Businesses gather a lot of information from their customers, including personal identifying information (PII). Because of the sensitivity of this information, many states have adopted standards that businesses must follow to safeguard PII. These standards often include data security breach notification requirements.
In California, these laws are enforced by the California attorney general’s office. This Cyber Security Law Summary provides an overview of California’s data breach notification requirements. Businesses can use this information to understand their responsibilities in protecting PII of California customers.
Cyber security Responsibilities
California law requires businesses and individuals that own, license or maintain PII about Californians to safeguard that information. Businesses must implement reasonable security procedures and practices to protect PII from unauthorized access, destruction, use, modification or disclosure.
Under California law, “owning” and “licensing” includes retaining an individual’s PII in an internal account for the purpose of conducting transactions with the individual in question.
Businesses that disclose PII to a third party must have a contract in place requiring the third party to implement and maintain reasonable security procedures and practices.
The responsibility to safeguard PII begins when the information is first acquired and remains in effect until the information is properly disposed of. This means that businesses must also take reasonable steps to dispose of customer records that are within their custody.
Adequate disposal methods include shredding, erasing and otherwise modifying the records where the information is stored to make them unreadable or undecipherable. Businesses can use any means necessary to dispose of PII properly.
Affected Entities
Breach notification requirements apply to individuals and businesses in California that own, license or maintain PII about Californians. Under these laws, a business is any group that is organized, chartered, or holds a license or authorization certificate under California law or the law of any other state, the federal government or of any other country. This definition of business includes any sole proprietorship, partnership, corporation, association and financial institutions. The term also includes any entity that disposes of records.
Certain businesses are exempt from California’s breach notification law, including:
- Health care providers, health care service plans or contractors regulated by the Confidentiality of Medical Information Act;
- Financial institutions that are subject to the California Financial Information Privacy Act;
- Businesses governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules;
- Entities that obtain information under an agreement authorized by the vehicle code and that are subject to the confidentiality requirements of the vehicle code; and
- Businesses that are regulated by state or federal laws that provide greater protections to PII than what is required under California’s breach notification laws. This last exemption is possible because compliance with stricter state or federal laws will be considered compliance with California laws.
Affected Information
Under the breach notification law, PII includes an individual’s first name or first initial and last name in combination with one or more of the following:
- A Social Security number;
- A driver’s license number or California identification card number;
- An account, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial information;
- Medical information (meaning any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional);
- Health insurance information (meaning an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records); and
- Information or data collected through the use or operation of an automated license plate recognition system.
PII also includes a username or email address, in combination with a password or security question and answer that would permit access to an online account.
PII does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.
What is a Security Breach?
Under the law, a security system breach is an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the PII maintained by another person or business.
Determining whether a breach took place under the law depends on whether the affected information was encrypted or unencrypted, as shown in the table below.
|
Encrypted Information |
|
Unencrypted Information
|
|
Notification must be given if:
- The business reasonably believes the information has been acquired by an unauthorized person;
- The encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person; and
- The business that owns or licenses the PII reasonably believes that the encryption key or security credential could render that PII readable or usable.
|
|
- Notification must be given if the business reasonably believes that the information was acquired by an unauthorized person.
|
Data Breach Notification
California law requires businesses to provide written notice of a breach to the security of their systems if they own or license computerized data that includes PII.
|
Who must be notified?
|
Businesses must notify any person whose PII was compromised as a result of a data breach (as defined above).
In addition, any business that is required to notify more than 500 California residents as a result of a single breach must submit a single sample copy of that notification to California’s attorney general.
Businesses that maintain, but do not own or license, PII must inform the entity that owns or licenses the information of any security breach if the PII was, or is reasonably believed to have been, acquired by an unauthorized person.
|
|
Mandatory Notification Content
|
A valid data breach notification must be written in plain language and must be titled “Notice of Data Breach.” This notification must include the following information (if available at the time the notification is sent):
- The name and contact information of the reporting person or business subject to these requirements;
- A list of the types of PII that was or is reasonably believed to have been compromised by the breach;
- The date of, the estimated date of or date range for the breach;
- Whether notification was delayed as a result of a law enforcement investigation;
- A general description of the breach incident;
- The toll-free numbers and addresses for the major credit reporting agencies (if the breach exposed a Social Security number, driver’s license number or California identification card number);
- An offer to provide appropriate identity theft prevention and mitigation services for affected individuals for at least 12 months (if the entity providing the notification was the source of the breach); and
- Instructions on how to take advantage of the 12-month identity prevention and mitigation services offered (as applicable).
