April is Sexual Assault Awareness Month, and your workplace must be safe for employees, vendors and customers. Make time this month to refresh your understanding of sexual harassment as you prevent sexual assault and create a safe work environment.
Define Sexual Harassment
Sexual harassment includes any unwanted sexual advances such as offering a work benefit in exchange for sexual favors, inappropriate touching, unwelcome or intimidating behavior, offensive jokes, and inappropriate decor. Federal and state laws prohibit any form of sexual harassment.
Know Your Role
As an employer, you have the responsibility to prevent sexual harassment and create a safe work environment for all employees. A harassment-free work environment improves morale and productivity, and it reduces liability.
Write a Clear Anti-Harassment Policy
Your employee handbook should include a comprehensive anti-harassment policy that outlines:
- The definition of sexual harassment
- Your zero-tolerance policy
- Reporting procedures
- Investigation process
- Disciplinary action
- Anti-retaliation details
Consult your attorney to ensure the policy meets or exceeds federal and state requirements and covers all your bases.
Conduct Frequent Training Sessions
Schedule annual or more frequent training sessions to ensure all your employees understand the definition of sexual harassment, your company’s official policy, how to report it, and ways to prevent it. These trainings should be mandatory for all your employees, including supervisors.
Ensure Leadership Complies with the Zero-Tolerance Policy
All supervisors and managers must comply with your zero-tolerance policy as they prevent sexual harassment. Leaders set the bar for everyone else’s behavior and must be trusted to handle cases appropriately.
Monitor Employees
You can monitor email and other electronic communications as well as behavior as you look for and stop inappropriate behavior. Encourage your employees to monitor and report inappropriate behavior, too.
Clarify the Reporting Procedure
Despite your efforts, sexual harassment may occur, and you will need to clarify the reporting procedure and empower victims and onlookers to report improper actions. While employees should tell the perpetrator to stop, they should also know who to report to, what information to share and how to report harassment perpetrated by their direct supervisor.
Define Consequences
Every employee should know the consequences of sexual harassment. They should also be confident that the consequences will be applied consistently to all employees.
Create a Safe Culture
While you need and want to prevent sexual harassment, the company’s culture should also support your stand. No crude or offensive jokes, inappropriate activities during after-work events or other improper actions should be tolerated, encouraged or allowed.
Your company must be safe for everyone. This April, improve sexual assault awareness and prevent sexual harassment as you follow the law and improve your company and culture.
Read more
As of Feb. 15, 2018, employers must use new tables to determine how much income tax to withhold from their employees’ paychecks. The Internal Revenue Service (IRS) issued the required new tables in Notice 1036 on Jan. 9, 2018. The new tables are also available in IRS Publication 15.
In addition, the IRS issued a new Form W-4 and a new withholding calculator on Feb. 28, 2018.
The updated tools aim to help employers improve the accuracy of their tax withholdings under changes made by the tax reform law, the Tax Cuts and Jobs Act, which was enacted on Dec. 22, 2017.
Employers should already be using the new tables for 2018. Employers are not required to use the new Form W-4 for 2018 but may use it for any 2018 withholding changes. Employers will be required to use the new version of Form W-4 for 2019.
Taxpayers can use the updated tax withholding calculator to determine whether they should make any changes to their 2018 withholdings.
The Tax Cuts and Jobs Act made several changes to the tax code that will affect individual taxpayers in 2018. For example, the new law:
To reflect these changes, the IRS has issued three new tax withholding tools. The tools aim to help employers avoid withholding too much or too little from their employees’ paychecks for income taxes in 2018 and 2019.
For 2018, New Tables Work with Existing Forms W-4
The IRS’ new withholding tables are designed to work with the Forms W-4 that employees have already filed with their employers to claim withholding allowances for 2018. Thus, employers do not need to obtain updated Forms W-4 from their employees to use the new tables. The deadline for employers to begin using the new tables was Feb. 15, 2018.
New Form W-4 for 2019 May Be Used in 2018
For 2019, the IRS has revised Form W-4 to more fully reflect the new tax law and to help employees determine appropriate withholding amounts. Released on Feb. 28, 2018, the Form W-4 can be used in 2018 if an employee starts a new job or if existing employees wish to update their 2018 withholding in response to the new law or changes in their personal circumstances.
