On Dec. 22, 2017, President Donald Trump signed into law the Tax Cuts and Jobs Act (Act). The Act makes significant changes to the federal Internal Revenue Code (Code), including changes that impact employee benefits. Effective for 2018:
- Employers cannot deduct expenses associated with qualified transportation fringe benefit programs;
- Employees cannot exclude bicycle commuting reimbursements from their gross income; and
- Moving expense reimbursements are not deductible for employers and cannot be excluded from employees’ gross income.
In addition, effective for 2018 and 2019, the Act creates a federal tax credit for employers that provide paid family and medical leave.
Because most of the Act’s provisions became effective on Jan. 1, 2018, employers should start working with their tax advisors to determine how the tax changes will impact their businesses.
Qualified Transportation Fringe Benefits
Code Section 132 allows employers to provide certain transportation benefits to employees on a tax-free basis. These benefits include qualified parking, transit passes, and transportation to and from work in a commuter highway vehicle (“vanpooling”). Prior to 2018, bicycle commuting reimbursements also qualified for this tax exclusion.
Qualified transportation expenses paid by either the employer or employee can be excluded from an employee’s gross income, up to certain limits. For 2018, the tax exclusion limits are $260 per month for qualified parking expenses and $260 per month for transit passes and vanpooling expenses, combined.
Beginning in 2018, the Act eliminates the employer deduction for expenses associated with a qualified transportation fringe benefit program. The Act also eliminates the deduction for any expenses incurred in connection with providing transportation to an employee in connection with travel between the employee’s residence and place of employment, except as necessary for ensuring the employee’s safety.
However, with the exception of bicycling commuting expenses, the tax exclusion for employees has not changed—qualified transportation benefits are still excludable from employees’ gross income. The tax exclusion for bicycling commuting benefits is suspended for tax years beginning after Dec. 31, 2017, and before Jan. 1, 2026.
Qualified Moving Expense Reimbursements
Before 2018, employers could pay or reimburse an employee’s eligible moving expenses related to starting employment at a new principal place of work on a tax-free basis. The Act suspends this income exclusion from 2018 through 2025 tax years.
It also suspends the employer deduction for qualified moving expense reimbursements for the same period of time. However, the income exclusion and deduction still apply in the case of a member of the U.S. armed forces on active duty who moves pursuant to a military order and incident to a permanent change of station.
Employer Credit for Paid Family and Medical Leave
The Act creates a new temporary tax credit for employers that provide paid family and medical leave to their employees. The tax credit, which applies to wages paid in 2018 and 2019, is equal to a percentage of wages paid to employees who are on family and medical leave. Paid leave that is provided as vacation leave, personal leave, sick leave, or required by state or local law is not taken into consideration.
To qualify for the tax credit, an employer must have a written policy in place that provides at least two weeks of paid family and medical leave for full-time employees (proportionally adjusted for part-time employees) and a rate of payment that is at least 50 percent of an employee’s normal pay rate.
Read more
When cyber attacks like data breaches and hacks occur, they can result in devastating damage. Businesses have to deal with business disruptions, lost revenue and litigation. It is important to remember that no organization is immune to the impact of cyber crime. As a result, cyber liability insurance has become an essential component to any risk management program.
Cyber liability insurance policies are tailored to meet your company’s specific needs and can offer a number of important benefits, including the following:
Data breach coverage.
In the event of a breach, organizations are required by law to notify affected parties. This can add to overall data breach costs, particularly as they relate to security fixes, identity theft protection for those impacted by the breach and protection from possible legal action. Cyber liability policies include coverage for these exposures, thus safeguarding your data from cyber criminals.
Business interruption loss reimbursement.
A cyber attack can lead to an IT failure that disrupts business operations, costing your organization both time and money. Cyber liability policies may cover your loss of income during these interruptions. What’s more, increased costs to your business operations in the aftermath of a cyber attack may also be covered.
Cyber extortion defense.
Ransomware and similar malicious software are designed to steal and withhold key data from organization until a steep fee is paid. As these types of attacks increase in frequency and severity, it’s critical that organizations seek cyber liability insurance, which can help recoup loses related to cyber extortion.
