On Dec. 22, 2017, President Donald Trump signed into law the tax reform bill, called the Tax Cuts and Jobs Act, after it passed both the U.S. Senate and the U.S. House of Representatives.
This tax reform bill makes significant changes to the federal tax code. The bill does not impact the majority of the Affordable Care Act (ACA) tax provisions. However, it does reduce the ACA’s individual shared responsibility (or individual mandate) penalty to zero, effective beginning in 2019.
As a result, beginning in 2019, individuals will no longer be penalized for failing to obtain acceptable health insurance coverage.
ACTION STEPS
Although the tax reform bill eliminates the ACA’s individual mandate penalty, this repeal does not become effective until 2019.
As a result, individuals continue to be required to comply with the mandate (or pay a penalty) for 2017 and 2018. A failure to obtain acceptable health insurance coverage for these years may still result in a penalty for the individual.
The Individual Mandate
The ACA’s individual mandate, which took effect in 2014, requires most individuals to obtain acceptable health insurance coverage for themselves and their family members or pay a penalty. The mandate is enforced each year on individual federal tax returns. Starting in 2015, individuals filing a tax return for the previous tax year indicate, by checking a box on their returns, which members of their family (including themselves) had health insurance coverage for the year (or qualified for an exemption from the individual mandate). Based on this information, the IRS then assesses a penalty for each nonexempt family member without coverage.
Effect of the Tax Reform Bill
The tax reform bill will reduce the ACA’s individual mandate penalty to zero, effective beginning with the 2019 tax year. This effectively eliminates the individual mandate penalty for the 2019 tax year and beyond. As a result, beginning with the 2019 tax year, individuals will no longer be penalized for failing to obtain acceptable health insurance coverage for themselves and their family members.
Impact on Years Prior to 2019
Although the tax reform bill eliminates the ACA’s individual mandate penalty, this repeal does not take effect until 2019. As a result, individuals continue to be required to comply with the mandate (or pay a penalty) for 2017 and 2018. A failure to obtain acceptable health insurance coverage for these years may still result in a penalty for the individual.
Therefore, nonexempt individuals should continue to maintain acceptable health coverage in 2017 and 2018, and should indicate on their 2017 and 2018 tax returns whether they (and everyone in their family):
- Had health coverage for the year;
- Qualified for an exemption from the individual mandate; or
- Will pay an individual mandate penalty.
In addition, keep in mind that individuals who are liable for a penalty for failing to obtain acceptable health coverage in 2018 will be required to pay that penalty when they file their federal income taxes in 2019. As a result, some individuals may be required to pay the individual mandate penalty in early 2019, based on their noncompliance for the 2018 tax year.
Effect on Other ACA Provisions
Despite the repeal of the individual mandate penalty, employers and individuals must continue to comply with all other ACA provisions. The tax reform bill does not impact any other ACA provisions, including the Cadillac tax on high-cost group health coverage, the PCORI fees and the health insurance providers fee. In addition, the employer shared responsibility (pay or play) rules and related Section 6055 and Section 6056 reporting requirements are still in place.
Read more
Businesses gather a lot of information from their customers, including personal identifying information (PII). Because of the sensitivity of this information, many states have adopted standards that businesses must follow to safeguard PII. These standards often include data security breach notification requirements.
In California, these laws are enforced by the California attorney general’s office. This Cyber Security Law Summary provides an overview of California’s data breach notification requirements. Businesses can use this information to understand their responsibilities in protecting PII of California customers.
Cyber security Responsibilities
California law requires businesses and individuals that own, license or maintain PII about Californians to safeguard that information. Businesses must implement reasonable security procedures and practices to protect PII from unauthorized access, destruction, use, modification or disclosure.
Under California law, “owning” and “licensing” includes retaining an individual’s PII in an internal account for the purpose of conducting transactions with the individual in question.
Businesses that disclose PII to a third party must have a contract in place requiring the third party to implement and maintain reasonable security procedures and practices.
The responsibility to safeguard PII begins when the information is first acquired and remains in effect until the information is properly disposed of. This means that businesses must also take reasonable steps to dispose of customer records that are within their custody.