New Calculator
The IRS’ updated withholding calculator allows employees to perform a quick “paycheck checkup” to help them determine whether they should make changes to their 2018 withholdings. While the IRS encourages all taxpayers to use the new calculator, employees who have simple financial situations are not likely to require any revisions for 2018. Those with more complicated situations, however, are strongly encouraged to check their 2018 withholdings using the calculator. These include employees who itemized their deductions in 2017 or have:
- Two-income households;
- Two or more jobs at the same time;
|
- Children who claim credits; or
- High incomes.
|
Employees with even more complex situations (such as those who owe self-employment tax or have capital gains) may need to use Publication 505 instead of the withholding calculator. The IRS expects to release an updated version of this publication in the near future.
Read more
On Jan. 2, 2018, the Department of Labor (DOL) issued a final rule that increases the civil penalty amounts that may be imposed on employers under various federal laws. The final rule increases the civil penalty amounts associated with:
- Failing to file an annual Form 5500 under the Employee Retirement Income Security Act (ERISA);
- Repeated or willful violations of minimum wage or overtime requirements under the Fair Labor Standards Act (FLSA);
- Willful violations of the poster requirement under the Family and Medical Leave Act (FMLA); and
- Violations of the poster requirement under the Occupational Safety and Health Act (OSH Act).
The increased amounts apply to civil penalties that are assessed after Jan. 2, 2018.
Employers should become familiar with the new penalty amounts and review their pay practices, benefit plan administration and safety protocols to ensure compliance with federal requirements.
The 2015 Inflation Adjustment Act (Act) includes provisions to strengthen civil monetary penalties under various federal laws in order to maintain their deterrent effect. The Act required federal agencies, including the DOL, to adjust the civil monetary penalties with an initial “catch-up” adjustment. The DOL made this initial adjustment in July 2016. Federal agencies are also required to make subsequent annual adjustments for inflation, no later than Jan. 15 of each year.
The DOL’s final rule implements the 2018 annual adjustments for civil penalties assessed or enforced by the DOL, including penalties under the FLSA, FMLA, OSH Act and ERISA. The increased penalty amounts became effective on Jan. 2, 2018, and may apply for any violations occurring after Nov. 2, 2015.
The updated maximum penalty amounts are shown in the table below.
|
REQUIREMENT |
PENALTY AMOUNT |
| 2017 |
2018 |
| Wage and Hour |
| Repeated or willful violations of minimum wage or overtime requirements (FLSA) |
Up to $1,925 for each violation |
Up to $1,964 for each violation |
| Violations of child labor laws |
Up to $12,278 for each employee subject to the violation |
Up to $12,529 for each employee subject to the violation |
| Violations of child labor laws that cause death or serious injury to an employee under age 18 |
Up to $55,808 for each violation (doubled to $111,616 if the violation is repeated or willful) |
Up to $56,947 for each violation (doubled to $113,894 if the violation is repeated or willful) |
| Willful failure to post FMLA general notice |
Up to $166 for each separate offense |
Up to $169 for each separate offense |
| Violations of the Employee Polygraph Protection Act (EPPA) |
Up to $20,111 for each violation |
Up to $20,521 for each violation |
| Employee Benefits |
| Failure to file an annual report (Form 5500) with the DOL (unless a filing exemption applies) |
Up to $2,097 per day |
Up to $2,140 per day |
| Failure of a multiple employer welfare arrangement (MEWA) to file an annual report (Form M-1) with the DOL |
Up to $1,527 per day |
Up to $1,558 per day |
Failure to furnish plan-related information requested by the DOL
*Under ERISA, administrators of employee benefit plans must furnish to the DOL, upon request, any documents relating to the employee benefit plan. |
Up to $149 per day, but not to exceed $1,496 per request |
Up to $152 per day, but not to exceed $1,527 per request |
Failing to provide the annual notice regarding CHIP coverage opportunities
*This notice applies to employers with group health plans that cover residents of states that provide a premium assistance subsidy under a Medicaid or CHIP program. |
Up to $112 per day for each failure (each employee is a separate violation) |
Up to $114 per day for each failure (each employee is a separate violation) |
| For 401(k) plans, failure to provide blackout notice or notice of right to divest employer securities |
Up to $133 per day |
Up to $136 per day |
| Failure to provide Summary of Benefits and Coverage (SBC) |
Up to $1,105 per failure |
Up to $1,128 per failure |
| Employee Safety – OSH Act |
| Violation of posting requirement |
Up to $12,675 for each violation |
Up to $12,934 for each violation |
| Other-than-serious violation |
Up to $12,675 per violation |
Up to $12,934 for each violation |
| Serious violation |
Up to $12,675 for each violation |
Up to $12,934 for each violation |
| Willful violation |
Between $9,054 and $126,749 per violation |
Between $9,239 and $129,336 per violation |
| Uncorrected violation |
Up to $12,675 per day until the violation is corrected |
Up to $12,934 per day until the violation is corrected |
Read more
On Dec. 22, 2017, President Donald Trump signed into law the Tax Cuts and Jobs Act (Act). The Act makes significant changes to the federal Internal Revenue Code (Code), including changes that impact employee benefits. Effective for 2018:
- Employers cannot deduct expenses associated with qualified transportation fringe benefit programs;
- Employees cannot exclude bicycle commuting reimbursements from their gross income; and
- Moving expense reimbursements are not deductible for employers and cannot be excluded from employees’ gross income.