Forensic support.
Following a cyber attack, your organization will have to investigate to determine the extent of the breach and what led to it. The right policy can reimburse the insured for costs related to forensics and seeking out expert advice. Additionally, some policies can provide 24/7 support from cyber specialists, which is especially useful following a hack or data breach.
Legal support.
In the wake of a cyber incident, businesses often seek legal assistance. This assistance can be costly, Cyber liability insurance can help businesses afford proper legal work following a cyber attack.
Coverage beyond a general liability policy.
General liability policies don’t always protect organizations from losses related to data breaches. What’s more, data is generally worth far more than physical assets, and it’s important to have the right protection in place when you need it most. Supplementing your insurance with cyber coverage can provide you with peace of mind that, in even of an attack, your organization’s financial and reputational well-being is protected.
To learn more about cyber liability insurance, contact us today.
Read more
On Oct. 31, 2017, the Internal Revenue Service (IRS) issued Notice 2017-67 to provide comprehensive guidance on a variety of topics regarding qualified small employer health reimbursement arrangements (QSEHRAs). Small employers that do not maintain group health plans may establish QSEHRAs for their employees, effective for plan years beginning on or after Jan. 1, 2017. Unlike other health accounts, QSEHRAs can be used to reimburse employees for their health insurance premiums.
Notice 2017-67 clarifies the technical rules for QSEHRAs, including the requirements that employees provide proof of minimum essential coverage (MEC) and that employers provide a written notice to eligible employees each year.
ACTION STEPS
Small employers with QSEHRAs should confirm that their QSEHRAs comply with this new guidance. Notice 2017-62 applies to plan years beginning on or after Nov. 20, 2017. In addition, employers may need to provide their initial written notice by Feb. 19, 2018.
Background
Beginning Jan. 1, 2017, employers that are not applicable large employers under the Affordable Care Act and do not maintain group health plans may sponsor QSEHRAs to pay for employees’ individual health insurance policies and other out-of-pocket medical expenses on a tax-favored basis. To qualify as a QSEHRA, the reimbursement arrangement must meet the following criteria:
- The QSEHRA must be funded solely by the employer. Employees cannot make their own salary reduction contributions.
- QSEHRA payments or reimbursements must be limited to medical care expenses incurred by the employee or the employee’s family members, after the employee provides proof of coverage.
- The maximum amount of payments and reimbursements from the QSEHRA for any year cannot exceed $4,950 (or $10,000 for QSEHRAs that also reimburse medical expenses of the employee’s family members). These amounts are adjusted annually for inflation. For 2018, the total amount of payments and reimbursements from a QSEHRA cannot exceed $5,050 ($10,250 for family coverage).
- The QSEHRA must be provided on the same terms to all eligible employees.
IRS Guidance on QSEHRAs – Notice 2017-67
Notice 2017-67 provides detailed guidance on a wide range of topics for QSEHRAs, including the criteria for QSEHRAs, the tax consequences of the arrangement, the impact on eligibility for health savings account (HSA) contributions and the written notice requirement.
The guidance applies for plan years beginning on or after Nov. 20, 2017, although QSEHRAs established before that date may rely on this guidance. Also, employers that established QSEHRAs for 2017 in accordance with a reasonable good faith interpretation of the law may continue to operate their QSEHRAs based on those terms until the last day of the plan year that began in 2017.
Written Notice
An employer funding a QSEHRA for any year must provide a written notice to each eligible employee at least 90 days before the beginning of each year. For employees who become eligible to participate in the QSEHRA during the year, the notice must be provided by the date on which the employee becomes eligible to participate. If an employer fails to provide this notice for a reason other than reasonable cause, the employer may be subject to a penalty of $50 per employee for each failure, up to a maximum annual penalty of $2,500 for all notice failures during the year. On Feb. 27, 2017, the IRS delayed the initial notice deadline pending its issuance of further guidance.
Notice 2017-67 provides a new deadline for the initial QSEHRA notice, as well as sample language that employers may use.