|
|
Optional Notification Content
|
The following information may be included in a breach notification at the discretion of the entity sending the notice:
- Information about what has been done to protect individuals whose information has been breached; and
- Advice on steps affected individuals may take to protect themselves.
|
|
When to Send the Notification
|
Data breach notifications must be made as soon as possible, without unreasonable delay. Timely notifications must take into account legitimate needs to cooperate with law enforcement, determine the scope of the breach and restore a reasonable integrity of the data system. For example, the notification requirement may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
|
|
How to Send the Notification
|
Under California law, breach notification can be sent in print, electronically or through a substitute notice, as defined below.
The use of electronic notices is acceptable, as long as all timing, content and formatting requirements are met. Electronic notifications must also follow federal laws regarding electronic records and signatures in commerce.
A valid substitute notice must include:
- An email notice (when the business has an email address for the affected individuals);
- Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the business, if the business maintains one. Conspicuous posting means providing a link to the notice on the home page or first significant page after entering the business’ website. The link must stand out from the surrounding text by using larger type, contrasting type, font or color to the surrounding text. The text may also stand out by using symbols or other marks that call attention to the link; and
- Notification to major statewide media.
Substitute notice may also be provided if the business demonstrates that the cost of providing notice would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the business does not have sufficient contact information.
|
Required Format
The notice must be designed to call attention to the nature and the significance of the message. This includes making sure that the title and headings are clearly and conspicuously displayed and using a font type that is 10 point or larger.
In addition, the data breach notice must organize the information according to the following headers:
- What happened
- What information was involved
- What we are doing
- What you can do
- For more information
Safe Harbor
A business that maintains its own notification procedures as part of an information security policy for the treatment of PII is in compliance with the notification requirements mentioned above if it:
- Notifies individuals in accordance with its policies in the event of a breach; and
- The notification takes place within the time constraints mentioned above.
Enforcement
Businesses cannot waive any of the responsibilities imposed on them by California’s breach notification laws. Any business that fails to comply with these requirements may be required to pay damages and penalties to injured customers by a civil court. Any business that violates, proposes to violate or has violated notification requirements may be subject to these sanctions.
The amount of damages depends on the extent of the harm or injury caused to the customer. The penalty is typically $500 per violation, but a court may order the penalty to be as much as $3,000 per penalty for willful, intentional or reckless violations.
A “customer,” for these purposes, is any individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.
Unless the violation is willful, intentional or reckless, a business that fails to provide adequate, complete and accurate notification to affected individuals can raise a complete defense against court penalties if it strives to remedy inadequate, incomplete or inaccurate notifications within 90 days of discovering an issue.
Read more
On Dec. 22, 2017, President Donald Trump signed the tax reform bill, called the Tax Cuts and Jobs Act, into law, after it passed both the U.S. Senate and the U.S. House of Representatives.
This tax reform bill, drafted based on a tax reform plan that was developed in consultation with the Trump administration, will make significant changes to the federal tax code. Specifically, the tax reform bill will have a substantial impact on businesses.
For example, it:
- Lowers the corporate tax rate—Beginning in 2018, the bill reduces the corporate tax rate to 21 percent (down from 35 percent) and eliminates the corporate Alternative Minimum Tax (AMT), in an effort to make American corporations more competitive globally.
- Creates a new tax deduction for small businesses—The bill establishes a new 20 percent tax deduction for all businesses conducted as sole proprietorships, partnerships, LLCs and S corporations.
- Allows “expensing” of capital investments—The bill allows businesses to immediately write off (or “expense”) the cost of new investments for at least five years.
- Repeals or restrict many existing business deductions and credits—Because the bill substantially reduces the tax rate for all businesses, it also eliminates the existing domestic production (Section 199) deduction, and repeals or restricts numerous other special exclusions and deductions (including those for employer provided transportation and commuting benefits). However, the bill explicitly preserves business credits related to research and development and low-income housing, as well as deductions or exclusions for employer provided dependent care assistance programs (DCAPs), education assistance programs and adoption assistance programs.