In addition, effective for 2018 and 2019, the Act creates a federal tax credit for employers that provide paid family and medical leave.
Because most of the Act’s provisions became effective on Jan. 1, 2018, employers should start working with their tax advisors to determine how the tax changes will impact their businesses.
Qualified Transportation Fringe Benefits
Code Section 132 allows employers to provide certain transportation benefits to employees on a tax-free basis. These benefits include qualified parking, transit passes, and transportation to and from work in a commuter highway vehicle (“vanpooling”). Prior to 2018, bicycle commuting reimbursements also qualified for this tax exclusion.
Qualified transportation expenses paid by either the employer or employee can be excluded from an employee’s gross income, up to certain limits. For 2018, the tax exclusion limits are $260 per month for qualified parking expenses and $260 per month for transit passes and vanpooling expenses, combined.
Beginning in 2018, the Act eliminates the employer deduction for expenses associated with a qualified transportation fringe benefit program. The Act also eliminates the deduction for any expenses incurred in connection with providing transportation to an employee in connection with travel between the employee’s residence and place of employment, except as necessary for ensuring the employee’s safety.
However, with the exception of bicycling commuting expenses, the tax exclusion for employees has not changed—qualified transportation benefits are still excludable from employees’ gross income. The tax exclusion for bicycling commuting benefits is suspended for tax years beginning after Dec. 31, 2017, and before Jan. 1, 2026.
Qualified Moving Expense Reimbursements
Before 2018, employers could pay or reimburse an employee’s eligible moving expenses related to starting employment at a new principal place of work on a tax-free basis. The Act suspends this income exclusion from 2018 through 2025 tax years.
It also suspends the employer deduction for qualified moving expense reimbursements for the same period of time. However, the income exclusion and deduction still apply in the case of a member of the U.S. armed forces on active duty who moves pursuant to a military order and incident to a permanent change of station.
Employer Credit for Paid Family and Medical Leave
The Act creates a new temporary tax credit for employers that provide paid family and medical leave to their employees. The tax credit, which applies to wages paid in 2018 and 2019, is equal to a percentage of wages paid to employees who are on family and medical leave. Paid leave that is provided as vacation leave, personal leave, sick leave, or required by state or local law is not taken into consideration.
To qualify for the tax credit, an employer must have a written policy in place that provides at least two weeks of paid family and medical leave for full-time employees (proportionally adjusted for part-time employees) and a rate of payment that is at least 50 percent of an employee’s normal pay rate.
Read more
On Dec. 22, 2017, President Donald Trump signed into law the tax reform bill, called the Tax Cuts and Jobs Act, after it passed both the U.S. Senate and the U.S. House of Representatives.
This tax reform bill makes significant changes to the federal tax code. The bill does not impact the majority of the Affordable Care Act (ACA) tax provisions. However, it does reduce the ACA’s individual shared responsibility (or individual mandate) penalty to zero, effective beginning in 2019.
As a result, beginning in 2019, individuals will no longer be penalized for failing to obtain acceptable health insurance coverage.
ACTION STEPS
Although the tax reform bill eliminates the ACA’s individual mandate penalty, this repeal does not become effective until 2019.
As a result, individuals continue to be required to comply with the mandate (or pay a penalty) for 2017 and 2018. A failure to obtain acceptable health insurance coverage for these years may still result in a penalty for the individual.
The Individual Mandate
The ACA’s individual mandate, which took effect in 2014, requires most individuals to obtain acceptable health insurance coverage for themselves and their family members or pay a penalty. The mandate is enforced each year on individual federal tax returns. Starting in 2015, individuals filing a tax return for the previous tax year indicate, by checking a box on their returns, which members of their family (including themselves) had health insurance coverage for the year (or qualified for an exemption from the individual mandate). Based on this information, the IRS then assesses a penalty for each nonexempt family member without coverage.
