurisdictions, such as California, make texting and driving only an infraction. In California, a first offense is punishable by a fine of $20, and subsequent convictions are punishable by fines of $50.13

By comparison, Alaska treats texting while driving quite harshly, along with using other electronic devices while operating a motor vehicle. If a person does not injure another while texting and driving, he or she may still be convicted of a class A misdemeanor carrying a fine of up to $10,000 and imprisonment in a county jail of up to one year.14 If a person is injured in an accident caused by someone who was texting while driving in Alaska, the driver may be convicted of a class C felony, and if a person is killed, the driver may be convicted of a class A felony, making the felony sentencing range anywhere from 5 years for a class C conviction up to 20 years for a class A conviction and a fine of up to $50,000 for a class C conviction and up to $250,000 for a class A conviction.

As compared to its treatment of texting while driving, California takes a much harsher approach to people who are convicted of driving under the influence. For a first offense, a person may receive up to 6 months in jail and a fine of up to $1,000.If the DUI offense resulted in an injury, then the person may either be charged with a misdemeanor or a felony as a wobbler offense. A felony conviction can result in up to 3 years in jail along with a fine of up to $5,000.16

Distracted Driving: Does the Punishment Fit the Crime?

In states like California, which make texting while driving only a traffic infraction carrying very minimal fines, it is interesting to note the disparity between it and a DUI conviction in the same state. While texting and driving may cause greater driver impairment and potentially serious injuries or deaths, it is treated as a much less serious offense. In Alaska, by contrast, texting while driving is treated very seriously, potentially carrying penalties that are as great or greater than those for various levels of drunk driving offenses. The remainder of the states represents a mishmash, ranging between the four with no penalties at all to Alaska with the potential for a serious felony conviction.

Conclusion

Distracted driving is potentially just as or more dangerous than driving while under the influence of alcohol. With millions of people routinely texting while driving or using social media applications while driving, the roads are becoming more dangerous. Still, the states have yet to catch up to the dangers posed by these forms of distracted driving with a majority treating them as minor infractions. States should review the research and consider bringing parity between their DUI statutes and penalties with their statutes criminalizing texting and driving. An added emphasis on educational campaigns about texting while driving along with campaigns about using social media apps while driving may also be added steps that states should consider. Failing to take further action to curb these forms of distracted driving could be potentially disastrous.

ARTICLE BY Steven M. Sweat
Copyright © 2016 · Steven Sweat

1. NATIONAL CENTER FOR STATISTICS AND ANALYSIS, NATIONAL HIGHWAY TRAFFIC SAFETY ADMINISTRATION, [hereinafter NHTSA 2013 report] available at http://www.distraction.gov/downloads/pdfs/Distracted_Driving_2013_Resear….

2. CENTERS FOR DISEASE CONTROL AND PREVENTION, INJURY PREVENTION and CONTROL, MOTOR VEHICLE SAFETY, DISTRACTED DRIVING, 1 (2016)[hereinafter CDC report] available at http://www.cdc.gov/motorvehiclesafety/distracted_driving/.

3. Governors Highway Safety Association, Distracted Driving Laws (2016), available athttp://www.ghsa.org/html/stateinfo/laws/cellphone_laws.html.

4. Liberty Mutual Insurance, Teen Driving Study Reveals “App and Drive” is New Danger Among Teens, New Worry for Parents (2016), available at https://libertymutualgroup.com/about-lm/news/news-release-archive/articl….

5. Id.

6. National Safety Council, Distracted Driving Public Opinion Poll (March 2016), available at http://www.nsc.org/NewsDocuments/2016/DD-Methodology-Summary-033116.pdf.

7. David L. Strayer et al., Fatal Distraction? A Comparison of the Cell-Phone Driver and the Drunk Driver (2006), available athttp://www.psych.utah.edu/AppliedCognitionLab/DrivingAssessment2003.pdf.

8. Id.

9. Supra note 2.

10. CENTERS FOR DISEASE CONTROL AND PREVENTION, INJURY PREVENTION AND CONTROL, MOTOR VEHICLE SAFETY, IMPAIRED DRIVING, 1 (2016), available at http://www.cdc.gov/motorvehiclesafety/impaired_driving/impaired-drv_fact….

11. Distraction.gov, What is Distracted Driving?, http://www.distraction.gov/stats-research-laws/facts-and-statistics.html (last visited Aug. 2, 2016).

