Updated October 2012 © 2004 The Ultimate Software Group, Inc. All rights reserved. The information contained in this document is proprietary and confidential to Ultimate Software. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording, for any purpose without the express written permission of Ultimate Software. No part of this document may be extracted and/or used out of the context of the full published document for any reason. This document is for informational purposes only and is subject to change without notice. Ultimate Software makes no warranties, express or implied, with respect to this document or any statements contained therein and specifically disclaims any warranties including but not limited to those for a particular purpose. This document contains or may contain statements of future direction concerning possible functionality for Ultimate Software’s products and technology. Ultimate Software disclaims any express or implied commitment to deliver functionality or software unless or until actual shipment of the functionality or software occurs. The information presented in this paper is an overview of several legislative compliance regulations. Ultimate Software makes no guarantees as to the completeness or accuracy of the summarized requirements. This document in no way suggests or offers any guidance or legal advice and should not be construed as such. If you need legal advice in relation to legislative compliance, please consult your attorney. UltiPro is a registered trademark of Ultimate Software. All other trademarks referenced are the property of their respective owners. Ultimate Software wishes to acknowledge the tireless efforts of King & Spalding LLP, who contributed greatly to this guide.

2000 Ultimate Way Weston, FL 33326 800-432-1729 www.ultimatesoftware.com

Introduction: Managing Compliance Risks Can Save Your Business from Costly Fines Protecting your company from legislative compliance risks should be a high priority for any CEO or CFO. Ignorance and violation of workplace regulations costs U.S. organizations millions of dollars each year. With society becoming increasingly litigious, legislative compliance poses a greater risk than ever. More and more often, state and federal courts rule in favor of employees who feel wronged,1and court rulings and settlements can cost your business hundreds of thousands of dollars. Consider these facts:

• The U.S. Equal Employment Opportunity Commission (EEOC) received an unprecedented total of nearly 100,000 private sector discrimination charges in 2011.2

• In 2011, the EEOC secured a record of more than $455 million in relief

for employees and applicants through its enforcement efforts, an increase of more than $51 million over the past fiscal year.3

• Three out of five companies are sued by former employees every year—

and more than 450 companies are hit with employment lawsuits every day.4

• 50% of all companies defending employment lawsuits spend more than

$50,000 from start to finish of the case, and 33% of all companies spend more than $100,000 in litigation costs from start to finish of the case. The average jury award in an employment lawsuit exceeds $250,000, and 15% of all jury verdicts exceed $1 million.5

This paper reviews five of the most common, problematic workplace regulations, discusses the types of violations that can be costly for your business, and explains how UltiPro—a comprehensive people management cloud solution —can help you stay in compliance to avoid expensive fines and lawsuits.

Three out of five companies are sued by former employees every year—and more than 450 companies are hit with employment lawsuits every day.

The Dangers in Violating FLSA The Fair Labor Standards Act (FLSA), which prescribes standards for minimum wage and overtime pay, affects most private and public sector employment. The main purpose of FLSA is to protect unskilled laborers and minors who work by the hour, often in low-paying jobs. The act excludes from overtime pay requirements professional, administrative, and executive employees who receive a fixed salary, rather than an hourly wage (and excludes volunteers, independent contractors, and workers engaged in certain specific industries specified in the FLSA).6 Violating FLSA regulations can be very costly to employers7:

• In 2008, the U.S. Department of Labor (DOL), Employment Standards Administration, Wage and Hour Division (WHD) recovered more than $185 million in back wages on behalf of more than 228,000 affected employees.

• In 2008, the WHD collected more than $140 million in back wages for

FLSA overtime and minimum wage violations.

• In 2008, the WHD assessed $9.9 million in FLSA civil monetary penalties against companies that violated the FLSA.

• In 2008, the WHD collected $57.5 million in back wages for workers in

low-wage industries—an increase of more than 77% from the total back wages collected during fiscal year 2001 for violations involving low-wage earners.

• Employers who willfully or repeatedly violate minimum wage or overtime

pay requirements are subject to a civil monetary penalty of up to $1,000 for each violation, as well as back pay and liquidated damages awards for any violation arising in the preceding 3 years.

• Violators of child labor laws are subject to a civil monetary penalty of up

to $10,000 for each underage worker employed in violation of the FLSA.

• Willful violations of the FLSA may result in criminal prosecution and fines of up to $10,000. A second conviction may result in imprisonment.8

Willful violations of the FLSA may result in criminal prosecution and fines of up to $10,000. A second conviction may result in imprisonment.

Summary of “White Collar” Exemptions to Overtime Pay Requirements The FLSA principally recognizes three “white collar” exemptions: (1) Professional; (2) Executive; and (3) Administrative. Professional Exemption to Overtime Pay Requirements. An employee is an exempt professional if (1) the employee is paid on a salary basis of not less than $455.00 per week (i.e., $23,660 per year), and (2) the employee’s primary job duty entails the customary and regular exercise of independent judgment involving the application of knowledge and/or skills acquired through a four-year degree (or more) obtained from an institution of higher learning. If each of the foregoing elements is true, the professional exemption applies. Examples of positions that qualify under the professional exemption includes physicians, attorneys, CPAs, etc. Executive Exemption to Overtime Pay Requirements. An employee is an exempt executive if (1) the employee is paid on a salary basis of not less than $455.00 per week (i.e., $23,660 per year), (2) the employee holds a position that entails supervising at least two other employees, (3) the position held is either the number one or number two position within a recognized department or division within the company, and (4) the employee has authority (or can effectively recommend) to hire, fire, promote, or advance employees under his or her supervision. If each of these elements is true, the executive exemption applies. Administrative Exemption to Overtime Pay Requirements. An employee is an exempt administrative employee if (1) the employee is paid on a salary basis of not less than $455.00 per week (i.e., $23,660 per year), and (2) the employee holds a position that customarily and regularly entails the exercise of independent judgment (i.e., free from immediate direction

or supervision by another) as to matters of significance to the employer. According to the regulations, when determining whether the position customarily and regularly entails the exercise of independent judgment on matters of significance to the employer, the law assumes that this element is satisfied if the employee’s primary duty relates to one or more of the following areas (NOTE: This is not meant to be an exhaustive list of what can be considered “matters of significance to the employer”):

• tax • finance • accounting • budgeting • auditing • insurance • quality control • purchasing • procurement • advertising • marketing • research or technological

advance • safety and health • human resources • employee benefits • labor relations • public relations • government relations • computer network, internet,

and database management • legal and regulatory

compliance and related activities

If the employee's primary duty involves the regular and customary exercise of independent judgment in one or more of the above areas, the administrative exemption applies. In addition, even if none of the above “white collar” exemptions apply, if the employee’s total

compensation over a 12-month period equals $100,000 or more, the employee may qualify under the “highly-compensated employee” exemption and be legally exempt from FLSA’s overtime requirements (and there is 30-day “window of correction,” where employers can pay money to reach the $100,000 threshold for the preceding 12 months). Here are some other highlights of the current FLSA regulations:

• Executive employees may concurrently perform exempt and non-exempt work and still be exempt, so long as his or her “primary duty” consists of “management.”

• An exempt employee's

“primary duty” can be management or an exempt administrative function (i.e., office or non-manual work directly related to the management of the business or the employer's customers' business and involving the exercise of independent judgment with respect to matters of significance to the employer) even if the employee actually spends less than 50% of his/her total work time performing exempt work.

• For purposes of the

executive exemption,

“effectively recommend” means only that the employee’s opinion concerning hiring, firing, promotion, or advancement decisions is given “particular weight,” and can include situations where a higher level manager’s opinion has more importance, so that the employee does not have to be the final decision-maker in order to retain the executive exemption. In addition, the requirement that an executive employee must “customarily and regularly supervise the work of at least two others” means only that the employee must do so at least weekly in order to qualify for the exemption.