Initial Notice Deadline – An eligible employer that provides a QSEHRA during 2017 or 2018 must provide the initial written notice to eligible employees by the later of (1) Feb. 19, 2018, or (2) 90 days before the first day of the QSEHRA’s plan year. According to the IRS, penalties may apply to any employer that does not timely provide the written notice.
Same Terms Requirement
Notice 2017-67 explains what it means for a QSEHRA to be provided on the same terms to all eligible employees. For example, to satisfy this requirement:
- The QSEHRA must be operated on a uniform and consistent basis for all eligible employees;
- Eligible employees cannot be allowed to waive coverage; and
- If an employer is part of a controlled group or affiliated service group (as determined under Internal Revenue Code Section 414), each employer in the group must provide a QSEHRA to all eligible employees on the same terms.
In addition, Notice 2017-67 confirms that a QSEHRA may be designed to limit reimbursements to certain medical expenses (for example, health insurance premiums or cost-sharing expenses that are medical expenses). However, a QSEHRA will fail to satisfy the same terms requirement if, under the facts and circumstances, the plan’s reimbursement limit causes the QSEHRA not to be effectively available to all eligible employees. This may occur, for example, if a QSEHRA limits reimbursements to Medicare or Medicare supplement policies.
Maximum Benefit and Reimbursements
QSEHRAs may use the statutory dollar limits in effect for the preceding year to determine permitted benefits, rather than the dollar limits in effect for the current year. IRS Notice 2017-67 also confirms that any carryovers of unused amounts from a prior plan year are taken into account when determining an employee’s maximum annual benefit. An employee’s total permitted benefit, taking into account both carry-over amounts and newly available amounts, may not exceed the applicable statutory dollar limit.
In addition, a QSEHRA may reimburse premiums for coverage under the group health plan of a spouse’s employer. However, the reimbursement is taxable to the extent that the spouse’s share of premiums was paid on a pre-tax basis.
Proof of Coverage
Before a QSEHRA can reimburse an expense for any plan year, the eligible employee must first provide proof that he or she had MEC for the month during which the expense was incurred. This proof must consist of either:
- A document from a third party (for example, the insurer) showing that the employee had coverage (for example, an insurance card or explanation of benefits) and an attestation by the employee that the coverage was MEC; or
- An attestation by the employee stating that the employee had MEC, the date the coverage began and the name of the coverage provider.
- Notice 2017-67 includes model attestation language that employers may use. The initial proof of MEC must be provided with respect to each individual whose expenses are eligible for reimbursement before the first expense reimbursement. Following the initial proof, the employee must attest with each new request for reimbursement during the plan year that the employee and the individual whose expenses are being reimbursed (if different) continue to have MEC. This attestation can be part of the form for requesting reimbursement.
Employer Reporting
Employers that sponsor QSEHRAs must report the amount of payments and reimbursements that an eligible employee is entitled to receive from the QSEHRA for the calendar year in box 12 of the employee’s Form W-2 using code FF, without regard to the payments or reimbursements actually received. Notice 2017-67 provides detailed rules for this reporting.
In addition, Notice 2017-67 confirms that an employer providing a QSEHRA is not required to provide IRS Forms 1095-B (Section 6056 statements) to covered employees. However, a QSEHRA is subject to the Patient-Centered Outcomes Research Institute (PCORI) fee, which applies for plan years ending before Oct. 1, 2019.
HSA Contributions
Employers that sponsor QSEHRAs may contribute to employees’ HSAs and may allow employees to make pre-tax HSA contributions through a Section 125 plan.
Notice 2017-67 also addresses how QSEHRA coverage impacts an individual’s eligibility for HSA contributions. To be HSA-eligible, an individual must be covered by a high deductible health plan (HDHP) and not be covered by other health coverage that provides benefits below the HDHP minimum deductible. According to the IRS, if the QSEHRA only reimburses health insurance premiums, it will not cause an individual to be ineligible for HSA contributions. However, individuals who are covered by QSEHRAs that reimburse any medical expenses, including cost sharing, are not eligible for HSA contributions.
Read more
When a data breach or other cyber event occurs, the damages can be significant, often resulting in lawsuits, fines and serious financial losses. What’s more, cyber exposures impact businesses of all kinds, regardless of their size, area of focus, or status as a private or public entity.