- Ends “offshoring” incentives—The bill ends the incentive to offshore jobs and keep foreign profits overseas by exempting them when they are repatriated to the United States. It imposes a one-time, low tax rate on wealth that has already accumulated overseas so there is no tax incentive to keep the money offshore.
- Repeals the individual mandate tax penalty imposed under the Affordable Care Act (ACA), effective in 2019.
However, the tax reform bill does not affect the following tax provisions:
- Tax treatment of employer-sponsored health plans; and
- The ACA’s Cadillac tax on high-cost employer-sponsored health coverage.
Scurich Insurance will continue to monitor the tax reform process for any future updates.
Read more
On Oct. 31, 2017, the Internal Revenue Service (IRS) issued Notice 2017-67 to provide comprehensive guidance on a variety of topics regarding qualified small employer health reimbursement arrangements (QSEHRAs). Small employers that do not maintain group health plans may establish QSEHRAs for their employees, effective for plan years beginning on or after Jan. 1, 2017. Unlike other health accounts, QSEHRAs can be used to reimburse employees for their health insurance premiums.
Notice 2017-67 clarifies the technical rules for QSEHRAs, including the requirements that employees provide proof of minimum essential coverage (MEC) and that employers provide a written notice to eligible employees each year.
ACTION STEPS
Small employers with QSEHRAs should confirm that their QSEHRAs comply with this new guidance. Notice 2017-62 applies to plan years beginning on or after Nov. 20, 2017. In addition, employers may need to provide their initial written notice by Feb. 19, 2018.
Background
Beginning Jan. 1, 2017, employers that are not applicable large employers under the Affordable Care Act and do not maintain group health plans may sponsor QSEHRAs to pay for employees’ individual health insurance policies and other out-of-pocket medical expenses on a tax-favored basis. To qualify as a QSEHRA, the reimbursement arrangement must meet the following criteria:
- The QSEHRA must be funded solely by the employer. Employees cannot make their own salary reduction contributions.
- QSEHRA payments or reimbursements must be limited to medical care expenses incurred by the employee or the employee’s family members, after the employee provides proof of coverage.
- The maximum amount of payments and reimbursements from the QSEHRA for any year cannot exceed $4,950 (or $10,000 for QSEHRAs that also reimburse medical expenses of the employee’s family members). These amounts are adjusted annually for inflation. For 2018, the total amount of payments and reimbursements from a QSEHRA cannot exceed $5,050 ($10,250 for family coverage).
- The QSEHRA must be provided on the same terms to all eligible employees.
IRS Guidance on QSEHRAs – Notice 2017-67
Notice 2017-67 provides detailed guidance on a wide range of topics for QSEHRAs, including the criteria for QSEHRAs, the tax consequences of the arrangement, the impact on eligibility for health savings account (HSA) contributions and the written notice requirement.
The guidance applies for plan years beginning on or after Nov. 20, 2017, although QSEHRAs established before that date may rely on this guidance. Also, employers that established QSEHRAs for 2017 in accordance with a reasonable good faith interpretation of the law may continue to operate their QSEHRAs based on those terms until the last day of the plan year that began in 2017.
Written Notice
An employer funding a QSEHRA for any year must provide a written notice to each eligible employee at least 90 days before the beginning of each year. For employees who become eligible to participate in the QSEHRA during the year, the notice must be provided by the date on which the employee becomes eligible to participate. If an employer fails to provide this notice for a reason other than reasonable cause, the employer may be subject to a penalty of $50 per employee for each failure, up to a maximum annual penalty of $2,500 for all notice failures during the year. On Feb. 27, 2017, the IRS delayed the initial notice deadline pending its issuance of further guidance.
Notice 2017-67 provides a new deadline for the initial QSEHRA notice, as well as sample language that employers may use.
Initial Notice Deadline – An eligible employer that provides a QSEHRA during 2017 or 2018 must provide the initial written notice to eligible employees by the later of (1) Feb. 19, 2018, or (2) 90 days before the first day of the QSEHRA’s plan year. According to the IRS, penalties may apply to any employer that does not timely provide the written notice.