12. Matthew Chambers et al., UNITED STATES DEPARTMENT OF TRANSPORTATION, BUREAU OF TRANSPORTATION STATISTICS, DRUNK DRIVING BY THENUMBERS (2016), available at http://www.rita.dot.gov/bts/sites/rita.dot.gov.bts/files/publications/by….

13. Cal. Veh. Code § 23123.5(d).

14. Alaska Stat. §§ 28.35.161, 12.55.035, 12.55.135, 12.55.125.

15. Cal. Veh. Code §§ 23152, 23153.

Copyright © 2016 · Steven Sweat

Profits Interest as Equity-Based Incentive: Keeping Your Team Motivated

LLC, Business Team, Equity based incentiveSay you own one-half of an LLC that is taxed as a partnership. You and your partner invested the initial capital that was necessary to get the business up and running, and you both built the business with the help of a few key employees. With the business still in the growth phase, you want to make sure that you motivate and retain these key employees who are helping you grow your company. What should you do? You and your partner might want to consider causing the LLC to issue the key employees a profits interest in the LLC.

What is a Profits Interest?

From a tax-standpoint, an LLC can issue two basic types of membership interests: capital interests and profits interests. A capital interest is an interest in a partnership or LLC taxed as a partnership that entitles the recipient to share immediately in the proceeds of liquidation. A capital interest normally results from a capital investment and provides recipients with participation in current and future equity value, a share of income, and distributions. When someone receives a capital interest in an LLC in exchange for a corresponding capital contribution, this is typically a tax-free event. When someone receives a capital interest in exchange for services, this is taxable compensation to the service provider.

Profits interests are distinct from capital interests, providing no current right to share in the proceeds of liquidation as of the date of grant. Instead, they typically only provide a holder with the right to share in those profits of the business that arise after the recipient acquires the interest. The primary goal of issuing profits interests is typically to give a service provider the ability to participate in the growth of the enterprise without incurring tax on the receipt of the interest, and to enjoy at least some long-term capital gain treatment (instead of ordinary income treatment) on proceeds they receive on a sale of the LLC or similar liquidity event.

Structuring a Profits Interests

Usually, as long as the profits interest is structured properly and capital accounts are booked up on entrance of the profits interest member, the IRS should not treat the grant of a vested or unvested profits interest as a taxable event. Most practitioners design profits interests so that they meet IRS safe harbor standards for ensuring profits interest treatment. These standards include:

  1. The profits interest must not relate to a substantially certain and predictable stream of income from the entity’s assets, such as income from high quality debt securities or a net lease,

  2. The recipient of the profits interest must not dispose of it within two years of receipt, and

  3. The profits interest may not be a limited partnership interest in a publically traded partnership.

The issuing entity’s partnership or operating agreement should be closely examined upon the issuance of a profits interest. Things to consider with respect to newly issued profits interests include whether such recipients should have voting rights similar to that of members who contributed capital to the enterprise. Additionally, the agreement should be updated to clearly define how the profits interests will be valued relative to capital interests under current buy-out or redemption provisions. Oftentimes, practitioners ensure that a profits interest has no right to share in liquidation proceeds on the grant date by valuing the company as of that date, and providing that a profits interest holder will not share in distributions except to the extent a threshold established based on the value is exceeded. Also, booking up capital accounts is generally critical to ensuring that the profits interest does not entitle the recipient to any proceeds of liquidation if the entity was liquidated on the grant date.

To the extent the profits interest issued is unvested at the time of issuance, most practitioners opt to make an 83(b) election to ensure tax-free treatment upon receipt. When a profits interest is issued, it has no value. If the profits interest is vested, there is no question that it is taxed at the time of receipt, at $0. Unvested property is taxed at the time of vesting, on the property’s value at the time of vesting. Hence, if the profits interest has appreciated in value since the time of grant, then there would be ordinary income at the time of vesting. To avoid this treatment, recipients of profits interests can make an 83(b) election, which is an election to treat the profits interest as vested for tax purposes at the time of grant and to be taxed on the value of the profits interest at the time of grant. There is some IRS guidance that states that an 83(b) election is not necessary. However, that issue is beyond the scope of this article and a so-called “protective 83(b) election” is usually still made to assist in easing the minds of profits interest holders who want to ensure that the interest is not taxable when it vests.