In order for organizations to truly protect themselves from cyber risks, corporate boards must play an active role. Not only does involvement from leadership improve cyber security, it can also reduce liability for board members.
To help oversee their organization’s cyber risk management, boards should ask the following questions:
Does the organization utilize technology to prevent data breaches?
Every company must have robust cyber security tools and anti-virus systems in place. These systems act as a first line of defense for detecting and preventing potentially debilitating breaches.
While it may sound obvious, many organizations fail to take cyber threats seriously and implement even the simplest protections. Boards can help highlight the importance of cyber security, ensuring that basic, preventive measures are in place.
These preventive measures must be reviewed on a regular basis, as cyber threats can evolve quickly. Boards should ensure that the management team reviews company technology at least annually, ensuring that cyber security tools are up to date and effective.
Has the board or the company’s management team identified a senior member to be responsible for organizational cyber security preparedness?
Organizations that fail to create cyber-specific leadership roles could end up paying more for a data breach than organizations that do. This is because, in the event of a cyber incident, a fast response and clear guidance is needed to contain a breach and limit damages.
When establishing a chief information security officer or similar cyber leadership role, boards need to be involved in the process. Cyber leaders should have a good mix of technical and business experience. This individual should also be able to explain cyber risks and mitigation tactics at a high level so they are easy to understand for those who are not well-versed in technical terminology.
It should be noted that hiring a chief information security officer or creating a new cyber leadership role is not practical for every organization. In these instances, organizations should identify a qualified, in-house team member and roll cyber security responsibilities into their current job requirements. At a minimum, boards need to ensure that their company has a go-to resource for managing cyber security.
Does the organization have a comprehensive cyber security program? Does it include specific policies and procedures?
It is essential for companies to create comprehensive data privacy and cyber security programs. These programs help organizations build a framework for detecting threats, remain informed on emerging risks and establish a cyber response plan.
Corporate boards should ensure that cyber security programs align with industry standards. These programs should be audited on a regular basis to ensure effectiveness and internal compliance.
Does the organization have a breach response plan in place?
Even the most secure organizations can be impacted by a data breach. What’s more, it can often take days or even months for a company to notice its data has been compromised.
While cyber security programs help secure an organization’s digital assets, breach response plans provide clear steps for companies to follow when a cyber event occurs. Breach response plans allow organizations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damage.
Board members should ensure that crisis management and breach response plans are documented. Specific actions noted in breach response plans should also be rehearsed through simulations and team interactions to evaluate effectiveness.
In addition, response plans should clearly identify key individuals and their responsibilities. This ensures that there is no confusion in the event of a breach and your organization’s response plan runs as smoothly as possible.
Has the organization discussed and formalized a cyber risk budget? How engaged is the board in terms of providing guidance related to cyber exposures?
Both overpaying and underpaying for cyber security services can negatively affect an organization. Creating a budget based on informed decisions and research helps companies invest in the right tools.
Boards can help oversee investments and ensure that they are directed toward baseline security controls that address common threats. Boards, with guidance from the chief security officer or a similar cyber leader, should also prioritize funding. That way, an organization’s most vulnerable and important assets are protected.
Has the management team provided adequate employee training to ensure sensitive data is handled correctly?
While employees can be a company’s greatest asset, they also represent one of their biggest cyber liabilities. This is because hackers commonly exploit employees through spear phishing and similar scams. When this happens, employees can unknowingly give criminals access to their employer’s entire system.
In order to ensure data security, organizations must provide thorough employee training. Boards can help oversee this process and instruct management to make training programs meaningful and based on more than just written policies.
In addition, boards should see to it that education programs are properly designed and foster a culture of cyber security awareness.
Has management taken the appropriate steps to reduce cyber risks when working with third parties?
Working alongside third-party vendors is common for many businesses. However, whenever an organization entrusts its data to an outside source, there’s a chance that it could be compromised.
Boards can help ensure that vendors and other partners are aware of their organization’s cyber security expectations. Boards should work with the company’s management team to draw up a standard third-party agreement that identifies how the vendor will protect sensitive data, whether or not the vendor will subcontract any services and how it intends to inform the organization if data is compromised.