In addition to FLSA, an employer must also be mindful of state wage payment laws, which usually carry their own penalties and fines, and may award attorneys’ fees to those who sue to enforce such laws.9 If a company’s actions are deemed “willful,” any back pay due and owing will be doubled and considered “liquidated damages.” Individual employees also have the right to recover their attorneys’ fees and the costs incurred bringing an FLSA action in court.10

Overview of FLSA’s Requirements FLSA prescribes standards for both minimum wage and overtime pay requirements, and establishes administrative and record-keeping procedures for compensating workers. The act also includes provisions related to child labor, equal pay, portal-to-portal activities, and most recently, work breaks for nursing mothers.11 Currently, workers covered by the FLSA are entitled to the current minimum hourly wage, and all overtime work hours must be paid at a rate of 1.5 times their regular rate of pay (overtime is paid by the week, not the day). Exceptions to the minimum wage apply to various groups, such as disabled workers, full-time students, youths under age 20 in their first 90 days of employment, and tipped employees. Special rules apply to state and local government employees involving fire protection and law enforcement activities, volunteer services, and compensatory time-off (instead of cash overtime pay).12 To determine an employee’s regular hourly pay rate, the employer must add up wages, vacation pay, sick pay, travel expenses, production bonuses, and certain profit-sharing payments, and then divide by the total number of hours worked in the workweek. The employer must then pay 1.5 times this rate for all overtime hours worked.13 The FLSA’s child labor provisions protect the educational opportunities for youths and prohibit their

employment in jobs that are detrimental to their health or safety. These provisions include some restrictions on the working hours for youths under the age of 16 and specify hazardous occupations that are too dangerous for young workers to perform.14 Wages required by the FLSA must be paid on the regular payday for the pay period covered. Deductions cannot be taken from wages for items such as cash or merchandise shortages, employer-required uniforms, or tools of the trade if these reduce an employee’s wages below the minimum wage or reduce the amount of overtime pay due under the FLSA.15 In addition to wage and overtime requirements, every employer covered by the FLSA must keep certain records for each covered, nonexempt worker. While there is no required form for the records, the records must include accurate information about the employee and data about the hours worked and the wages earned. Audits of a company’s payroll and timekeeping records will “look back” two to three years. Thus, to be in compliance with FLSA, employers must retain records of employees’ earnings for three years. Records should include each employee’s address, job title, hours, and days worked; amounts earned each day or week; regular hourly pay rate; total overtime pay for each week; deductions or additions; total wages paid for each pay period; and the dates wages were paid.16

Violating FLSA Could Cost Your Company Millions In 2011, the U.S. Department of Labor reached agreement with an onion grower to pay more than $2.3 million in back pay, as well as pay a $500,000 civil penalty, to 1,365 temporary agricultural workers. The Wage and Hour Division’s investigation determined that workers employed by the onion grower were not paid properly for work performed. All of the workers came to the U.S. from Mexico under the H-2A temporary agricultural worker visa program. In most cases, their earnings fell below the hourly wage required by the program, as well as below the federal minimum wage of $7.25 per hour for a brief period of time. Investigators also found that workers were not paid for time spent in mandatory training or reimbursed for subsistence expenses while traveling to and from the U.S.17 In 2011, the U.S. Department of Labor recovered $4.83 million in back wages, damages for more than 4,500 misclassified workers. In addition to the back pay, the employer, a large retailer, was assessed penalties of nearly $464,000. The violations affected current and former employees many of whom held the title “manager.” The Labor Department's investigation found that the employer failed to properly classify the employees as non-exempt and thus failed to compensate those employees with overtime pay.18 In 2011, the U.S. Department of Labor focused on the restaurant industry and found widespread violations in Boston, MA and Long Island, NY. In Boston, the Department found more than $1.3 million in back wages due to 478 underpaid restaurant employees. The Boston District Office’s investigation uncovered significant violations of the minimum wage, overtime and record-keeping provisions of the Fair Labor Standards Act, including finding that several restaurants violated the FLSA by paying employees flat salaries for all hours worked without overtime pay, failing to combine hours worked at multiple locations for overtime purposes, paying incorrect overtime rates to tipped employees, making illegal deductions from employees' wages and failing to keep accurate records of employees' hours. They also found an emerging trend of misclassifying restaurant workers as independent contractors in order to avoid minimum wage, overtime, and record-keeping requirements of the FLSA. Likewise, in Long Island, NY, the Department’s investigation resulted in more than $2.3 million in back wages for 578 restaurant workers. The Wage and Hour Division will continue to monitor full-service restaurants and other industries in which unlawful pay practices are widespread.19

UltiPro Can Help with FLSA Compliance UltiPro helps companies comply with the FLSA by tracking jobs through the payroll solution, as well as tracking hours, tips, overtime, employee type, pay groups, status of seasonal workers, and any retroactive pay that is due. With UltiPro, employers can calculate overtime pay, and then display the results through its payroll reports. On the Pay Data Entry window, employees’ work hours are entered for the type of pay earned. Payroll staff do not have to enter the overtime computed pay rate or the fully computed overtime pay figure because UltiPro calculates the pay rate and the pay amount based on the overtime calculation rule—whether that be time and a half, double time, or a fully separate premium amount of overtime. Users can set up earnings with the FLSA average pay rate (hours) option to flag the earnings to calculate the FLSA average pay rate. When you enter hours for the employee’s pay, the system will include the earnings in the calculation to determine the employee’s average pay rate for coefficient overtime. Earning codes set with either of the FLSA average rate options (hours or dollars) are included in the calculations regardless of the earning calculation rule that is selected. UltiPro allows employers to set up several earning codes to be used in conjunction with one another, depending on the type of compensation an employee earns. For an employee who works in several different capacities during one payroll period and is paid at different rates, his or her regular (or

average) hourly pay rate can be used to calculate coefficient overtime compensation. Coefficient overtime also can be used for hourly-based compensation where the hours worked are excluded from calculations, such as on-call time. Based on the FLSA, payments received by an employee for on-call time must be included in the determination of the regular pay rate for computing overtime. Payments for on-call time are generally computed on an hourly basis for time that is not actually worked. Payroll administrators who want UltiPro to compute the regular pay rate that is then used to calculate the compensation for coefficient overtime can assign the coefficient overtime earnings calculation rule to an earning code. When this earning code is entered during pay data entry, the solution calculates the employee’s regular hourly pay rate (based on all other earnings) and then applies this calculated rate to all instances of the coefficient overtime earnings for that pay period. The coefficient overtime pay rate can be allocated to multiple cost centers by including multiple entries of the same earning code during pay data entry and, for each earning code entry, assigning the cost center (organization level or location) where the overtime was earned. UltiPro also makes it easy to review and run reports on detailed employee payroll history records on demand for the required three years. This information will remain within the solution until it is archived and purged by the customer.

Potential Risks with Violating EEO Laws U.S. Equal Employment Opportunity (EEO) laws are designed to ensure that businesses comply with the laws, regulations, and policies that prohibit discrimination in the workplace based on race, color, national origin, religion, gender, age, disability, prohibited retaliation, and most recently a person’s “genetic information” and sexual identity.20 Violating EEO laws can result in significant penalties for a company. Under the laws enforced by the Equal Employment Opportunity Commission (EEOC):

• A worker can collect lost wages and prejudgment interest, liquidated/double damages, compensatory damages, and front pay and/or punitive damages in appropriate cases.

• Compensatory damages can run, per employee, from up to $50,000 for

employers with 15 to 100 employees, to up to $300,000 for employers with more than 500 employees.

