EFFECTIVE: JANUARY 1, 2020
The IRS has released the 2020 cost-of-living adjustments applicable to the dollar limits and thresholds for retirement plans and health and welfare benefit plans. Plan sponsors should update their systems and formulas to include the limits that have been adjusted.
The IRS has released the 2020 cost-of-living adjustments applicable to the dollar limits and thresholds for retirement plans and health and welfare benefit plans. Plan sponsors should update their systems and formulas to include the limits that have been adjusted.
To view the chart, click here.
On October 29, the USDA released the much-anticipated draft rules for hemp manufacturing (the “Proposed Rules”). As we have previously written about HERE, the 2018 Farm Bill removed hemp from the Controlled Substances Act and ordered the USDA to establish a Domestic Hemp Production Program and implementing regulations. The Proposed Rules cover the requirements for where hemp can be grown, THC testing standards, the disposal process for “hot hemp” (hemp with THC content in excess of the permitted limit) and licensing protocols.
USDA-Approved State and Tribal Plans; USDA Plan
Under the Proposed Rules, a State or Indian Tribe that wants to have primary regulatory authority over the production of hemp in that State or Indian Tribe territory may submit a plan for monitoring and regulating hemp to the USDA for approval. States and Indian Tribes may begin submitting production plans once the Proposed Rules are published in the Federal Register (which we expect to happen yet this week). USDA will have 60 days following receipt to review and rule on the submitted plan.
The Proposed Rules also establish a USDA production plan to regulate production in states or territories where hemp production is legal but not covered by a USDA-approved State or Tribal plan. USDA will begin accepting applications 30 days after the Proposed Rules are published in the Federal Register; however, USDA will not issue licenses to producers located in a State or Indian Tribe territory that has a draft hemp production plan pending for USDA approval.
Regardless of whether a producer is operating under a State, Tribal or USDA Plan, operating under a USDA-approved plan is significant because hemp producers will be eligible for USDA programs, such as loans and crop insurance coverage.
There are requirements that all producers must meet, regardless of whether the USDA, State or Indian Tribe is overseeing production, including:
- Licensing requirements
- Maintaining information on the land on which hemp is produced
- Procedures for testing the THC concentration levels for hemp
- Procedures for disposing of non-compliant plants
- Compliance provisions, including annual inspections of a random sample of hemp producers to verify compliant hemp is being produced
- Procedures for handling violations
THC Testing and Violations
All hemp must be sampled and tested for THC levels by a USDA-approved sampling agent or authorized federal, state or local law enforcement within 15 days prior to anticipated harvest. Because of the potential for labs to handle product testing above the approved 0.3% THC level (which, under the Controlled Substance Act, would be marijuana and a Schedule I controlled substance), testing can only occur in DEA-registered labs.
The Proposed Rules also establish an acceptable hemp THC level distribution range that takes into account uncertainty in cultivation and provides some flexibility for producers. The Proposed Rules provide the following example: “if a laboratory reports a result as 0.35% with a measurement of uncertainty of +/- 0.06, the distribution or range is 0.29% to 0.41%. Because 0.3% is within that distribution or range, the sample, and the lot it represents, is considered hemp for the purpose of compliance with the requirements of State, Tribal, or USDA hemp plans.”
If the THC content is found to exceed the permitted THC limit (known as a “hot hemp”), it must be reported by the laboratory to the producer and USDA, and destroyed by someone authorized under the Controlled Substance Act and DEA to handle marijuana, such as a DEA-registered reverse distributor or federal, state or local law enforcement.
In cases where a negligent violation has occurred, a corrective action plan will be established and the producer must periodically report on compliance with the plan for at least 2 years following such violation. A producer who negligently violates the Rules three times in a 5-year period will be ineligible to produce hemp for a period of five years from the date of the third violation. Note that negligent violations are not subject to criminal enforcement by federal, state or local law authorities. In addition, the Proposed Rules provide that a producer would not negligently violate the Proposed Rules if the plants test between 0.3%-0.5% THC and the producer used “reasonable efforts” to grow compliant hemp.
In cases where an intentional, knowing or reckless violation has occurred, the producer will be reported to the Attorney General, USDA and the chief law enforcement officer of the State or Tribe.