Same Terms Requirement
Notice 2017-67 explains what it means for a QSEHRA to be provided on the same terms to all eligible employees. For example, to satisfy this requirement:
- The QSEHRA must be operated on a uniform and consistent basis for all eligible employees;
- Eligible employees cannot be allowed to waive coverage; and
- If an employer is part of a controlled group or affiliated service group (as determined under Internal Revenue Code Section 414), each employer in the group must provide a QSEHRA to all eligible employees on the same terms.
In addition, Notice 2017-67 confirms that a QSEHRA may be designed to limit reimbursements to certain medical expenses (for example, health insurance premiums or cost-sharing expenses that are medical expenses). However, a QSEHRA will fail to satisfy the same terms requirement if, under the facts and circumstances, the plan’s reimbursement limit causes the QSEHRA not to be effectively available to all eligible employees. This may occur, for example, if a QSEHRA limits reimbursements to Medicare or Medicare supplement policies.
Maximum Benefit and Reimbursements
QSEHRAs may use the statutory dollar limits in effect for the preceding year to determine permitted benefits, rather than the dollar limits in effect for the current year. IRS Notice 2017-67 also confirms that any carryovers of unused amounts from a prior plan year are taken into account when determining an employee’s maximum annual benefit. An employee’s total permitted benefit, taking into account both carry-over amounts and newly available amounts, may not exceed the applicable statutory dollar limit.
In addition, a QSEHRA may reimburse premiums for coverage under the group health plan of a spouse’s employer. However, the reimbursement is taxable to the extent that the spouse’s share of premiums was paid on a pre-tax basis.
Proof of Coverage
Before a QSEHRA can reimburse an expense for any plan year, the eligible employee must first provide proof that he or she had MEC for the month during which the expense was incurred. This proof must consist of either:
- A document from a third party (for example, the insurer) showing that the employee had coverage (for example, an insurance card or explanation of benefits) and an attestation by the employee that the coverage was MEC; or
- An attestation by the employee stating that the employee had MEC, the date the coverage began and the name of the coverage provider.
- Notice 2017-67 includes model attestation language that employers may use. The initial proof of MEC must be provided with respect to each individual whose expenses are eligible for reimbursement before the first expense reimbursement. Following the initial proof, the employee must attest with each new request for reimbursement during the plan year that the employee and the individual whose expenses are being reimbursed (if different) continue to have MEC. This attestation can be part of the form for requesting reimbursement.
Employer Reporting
Employers that sponsor QSEHRAs must report the amount of payments and reimbursements that an eligible employee is entitled to receive from the QSEHRA for the calendar year in box 12 of the employee’s Form W-2 using code FF, without regard to the payments or reimbursements actually received. Notice 2017-67 provides detailed rules for this reporting.
In addition, Notice 2017-67 confirms that an employer providing a QSEHRA is not required to provide IRS Forms 1095-B (Section 6056 statements) to covered employees. However, a QSEHRA is subject to the Patient-Centered Outcomes Research Institute (PCORI) fee, which applies for plan years ending before Oct. 1, 2019.
HSA Contributions
Employers that sponsor QSEHRAs may contribute to employees’ HSAs and may allow employees to make pre-tax HSA contributions through a Section 125 plan.
Notice 2017-67 also addresses how QSEHRA coverage impacts an individual’s eligibility for HSA contributions. To be HSA-eligible, an individual must be covered by a high deductible health plan (HDHP) and not be covered by other health coverage that provides benefits below the HDHP minimum deductible. According to the IRS, if the QSEHRA only reimburses health insurance premiums, it will not cause an individual to be ineligible for HSA contributions. However, individuals who are covered by QSEHRAs that reimburse any medical expenses, including cost sharing, are not eligible for HSA contributions.
Read more
The Occupational Safety and Health Administration’s (OSHA) electronic reporting rule requires certain establishments to report information electronically from their OSHA Forms 300, 300A and 301. Under the rule, the first electronic reports were due on July 1, 2017.
However, on Nov. 24, 2017, OSHA issued a new final rule officially delaying the first electronic reporting deadline to Dec. 15, 2017. Affected establishments will need to submit their reports through the Injury Tracking Application (ITA) website by that time or face possible OSHA penalties.