• U.S. companies paid $456 million for EEO violations pursued outside of

court by the U.S. Equal Employment Opportunity Commission (EEOC) in 2011—the highest level of monetary relief ever obtained by the EEOC through the administrative process.21

If the EEOC decides there is reasonable cause to believe that discrimination occurred, the parties are asked to enter into conciliation discussions. If conciliation efforts are unsuccessful, the EEOC and/or the charging party may file suit in state or federal court. The EEOC can order an employer in violation of the laws enforced by the EEOC to eliminate discriminatory practices, and to hire, adjust wages, promote, or reinstate a current or former employee, depending upon the nature of the adverse action taken against the individual.

U.S. companies paid $455 million for EEO violations pursued outside of court by the U.S. Equal Employment Opportunity Commission (EEOC) in 2011.

The EEOC’s Purpose The EEOC was created by Title VII of the Civil Rights Act of 1964, but its intent began many years before. In June 1941, President Franklin D. Roosevelt signed Executive Order 8802, which prohibited government contractors from engaging in employment discrimination based on race, color, or national origin. This order was the first presidential action ever taken to prevent employment discrimination by private employers holding government contracts. It applied to all defense contractors, but contained no enforcement authority. President Roosevelt signed this executive order primarily to ensure that there would be no strikes or demonstrations disrupting the manufacture of military supplies as the country prepared for World War II. Over the years, the nation’s EEO laws were amended several times to include:

• Executive Order 9981: This brought about the desegregation of the Armed Forces. However, America's fighting forces were not actually integrated until the Korean War began in 1952.

• Executive Order 10925:

President John F. Kennedy signed this law prohibiting federal government contractors from discriminating on the basis of race and establishing the EEOC.

• Equal Pay Act of 1963:

Passed by Congress in June 1963, this decreed that men and women who perform equal work in the same establishment must be paid equal wages.

• The Age Discrimination in Employment Act of 1967 (ADEA): The ADEA protects individuals between 40 and 65 years of age from discrimination in employment.

• Rehabilitation Act of 1973:

Section 501 of the act prohibits the federal government from discriminating against qualified individuals with disabilities.22

• Section 505 establishes the

procedures and rights for any employee or applicant for employment who is unhappy with the final outcome of a complaint or by the failure of an employer to take final action on such complaint.

• Americans with Disabilities

Act of 1990 (ADA): Modeled after the Rehabilitation Act of 1973, the Act prohibits discrimination against people with disabilities in employment (Title I), public services (Title II), public accommodations (Title III), and telecommunications (Title IV).23 Title V explains the ADA’s relationship with other laws, details insurance issues, prohibits state immunity, provides congressional inclusion, sets regulations, describes the implementation of each title, and notes any amendments to the Act.24

• Civil Rights Act of 1991

(CRA): The CRA amended Title VII, the ADEA, and the ADA, stating that the parties involved can request jury trials and successful

plaintiffs can recover compensatory and punitive damages in intentional employment discrimination cases. The CRA also expanded Title VII’s protections to include congressional and high-level political appointees and eliminated the two and three-year statute of limitations period for filing private lawsuits under the ADEA.25

• VETS-100: This is the Federal Contractor Program requiring any contractor with a contract from the federal government for $25,000 or more, or any subcontractor receiving a contract in the amount of $25,000 or more from a covered contractor, to take affirmative action to hire and promote qualified Vietnam-era veterans, special disabled veterans, and any other veteran who

served on active duty. Contractors also must file a VETS-100 report annually, showing the number of Vietnam-era and special disabled veterans in their workforce by job category, hiring location, and number of new hires.26

• Genetic Information

Nondiscrimination Act of 2008 (GINA): Effective November 2009, employers with 15 or more employees now are prohibited from discriminating against employees or applicants based upon genetics or genetic information. Under GINA, employers are prohibited from using genetic information in making employment decisions, intentionally acquiring genetic information or disclosing genetic information.27

The Price of Violating EEO Laws In January 2011, a federal judge signed a consent decree for $3.2 million and extensive remedial relief resolving an EEOC disability discrimination lawsuit against several supermarket giants. According to the EEOC, one of the supermarket chains had a policy and practice of terminating employees with disabilities at the end of medical leaves of absence, rather than bringing them back to work with reasonable accommodations. Approximately 1,000 store employees in the greater Chicago area were allegedly terminated under this policy since 2003. In addition to the monetary relief, the company was required to ensure that its employees involved in making accommodation decisions undergo training on the requirements of the ADA and on the types of accommodations that are available to return employees to the workplace following a medical leave of absence. As part of the consent decree, the organization was also required to hire consultants to review and recommend changes to its current job descriptions, to ensure that the descriptions of the physical requirements of the job are accurate, and to provide recommendations on possible accommodations for common work restrictions in various positions in the stores. As part of the consent decree, the company will also have to report regularly to the EEOC on the its efforts to accommodate employees with disabilities who are

attempting to return to work from a medical leave of absence. Furthermore, the supermarket chain must revise its communications with such employees to assure them that they need not be 100% healed in order to be considered for return to work, and to inform them of some of the types of accommodations that may be available to them if they are considering returning to work with medical restrictions.28 In August 2010, one of the largest commercial roofing contractors in New York State and one of the top 40 largest commercial roofing contractors in the U.S. agreed to pay $1 million to African-American employees to settle a race discrimination lawsuit brought by the EEOC, which charged that black employees at the company were subjected to a pattern of race discrimination, including harassment, unfair work assignments, failure to be promoted, and retaliation for complaining about discrimination. The EEOC contended that these illegal practices continued from at least 1993 to the present. The roofing contractor agreed to a five-year consent decree which, in addition to paying $1 million in monetary relief to the victims of discrimination, enjoins the company from engaging in any further race discrimination or unlawful retaliation. The decree also requires the organization to hire an EEO coordinator to provide training, to monitor race discrimination complaints, and to report to the EEOC on all hiring, layoffs, and promotions for a five-year period.29

UltiPro Can Help Your Company Remain Compliant with EEO Regulations Once an EEO job category is assigned for the job code, an employee is assigned to the job. This links the employee to that category for as long as he or she is in that position or until the category for the job is changed. Employers can generate EEO summary and detail reports for headcount, new hire/rehire, promotion, termination, and transfer (delivered as standard reports). UltiPro also tracks, for example, whether members of the management team have been trained on appropriate actions related to fair hiring and labor practices, and managers can see their training information on the Web. UltiPro also generates EEO-1 Headcount Summary and EEO-1 Headcount Detail reports for employers to use when filing required EEO reports with the government every year. These reports count the number of employees in a business by job group, gender, and ethnicity. These reports offer useful information on affirmative action tracking because they show hiring trends from which companies can analyze the diversity of their hiring practices. With regard to VETS-100, UltiPro collects veteran data for reporting. UltiPro can then identify the number of veterans in an organization by job group as well as from a headcount and new hire perspective. UltiPro also can track and show the details of an employee’s evaluation to help justify a termination or to explain the legitimate non-discrimination reasons that a particular employee may have been passed over for a job.

Penalties for HIPAA Violations The Health Insurance Portability and Accountability Act of 1996 (HIPAA) provides rights and protections for participants and beneficiaries in group health plans. Under federal law, employers are responsible to ensure that former employees receive a certificate-of-health coverage. Administered by the U.S. Department of Health & Human Services (HHS), HIPAA limits exclusions for preexisting conditions, prohibits discrimination against employees and dependents based on their health status, and allows a special opportunity to enroll in a new insurance plan to individuals in certain circumstances.30 Civil penalties for health plans, providers, and clearinghouses that violate the standards set forth by HIPAA can be steep. The minimum fine is $100 and the maximum fine is $50,000 per individual violation. The maximum annual civil penalties for multiple violations range from $25,000 to $1.5 million.31 Federal criminal penalties for knowingly violating a patient’s privacy rights can run as high as:

• $50,000 and one year in prison for obtaining or disclosing protected health information.

