FEDERAL PRIVACY RULE PROTECTS HEALTH INFORMATION

Recently, the first-ever federal privacy standards to protect individuals' health-care information went into effect. The mandate for these standards, collectively known as the Privacy Rule, was in the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The Privacy Rule gives individuals access to their medical records and greater control over the use and disclosure of their personal health information. States are still free to keep or adopt their own policies or practices that are at least as protective as the new federal requirements.
Who Is Covered
Entities subject to the Privacy Rule include health-care providers, health plans (including insurance companies and HMOs), and health-care clearinghouses, such as physicians' billing services. The regulations also apply to "business associates," meaning any organization or person (other than a worker for a covered entity) that receives or accesses private medical information on behalf of a covered entity. When a covered entity uses a business associate, the two must enter into a written agreement containing specific protections for the health information used or disclosed by the business associate.
On its face, the Privacy Rule does not directly apply to employers, but that is not to say that employers need not become familiar with its requirements. Employers frequently interact with covered entities and their business associates. In addition, employers administering their own group health plans are effectively brought within the reach of the Privacy Rule.
Safeguards for Individuals
The Privacy Rule applies to "protected health information" (PHI), defined as all individually identifiable health information held or transmitted in any form or media, whether electronic, paper, or oral. Individuals generally should be able to see and obtain copies of their PHI within 30 days of a request. Covered entities must provide a notice to individuals describing how their PHI may be used and informing them of their rights under the Privacy Rule.
In the interest of promoting quality health care, providers are not restricted in their ability to share information needed to treat patients. Generally, PHI may not be used for purposes unrelated to health care. However, in the rare cases where it is allowed, only a minimum amount of protected information may be used or shared. Covered entities may release medical information to outside businesses such as insurers, banks, or marketing firms only with specific written authorization from the individual.
The Privacy Rule gives individuals the right to request alternative means or locations for receiving PHI communications. For example, a patient could ask a doctor to communicate with the patient through a designated telephone number or address. Another reasonable accommodation might be sending medical information to a patient in a closed envelope rather than on a postcard.
Policies and Procedures
The Privacy Rule requires covered entities to set up policies and procedures to protect the confidentiality of PHI. Written privacy procedures must identify staff with access to PHI and describe how such information will be used and when it may be disclosed. There must be training of employees in privacy procedures and designation of an individual to be responsible for insuring that those procedures are followed.
Covered entities may continue existing disclosures of health information for certain public responsibilities, subject to limits and safeguards that are specific to such circumstances. Examples include emergencies, identification of the body of a deceased person, and public health needs. If there is no other law that mandates disclosure to meet a particular public responsibility, covered entities may use their professional judgment to decide whether to make disclosures.
Enforcement
The Government may impose civil penalties of $100 for each failure to comply with a Privacy Rule requirement. A penalty may not exceed $25,000 per year for multiple violations of the same requirement in a calendar year. If a violation is due to reasonable cause, involved no willful neglect, and is corrected within 30 days of when an entity knew or should have known about it, no civil penalty may be imposed. A knowing violation of the Privacy Rule could also bring a fine of $50,000 and up to a one-year prison term. Maximum criminal penalties are higher if the wrongful conduct involves false pretenses, or use of the health information for commercial advantage, personal gain, or malicious harm.

Top of page

HIGHLIGHTS OF THE NEW FEDERAL TAX ACT

On May 28, 2003, the Jobs and Growth Tax Relief Reconciliation Act of 2003 became law. Much of this federal tax law applies only to the years 2003 and 2004, after which provisions in the 2001 Tax Act will again become effective. Nonetheless, the Act contains some significant changes for individuals as well as businesses.
Individuals
The child tax credit increases from $600 to $1,000, which is an acceleration of a scheduled phase-in that was to have occurred between 2005 and 2010. In 2005, the credit will fall to $700, but will then gradually rise to $1,000 again by 2010 by virtue of the 2001 Act.
The standard deduction for married couples will double to twice the amount of the standard deduction for single taxpayers. Married taxpayers filing a separate return will claim the same standard deduction as a single person. Similarly, for 2003 and 2004, the upper limit of the 15% income tax bracket for married couples will increase to a dollar amount that is twice that for a single taxpayer.
For 2003, income levels for the 10% tax bracket will increase to $7,000 for single taxpayers and $14,000 for joint filers. In 2004, these levels of income will be indexed for inflation. Retroactive to January 1, 2003, the new tax rates for individuals are 10%, 15%, 25%, 28%, 33%, and 35%. For transactions taking place from May 6, 2003 to December 31, 2007, the maximum capital gain tax rate has dropped from 20% to 15%, and from 10% to 5% for lower-income taxpayers.
To reduce the double taxation of corporate earnings, dividends received by an individual shareholder from a domestic or qualified foreign corporation will be taxed like capital gain income. This means a rate of 15% for most taxpayers and 5% for those at lower-income levels, assuming the stock is held for at least the holding period set by law. Dividends from certain corporations are not eligible for this new treatment, such as those from tax-exempt charities, farmers' cooperatives, and particular foreign companies.
Businesses
The Act increases the amount of investment that may be deducted immediately by small businesses from $25,000 to $100,000. The amount of this deduction is reduced by the amount that the cost of the business assets exceeds $400,000. Under prior law, this phase-out of the deduction began at $200,000.
The additional first-year bonus depreciation deduction is increased from 30% to 50% for investments acquired and put into service between May 5, 2003 and January 1, 2005. Qualifying property still must be brand new, with a class life of 20 years or less.

Top of page

TELECOMMUTING AND UNEMPLOYMENT

Maxine worked in New York for a financial information services provider. When she moved to Florida, her employer agreed to allow her to telecommute. Maxine was responsible for the same tasks that she had handled in New York, only now from her laptop in Florida she logged onto her employer's mainframe computer each workday.
Two years into the telecommuting arrangement, Maxine's company decided to end it. When she turned down an offer to return to New York, Maxine was without a job. She was denied unemployment benefits in Florida following a ruling that she had voluntarily quit her job without good cause. However, the Florida agency advised Maxine that she might be eligible to receive unemployment benefits in New York.
In what may be the first court decision of its kind on interstate telecommuters, New York's highest court also ruled that Maxine was ineligible for benefits, but for a different reason. Under New York law, a threshold requirement for eligibility is that the employee's entire service for the employer, except for incidental work, must be "localized" in New York. Maxine argued unsuccessfully that her services were localized in New York, at her employer's mainframe computer, notwithstanding that she initiated this service on her laptop in Florida. The court ruled instead that the physical presence of the employee determines in which state a telecommuter is located. For work done while she was located in Florida, Maxine was not eligible for unemployment compensation in New York.
When the new economy met the old unemployment insurance system in Maxine's case, the court stayed with principles that predate the age of computers. The outcome was dictated by two rules that are uniformly recognized: All of an individual's employment should be allocated to one state, which should be solely responsible for paying benefits; and that state should be the one in which it is most likely that the individual will become unemployed and seek work.
Unemployment has the greatest economic impact on the community in which the unemployed individual resides, and benefits generally are linked to that area's cost of living. Legislators and judges from previous generations could not have foreseen today's world of interstate telecommuting, but the rules they created are still valid. For better or worse, Maxine was tied to Florida, where she was physically present, and she could not look to New York for unemployment benefits.

Top of page