The Proposed Rules are an important step in creating a consistent regulatory framework for growing hemp and testing its THC content. Of note, the Proposed Rules do not address what happens to processed hemp products, such as CBD (which we have written about HERE). In a footnote, the Proposed Rules reiterate the provision in the 2018 Farm Bill preserving FDA’s authority to regulate these products.
The public has 60 days to comment on the Proposed Rules once formally published in the Federal Register. Thereafter, if USDA makes no changes based on the public comments, USDA will publish a Final Rule. Then implementing regulations still need to be drafted and published. Those regulations will be focused on the nuts and bolts of implementing the Final Rule. We are continuing to monitor developments in this area and will provide further updates as necessary. If you have any questions about this Alert, please contact Rachel Meyer or Sandra Morar.
New “Notice And Access” Safe Harbor Allows Employers To Ditch Paper Disclosures For Retirement Plans
On October 22, 2019, the Department of Labor (“DOL”) released proposed regulations updating the electronic disclosure rules for ERISA notices. Given the significant advances in technology over the last decade, employers have long-awaited a meaningful update to the current, outdated electronic disclosure safe harbor. Although employers may continue to provide paper notices to employees, the DOL anticipates that most employers will migrate to the new, proposed safe harbor for electronic disclosure of ERISA notices. The new safe harbor is expected to create efficiency, increase participant awareness, and result in cost savings for employers. The only downside¾the safe harbor does not apply to health and welfare plans.
What disclosures are impacted by the rule?
The new safe harbor can be used for any ERISA notices required to be distributed to pension benefit plan participants, other than those documents only required to be furnished upon request. In other words, pension benefit statements, Safe Harbor Notices, QDIA Notices, fee disclosures, summary annual reports, and other documents required to be furnished solely because of the passage of time may be disclosed electronically under the new safe harbor. However, disclosures such as the plan document, terminal report, trust agreement, and other documents that only need be to be furnished upon request cannot utilize the new safe harbor for disclosure.
Curiously, the safe harbor only applies to pension benefit plans, as defined in ERISA Section 3(2), including defined contribution (e.g., 401(k) plans) and defined benefit (e.g., pension) plans. The safe harbor does not apply to “employee welfare benefit plans,” which means that group health plans, disability plans, and other health and welfare plans must continue to rely on the old electronic disclosure regulations. The DOL expressed concern about the safe harbor as applied to group health plans, given the special considerations relating to issues such as pre-service claims review, access to emergency health care, and more.
Who can receive retirement plan disclosures electronically?
Participants, beneficiaries, or other individuals (“Covered Individuals”) entitled to ERISA notices can receive the notices electronically if: (1) they provide the employer, as a condition of employment or at the beginning of plan participation, with an e-mail address or smartphone telephone number; (2) they are assigned an e-mail address by the employer; or (3) they are given an internet-based mobile computing device by the employer.
Internet-based mobile computing devices include smartphones with data plans, laptops, tablets, or similar devices. The DOL does not want to specifically limit the regulations to any particular devices, as technology changes quickly over time and they want to avoid ending up with outdated regulations.
What are the notice and access requirements?
The “notice and access” safe harbor requires just that: delivery of a specific notice of internet availability and compliance with certain minimum standards concerning the availability of and access to the notices. A notice of internet availability must comply with certain content requirements and must be furnished electronically to the Covered Individuals no later than the time the notice is available on the internet/website. In other words, if a notice is due to participants on January 1st and is uploaded to the company website on such date, the notice of internet availability must be provided to Covered Individuals on January 1st. For an employer that chooses to provide all notices at the same time each year, the notice of availability must only be provided each plan year, and no more than 14 months following the date the prior plan year’s notice was furnished.
The “access” prong of the safe harbor requires that employers comply with the following requirements: (1) the employer must ensure the existence of an internet website at which a covered individual is able to access covered documents; (2) the notices must be available on the applicable, required dates; (3) each notice must remain available on the website until it is superseded by a subsequent version of the notice; (4) the notice must be presented on the website in a manner calculated to be understood by the average plan participant (must be “readable”); (5) the notice must be presented in a widely-available format or formats that are suitable to be both read online and printed clearly on paper, and must be “searchable”; (6) the notice must be presented on the website in a widely-available format or formats that allow the covered document to be permanently retained in an electronic format; and (7) the website must protect the confidentiality of personal information relating to the Covered Individuals.