ACTION STEPS
- Affected establishments must create an account on the ITA website and submit information from their 2016 OSHA 300A form by Dec. 15, 2017.
- Other deadlines under the electronic reporting rule remain unaltered. Therefore, affected establishments should begin their preparations to submit information from all 2017 OSHA forms by July 1, 2018.
Affected Establishments
OSHA’s electronic reporting rule affects establishments that:
- Are already required to create and maintain OSHA injury and illness records and have 250 or more employees;
- Have between 20 and 249 employees and belong to a high-risk industry; and
- Receive a specific request from OSHA to create, maintain and submit electronic records, even if they would otherwise be exempt from OSHA recordkeeping requirements.
The electronic reporting rule applies to establishments, not employers. An employer may have several worksites or establishments. In these situations, some establishments may be affected while others are not.
To determine whether an establishment is affected, employers must determine each establishment’s peak employment during the calendar year. During this determination, employers must count every individual that worked at that establishment, regardless of whether he or she worked full-time, part-time, or was a temporary or seasonal worker.
Finally, a firm with more than one establishment may submit establishment-specific data for multiple establishments.
Reporting Requirements
| Submission Deadline |
Number of Employees
(per establishment) |
| 250+ |
20 -249 |
| Dec. 15, 2017 |
Form 300A |
Form 300A |
| July 1, 2018 |
Forms 300A, 300 and 301 |
Form 300A |
| March 2 (2019 and beyond) |
Forms 300A, 300 and 301 |
Form 300A |
The data an employer must submit and the timeline for submitting this information to OSHA depends on the establishment size.
Establishments with 250 or more employees will be required to submit information from their OSHA Forms 300A, 300 and 301. However, in 2017, these establishments will only be required to submit data from their 300A Form. Establishments in high-risk industries with between 20 and 249 employees will be required to submit information only from their OSHA Form 300A.
For the first reporting year, the deadline has been delayed to Dec. 15, 2017. However, the final rule that delayed the first deadline did not alter subsequent deadlines, so reporting deadlines for 2018, 2019 and beyond remain as shown in the table above.
Submitting the Report
The ITA is a secure website that OSHA created specifically for the data required by the electronic reporting rule. The ITA allows employers three options to submit their reports:
- Manual entry;
- Comma-separated value (CSV) file upload; and
- Application programming interface (API) transmission.
The ITA offers affected establishment instructions and sample files and templates to help them complete the submission process.
OSHA-approved State Plans
The final rule required OSHA-approved State Plans to adopt the electronic rule or “substantially identical” requirements within six months of the final rule’s publication date. The final rule was published on May 12, 2016.
This means that OSHA-approved State Plans have the authority to adopt reporting requirements that go above and beyond what is required by the federal rule. For this reason, establishments located in OSHA-approved State Plan jurisdictions should consult with their local OSHA offices to make sure they are satisfying all electronic reporting requirements.
However, the following OSHA-approved State Plans have not yet adopted the requirement to submit injury and illness reports electronically:
 |
| All Employers |
Public Employers |
- California
- Maryland
- Minnesota
- South Carolina
- Utah
- Washington
- Wyoming
|
- Illinois
- Maine
- New Jersey
- New York
|
Similarly, state and local government establishments in IL, ME, NJ and NY are not currently required to submit their data through the reporting website.
More Information
Contact Scurich Insurance or visit the OSHA tracking of workplace injuries and illnesses webpage for more information regarding electronic reporting.
Read more
A new law will require California employers with 20 or more employees to grant up to 12 weeks of unpaid, job-protected leave for employees to bond with a new child.
The New Parent Leave Act, enacted on Oct. 12, 2017, extends the state’s parental-bonding leave requirements, which currently apply only to employers with 50 or more employees, to smaller employers starting on Jan. 1, 2018.
The law will allow employees who are employed at a worksite where the employer has 20 or more employees within 75 miles to take parental leave within the first year after their child is born, adopted or placed with them for foster care.
ACTION STEPS
California employers with 20 to 49 employees should become familiar with the new law and revise their leave policies as necessary to ensure compliance.