Does the organization have a system in place for staying current on cyber trends, news, and federal, state, industry and international data security regulations?
Cyber-related legislation can change with little warning, often having a sprawling impact on the way organizations do business. If organizations do not keep up with federal, state, industry and international data security regulations, they could face serious fines or other penalties.
Boards should ensure that the chief information security officer or similar leader is aware of his or her role in upholding cyber compliance. In addition, boards should ensure that there is a system in place for identifying, evaluating and implementing compliance-related legislation.
Additionally, boards should constantly seek opportunities to bring expert perspectives into boardroom discussions. Often, authorities from government, law enforcement and cyber security agencies can provide invaluable advice. Building a relationship with these types of entities can help organizations evaluate their cyber strengths, weaknesses and critical needs.
Has the organization conducted a thorough risk assessment? Has the organization purchased or considered purchasing cyber liability insurance?
Cyber liability insurance is specifically designed to address the risks that come with using modern technology—risks that other types of business liability coverage simply won’t cover.
The level of coverage your business needs is based on your individual operations and can vary depending on your range of exposure. As such, boards, alongside the company’s management team, need to conduct a cyber risk assessment and identify potential gaps. From there, organizations can work with their insurance broker to customize a policy that meets their specific needs.
Asking thoughtful questions can help boards better understand the strategies management uses to prevent, detect and respond to data breaches. When it comes to cyber threats, organizations need to be diligent and thorough in their risk prevention tactics, and boards can help move the cyber conversation in the right direction.
Cyber exposures impact organizations from top to bottom, and all team members play a role in maintaining a secure environment. However, managing personnel and technology can be a challenge, particularly for organizations that don’t know where to start.
That’s where Scurich Insurance can help. Contact us today to learn more about cyber risk mitigation strategies you can implement today to secure your business.
Read more
OSHA’s final rule on electronic reporting requires certain employers to submit data from their injury and illness records electronically so it can be posted on the agency’s website. Because the rule is an extra requirement on top of existing OSHA recordkeeping standards, affected employers need to be ready to comply with the rule before the proposed Dec. 1, 2017, deadline.
Other News and Tips
Preparing for OSHA Inspections
If an unannounced OSHA inspection finds violations at your business, you may have to pay thousands in fines and watch as your reputation plummets. Fortunately, OSHA inspections generally follow an established procedure that you and your staff can prepare for.
When an OSHA compliance officer arrives at your business, it’s important to check his or her credentials and then determine if you’ll give consent to the inspection. Although you can refuse an inspection or give only partial consent, the compliance officer will take note of this and OSHA may take further action.
Once an inspection begins, the goal should be to determine its purpose and set any ground rules. You should also be prepared to provide proof that your business is in compliance with OSHA standards. During the walkaround process, be sure to take notes of what the inspector documents so you can review them later.
OSHA inspections can be stressful, even when your business is in full compliance. Scurich Insurance can provide you with our inspection guide, “Be Prepared for an OSHA Inspection,” and help your business impress OSHA compliance officers.
OSHA Removes Employee Fatalities from Home Page
Although OSHA used to include a URL link on its home page that would direct viewers to a list of employee fatalities, the agency recently moved the link to a separate page on its website.
According to a spokesperson from the Department of Labor, the link was moved in order to increase the accuracy of workplace data, as previous listings included fatalities that were outside OSHA’s jurisdiction. However, OSHA will keep the list of employee fatalities on its website and continue to review data from employers.
Although the electronic reporting rule initially required certain employers to start submitting their required information by July 1, 2017, OSHA’s Injury Tracking Application website wasn’t ready to receive electronic reports in time, and OSHA proposed Dec. 1, 2017, as the new deadline. The rule doesn’t change an employer’s requirements to complete and retain regular injury and illness records, but some employers will now have additional obligations. Here are the requirements for the rule:
- Establishments with 250 or more employees that are required to keep injury and illness records must electronically submit the following forms:
- OSHA Form 300: Log of Work-Related Injuries and Illnesses
- OSHA Form 300A: Summary of Work-Related Injuries and Illnesses
- OSHA Form 301: Injury and Illnesses Incident Report
- Establishments with 20 to 249 employees that work in industries with historically high rates of occupational injuries and illnesses must electronically submit information from OSHA Form 300A.