Adequate disposal methods include shredding, erasing and otherwise modifying the records where the information is stored to make them unreadable or undecipherable. Businesses can use any means necessary to dispose of PII properly.
Affected Entities
Breach notification requirements apply to individuals and businesses in California that own, license or maintain PII about Californians. Under these laws, a business is any group that is organized, chartered, or holds a license or authorization certificate under California law or the law of any other state, the federal government or of any other country. This definition of business includes any sole proprietorship, partnership, corporation, association and financial institutions. The term also includes any entity that disposes of records.
Certain businesses are exempt from California’s breach notification law, including:
- Health care providers, health care service plans or contractors regulated by the Confidentiality of Medical Information Act;
- Financial institutions that are subject to the California Financial Information Privacy Act;
- Businesses governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules;
- Entities that obtain information under an agreement authorized by the vehicle code and that are subject to the confidentiality requirements of the vehicle code; and
- Businesses that are regulated by state or federal laws that provide greater protections to PII than what is required under California’s breach notification laws. This last exemption is possible because compliance with stricter state or federal laws will be considered compliance with California laws.
Affected Information
Under the breach notification law, PII includes an individual’s first name or first initial and last name in combination with one or more of the following:
- A Social Security number;
- A driver’s license number or California identification card number;
- An account, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial information;
- Medical information (meaning any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional);
- Health insurance information (meaning an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records); and
- Information or data collected through the use or operation of an automated license plate recognition system.
PII also includes a username or email address, in combination with a password or security question and answer that would permit access to an online account.
PII does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.
What is a Security Breach?
Under the law, a security system breach is an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the PII maintained by another person or business.
Determining whether a breach took place under the law depends on whether the affected information was encrypted or unencrypted, as shown in the table below.
|
Encrypted Information |
|
Unencrypted Information
|
|
Notification must be given if:
- The business reasonably believes the information has been acquired by an unauthorized person;
- The encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person; and
- The business that owns or licenses the PII reasonably believes that the encryption key or security credential could render that PII readable or usable.
|
|
- Notification must be given if the business reasonably believes that the information was acquired by an unauthorized person.
|
Data Breach Notification
California law requires businesses to provide written notice of a breach to the security of their systems if they own or license computerized data that includes PII.
|
Who must be notified?
|
Businesses must notify any person whose PII was compromised as a result of a data breach (as defined above).
In addition, any business that is required to notify more than 500 California residents as a result of a single breach must submit a single sample copy of that notification to California’s attorney general.
Businesses that maintain, but do not own or license, PII must inform the entity that owns or licenses the information of any security breach if the PII was, or is reasonably believed to have been, acquired by an unauthorized person.
|
|
Mandatory Notification Content
|
A valid data breach notification must be written in plain language and must be titled “Notice of Data Breach.” This notification must include the following information (if available at the time the notification is sent):
- The name and contact information of the reporting person or business subject to these requirements;
- A list of the types of PII that was or is reasonably believed to have been compromised by the breach;
- The date of, the estimated date of or date range for the breach;
- Whether notification was delayed as a result of a law enforcement investigation;
- A general description of the breach incident;
- The toll-free numbers and addresses for the major credit reporting agencies (if the breach exposed a Social Security number, driver’s license number or California identification card number);
- An offer to provide appropriate identity theft prevention and mitigation services for affected individuals for at least 12 months (if the entity providing the notification was the source of the breach); and
- Instructions on how to take advantage of the 12-month identity prevention and mitigation services offered (as applicable).
|
|
Optional Notification Content
|
The following information may be included in a breach notification at the discretion of the entity sending the notice:
- Information about what has been done to protect individuals whose information has been breached; and
- Advice on steps affected individuals may take to protect themselves.
|
|
When to Send the Notification
|
Data breach notifications must be made as soon as possible, without unreasonable delay. Timely notifications must take into account legitimate needs to cooperate with law enforcement, determine the scope of the breach and restore a reasonable integrity of the data system. For example, the notification requirement may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
|
|
How to Send the Notification
|
Under California law, breach notification can be sent in print, electronically or through a substitute notice, as defined below.