Employers Subject to the New Law
An employer is subject to the New Parent Leave Act if it:
| ✓ |
Has at least 20 employees working within 75 miles of each other; and |
| ✓ |
Is not subject to the California Family Rights Act (CFRA) and the Family Medical Leave Act (FMLA) |
Thus, the New Parent Leave Act generally applies to all California employers that have between 20 and 49 employees.
Employees Entitled to Leave Under the New Law
Under the New Parent Leave Act, an employee will be eligible to take leave if he or she:
| ✓ |
Has more than 12 months of service for the employer;
|
| ✓ |
Has at least 1,250 hours of service with the employer during the previous 12 months; and |
| ✓ |
Works at a worksite in which the employer has at least 20 employees within 75 miles. |
In addition, an employee that wishes to take leave under the New Parent Leave Act must request and take the leave within the first year after:
| ✓ |
The birth of the employee’s child; |
| ✓ |
The employee’s adoption of a child; or |
| ✓ |
The placement of a child for foster care with the employee. |
An employer may require at least 30 days’ advance notice when the need for leave is foreseeable due to an expected birth or placement of a child for adoption or foster care. If 30 days’ advance notice is not possible, an employee may be required to provide notice as soon as practicable. Employers must respond to an employee’s leave request no later than five business days after receiving it.
Leave Requirements
Before the start of an employee’s leave under the New Parent Leave Act, the employer must provide the employee with a guarantee of employment in the same or a comparable position following the leave. An employer that fails to provide this guarantee may be deemed to have unlawfully refused the employee’s leave request.
Employers are not required to pay an employee while he or she is on leave under the New Parent Leave Act. However, employees may use, and employers may require employees to use, any accrued vacation pay, paid sick time, other accrued paid time off, or other paid or unpaid time off negotiated with the employer, during a period of parental leave.
Like the CFRA and FMLA, the New Parent Leave Act requires employers to maintain and pay for continued group health coverage for an employee while he or she is on parental leave.
The health coverage must be continued at the same level and under the same conditions as those provided prior to a leave period. An employer may recover the costs of maintaining an employee’s health coverage if the employee fails to return to work following a parental leave period for any reason other than a serious health condition or circumstances beyond the employee’s control.
If both parents of a new child are employed by the same employer, the employer is not required to grant more than a total of 12 weeks of leave under the New Parent Leave Act. However, an employer may allow both employees to take up to 12 weeks of leave at the same time.
Prohibited Practices
The New Parent Leave Act prohibits employers from:
| • |
Interfering with, restraining or denying an employee’s rights under the law; and |
| • |
Discharging, fining, suspending, expelling, refusing to hire or discriminating against an employee for exercising his or her rights under the law, or for providing information or testimony in any inquiry or proceeding related to the rights guaranteed under the law. |
Enforcement
If an employer violates the New Parent Leave Act, an affected employee may file a complaint with the California Department of Fair Employment and Housing (DFEH), which may order the employer to:
| • |
Hire, reinstate or upgrade the employee, with or without back pay; |
| • |
Refrain from committing any further violations; and |
| • |
Pay a fine of up to $25,000 for any discrimination. |
The DFEH may also file or grant an employee the right to file a civil lawsuit against an employer for violations of the New Parent Leave Act. Until Jan. 1, 2020, however, employers will have the right to request that all parties participate in mediation before an employee is allowed to file a lawsuit. An employer that receives a right-to-sue notice from the DFEH will have 60 days to submit a mediation request.
Interaction with Existing State Laws
Currently, the CFRA and the FMLA require California employers with 50 or more employees to provide up to 12 weeks of unpaid, job-protected leave for employees to bond with a new child born to, adopted by or placed for foster care with them. The New Parent Leave Act, which was signed into law on Oct. 12, 2017, will require smaller employers in California to provide the same leave.
Unlike the CFRA and the FMLA, however, the New Parent Leave Act will not require employers to provide leave for an employee’s own serious health condition or for the serious health condition of a family member.
Under another existing state law, California employers with five or more employees must grant up to four months of unpaid, job-protected leave to female employees who are disabled by pregnancy, childbirth or a related medical condition. Because of this, an employee cannot take leave under the CFRA for these conditions. Likewise, an employee will not be allowed to take leave for those conditions under the New Parent Leave Act.