• $100,000 and up to five years in prison for obtaining protected health

information under false pretenses.

• $250,000 with up to 10 years in prison for obtaining or disclosing protected health information with the intent to sell, transfer, or use it for commercial advantage, personal gain, or malicious harm.32

Civil penalties for health plans, providers, and clearinghouses that violate the standards set forth by HIPAA can be steep.

HIPAA’s Rules and Regulations Several sections comprise this act. Title I of HIPAA protects health insurance coverage for workers and their families when they lose or change jobs. It also limits restrictions that a group health plan can place on benefits for preexisting conditions.33 HIPAA can reduce an employee’s chances of losing existing health insurance coverage, ease their ability to switch health plans, and help them buy coverage on their own if they lose their employer’s plan and do not have access to other coverage.34 Under this act, insurers must renew coverage to all groups and accept new employees into their health plans, regardless of the health status of any family member.35 In addition, HIPAA prohibits group health plans from denying coverage because of mental illness, genetic information, disability, or claims that have been filed previously. Pregnancy cannot be considered a preexisting condition under a group health plan that offers maternity coverage, and that plan cannot exclude coverage for prenatal care or delivery, regardless of employment or health insurance history. This holds true for both the primary insured and dependents. HIPAA applies to every employer group health plan with at least two participants who are current employees, including companies that are self-insured. HIPAA prohibits group health plans, insurance issuers, and HMOs from imposing preexisting condition exclusions for longer than 12 months (18 months for late enrollees) and requires them to apply “creditable” health insurance coverage to an individual for previous continuous coverage, meaning that employees receive one day of credit for every day worked with a previous employer.36

Title II of HIPAA, known as Administrative Simplification, involves the handling of certain claims-related information in both electronic and standardized forms.37 Its purpose is to improve Medicare, Medicaid, and the efficiency and effectiveness of the healthcare system by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.38 The HIPAA Privacy Rule confers specific rights on individuals, including rights to access and amend certain health information and to obtain a record of when and how their protected health information has been shared with others for certain purposes. The rule requires that each covered entity that maintains or transmits information electronically assess the potential risks and vulnerabilities to such information, and develop, implement, and maintain appropriate security measures to protect that information from disclosure. These steps must be documented and kept current.39 The HIPAA Privacy Rule also regulates the use and disclosure of certain information held by covered entities (generally, healthcare clearinghouses, employer-sponsored health plans, health insurers, and medical service providers) that engage in certain transactions. It also establishes regulations for the use and disclosure of any information held by a covered entity that concerns health status, provision of healthcare, or payment for healthcare that can be linked to an individual. A covered entity may disclose protected health information (PHI) to facilitate treatment, payment, or

healthcare operations, or if the covered entity has obtained authorization from the individual. Upon disclosure of any PHI, the covered entity must make a reasonable effort to disclose only the minimum necessary information required to achieve its purpose. The Privacy Rule gives individuals the right to request that a covered entity correct any inaccurate PHI. It also requires covered entities to take reasonable steps to ensure the confidentiality of communications with individuals, as well as requires covered entities to notify individuals when their PHI is used or disclosed. Covered entities also must keep track of PHI disclosures and document their privacy policies and procedures. The Security Standards Rule, effective April 2003, complements the Privacy Rule. While the Privacy Rule pertains to both paper and electronic PHI, the Security Rule deals specifically with electronic protected health information (EPHI). It lays out three types of security safeguards required for compliance: administrative, physical, and technical. For each of these types, the rule identifies various security standards, and for each standard, it names both required and addressable implementation specifications. Required specifications must be adopted and administered as dictated by the rule. Addressable specifications are more flexible. Individual covered entities can evaluate their own situation and determine the best way to implement addressable specifications. The Unique Identifiers Rule states that HIPAA-covered entities—such as health care providers completing electronic transactions, healthcare clearinghouses, and large health plans—must use only the national

provider identifier (NPI) to identify covered healthcare providers in standard transactions. All covered entities using electronic communications (such as physicians, hospitals, health insurance companies, etc.) must use a single new NPI. The NPI replaces all other identifiers used by health plans, Medicare (i.e., the UPIN), Medicaid, and other government programs. However, the NPI does not replace a provider's DEA number, state license number, or taxpayer identification number. Effective September 2009, HHS issued regulations requiring health care providers, health plans, and other entities covered by HIPAA to notify individuals when their health information is breached. These “breach notification” regulations implement provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act. The regulations require health care providers and other HIPAA-covered entities to promptly notify affected individuals of a breach, as well as the HHS secretary and the media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals will be reported to the HHS secretary on an annual basis. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate.40 Effective November 2009, the HITECH Act also strengthened the civil and criminal enforcement of the HIPAA rules and increased the civil monetary penalties in the event of a violation. This section of the act also removed the previous bar on the imposition of penalties if the covered entity did not know and with the

exercise of reasonable diligence would not have known of the violation—such violations are now punishable under the lowest tier of penalties.41 Although covered entities have been subject to potential civil penalties since the original effective dates of HIPAA's Privacy Rule, HHS generally did not impose those penalties. Instead, HHS worked with covered entities to correct any reported violations, through informal resolutions and consent orders, and only rarely was payment of penalties

part of those resolutions. However, enforcement will be much stricter under the new laws. The HITECH Act now requires HHS to perform periodic audits and to formally investigate any complaints received. A finding of a violation by either a covered entity or a business associate that is based upon willful neglect, such as failure to follow established privacy and security policies and procedures, or failure to adequately train and supervise employees, now requires imposition of a civil penalty.42

The High Cost of Violating HIPAA In February 2011, the HHS imposed a $4.3 million civil penalty for a healthcare organization’s violation of the Privacy Rule.This action marks first civil money penalty issued by HHS for violations of the HIPAA Privacy Rule. The penalty was based on the violation categories and increased penalty amounts authorized by the HITECH Act. The investigation revealed that the company violated 41 patients’ rights by denying them access to their medical records when requested between September 2008 and October 2009. These patients individually filed complaints with HHS, initiating investigations of each complaint. The HIPAA Privacy Rule requires that a covered entity provide a patient with a copy of his or her medical records within 30 (and no later than 60) days of the

patient’s request. The penalty for these violations was $1.3 million. HHS also found that the organization failed to cooperate with the investigations on a continuing daily basis from March 17, 2009, to April 7, 2010, and that the failure to cooperate was due to the healthcare provider’s willful neglect to comply with the Privacy Rule. Covered entities are required by law to cooperate with the department’s investigations. The penalty for these violations was $3 million.43 This case should cause all HIPAA-covered entities to reevaluate their current security practices, engage in a focused effort to stay abreast of technological developments, and recognize the importance of documented procedures for privacy and security issues.

UltiPro Can Help You Manage HIPAA Compliance UltiPro’s functionality for human resources and benefits administration helps businesses track HIPAA information in employee records, such as benefit eligibility and coverage dates, effective dates, benefit maximums, and dependent benefit data. With UltiPro, companies can easily generate HIPAA Certificates of Creditable Coverage (delivered as a standard report) for employees and dependents. UltiPro can help companies comply with government-mandated training for employee education. For example, employers can track whether their employees have been trained in employee data privacy issues. Employers can set up a list of required training programs associated with specific jobs and then, using the Career Training/Education folder, track who has attended these training classes and who still needs to enroll.

Potential COBRA Liabilities The Consolidated Omnibus Budget Reconciliation Act (COBRA) gives workers and their families who lose their health benefits the right to choose to continue employer-sponsored group health benefits for limited periods of time under certain circumstances, such as voluntary or involuntary job loss, reduction in hours worked, transition between jobs, death, divorce, and other life events. Employers with at least 20 employees (except certain religious organizations and federal employers) must advise employees of their rights within 90 days of beginning healthcare coverage or within 44 days after the loss of employer-sponsored healthcare coverage. Both the U.S. Department of Labor (DOL) and the Internal Revenue Service (IRS) can assess penalties for COBRA violations. Failure to comply with COBRA can result in the following penalties:

• Employers that fail to inform employees of their rights or violate COBRA requirements may face the loss of federal income tax benefits.