Tax Consequences of a Profits Interest

The recipient of a properly structured profits interest is not taxed on receipt because the IRS views the profits interest’s value as $0. Because the profits interest is treated as having no value, there is no deduction that corresponds to the issuance of the profits interest for the entity. The profits interest will be treated as having a $0 basis, and no capital account. Going forward, the recipient should be treated as an equity owner under the terms of the governing partnership or operating agreement for the entity starting on the date on which the profits interest was granted. The recipient should receive a K-1 and pay taxes on income that is passed through from the entity. Capital accounts should be adjusted accordingly, just as is the case for any other member.

The Future of Profits Interests

The history of how profits interests are taxed is riddled with controversy. In addition, politicians continue to discuss the desirability of profits interests (also sometimes called “carried interests”), in the context of private equity and hedge funds. However, the foregoing analysis reflects the IRS’ stated position on profits interests based on several Revenue Procedures that were issued to address the topic pending additional guidance. Until the IRS or Department of Treasury issues additional guidance, the current rules will generally remain applicable to small businesses and startups who are issuing profits interests.

Overall, profits interests are a unique and creative way to give people who are rendering services to the LLC or partnership a stake in the enterprise. They can generally be viewed as similar to options, except that they also provide the holder with a stake in the losses of the entity. With the increasing use of LLCs for startup operations, the use of profits interests as an incentive compensation mechanism has grown in the past years.

ARTICLE BY Katie K. Wilbur of Varnum LLP

© 2016 Varnum LLP

Pokémon Go – Staying Ahead of Game and Avoiding Unexpected HIPAA Risks

HIPAA RisksIt was inevitable – Pokémon Go fever has swept the nation, and now little cartoon creatures have found their way into your health care facility.

Wait, what!?

Yes, you read that right, those pesky (or beloved, depending on your point of view) creatures are popping up literally everywhere, and unfortunately hospitals and other health care facilities are no exception. As a result, in addition to keeping up with the various advances in mobile technology related to health care and patient management, health care facilities across the country must now add keeping up with virtual and augmented reality to their to-do lists.

So why should this matter to your health care facility?

Currently, industry trends suggest that hospitals and other health care facilities are taking two divergent views when it comes to this new frontier – (a) asking to be taken off the “map” (i.e., having Pokémon removed from their property), or (b) embracing the game, as it motivates the young (and old) to be active. While the latter could be tempting – and for some facilities with proper controls it could be successful – for most, we recommend taking whatever steps possible to prohibit game play within your health care facility.

Regardless of the road taken by your facility, there are a few key considerations to keep in mind when evaluating potential HIPAA risks related to virtual and augmented reality games, which are only likely to grow substantially in number in the future.

How do Pokémon Go and augmented reality games work?

On first glance, this specific game (which is fairly primitive as augmented reality) doesn’t appear problematic from a HIPAA perspective. However, there are some hidden risks. The Pokémon game’s functionality allows for a user to switch between a virtual map and camera mode which literally shows the Pokémon in the world around the player. The images seen on the player’s phone do not appear to be saved or shared automatically – however, the mobile application does offer the option of letting you take a photo of what you see from within the app. In a world dominated by social media, this is where the problem arises.

Pokémon Go and other augmented realty games allow a player to engage in a virtual game which takes place in the real world around them. Pokémon Go players are motivated to take photos of their surroundings and share them with third parties and on social media. In a health care environment, this could easily result in a player – whether patient, employee or third-party gamesman – inadvertently sharing protected health information (PHI) with all of his or her followers in as little as four clicks from taking a screenshot.

Many hospitals are already dealing with the unintended consequences of individuals playing Pokémon Go and wandering into areas containing sensitive information. Even if photographs are not taken, the mere presence of individuals who are only on premises for the purpose of playing a game heightens potential information privacy and security risks.

What is this picture worth?

Hospitals have learned the hard way the high cost of a HIPAA violation. In April of this year the Department of Health and Human Services, Office for Civil Rights (OCR) reached a $2.2 Million settlement with New York Presbyterian Hospital for the filming of “NY Med” on the premises, which resulted in the unauthorized sharing of two patients’ images. OCR also determined that the hospital failed to safeguard health information when it offered the film crew access to an environment where PHI could not be effectively protected.