The use of electronic notices is acceptable, as long as all timing, content and formatting requirements are met. Electronic notifications must also follow federal laws regarding electronic records and signatures in commerce.
A valid substitute notice must include:
- An email notice (when the business has an email address for the affected individuals);
- Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the business, if the business maintains one. Conspicuous posting means providing a link to the notice on the home page or first significant page after entering the business’ website. The link must stand out from the surrounding text by using larger type, contrasting type, font or color to the surrounding text. The text may also stand out by using symbols or other marks that call attention to the link; and
- Notification to major statewide media.
Substitute notice may also be provided if the business demonstrates that the cost of providing notice would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the business does not have sufficient contact information.
|
Required Format
The notice must be designed to call attention to the nature and the significance of the message. This includes making sure that the title and headings are clearly and conspicuously displayed and using a font type that is 10 point or larger.
In addition, the data breach notice must organize the information according to the following headers:
- What happened
- What information was involved
- What we are doing
- What you can do
- For more information
Safe Harbor
A business that maintains its own notification procedures as part of an information security policy for the treatment of PII is in compliance with the notification requirements mentioned above if it:
- Notifies individuals in accordance with its policies in the event of a breach; and
- The notification takes place within the time constraints mentioned above.
Enforcement
Businesses cannot waive any of the responsibilities imposed on them by California’s breach notification laws. Any business that fails to comply with these requirements may be required to pay damages and penalties to injured customers by a civil court. Any business that violates, proposes to violate or has violated notification requirements may be subject to these sanctions.
The amount of damages depends on the extent of the harm or injury caused to the customer. The penalty is typically $500 per violation, but a court may order the penalty to be as much as $3,000 per penalty for willful, intentional or reckless violations.
A “customer,” for these purposes, is any individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.
Unless the violation is willful, intentional or reckless, a business that fails to provide adequate, complete and accurate notification to affected individuals can raise a complete defense against court penalties if it strives to remedy inadequate, incomplete or inaccurate notifications within 90 days of discovering an issue.
Read more
Although it is important for companies to trust their workers and the general public, the unfortunate reality is that theft can happen at any time. This is particularly true in the construction industry, where expensive tools and machinery are often left in plain sight or are easily accessible to criminals.
Construction site theft is especially damaging, as the theft of materials and tools can quickly delay a project, sometimes bringing production to a halt. Accordingly, it is essential for construction companies to understand how they can prevent job site theft before it happens.
General Tips
While every job site presents its own set of unique challenges, there are a number of general tips firms can use to better secure a construction site. The following are some basic strategies you can use to protect your materials and tools from thieves:
- Create a written security policy and job site security plan. These written plans should assign supervisory responsibilities, encourage awareness, and establish basic best practices for securing tools and materials.
- Contact nearby property owners and local law enforcement officials whenever you start a new project. These parties can help monitor your job site, particularly during off-hours.
- Establish a way for your employees to report theft or suspicious activity. Be sure to maintain complete records of any security incidents, as they can be beneficial to law enforcement in the event of theft, vandalism or similar occurrences.
- Conduct thorough background checks on your employees before hiring them on full time. You should also keep a list of people authorized to be on the job site on hand at all times.
Worksite Protections
Equipping your worksite with theft prevention features is mandatory if you expect to ward off potential criminals. Whenever possible, consider doing the following:
- Enclose your worksite with a security fence and provide limited access at all times. Use lockable gates whenever possible. Avoid using low-quality locks or leaving keys in the locks themselves.
- Ensure that your worksite is well-lit at night to deter criminals.
- Utilize signage to keep unauthorized personnel off your worksite.
- Walk around the worksite at the beginning and end of each day to ensure that no items are missing.
- Consider hiring security guards to patrol the construction site, particularly at night.
If possible, install security cameras to safeguard your job site. Overall, training employees on how to best keep materials and equipment out of the hands of thieves is your first line of defense against losses.