• Companies found in

violation of COBRA may have to pay damages and attorneys’ fees, and may be held responsible for any outstanding medical claims.44

• Employers that do not

comply with COBRA’s requirements are subject to a minimum excise tax of $100 per day for each day that a plan is not in compliance with COBRA.45 If there is more than one

qualified beneficiary with respect to the same violation, the maximum amount of tax for any day is $200 per family.

• Penalties from the IRS also

may be as high as $2,500 for each beneficiary affected by the failure to comply, or the total amount based on the length of the noncompliance period, whichever is less.46

• Plan administrators who are

in violation of COBRA’s notice requirements can be fined up to $110 per day for each qualified beneficiary who is not notified.47

Noncompliance begins on the date of the failure and lasts until the date when the failure is corrected or the date six months after the last day of the otherwise applicable COBRA coverage period, whichever is earlier. The maximum amount for which an employer can be liable under the tax penalty is limited to the lesser of $500,000 or 10% of the preceding year’s total costs of providing group health coverage. A third party may incur the COBRA excise tax penalty if it signs a written agreement with an employer to assume responsibilities for either plan administration or plan benefit payment. But an administrator or benefit provider may be subject to penalties only for violations relating to the specific responsibilities assumed under the written agreement. In addition, the third-party's actions (or lack thereof) must be a contributing factor to the violation in question.

Employers that do not comply with COBRA’s requirements are subject to a minimum excise tax of $100 per day for each day that a plan is not in compliance with COBRA.

Even in cases where a written agreement exists between the employer and the third-party administrator or provider, the administrator/provider may not be liable for COBRA violations where the employer's actions (or lack thereof) render the administrator/provider unable to

carry out its responsibilities under the agreement.48 For third parties that are found to be jointly liable for violations, the maximum liability for the excise tax penalty is $2 million per noncompliance period.

COBRA’s Rules and Regulations COBRA’s provisions give certain former employees, retirees, spouses, former spouses, and dependent children the right to temporary continuation of health coverage at group rates. However, this coverage is available only when coverage is lost due to certain events.49For employees, these events could include voluntary or involuntary termination of employment for reasons other than “gross misconduct,” or reduction in the number of hours of employment. Spouses can apply for COBRA due to the covered employee becoming entitled to Medicare, a divorce or legal separation from the covered employee, or the death of the covered employee. For children of employees, it could include the loss of dependent child status under an insurance plan’s rules or the effects of a covered parent’s loss of coverage.50 An employer or plan administrator must provide notice to an employee within 30 days of a qualifying event of their right to continue coverage,51 informing them of their rights under COBRA as well as describing the law. COBRA information also must be part of the health plan’s summary plan description (SPD). When the plan administrator is told that an event has occurred that qualifies an employee or beneficiary for COBRA, it then must notify each qualified person of the right to choose continuation coverage.52

Qualified beneficiaries have 60 days to elect to continue coverage. This period begins from either the coverage loss date or the date the notice to elect COBRA coverage is sent, whichever comes first. If elected and paid for by the qualified beneficiary, COBRA coverage is retroactive. A covered employee or the covered employee’s spouse can elect COBRA coverage on behalf of any other qualified beneficiary. A parent or legal guardian may elect coverage for a minor child.53 Under COBRA, covered employees or family members are responsible for informing the plan administrator of a divorce, legal separation, disability, or a child’s losing dependent status under the plan. Employers must notify the plan administrator of the employee’s death, termination of employment, reduction in hours, or Medicare entitlement. If covered individuals change their marital status, or their spouses change addresses, they must notify the plan administrator.54 In general, group health coverage for COBRA participants is usually more expensive than health coverage for active employees because the former employer is no longer paying a portion of the premium that it would normally pay for active employees. Generally, COBRA participants must pay the entire premium themselves. Even so, it is typically less expensive than individual health coverage.

COBRA generally pertains to group health plans maintained by employers with 20 or more employees in the prior year, and applies to plans in the private sector and those sponsored by state and local governments. Healthcare benefits available to COBRA beneficiaries may include inpatient and outpatient hospital care; physician care; surgery and other major medical benefits; prescription drugs; and healthcare benefits, such as dental and vision care. Life insurance is not covered under COBRA.55 COBRA beneficiaries are eligible for group coverage for up to 18 months. Certain events, or a second qualifying event occurring during the initial period of coverage, may extend that coverage to a maximum of 36 months. Special rules for disabled individuals may extend their maximum period of coverage to 29 months.56 Nondisabled family members who are entitled to COBRA continuation coverage also are entitled to the 29-month disability extension. A child born to a covered employee, adopted, or placed for adoption with a covered employee while the employee is under COBRA continuation coverage is also considered to be a qualified beneficiary. Coverage for COBRA beneficiaries begins on the date that coverage would have ended and can be

terminated for any of the following reasons:

• The last day of coverage is reached

• Premiums are not paid on

time

• The employer no longer maintains a group health plan

• The COBRA beneficiary

obtains health insurance with another employer group health plan that does not contain any exclusion or limitation with respect to any preexisting condition of the beneficiary

• A beneficiary may begin

receiving Medicare benefits57

If a group health plan limits or excludes benefits for preexisting conditions but, because of the new HIPAA rules, those limits or exclusions would not apply to, or would be satisfied by, an individual receiving COBRA continuation coverage, then the plan providing the COBRA continuation coverage can stop making that coverage available.58 It is also important to note that if workers want to protect their rights to coverage in the individual market as a HIPAA-eligible individual, they must take and exhaust COBRA or similar state continuation coverage offered to them.59

Disability Extension If an individual entitled to COBRA continuation coverage is disabled, as determined under the Social Security Act, and satisfies the applicable notice requirements, the plan must provide COBRA continuation coverage for 29 months. The disability extension also applies if the individual becomes disabled at any time during the first 60 days of COBRA continuation coverage. If the individual entitled to the disability extension has nondisabled family members who are entitled to the COBRA continuation coverage, those nondisabled family members also are entitled to the 29-month disability extension. Definition of Qualified Beneficiary Individuals entitled to COBRA continuation coverage are called qualified beneficiaries and are the spouse and dependent children of a covered employee and, in certain cases, the covered employee. Before HIPAA, in order to be a qualified beneficiary, an individual had to have been covered under a group health plan on the day before the event that caused a loss of coverage (such as a termination of employment or a divorce from or death of the covered employee). HIPAA changed this requirement so that now a child who is born to the covered employee or who is placed for adoption with the covered employee during a period of COBRA continuation coverage is also a qualified beneficiary. Duration of COBRA Continuation Coverage HIPAA changes the COBRA rules so that if a group health plan limits or excludes benefits for preexisting conditions but, because of the new HIPAA rules, those limits or exclusions would not apply to (or would be satisfied by) an individual receiving COBRA continuation coverage, then the plan that provides the COBRA continuation coverage can stop making the COBRA continuation coverage available.60