OCR is likely to follow the same logic in the context of augmented reality games and the potential exposure of PHI to unauthorized parties. Having Pokémon Go players on hospital premises – including patients, visitors, employees and, most especially, those present solely for the purpose of playing the game – could lead to unnecessary HIPAA risks.

Best practices for Pokémon Go and its successors:

  • Take yourself off the “map,” but remember this is not where the story ends: To alleviate the a number of risks, you can, of course, submit an online request to Niantic Labs – the creator of Pokémon Go – to be removed as an in-game location. However, this step alone will not be sufficient to end all possible risks related to Pokémon Go, and the universe of augmented realty that could pop up next. It is also notable the removal process to be a stop has proven lengthy, therefore it would be advisable to also take additional steps regarding your stance on Pokémon Go and augmented realty games. To speed up the process, consider writing a formal demand – above and beyond the online system – to have your coordinates removed from game play.

  • Determine your stance on patient play: Aside from hospital policies on visitor and patient cell phone use, determine if your establishment wants to promote patient use of Pokémon Go. Many facilities are finding Pokémon Go to be a valuable tool in promoting exercise and activity – especially post procedures. If your hospital wants to take that approach – consider limited play to “Pokémon Zones” where PHI is less accessible and adequately protected. However, keep in mind that significant risks remain related to permitted access to PHI to unauthorized individuals.

  • Determine if health care providers and hospital staff should be prohibited from playing: Reevaluate your social media and bring-your-own-device policies to determine if augmented reality games such as Pokémon Go need to be specifically addressed. The player base of Pokémon Go appears to be growing exponentially, and it is highly unlikely that facilities’ employees are not among those playing or considering playing. While taking photographs is often prohibited in hospital settings, make sure the policy is clear that the prohibition applies to photos in the augmented reality space. Take the opportunity to clarify and reiterate acceptable social media practices. Also, if your hospital is creating “Pokémon Zones,” stress to health care providers and staff that this applies to them as well.

While Pokémon Go took over the scene almost literally overnight, this is just a glimpse of what the future holds. As augmented reality mobile applications and games become even more popular, and more immersive, these issues are bound to come up again and reinvent themselves in the form of new challenges. Now is the time to determine your organization’s policy on augmented reality and revisit social media and BYOD policies. Pokémon Go may or may not be here to stay – but it is definitely not one of a kind.

©2016 Drinker Biddle & Reath LLP. All Rights Reserved

NFL Commissioner’s Powers Affirmed in Eighth Circuit Ruling on Adrian Peterson Suspension

Adrian PetersonNFL-appointed Arbitrator Harold Henderson’s decision to uphold Commissioner Roger Goodell’s suspension of Minnesota Vikings running back Adrian Peterson for alleged child abuse was proper, The U.S. Court of Appeals for the Eighth Circuit has ruled. NFL Players Association v. National Football League et al., No. 15-1438 (8th Cir. Aug. 4, 2016).

The decision marks a further affirmation of Commissioner Goodell’s authority and almost unlimited power to discipline players pursuant to the terms of the current collective bargaining agreement between the League and its players association.

As Boston College Law Professor Warren K. Zola commented, “The power of the NFL commissioner strengthens as 8th Circuit determines ‘fundamental fairness’ is subordinate to collective bargaining.”

The Eighth Circuit’s decision overturned U.S. District Judge David Doty’s February 2015 decision vacating Arbitrator Henderson’s decision to uphold Goodell’s suspension of Peterson for the remainder of the 2014 season after Peterson pled no contest to a charge of misdemeanor reckless assault child abuse charges in November of that year.

The National Football League Players Association (NFLPA) had filed a grievance against the NFL on Peterson’s behalf following the suspension, asserting that Peterson should have been disciplined under the League’s prior conduct policy, which authorized only a maximum two-game suspension. Goodell’s appointed arbitrator rejected that argument and upheld the suspension.

The NFLPA had argued before the Eighth Circuit that Judge Doty had properly ruled that the League misapplied a domestic abuse policy enacted after Peterson’s alleged wrongful conduct in violation of the League’s collective bargaining agreement. A three-judge Eighth Circuit panel disagreed, reversing Judge Doty’s decision and concluding the district court had improperly vacated Arbitrator Henderson’s decision upholding the suspension.

The Eighth Circuit stated,

“We conclude that the parties bargained to be bound by the decision of the arbitrator, and the arbitrator acted within his authority, so we reverse the district court’s judgement vacating the arbitration decision.”