Controls for Equipment, Tools and Materials
The number of tools and machinery found on a construction site can vary heavily from day to day, making it difficult to keep track of valuables. That’s why the first step in any good protection program is to inventory the equipment you have.
An inventory should be made available for each job site and should accomplish the following:
- Inventories should track all newly purchased items. Copies of the inventory should be kept in a secure location.
- Inventories should be up to date and include photos of the larger, more important equipment.
- To aid in the settlement and recovery of any stolen equipment, inventories should include the following:
- The original date of purchase
- The original cost of the equipment
- The equipment’s age and serial number
- Relevant manufacturer information
Firms should assign one employee to be in charge of managing the inventory. This person would be responsible for keeping track of all materials, tools and deliveries.
Other major steps to securing equipment, tools and materials include the following:
- Utilize a secured area to store your equipment.
- Mark and label all tools in a distinctive manner for easy identification.
- Implement a checkout system of all tools and equipment so you can track their whereabouts.
- Establish a key control system for heavy duty machinery.
- Install anti-theft devices on mobile equipment.
- Lock all oil and gas tank caps.
- Park all equipment in a centralized, well-lit and secure area.
- Avoid using your worksite for storage. Remove any tools, materials or equipment that are not in use.
In general, it’s important to keep inventory levels low on-site to discourage thieves. In addition, creating and maintaining an equipment program can make all the difference when it comes to safeguarding your tools.
Equipment programs should make employees, managers, supervisors and foremen responsible for equipment losses. Under such programs, all losses are must be reported, regardless of how small. You should review equipment programs at least annually.
Responding to Job Site Theft
Even if an unimportant or inexpensive piece of equipment goes missing, it’s critical to report the theft to the police. While the authorities may not always be able to recover stolen items, reporting every instance of theft helps police establish a pattern that may assist in future cases.
When a theft occurs, respond by doing the following:
- Notify the proper authorities. Provide as much detail as possible, including when the theft took place and what was stolen.
- Contact your insurance broker and review the specifics of your policies, including coverages, limitations and deductibles related to personal property.
- File an insurance claim.
Following a theft, it’s important to take any additional steps necessary to secure your job site to prevent future losses.
Protect Your Projects
Theft is unpredictable, but there are many workplace controls that firms can implement in order to protect themselves. In addition, it’s important to speak to a broker to seek the appropriate insurance coverages. Contact Scurich Insurance today for more information.
Read more
Business leaders make decidions each day on a range of issues including things like hiring, firing, compensation, promotions and the work environment. Every one of these decisions impacts your employees and, depending on the outcome, could result in a claim related to wrongful employment practices.
These claims can disrupt business, hurt morale, damage your reputation and lead to serious financial damages. Thankfully, employment practicies liability (EPL) insurance can provide organizations with protection from the above risks. Specifically, EPL insurance provides the following to policyholders.
Coverage for alleged acts.
EPL insurance not only protects organization from actual wrongful acts, but alleged acts as well. Specifically, EPL coverage can safeguard an organization from claims related to discrimination, harassment, retaliation and wrongful termination.
Timely responses to lawsuits.
Employees suing their employers is common, and orginzations will want to be prepared. This is especially important when you consider that there is no cap on how much a jury can award and that settlements in employment-related cases can easily reach six-figures.
Access to legal help.
Strong EPL policies provide the insured with access to legal resouces. This can prove invaluable if you need advice quickly.
Risk management strategies.
While employment-related lawsuits can arise at any time, organizations that take the time to implement basic risk controls are better equipped to avoid claims altogether. Many insurance companies provide access to risk management training and human resources consulting. These services can greatly reduce the likelihood that your company is sued by an employee.
Additional protection for your directors and officers.
While directors and officers (D&O) insurance can defend against employment-related lawsuits, dedicated EPL insurance is necessary for many orginzations.Having a policy that provides separate coverage for lawsuits connected to wrongful terminations, discrimination, invasion of privacy and similar employent claims ensures that the limits on your D&O policy aren’t exhuasted unnecessarily.