Violating COBRA Can Cost Your Company Hundreds of Thousands of Dollars In 2006, a Michigan District Court awarded almost $63,000 to a participant to cover claims that were unpaid due to an untimely election notice. A tubing manufacturer terminated Francis Czaplicki’s employment on June 15, 2001. In late July 2001, Czaplicki was admitted to a hospital for about two months. In late August, the company became aware of its oversight and instructed its COBRA administrator to send the election notice. The administrator did not send the election notice until November 7, 2001. Huron Valley Hospital, the hospital that treated Czaplicki, authorized MedAssist to coordinate the COBRA election and handle the COBRA payments. MedAssist sent the administrator payment for three months of coverage, but there was some dispute as to whether that money was ever forwarded to the tubing company. Thus, no insurance coverage existed for those months to cover claims that totaled $62,923.45. The court ruled that Howard Linden—now the personal representative of the estate of Czaplicki, who died in 2003—was entitled to reimbursement for the claims. The court decided that neither the tubing manufacturer nor the COBRA administrator were entitled to judgment against each other. The company was ordered to pay $62,923.45 in claims. The outcome could have been worse: The court could have assessed a $110 daily penalty for the failure to send a timely notice.61 Four days before scheduled knee surgery, Gary Shephard learned

that his employer—an equipment repair and service company—terminated his employment. The owner of the business described the termination as a temporary layoff and said that Shephard’s insurance coverage would be paid for one additional month and for the first two months of COBRA thereafter. However, the company was not forwarding premium payments to the insurance carrier, resulting in a lapse of coverage. Shephard also never received a COBRA election notice. The unpaid medical bills resulted in collection activities, stress, frustration, and a worsening credit score for Mr. Shephard. The court awarded $90,860 in statutory penalties at the $110-per-day maximum for not providing a COBRA election notice. Attorney's fees were another $16,909, and medical claims totaled $12,200. The court also deemed rates of $225 per hour for attorney time and $95 per hour for paralegal time as reasonable. The court stated that it wanted this case to “act as a deterrent and caution to other employers who may purport to provide a group health insurance benefit to their employees.”62

UltiPro Can Help Your Company Remain Compliant with COBRA Regulations Accurate documentation is everything—as the stakes can be high. With UltiPro, employers can track COBRA information, including COBRA status and the date and description of a COBRA-qualifying event for employees and their dependents. Because UltiPro allows you to record the details of benefit change reasons, you can easily identify COBRA-qualifying events. UltiPro will help you generate COBRA Continuation of Coverage reports (delivered standard in UltiPro) as well as track disabled employees (through an indicator) for ADA purposes.

Not Establishing or Enforcing Sexual Harassment Policies Can Put You in the Danger Zone Sexual harassment is a form of sex discrimination in violation of Title VII of the Civil Rights Act of 1964. Title VII defines sexual harassment as “unwelcome sexual advances, requests for sexual favors, and other verbal or physical conduct of a sexual nature” when “submission to or rejection of this conduct explicitly or implicitly affects an individual’s employment, unreasonably interferes with an individual’s work performance or creates an intimidating, hostile, or offensive work environment.”63 Verdicts in cases of sexual harassment can lead to:

• Awards amounting to hundreds of thousands of dollars in federal cases for damages, plus economic damages and attorneys' costs;

• Awards resulting in multimillion-dollar settlements in cases brought under

state laws; and

• Company liability, not for sexual harassment per se, but for intentional infliction of emotional suffering, negligent supervision, invasion of privacy, assault, battery, or other tort claims.64

Examples of sexual harassment include unwelcome sexually oriented gestures, jokes, or remarks; repeated and unwanted sexual advances; touching or other unwelcome bodily contact; and physical intimidation. Sexual harassment among peers can occur if coworkers repeatedly tell sexual jokes, display or transmit pornographic images, or make unwelcome sexual innuendos to a coworker.

Verdicts in cases of sexual harassment can lead to awards resulting in multimillion-dollar settlements in cases brought under state laws.

Rules and Regulations to Prevent Sexual Harassment Federal law recognizes two different sets of legal grounds for claiming sexual harassment under Title VII, the first being quid pro quo, and the second being a hostile work environment. Under quid pro quo, an authority figure demands sexual favors of a subordinate as a condition of getting or keeping a job benefit. A hostile work environment is fostered by a co-worker or supervisor who engages in unwelcome and inappropriate sexually based behavior, making the atmosphere intimidating, hostile, or offensive.65 Statistics on sexual harassment in the workplace vary widely, with some research stating that anywhere from 40% to 70% of women and 10% to 20% of men have experienced some form of sexual harassment at some point in their lives. This wide range may be due in part to what some people might consider acceptable behavior, others might think of as sexual harassment.66 However, in fiscal year 2010, the EEOC and the Fair Employment Practice Agencies received 11,717 charges of sexual harassment, 16.4% from men, for a total of $48 million in compensation awarded (not including monetary benefits obtained through litigation).67 The victim or the harasser may be a woman or a man, the victim does not have to be of the opposite sex, and the conduct must be unwelcome. The harasser can be a supervisor, an employer’s agent, a supervisor in another area of the company, a coworker, or a nonemployee. The victim does not have to be the person harassed, but

can be anyone affected by the offensive conduct. Also, to be considered unlawful, an act of sexual harassment does not have to cause economic injury to or discharge of the victim.68 It is illegal for retaliatory action to be taken against an employee who complains about sexual harassment or who opposes any type of discrimination prohibited by the Civil Rights Act.69 Under federal law, an employee must file a complaint with the EEOC within 300 days of the unlawful act.70 After the EEOC investigates a claim of sexual harassment on the job, it issues a right-to-sue letter, regardless of its conclusions about the matter. The victim then has 90 days to file a lawsuit against his or her employer in court. If the court rules in the victim’s favor, he or she can receive up to $300,000 in compensatory damages for each incident of unlawful harassment as well as back pay, attorneys’ fees, and possibly additional money damages under state or local law. If the victim was fired or did not receive a promotion as a result of the harassment, the court can order reinstatement or promotion.71 To avoid sexual harassment suits, an employer is responsible for establishing a sexual harassment policy that must be communicated to all of its employees via memoranda, orientations, workshops, videos, departmental training, bulletin board postings, staff meetings, and any other formal or informal training. Also, a company must institute a sexual harassment complaint procedure and designate a sexual harassment complaint processor to receive the complaint and investigate the allegations.72

Responsibilities of supervisors and/or managers include having the proper knowledge of sexual harassment, the employer’s sexual harassment policy, and the consequences of sexual harassment in the workplace. For a company to defend itself successfully in court, it must prove that it had an effective policy against harassment, stating that improper behavior would not be tolerated, and that the employee alleging harassment either unreasonably failed to take advantage of that policy, or that the company investigated promptly and thoroughly once a harassment complaint was made known to the company. This "affirmative defense" requires companies to make reasonable efforts to prevent and correct harassment, have a policy against sexual harassment, put it in writing, disseminate it, and enforce it. According to U.S. Supreme Court rulings, companies must have sexual harassment training for supervisors, as well as a strategy for responding to sexual harassment complaints. Employees should be told in writing, as part of the

company policy, the steps an employer will take to investigate a sexual harassment complaint.73 If an employee finds the harassment so pervasive that he or she resigns, courts may find that the employee was constructively discharged. This would entitle the employee to collect damages that discharged workers can collect, including unemployment compensation. Sexual harassment victims may recover compensatory damages beyond back pay, including future pecuniary losses, emotional pain, suffering, inconvenience, mental anguish, loss of enjoyment of life, and other nonpecuniary losses. Punitive damages also can be collected if the plaintiff can prove the employer acted with malice or with reckless or callous indifference to the employee’s protected rights. The maximum sum of compensatory and punitive damages ranges from $50,000 to $300,000, based on the number of employees in a company. Provided, however, that overlapping state laws can permit for larger recovery under state law in appropriate cases.