Effect of the Tax Reform Bill
The tax reform bill will reduce the ACA’s individual mandate penalty to zero, effective beginning with the 2019 tax year. This effectively eliminates the individual mandate penalty for the 2019 tax year and beyond. As a result, beginning with the 2019 tax year, individuals will no longer be penalized for failing to obtain acceptable health insurance coverage for themselves and their family members.
Impact on Years Prior to 2019
Although the tax reform bill eliminates the ACA’s individual mandate penalty, this repeal does not take effect until 2019. As a result, individuals continue to be required to comply with the mandate (or pay a penalty) for 2017 and 2018. A failure to obtain acceptable health insurance coverage for these years may still result in a penalty for the individual.
Therefore, nonexempt individuals should continue to maintain acceptable health coverage in 2017 and 2018, and should indicate on their 2017 and 2018 tax returns whether they (and everyone in their family):
- Had health coverage for the year;
- Qualified for an exemption from the individual mandate; or
- Will pay an individual mandate penalty.
In addition, keep in mind that individuals who are liable for a penalty for failing to obtain acceptable health coverage in 2018 will be required to pay that penalty when they file their federal income taxes in 2019. As a result, some individuals may be required to pay the individual mandate penalty in early 2019, based on their noncompliance for the 2018 tax year.
Effect on Other ACA Provisions
Despite the repeal of the individual mandate penalty, employers and individuals must continue to comply with all other ACA provisions. The tax reform bill does not impact any other ACA provisions, including the Cadillac tax on high-cost group health coverage, the PCORI fees and the health insurance providers fee. In addition, the employer shared responsibility (pay or play) rules and related Section 6055 and Section 6056 reporting requirements are still in place.
Read more
Businesses gather a lot of information from their customers, including personal identifying information (PII). Because of the sensitivity of this information, many states have adopted standards that businesses must follow to safeguard PII. These standards often include data security breach notification requirements.
In California, these laws are enforced by the California attorney general’s office. This Cyber Security Law Summary provides an overview of California’s data breach notification requirements. Businesses can use this information to understand their responsibilities in protecting PII of California customers.
Cyber security Responsibilities
California law requires businesses and individuals that own, license or maintain PII about Californians to safeguard that information. Businesses must implement reasonable security procedures and practices to protect PII from unauthorized access, destruction, use, modification or disclosure.
Under California law, “owning” and “licensing” includes retaining an individual’s PII in an internal account for the purpose of conducting transactions with the individual in question.
Businesses that disclose PII to a third party must have a contract in place requiring the third party to implement and maintain reasonable security procedures and practices.
The responsibility to safeguard PII begins when the information is first acquired and remains in effect until the information is properly disposed of. This means that businesses must also take reasonable steps to dispose of customer records that are within their custody.
Adequate disposal methods include shredding, erasing and otherwise modifying the records where the information is stored to make them unreadable or undecipherable. Businesses can use any means necessary to dispose of PII properly.
Affected Entities
Breach notification requirements apply to individuals and businesses in California that own, license or maintain PII about Californians. Under these laws, a business is any group that is organized, chartered, or holds a license or authorization certificate under California law or the law of any other state, the federal government or of any other country. This definition of business includes any sole proprietorship, partnership, corporation, association and financial institutions. The term also includes any entity that disposes of records.
Certain businesses are exempt from California’s breach notification law, including:
- Health care providers, health care service plans or contractors regulated by the Confidentiality of Medical Information Act;
- Financial institutions that are subject to the California Financial Information Privacy Act;
- Businesses governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules;
- Entities that obtain information under an agreement authorized by the vehicle code and that are subject to the confidentiality requirements of the vehicle code; and
- Businesses that are regulated by state or federal laws that provide greater protections to PII than what is required under California’s breach notification laws. This last exemption is possible because compliance with stricter state or federal laws will be considered compliance with California laws.
Affected Information
Under the breach notification law, PII includes an individual’s first name or first initial and last name in combination with one or more of the following:
- A Social Security number;
- A driver’s license number or California identification card number;
- An account, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial information;
- Medical information (meaning any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional);
- Health insurance information (meaning an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records); and
- Information or data collected through the use or operation of an automated license plate recognition system.
PII also includes a username or email address, in combination with a password or security question and answer that would permit access to an online account.
PII does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.
What is a Security Breach?
Under the law, a security system breach is an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the PII maintained by another person or business.