Jackson Lewis P.C. © 2016

Bristol-Myers Squibb Agrees To Pay $30 million To Settle Whistleblower Case Brought Under The California Insurance Fraud Prevention Act

Bristol-Myers Squibb whistleblower
Intimidation of whistleblower concept and whistle blower stress symbol representing the pressure experienced for exposing corruption with shadows of people who do not follw the rules as a red whistle shaped as a human head.

In 1993, the California Legislature enacted the Insurance Frauds Prevention Act (“IFPA”) in a unique effort to combat rampant insurance fraud that was driving up the cost of insurance premiums for citizens throughout the state. In particular, California lawmakers sought to deter fraudulent activity related to automotive insurance, workers’ compensation, and healthcare claims.

With regard to the latter, the IFPA expressly recognizes that “[h]ealth insurance fraud is a particular problem for health insurance policyholders. Although there are no precise figures, it is believed that fraudulent activities account for billions of dollars annually in added health care costs nationally. Health care fraud causes losses in premium dollars and increases health care costs unnecessarily.”

One of the specific fraudulent practices the IFPA is designed to prevent is the payment of unlawful kickbacks to doctors for prescribing certain medicines.

This month, after nearly a decade of litigation, Bristol-Myers Squibb agreed to pay $30 million to settle an IFPA lawsuit that was filed in 2007 by three former Bristol-Myers employees. The whistleblowers alleged that Bristol-Myers Squibb violated the IFPA by employing and using sales representatives for the purpose of defrauding private commercial health insurers by using kickbacks to procure patients or clients. The kickbacks were designed to increase physician prescriptions of several drugs produced by Bristol-Myers Squibb including Pravachol, used to lower cholesterol. Enticements included:

  • Box suites at sporting events where physicians were provided tickets, food, drinks, and parking.
  • Enrollment in a Lakers basketball camp for doctors and their children.
  • Pre-paid golf outings at luxurious golf courses.
  • Tickets for physicians and their families to see Broadway plays in California cities.
  • Monetary incentives given to doctors responsible for prescription-drug decisions for formularies.
  • Lavish dinners, resort hotel trips, and concert tickets, given to doctors who were large-volume prescribers, to induce more prescriptions in the future.

In addition to the $30 million payment, the settlement agreement with the California Insurance Commissioner Dave Jones requires Bristol-Myers Squibb to affirm its commitment to abiding by California laws regulating its sales representatives’ interactions with doctors, including compliance with pertinent provisions of the IFPA.

The Bristol-Meyers settlement is a prime example of how regular citizens can use the IFPA to hold wrongdoers accountable for fraudulent acts that harm the public. The IFPA provides for civil penalties of $5,000 and $10,000 per insurance claim that is made as a result of fraud (so, here, every prescription doctors wrote as a result of the kickback scheme that was then submitted for payment by an insurer), plus an additional assessment of up to three times the amount of each claim for compensation.  In addition, the IFPA vests the court with authority to grant additional relief as needed to protect the public interest. This additional relief can take the form of an injunction, which prohibits future fraudulent conduct—and can change industry practices.

How the IFPA works

Codified at section 1871 of the California Insurance Code, the California Insurance Fraud Prevention Act (“IFPA”) allows members of the public to bring whistleblower lawsuits in the name of the State against anyone who submits a fraudulent insurance claim to a California insurance provider. Some of the most common types of fraud prohibited by the IFPA include:

  • Providing kickbacks to doctors to prescribe certain medications.
  • Billing for healthcare services that were not provided.
  • Submitting multiple claims for a single health service.
  • Knowingly causing an auto accident for the purpose of submitting false insurance claims.
  • Underreporting the number of employees to avoid paying proper workers’ compensation insurance.
  • Providing kickbacks to insurance agents for sending business to a particular automotive repair business.

Once an IFPA violation has been identified, the complaint is filed under seal in state court and served on the local district attorney and the California insurance commissioner. The district attorney and insurance commissioner then have 60 days (or longer) to decide whether or not to intervene in the case. If either the district attorney or the commissioner decides to intervene, government attorneys may take a leading role in the prosecution, or they may allow the relator (the technical term for the whistleblower or other private citizen who initiates the lawsuit) to take the lead with the government in a supporting role.