The High Price of Violating Sexual Harassment Laws In March 2011, a jury awarded more than $1.5 million to three women formerly employed by a Memphis-based company that distributes promotional products and office supplies. The jury found that two male managers at the company subjected female subordinates to severe, pervasive, and unwelcome sexual harassment. There was testimony that a manager made demands for women to participate in a “kissing” or “smooching” club in order to receive the sales leads and accounts necessary for the women to earn commissions. The trial evidence further showed that as a result of their rejection of their managers’ sexual advances and complaints about the harassment, the promotional products vendor fired two of the women. During the two years that the harassment took place, the organization had no sexual harassment policy, no training on sexual harassment, and no reporting procedures. Company officials testified that they did not think that such policies and procedures were necessary, so the complaints of the women fell on deaf ears. The human resources manager testified that she did not even know the definition of sexual harassment at the time of the events.74 In September 2010, a commercial building maintenance company, along with two subsidiaries, agreed to pay $5.8 million and provide other relief to a class of 21 Hispanic female janitorial workers, settling a sexual harassment lawsuit filed by EEOC. The Hispanic female janitorial workers asserted that they were victims of varying degrees of unwelcome touching, explicit sexual

comments, and requests for sex by 14 male co-workers and supervisors, one of whom was a registered sex offender. Some of the harassers allegedly often exposed themselves, groped female employees, and even raped at least one of the victims. The EEOC’s suit charged that the facility maintenance organization failed to respond to the employees’ repeated complaints of harassment, which made for a dangerous and sexually hostile work environment. Many of the harassers were permitted to continue working, despite the complaints. Aside from monetary relief, the three-year consent decree entered in this case required the company to:

• Designate an outside Equal Employment Opportunity monitor to ensure the effectiveness of the company’s investigations, complaint policies and procedures, and assist in anti-harassment training to employees;

• Ensure that investigators of

harassment complaints are trained thoroughly to investigate internal complaints of discrimination, harassment and retaliation;

• Establish a toll-free

telephone hotline to receive complaints of harassment and retaliation;

• Provide anti-harassment

training to its employees in both English and Spanish to include a video message from the chief executive officer emphasizing zero tolerance for harassment and retaliation;

• Conduct internal compliance audits at worksites;

• Closely track any future discrimination complaints to conform to its obligations under Title VII;

• Provide periodic annual

reports to the EEOC

regarding its employment practices; and

• Ensure that employees are

not subjected to harassment and retaliation in the future.75

UltiPro Can Facilitate Proactive Training to Prevent Sexual Harassment Preventing sexual harassment and safeguarding a company from legal action has become a training and communications issue. As companies establish clear policies and procedures, HR managers need to convey those practices to employees and to management. UltiPro provides an employee relations module that tracks disciplinary actions and grievances. With this module, managers can go online, track incidents, and record specific information, including names of witnesses to the harassment, the status of the incident, and any follow-up actions that are pending. Employers can track if a grievance has been filed, view witnesses’ statements, see the status of arbitration, and note any discussions related to the grievance. They also can discover what the employee views as the end result of his or her action. UltiPro also offers businesses the ability to maintain centralized and secure 24-7 storage and access to a repository of past and present performance plans. This helps companies record promotion histories and other appraisal details that can be useful if an employee files sexual harassment charges.

Conclusion: Your Best Defense Is a Unified Human Capital Management Solution In the face of increasingly complex workplace regulations (and increasingly costly lawsuits), employers must work harder than ever to protect themselves from compliance risks. One of the best ways to reduce vulnerability is through meticulous record-keeping in all matters related to human resources. By precisely tracking and recording when hiring, training, promoting, transferring, and/or terminating employees, companies reduce the risk of compliance violations—and their vulnerability to litigation. Furthermore, for any organization faced with the prospect of fines or lawsuits, the ability to retrieve data quickly and accurately is an invaluable asset. UltiPro provides comprehensive human resources, payroll, and talent management in a single, solution for completely unified human capital management. As such, it is specifically engineered to fulfill all of an organization’s workforce management needs, plus enable rapid and accurate reporting across all areas of HR to help organizations stay compliant. By taking advantage of the extensive HR functionality built into UltiPro, companies have one system of record and can:

• Retrieve and review historical payroll data instantly

• Record promotion histories and appraisal details

• Track past grievances and disciplinary actions

• Monitor compliance with training requirements

• Generate reports and certificates on demand For more information about UltiPro from Ultimate Software, please call 800-432-1729 or visit www.ultimatesoftware.com.

UltiPro is specifically engineered to fulfill all of an organization’s workforce management needs, plus enable rapid and accurate reporting across all areas of HR to help organizations stay compliant.

References 1Weiss, Donald H. Fair, Square & Legal: Safe Hiring, Managing and Firing Practices to Keep You and Your Company Out of Court. New York: American Management Association, 2000. pp. 8-9.

2 http://www1.eeoc.gov/eeoc/newsroom/release/124-12a.cfm?renderforprint=1 3 http://www1.eeoc.gov//eeoc/newsroom/release/1-24-12a.cfm?renderforprint=1

4 http://www.hr.com/en/communities/compensation/employee-practices-compliance-systems---a-new-comp_eacz8th8.html

5 http://www.hr.com/SITEFORUM?t=/contentManager/onStory&e=UTF-8&i=1116423256281&l=0&ParentID=1120248895455&StoryID=1119650912828&highlight=1&keys=online+%252Bdistribute+%252Bcompliance&lang=0&active=no

6 Goldstein, Valerie H. Employment Law. Deerfield Beach, FL: Made E-Z Products, Inc., 2000. pp. 39-40

7 http://www.dol.gov/esa/whd/statistics/200712.htm

8U.S. Department of Labor in the 21st Century, Enforcement under the Fair Labor Standards Act: http://www.dol.gov/elaws/esa/flsa/screen74.asp

9Hale Eagland, Jennifer, Jeffrey E. Myers, and Paul H. Schieber. FLSA and Financial Services Organizations: What to Know, http://www.blankrome.com/publications/articles/FLSA_workindex.as

10 Hale Eagland, Jennifer, Jeffrey E. Myers, and Paul H. Schieber. FLSA and Financial Services Organizations: What to Know, http://www.blankrome.com/publications/articles/FLSA_workindex.asp

11 Office of Personnel Management: An Overview of the Fair Labor Standards Act. http://www.opm.gov/flsa/overview.asp; The Patient Protection and Affordable Care Act of 2010 amendments to the FLSA.

12 U.S. Department of Labor in the 21st Century. What Does the Fair Labor Standards Act Require? www.dol.gov/elaws/esa/flsa/screen5.asp

13 Goldstein, Valerie H. Employment Law. Deerfield Beach, FL: Made E-Z Products, Inc., 2000. pp. 39-40

14 U.S. Department of Labor in the 21st Century. What Does the Fair Labor Standards Act Require? http://www.dol.gov/elaws/esa/flsa/screen5.asp

15 U.S. Department of Labor in the 21st Century. What Does the Fair Labor Standards Act Require? http://www.dol.gov/elaws/esa/flsa/screen5.asp 16 Goldstein, Valerie H. Employment Law. Deerfield Beach, FL: Made E-Z Products, Inc., 2000. pp. 39-40

17 http://www.dol.gov/opa/media/press/whd/WHD20121352.htm

18 http://www.dol.gov/opa/media/press/whd/WHD20120801.htm

19 http://www.dol.gov/opa/media/press/whd/WHD20120445.htm

20 U.S. General Services Administration, Office of Civil Rights, Equal Employment Opportunity: http://www.gsa.gov/Portal/gsa/ep/contentView.do?programId=9611&channelId=-13328&ooid=11553&contentId=11939&pageTypeId=8199&contentType=GSA_BASIC&programPage=%252Fep%252Fprogram%252FgsaBasic.jsp&P=AK; Title II of the Genetic Information Nondiscrimination Act, effective January 10, 2011. Glenn v. Brumby, 2011 U.S. App. LEXIS 24137 (11th Cir. Dec. 6, 2011) (affirming transgendered individual’s claim of sex discrimination under Title VII). 21 http://www.eeoc.gov/eeoc/newsroom/release/1-11-11.cfm