Read more
When cyber attacks like data breaches and hacks occur, they can result in devastating damage. Businesses have to deal with business disruptions, lost revenue and litigation. It is important to remember that no organization is immune to the impact of cyber crime. As a result, cyber liability insurance has become an essential component to any risk management program.
Cyber liability insurance policies are tailored to meet your company’s specific needs and can offer a number of important benefits, including the following:
Data breach coverage.
In the event of a breach, organizations are required by law to notify affected parties. This can add to overall data breach costs, particularly as they relate to security fixes, identity theft protection for those impacted by the breach and protection from possible legal action. Cyber liability policies include coverage for these exposures, thus safeguarding your data from cyber criminals.
Business interruption loss reimbursement.
A cyber attack can lead to an IT failure that disrupts business operations, costing your organization both time and money. Cyber liability policies may cover your loss of income during these interruptions. What’s more, increased costs to your business operations in the aftermath of a cyber attack may also be covered.
Cyber extortion defense.
Ransomware and similar malicious software are designed to steal and withhold key data from organization until a steep fee is paid. As these types of attacks increase in frequency and severity, it’s critical that organizations seek cyber liability insurance, which can help recoup loses related to cyber extortion.
Forensic support.
Following a cyber attack, your organization will have to investigate to determine the extent of the breach and what led to it. The right policy can reimburse the insured for costs related to forensics and seeking out expert advice. Additionally, some policies can provide 24/7 support from cyber specialists, which is especially useful following a hack or data breach.
Legal support.
In the wake of a cyber incident, businesses often seek legal assistance. This assistance can be costly, Cyber liability insurance can help businesses afford proper legal work following a cyber attack.
Coverage beyond a general liability policy.
General liability policies don’t always protect organizations from losses related to data breaches. What’s more, data is generally worth far more than physical assets, and it’s important to have the right protection in place when you need it most. Supplementing your insurance with cyber coverage can provide you with peace of mind that, in even of an attack, your organization’s financial and reputational well-being is protected.
To learn more about cyber liability insurance, contact us today.
Read more
When a data breach or other cyber event occurs, the damages can be significant, often resulting in lawsuits, fines and serious financial losses. What’s more, cyber exposures impact businesses of all kinds, regardless of their size, area of focus, or status as a private or public entity.
In order for organizations to truly protect themselves from cyber risks, corporate boards must play an active role. Not only does involvement from leadership improve cyber security, it can also reduce liability for board members.
To help oversee their organization’s cyber risk management, boards should ask the following questions:
Does the organization utilize technology to prevent data breaches?
Every company must have robust cyber security tools and anti-virus systems in place. These systems act as a first line of defense for detecting and preventing potentially debilitating breaches.
While it may sound obvious, many organizations fail to take cyber threats seriously and implement even the simplest protections. Boards can help highlight the importance of cyber security, ensuring that basic, preventive measures are in place.
These preventive measures must be reviewed on a regular basis, as cyber threats can evolve quickly. Boards should ensure that the management team reviews company technology at least annually, ensuring that cyber security tools are up to date and effective.
Has the board or the company’s management team identified a senior member to be responsible for organizational cyber security preparedness?
Organizations that fail to create cyber-specific leadership roles could end up paying more for a data breach than organizations that do. This is because, in the event of a cyber incident, a fast response and clear guidance is needed to contain a breach and limit damages.
When establishing a chief information security officer or similar cyber leadership role, boards need to be involved in the process. Cyber leaders should have a good mix of technical and business experience. This individual should also be able to explain cyber risks and mitigation tactics at a high level so they are easy to understand for those who are not well-versed in technical terminology.
It should be noted that hiring a chief information security officer or creating a new cyber leadership role is not practical for every organization. In these instances, organizations should identify a qualified, in-house team member and roll cyber security responsibilities into their current job requirements. At a minimum, boards need to ensure that their company has a go-to resource for managing cyber security.
Does the organization have a comprehensive cyber security program? Does it include specific policies and procedures?
It is essential for companies to create comprehensive data privacy and cyber security programs. These programs help organizations build a framework for detecting threats, remain informed on emerging risks and establish a cyber response plan.