In cases where government attorneys intervene to assist with the prosecution of the case, the relator is entitled to collect 30-40% of any recovery from the defendant, whether that recovery is achieved through settlement or a favorable judgment. For purposes of determining the relator’s share, the “total recovery” is the amount remaining after the government and the relator have been reimbursed for reasonable attorneys’ fees, costs and expenses incurred during the case.

If the government does not intervene, the relator may proceed with the case with her own counsel. If she chooses to proceed without the government’s help, she stands to recover 40-50% of any eventual recovery. Whether the government intervenes or not, the exact percentage of the relator’s recovery will depend upon “the extent to which the person substantially contributed to the prosecution of the action.” Moreover, if the court determines that the relator’s case is based primarily on information that was already publicly available, such as news articles or public hearings, the relator’s share of the recovery is reduced to a maximum of 10% of the recovery.

In addition to steep penalties for fraudulent acts and generous payments to the relator in successful cases, the IFPA has specific provisions aimed at protecting whistleblowers from retaliation for reporting fraudulent practices. The Act states that employees who suffer retaliation as a result of their involvement in reporting insurance fraud are entitled to complete relief, which includes reinstatement in a position with seniority equal to what the employee would have had absent the retaliation, plus twice the amount of back pay the employee is due, with interest. In addition, employees who are discriminated against in violation of the statute are entitled to attorneys’ fees and reasonable litigation costs.

© 2016 by Tycko & Zavareei LLP

Is H-1B Reform On Its Way?

h-1b reformTwo bipartisan bills to reform professional-level visa classifications were introduced into Congress this past July. Given the charged nature of the national discourse on immigration issues this election year, it seems unlikely either bill will be enacted before the presidential election. The bipartisan nature of both bills, however, suggests Congress may be able to coalesce, in the near future, around new H-1B legislation. If these or similar reforms are enacted under a new administration, the information technology (IT) sector, specifically, and all employers who rely on outsourced labor or who contract with H-1B dependent employers may face significant changes to their operations.

Overview of the H-1B program

Through the H-1B program, U.S. employers can sponsor up to 85,000 new foreign workers each fiscal year for employment in “specialty occupations.”1 Generally speaking, a “specialty occupation” is a professional-level position that requires a bachelor’s level education (or higher) in a specific field of study. Common specialty occupations include white-collar professions such as accountants, teachers, doctors, engineers and numerous IT positions including software developers, computer programmers and systems analysts. With the exception of H-1B workers whose employers are sponsoring them for legal permanent residence (green cards), H-1B workers are allowed to remain in the U.S. for up to six years of employment.

The H-1B program has been heavily oversubscribed the last few years. In fact, in each of the last two years, employers filed approximately 230,000 petitions against the 85,000 H-1B visas available. Because extension petitions for employees who have already been granted H-1B status are not counted against the numerical cap, the total number of H-1B workers in the U.S. at any given time is estimated to be around 600,000.2

IT workers constitute the bulk of H-1B employees in the U.S. For fiscal years 2013 and 2014, for example, U.S. Citizenship & Immigration Services (USCIS) reports that close to two-thirds of workers in each fiscal year were employed in computer-related occupations.3 The significance of the H-1B program to the IT sector and entrepreneurship is such that over the years many leading entrepreneurs and IT innovators, including Michael Bloomberg, Mark Zuckerberg and Bill Gates have vocally called for increases in the number of annual H-1Bs available, among other reforms.4

The H-1B program is regulated by both the U.S. Citizenship & Immigration Services (USCIS) and the Department of Labor (DOL). The program requires, among other elements, that the employer make a binding promise to pay the sponsored H-1B worker the higher of the actual wage the employer pays to similarly-situated workers or the prevailing wage for the occupation in the area of intended employment.

In addition, an employer who relies significantly on H-1B workers, called an “H-1B dependent” employer,5 must attest to having tried to recruit a U.S. worker for the position and must promise that the intended H-1B employment will not displace a U.S. worker within 90 days before and 90 days after the employer files the H-1B petition in support of the H-1B worker.6 An H-1B dependent employer, however, can exempt itself from the U.S. recruitment and non-displacement limitations for petitions in which the company pays the H-1B worker at least $60,000 or for petitions in which the employer files on behalf of an H-1B worker with at least a master’s degree in the specialty occupation.