Determining whether a breach took place under the law depends on whether the affected information was encrypted or unencrypted, as shown in the table below.
|
Encrypted Information |
|
Unencrypted Information
|
|
Notification must be given if:
- The business reasonably believes the information has been acquired by an unauthorized person;
- The encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person; and
- The business that owns or licenses the PII reasonably believes that the encryption key or security credential could render that PII readable or usable.
|
|
- Notification must be given if the business reasonably believes that the information was acquired by an unauthorized person.
|
Data Breach Notification
California law requires businesses to provide written notice of a breach to the security of their systems if they own or license computerized data that includes PII.
|
Who must be notified?
|
Businesses must notify any person whose PII was compromised as a result of a data breach (as defined above).
In addition, any business that is required to notify more than 500 California residents as a result of a single breach must submit a single sample copy of that notification to California’s attorney general.
Businesses that maintain, but do not own or license, PII must inform the entity that owns or licenses the information of any security breach if the PII was, or is reasonably believed to have been, acquired by an unauthorized person.
|
|
Mandatory Notification Content
|
A valid data breach notification must be written in plain language and must be titled “Notice of Data Breach.” This notification must include the following information (if available at the time the notification is sent):
- The name and contact information of the reporting person or business subject to these requirements;
- A list of the types of PII that was or is reasonably believed to have been compromised by the breach;
- The date of, the estimated date of or date range for the breach;
- Whether notification was delayed as a result of a law enforcement investigation;
- A general description of the breach incident;
- The toll-free numbers and addresses for the major credit reporting agencies (if the breach exposed a Social Security number, driver’s license number or California identification card number);
- An offer to provide appropriate identity theft prevention and mitigation services for affected individuals for at least 12 months (if the entity providing the notification was the source of the breach); and
- Instructions on how to take advantage of the 12-month identity prevention and mitigation services offered (as applicable).
|
|
Optional Notification Content
|
The following information may be included in a breach notification at the discretion of the entity sending the notice:
- Information about what has been done to protect individuals whose information has been breached; and
- Advice on steps affected individuals may take to protect themselves.
|
|
When to Send the Notification
|
Data breach notifications must be made as soon as possible, without unreasonable delay. Timely notifications must take into account legitimate needs to cooperate with law enforcement, determine the scope of the breach and restore a reasonable integrity of the data system. For example, the notification requirement may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
|
|
How to Send the Notification
|
Under California law, breach notification can be sent in print, electronically or through a substitute notice, as defined below.
The use of electronic notices is acceptable, as long as all timing, content and formatting requirements are met. Electronic notifications must also follow federal laws regarding electronic records and signatures in commerce.
A valid substitute notice must include:
- An email notice (when the business has an email address for the affected individuals);
- Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the business, if the business maintains one. Conspicuous posting means providing a link to the notice on the home page or first significant page after entering the business’ website. The link must stand out from the surrounding text by using larger type, contrasting type, font or color to the surrounding text. The text may also stand out by using symbols or other marks that call attention to the link; and
- Notification to major statewide media.
Substitute notice may also be provided if the business demonstrates that the cost of providing notice would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the business does not have sufficient contact information.
|
Required Format
The notice must be designed to call attention to the nature and the significance of the message. This includes making sure that the title and headings are clearly and conspicuously displayed and using a font type that is 10 point or larger.
In addition, the data breach notice must organize the information according to the following headers:
- What happened
- What information was involved
- What we are doing
- What you can do
- For more information
Safe Harbor
A business that maintains its own notification procedures as part of an information security policy for the treatment of PII is in compliance with the notification requirements mentioned above if it:
- Notifies individuals in accordance with its policies in the event of a breach; and
- The notification takes place within the time constraints mentioned above.
Enforcement
Businesses cannot waive any of the responsibilities imposed on them by California’s breach notification laws. Any business that fails to comply with these requirements may be required to pay damages and penalties to injured customers by a civil court. Any business that violates, proposes to violate or has violated notification requirements may be subject to these sanctions.
The amount of damages depends on the extent of the harm or injury caused to the customer. The penalty is typically $500 per violation, but a court may order the penalty to be as much as $3,000 per penalty for willful, intentional or reckless violations.
A “customer,” for these purposes, is any individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.
Unless the violation is willful, intentional or reckless, a business that fails to provide adequate, complete and accurate notification to affected individuals can raise a complete defense against court penalties if it strives to remedy inadequate, incomplete or inaccurate notifications within 90 days of discovering an issue.
Read more