Corporate boards should ensure that cyber security programs align with industry standards. These programs should be audited on a regular basis to ensure effectiveness and internal compliance.
Does the organization have a breach response plan in place?
Even the most secure organizations can be impacted by a data breach. What’s more, it can often take days or even months for a company to notice its data has been compromised.
While cyber security programs help secure an organization’s digital assets, breach response plans provide clear steps for companies to follow when a cyber event occurs. Breach response plans allow organizations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damage.
Board members should ensure that crisis management and breach response plans are documented. Specific actions noted in breach response plans should also be rehearsed through simulations and team interactions to evaluate effectiveness.
In addition, response plans should clearly identify key individuals and their responsibilities. This ensures that there is no confusion in the event of a breach and your organization’s response plan runs as smoothly as possible.
Has the organization discussed and formalized a cyber risk budget? How engaged is the board in terms of providing guidance related to cyber exposures?
Both overpaying and underpaying for cyber security services can negatively affect an organization. Creating a budget based on informed decisions and research helps companies invest in the right tools.
Boards can help oversee investments and ensure that they are directed toward baseline security controls that address common threats. Boards, with guidance from the chief security officer or a similar cyber leader, should also prioritize funding. That way, an organization’s most vulnerable and important assets are protected.
Has the management team provided adequate employee training to ensure sensitive data is handled correctly?
While employees can be a company’s greatest asset, they also represent one of their biggest cyber liabilities. This is because hackers commonly exploit employees through spear phishing and similar scams. When this happens, employees can unknowingly give criminals access to their employer’s entire system.
In order to ensure data security, organizations must provide thorough employee training. Boards can help oversee this process and instruct management to make training programs meaningful and based on more than just written policies.
In addition, boards should see to it that education programs are properly designed and foster a culture of cyber security awareness.
Has management taken the appropriate steps to reduce cyber risks when working with third parties?
Working alongside third-party vendors is common for many businesses. However, whenever an organization entrusts its data to an outside source, there’s a chance that it could be compromised.
Boards can help ensure that vendors and other partners are aware of their organization’s cyber security expectations. Boards should work with the company’s management team to draw up a standard third-party agreement that identifies how the vendor will protect sensitive data, whether or not the vendor will subcontract any services and how it intends to inform the organization if data is compromised.
Does the organization have a system in place for staying current on cyber trends, news, and federal, state, industry and international data security regulations?
Cyber-related legislation can change with little warning, often having a sprawling impact on the way organizations do business. If organizations do not keep up with federal, state, industry and international data security regulations, they could face serious fines or other penalties.
Boards should ensure that the chief information security officer or similar leader is aware of his or her role in upholding cyber compliance. In addition, boards should ensure that there is a system in place for identifying, evaluating and implementing compliance-related legislation.
Additionally, boards should constantly seek opportunities to bring expert perspectives into boardroom discussions. Often, authorities from government, law enforcement and cyber security agencies can provide invaluable advice. Building a relationship with these types of entities can help organizations evaluate their cyber strengths, weaknesses and critical needs.
Has the organization conducted a thorough risk assessment? Has the organization purchased or considered purchasing cyber liability insurance?
Cyber liability insurance is specifically designed to address the risks that come with using modern technology—risks that other types of business liability coverage simply won’t cover.
The level of coverage your business needs is based on your individual operations and can vary depending on your range of exposure. As such, boards, alongside the company’s management team, need to conduct a cyber risk assessment and identify potential gaps. From there, organizations can work with their insurance broker to customize a policy that meets their specific needs.
Asking thoughtful questions can help boards better understand the strategies management uses to prevent, detect and respond to data breaches. When it comes to cyber threats, organizations need to be diligent and thorough in their risk prevention tactics, and boards can help move the cyber conversation in the right direction.
Cyber exposures impact organizations from top to bottom, and all team members play a role in maintaining a secure environment. However, managing personnel and technology can be a challenge, particularly for organizations that don’t know where to start.
That’s where Scurich Insurance can help. Contact us today to learn more about cyber risk mitigation strategies you can implement today to secure your business.
Read more