The potential displacement of U.S. workers by H-1Bs has been a periodic concern since the beginning of the modern H-1B program. Displacement has recently been brought back into the spotlight by allegations some U.S. employers replaced several hundred U.S. IT workers with foreign nationals.7 The U.S. workers are also alleged to have been forced to train their foreign-worker replacements as a precondition to receiving a severance package.8 A subsequent investigation by the DOL into allegations of H-1B program violations related to at least one of those U.S. employers, Southern California Edison, appears to have been resolved in favor of the company and its IT consulting vendor.

H.R. 5801: Limiting U.S. worker displacement by H-1B dependent employers

On July 14, 2016, Representative Darrell Issa (R-CA) introduced H.R. 5801, the “Protect and Grow American Jobs Act,” which has been referred to the House Judiciary Committee. The bill proposes to reduce H-1B dependent employers’ ability to avoid U.S. worker recruitment and non-displacement provisions. Under this bill, H-1B dependent employers would be bound by the provisions unless they promised H-1B workers a salary of at least $100,000 (increased from the current $60,000). The bill would also eliminate the Master’s degree exemption. The bill has bipartisan support and is co-sponsored by Rep. Peters (D-CA), Rep. Polis (D-CO), Rep. Vargas (D-CA), Rep. Farenthold (R-TX), Rep. Smith (R-TX), Rep. Hunter (R-CA) and Rep. Davis (D-CA).

H.R. 5657: Limiting U.S. worker displacement by any H-1B employer

On July 7, 2016, Representative Bill Pascrell, Jr. (D-NJ) introduced H.R. 5657, the “H-1B & L-1 Visa Reform Act of 2016,” which has been referred to both the House Judiciary and House Education and the Workforce committees. This bill proposes largescale changes to the H-1B program, including eliminating H-1B dependent employers as a separate classification. This change would subject all H-1B employers to the U.S. worker recruitment and non-displacement provisions that currently apply only to H-1B dependent employers.10 The bill would also double the non-displacement window from the 90 days before and after filing the petition to 180 days on each side of the filing.

In addition, under this proposal an H-1B worker would be authorized to perform services only at his or her employer’s work location unless the employer first obtained a waiver from the DOL.11 This provision would directly, and adversely, impact the business model of modern consulting companies and their clients; moreover, the new waiver requirement would seemingly prevent most staffing companies from accessing the H-1B program.12 

The bill is co-sponsored by Rep. Rohrabacher (R-CA).

What would these proposals mean?

For IT consulting companies and their corporate clients, these proposed changes could force significant changes. At a minimum, the cost to hire an H-1B worker would increase. And, if consultant-vendors are limited in placing H-1B workers at a client site, the end-client may need to scramble to fill positions that can no longer be filed by their consultant-vendor.

Copyright © 2016 Godfrey & Kahn S.C.

1 Universities and certain nonprofit research facilities are exempt from the 85,000 numerical limitation.
See, e.g., Immigration Reforms to Protect Skilled American Workers: Hearing Before the S. Judiciary Comm., 114th Cong. (2015) (testimony of Professor Ron Hira).
3 U.S. Citizenship and Immigration Servs., Characteristics of H-1B Specialty Occupation Workers: Fiscal Year 2014 Annual Report to Congress 12, Table 8A (2015).
4 Matthew DeLuca, Tech Demands More H1-B Visas as Critics Cry Foul (Apr. 10, 2014).
5 For an employer with at least 51 workers, if 15% or more are H-1B workers, the employer is classified as H-1B dependent.  8 U.S.C. §1182(n)(3)(A)(iii).  There are separate calculations for smaller employers.  Id. §§1182(n)(3)(A)(i) and (ii).
6 8 USC §§1182(n)(1)(E) and (G).
See Matthew Thibodeau, Southern California Edison IT Workers ‘Beyond Furious’ Over H1-B Replacements, Computerworld (Feb. 4, 2015); Sara Ashley O’Brien, Disney Sued for Replacing American Workers with Foreigners, CNN Money (Jan. 26, 2016).
Id.
9 Press Release, Infosys, U.S. Dep’t of Labor Concludes Investigation, No Violations by Infosys Found.
10 H.R. 5657, sec. 101(d)(1).
11 Id. sec. 101(e).
12 See, id. sec. 113(a) (making the waiver dependent, in part, on a DOL finding that the “placement of the H-1B [worker] is not essentially an arrangement to provide labor for hire for the [third-party] employer with which the H-1B [worker] will be placed.”)