22 U.S. Employment Opportunity Commission. http://www.eeoc.gov/35th/thelaw/index.html

23 U.S. Employment Opportunity Commission. http://www.eeoc.gov/35th/thelaw/index.html

24 Mentone Analytic Rehabilitation. ADA Titles III to V. http://www.analyticrehab.com/ada.htm

25 U.S. Employment Opportunity Commission. http://www.eeoc.gov/35th/thelaw/index.html

26 U.S. Department of Labor. Veterans’ Employment Training Service. Frequently Asked Questions about the Federal Contractor Program. http://www.dol.gov/vets/contractor/main.htm

27 http://www.eeoc.gov/laws/types/genetic.cfm

28 http://www.eeoc.gov/eeoc/newsroom/release/1-5-11a.cfm

29 http://www.eeoc.gov/eeoc/newsroom/release/8-10-10a.cfm

30 U.S. Department of Labor in the 21st Century; Health Plans & Benefits, Portability of Health Coverage (HIPAA). www.dol.gov/dol/topic/health-plans/portability.htm

31http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/enfifr.pdf

32 http://www.hhs.gov/news/facts/privacy.html

33 United States Department of Health & Human Services. OCR Privacy Brief. Summary of the HIPAA Privacy Rule. http://hhs.gov/ocr/privacysummary.pdf

34“Protecting Your Health Insurance Coverage.” Health Care Financing Administration. www.cms.hhs.gov/hipaa/hipaa1/content/protect.pdf

35“Understanding HIPAA,” Federal Employment Law: Volume IV, Society for Human Resource Management, March 2000.

36 National Conference of State Legislatures. NCSL Health Committee Bill Summary: The Health Insurance Portability and Accountability Act of 1996. http://www.ncsl.org/statefed/hr3103.htm

37 United States Department of Health & Human Services. Office of the Assistant Secretary for Planning and Evaluation. “Administrative Simplification in the Health Care Industry.” http://aspe.hhs.gov/admnsimp/index.shtml

38 Public Law 104-191, Aug. 21, 1996. Health Insurance Portability and Accountability Act of 1996. http://aspe.hhs.gov/admnsimp/pl104191.htm#261

39 United States Department of Health & Human Services. Office of the Assistant Secretary for Planning and Evaluation. “Administrative Simplification in the Health Care Industry.” http://aspe.hhs.gov/admnsimp/index.shtml

40 http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/ breachnotificationifr.html 41 http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/ hitechenforcementifr.html 42 http://www.martindale.com/health-care/article_Krieg-DeVault-LLP_797278.htm 43 http://www.hhs.gov/news/press/2011pres/02/20110222a.html 44 Goldstein, Valerie H. Employment Law. Deerfield Beach, FL: Made E-Z Products Inc. 2000 pp. 66-67 45 Business & Legal Reports. State HR Answers & Tools Online. http://www1.hrnext.com/Article.cfm/Nav/1.0.0.0.8119 46 http://onque.com/tips/irspenalties.html 47 Willis, Kerri M., and Bruce B. Barth, “Know Your Obligations under COBRA,” CBIA News, The Journal of the Connecticut Business & Industry Association. http://www.cbia.com/cbianews/sm_business_tips/200206sbknowyourobligationsundercobra.htm 48 Economic Research Institute. Consolidated Omnibus Budget Reconciliation Act (COBRA). http://www.erieri.co.uk/freedata/HRCodes/CONSOLIDATED_OMNIBUS_BUDGET.htm 49 Centers for Medicare & Medicaid Services. Consolidated Omnibus Budget Reconciliation Act (COBRA). http://www.cms.hhs.gov/hipaa/hipaa1/cobra/default.asp 50 COBRA Insurance.com Information. http://www.cobrainsurance.com/COBRA_Legal_Text.htm#ENTITLED 51 HR Next Human Resources Library; SHRM eLearning; COBRA Ch. 01 Basic Purpose for COBRA, www1.hrnext.com/article.cfm/nav/1.41.119.0.8096.8096 52 U.S. Department of Labor. Employee Benefits Security Administration. Fact Sheet. http://www.labor.gov/ebsa/newsroom/fscobra.html

53 COBRA Insurance.com Information. http://www.cobrainsurance.com/COBRA_Legal_Text.htm#ENTITLED 54 U.S. Department of Labor. Employee Benefits Security Administration. Fact Sheet. http://www.labor.gov/ebsa/newsroom/fscobra.html 55 Centers for Medicare & Medicaid Services. Consolidated Omnibus Budget Reconciliation Act (COBRA). http://www.cms.hhs.gov/hipaa/hipaa1/cobra/default.asp 56 COBRA Insurance.com Information. http://www.cobrainsurance.com/COBRA_Legal_Text.htm#ENTITLED 57 COBRA Insurance.com Information. http://www.cobrainsurance.com/COBRA_Legal_Text.htm#ENTITLED 58 U.S. Department of Labor. Employee Benefits Security Administration. Notice of Changes Under HIPAA to COBRA—Continuation Coverage under Group Health Plans. http://www.dol.gov/ebsa/publications/cobra.html 59 Protecting Your Health Insurance Coverage. Health Care Financing Administration. www.cms.hhs.gov/hipaa/hipaa1/content/protect.pdf 60 U.S. Department of Labor. Employee Benefits Security Administration. Notice of Changes under HIPAA to COBRA—Continuation Coverage under Group Health Plans. http://www.dol.gov/ebsa/publications/cobra.html 61 Fadalla v. Life Auto. Products, Inc., 2009 WL 3295369 (W.D. Tenn. Oct. 13, 2009) 62 http://www.infinisource.net/Infinisource/Benefit_Resources/caseLaw/ Shephard.aspx 63 The U.S. Equal Employment Opportunity Commission. Facts about Sexual Harassment. http://www.eeoc.gov/facts/fs-sex.html 64 Barrier, Michael M., “Sexual Harassment. (legal responsibilities of employer and employee) (Abstract). Nation’s Business, December 1998. http://www.findarticles.com/cf_dis/m1154/1998_Dec/53234826/p5/article.jhtml?term= 65 Roberts, Barry S., and Richard A. Mann, “Sexual Harassment in the Workplace: A Primer.” http://www3.uakron.edu/lawrev/robert1.html 66 What You Need to Know about Mental Health Resources, with Leonard Holmes, Ph.D., “New Light Shed on Sexual Harassment in the Workforce.” http://mentalhealth.about.com/library/sci/0202/blharass0202.htm 67 http://www.eeoc.gov/eeoc/statistics/enforcement/sexual_harassment.cfm 68 The U.S. Equal Employment Opportunity Commission. Facts about Sexual Harassment. http://www.eeoc.gov/facts/fs-sex.html 69 What You Need to Know about Job Searching: Technical, with J. Steven Niznik. “Seeking Relief from Sexual Harassment.” http://www.jobsearchtech.about.com/cs/labor_laws/a/sexual_harass_2.htm

70 Law Guru FAQ Section. Law Guru Sexual Harassment Law FAQs. http://www.lawguru.com/faq/16.html 71 Encarta. Sexual Harassment. http://encarta.msn.com/encyclopedia_761579949/Sexual_Harassment.html#endads 72 FindLaw for the Public. “Preventing Sexual Harassment in the Workplace.” http://www.findlaw.com/employment_employer/nolo/ency/7440C7F8-0B89-46E4-A1DE7 73 Barrier, Michael M. “Sexual Harassment. (legal responsibilities of employer and employee) (Abstract), “Nation’s Business,” Dec. 1998. http://www.findarticles.com/cf_dis/m1154/1998_Dec/53234826/p2/article.jhtml?term= 74 http://www.eeoc.gov/eeoc/newsroom/release/3-4-11.cfm 75 http://www.eeoc.gov/eeoc/newsroom/release/9-2-10.cfm