The final reporting requirements will be phased in over two years. After the initial Dec. 1, 2017, deadline, establishments with 250 or more employees must submit information from OSHA Forms 300, 300A and 301 by July 1, 2018. Beginning in 2019 and every year thereafter, the information must be submitted by March 2.
For more help preparing for this new rule, call us at 831-661-5697 and ask to see our comprehensive Compliance Overview on OSHA’s electronic reporting rule.
New Silica Rule Enforcement Begins
A new OSHA rule on respirable crystalline silica will require employers to limit their employees’ exposure to silica hazards and provide medical exams to monitor highly exposed employees. The rule is scheduled to come into effect on June 23, 2018; however, OSHA began enforcement of the new rule in the construction industry on Sept. 23, 2017.
Under the new rule, employers must reduce the permissible exposure limit (PEL) for respirable silica to 50 micrograms per cubic meter of air (50 µg/m3). The rule also requires employers to take the following steps:
- Establish engineering controls to limit employees’ exposure to the new PEL.
- Provide employees with respirators when engineering controls alone do not provide enough protection.
- Establish a written silica exposure control plan.
- Provide medical exams to employees who are exposed to levels of respirable silica at or above the new PEL for 30 or more days a year.
To see more information on the respirable silica rule, and to see specifics about the rule’s application in the construction industry, visit OSHA’s website.
Read more
The Insurance Research Council reports that an estimated 1 in 7 drivers in the United States are currently uninsured. As a result, many car insurance companies across the nation offer specific coverage in the event that you get into an accident with an uninsured driver, such as uninsured motorist (UM) coverage and underinsured motorist (UIM) coverage.
UM coverage applies if the uninsured driver was at fault in the accident or if you were the victim of a hit-and-run accident. UIM coverage applies if the other driver is at fault and lacks a high enough level of coverage to cover the cost of the accident. This means that if the underinsured driver’s policy limit is reached before the cost is covered, your insurance company would pay the remainder of the costs until your coverage limit is reached.
While UM/UIM coverage can be helpful, often times the level of coverage isn’t enough to cover the costs of the accident. Luckily, several states allow you to “stack” your UM or UIM coverage. Read on to learn the differences between stacked and unstacked UM/UIM coverage.
Unstacked Coverage
If you have unstacked UM/UIM coverage, your level of coverage is the limit on your policy. For instance, if you have a set limit of $20,000, that is the maximum amount of coverage you will receive after an accident with an uninsured or underinsured driver. Unstacked coverage is more common than stacked coverage, seeing as it is your only option if you insure just one car.
Stacked Coverage
If you insure multiple vehicles and your state allows stacking, you are permitted to increase your level of UM/UIM coverage. You can utilize stacked coverage within one policy, or across policies.
Stacking your coverage within one policy means you are combining your coverage limits for multiple vehicles on a singular policy. For example, if you own two cars on one insurance policy and your UM/UIM limit is $20,000, you can combine your coverage limits for a total of $40,000.
Using stacked coverage across policies means you are combining your coverage limits between separate policies for a singular claim. For example, if you own two vehicles, each with separate policies and your UM/UIM limit is $25,000, you could file a claim using both policies, therefore using up to $50,000.
The Advantages and Disadvantages
There are both benefits and drawbacks to utilizing stacked UM/UIM coverage. Stacking can potentially raise the amount of coverage you can use in case of an accident with an uninsured or underinsured driver, and lets you increase your UM/UIM limits without increasing your liability coverage.
However, if you have stacked coverage, you may have higher rates, seeing as car insurance companies have to offset the risk of costly reimbursement.
In addition, while some states lack laws for stacked coverage, some states either forbid it or only allow it in specific circumstances. Aside from state laws, some car insurance companies have certain policies that disallow stacked coverage. Be sure to contact your car insurance company to discuss your options with stacked UM/UIM coverage.
Read more