However, an employee who works for an employer with 50 or more employees may take CFRA leave to bond with a new child (or to deal with a serious health condition) once her pregnancy disability leave ends. Under the New Parent Leave Act, employees who work for smaller employers will also be allowed to take parental leave after a period of pregnancy- or childbirth-related disability leave.
More Information
Contact Scurich Insurance or visit the DFEH website for more information on California’s leave laws.
Read more
OSHA’s final rule on electronic reporting requires certain employers to submit data from their injury and illness records electronically so it can be posted on the agency’s website. Because the rule is an extra requirement on top of existing OSHA recordkeeping standards, affected employers need to be ready to comply with the rule before the proposed Dec. 1, 2017, deadline.
Other News and Tips
Preparing for OSHA Inspections
If an unannounced OSHA inspection finds violations at your business, you may have to pay thousands in fines and watch as your reputation plummets. Fortunately, OSHA inspections generally follow an established procedure that you and your staff can prepare for.
When an OSHA compliance officer arrives at your business, it’s important to check his or her credentials and then determine if you’ll give consent to the inspection. Although you can refuse an inspection or give only partial consent, the compliance officer will take note of this and OSHA may take further action.
Once an inspection begins, the goal should be to determine its purpose and set any ground rules. You should also be prepared to provide proof that your business is in compliance with OSHA standards. During the walkaround process, be sure to take notes of what the inspector documents so you can review them later.
OSHA inspections can be stressful, even when your business is in full compliance. Scurich Insurance can provide you with our inspection guide, “Be Prepared for an OSHA Inspection,” and help your business impress OSHA compliance officers.
OSHA Removes Employee Fatalities from Home Page
Although OSHA used to include a URL link on its home page that would direct viewers to a list of employee fatalities, the agency recently moved the link to a separate page on its website.
According to a spokesperson from the Department of Labor, the link was moved in order to increase the accuracy of workplace data, as previous listings included fatalities that were outside OSHA’s jurisdiction. However, OSHA will keep the list of employee fatalities on its website and continue to review data from employers.
Although the electronic reporting rule initially required certain employers to start submitting their required information by July 1, 2017, OSHA’s Injury Tracking Application website wasn’t ready to receive electronic reports in time, and OSHA proposed Dec. 1, 2017, as the new deadline. The rule doesn’t change an employer’s requirements to complete and retain regular injury and illness records, but some employers will now have additional obligations. Here are the requirements for the rule:
- Establishments with 250 or more employees that are required to keep injury and illness records must electronically submit the following forms:
- OSHA Form 300: Log of Work-Related Injuries and Illnesses
- OSHA Form 300A: Summary of Work-Related Injuries and Illnesses
- OSHA Form 301: Injury and Illnesses Incident Report
- Establishments with 20 to 249 employees that work in industries with historically high rates of occupational injuries and illnesses must electronically submit information from OSHA Form 300A.
The final reporting requirements will be phased in over two years. After the initial Dec. 1, 2017, deadline, establishments with 250 or more employees must submit information from OSHA Forms 300, 300A and 301 by July 1, 2018. Beginning in 2019 and every year thereafter, the information must be submitted by March 2.
For more help preparing for this new rule, call us at 831-661-5697 and ask to see our comprehensive Compliance Overview on OSHA’s electronic reporting rule.
New Silica Rule Enforcement Begins
A new OSHA rule on respirable crystalline silica will require employers to limit their employees’ exposure to silica hazards and provide medical exams to monitor highly exposed employees. The rule is scheduled to come into effect on June 23, 2018; however, OSHA began enforcement of the new rule in the construction industry on Sept. 23, 2017.
Under the new rule, employers must reduce the permissible exposure limit (PEL) for respirable silica to 50 micrograms per cubic meter of air (50 µg/m3). The rule also requires employers to take the following steps:
- Establish engineering controls to limit employees’ exposure to the new PEL.
- Provide employees with respirators when engineering controls alone do not provide enough protection.
- Establish a written silica exposure control plan.
- Provide medical exams to employees who are exposed to levels of respirable silica at or above the new PEL for 30 or more days a year.
To see more information on the respirable silica rule, and to see specifics about the rule’s application in the construction industry, visit OSHA’s website.
Read more