Can a Covered Individual opt out?
Yes. The safe harbor includes a “global” opt out provision. Covered Individuals may elect to opt out of electronic disclosure and receive all notices in paper. Covered Individuals may also maintain electronic disclosures, but request that the employer furnish them, free of charge, a paper copy of a notice (or all of the notices) as soon as reasonably practicable. For individuals that opt out, the employer must establish and maintain reasonable procedures governing requests or elections for paper copies.
The proposed regulations require employers to send an initial notification of default electronic delivery and the right to opt out to ensure that all participants and beneficiaries accustomed to receiving paper notices are aware of the new method for electronic disclosure and have the opportunity to choose to continue to receive paper copies.
Generally, the proposed regulations will be effective 60 days after publication of a final rule in the Federal Register. The DOL has proposed the new safe harbor apply to employee benefit plans as of the first day of the calendar year following the publication of the final rule. The Department has requested comments with regard to providing an earlier effective date.
For more information on the details of the proposed regulations and implementing the safe harbor going forward, including special rules for severance of employment and other circumstances, please contact Caroline Nelsen at 402-633-9575 or e-mail her at email@example.com
The California Attorney General (AG) has issued the long-awaited draft regulations for the California Consumer Privacy Act (CCPA), which regulations will be officially filed on October 11, 2019. The AG stated that July 1, 2020 is the expected effective date of final regulations and enforcement. This is not to be interpreted as a safe harbor, but simply an enforcement delay. The public may submit written comments to the proposed regulations prior to December 6, 2019 at 5:00pm. The CCPA is effective on January 1, 2020.
Below are highlights of the key take-aways from the proposed regulations:
Disclosure. The regulations provide a clear emphasis on transparency and set forth format and content requirements for disclosures and privacy notices.
Requests. The regulations include additional parameters on the procedures for receiving and responding to consumer requests, including guidance on timing and reasonings for denying requests. The regulations also provide detailed guidance on how to verify the identity of a requesting consumer.
Training and Record Retention. The regulations reinforce and add guidance to the CCPA-specific training requirements and add new record retention requirements for consumer requests.
To learn more about whether the CCPA applies to your business and how McGrath North attorneys can assist in implementing an efficient and cost-effective compliance plan, contact McGrath North’s data privacy attorneys.
The California Consumer Privacy Act (CCPA) will go into effect on January 1, 2020. In September, the California legislature passed a handful of amendments that may have large impacts on your business’s overall plan for compliance with the CCPA. The Governor of California has until October 13, 2019 to sign the amendments into law or veto the bills.
The CCPA is a sweeping piece of legislation designed to provide California residents with control over how their personal information is used and shared by businesses “doing business in California”. Businesses who are subject to the CCPA requirements must implement procedures for and facilitate consumer data requests, update their privacy policies and flow-down compliance obligations to their vendors. To determine whether the CCPA applies to you and your business, refer to Tackling the California Market Article.
Employee Data – AB-25. Ultimately, the CCPA will apply to employee data. However, AB 25 has sun-setted the application of most of the CCPA’s key provisions with respect to personal information that is collected about employees. As of January 1, 2020, businesses will have to provide employees notice about what categories of information the business collects and the purpose for collection, but businesses will not need to offer employees opt-out, access, and deletion rights until January 1, 2021. California resident employees will still be entitled to bring a private right of action under the CCPA with respect to a data breach.
Business to Business Data – AB 1355. AB 1355 added new Section 1798.145(l) which provides that certain obligations under the CCPA do not apply to personal information collected during business to business communications until January 1, 2021 when new Section 1798.145(l) would become inoperative. The year-long exemption would apply to “personal information reflecting written or verbal communication or a transaction between the business and the consumer, where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency and whose communications or transactions with the business occur solely within the context of the business conducting due diligence regarding, or providing or receiving a product or service to or from such company, partnership, sole proprietorship, nonprofit, or government agency.” Effective January 1, 2020, B2B customer personnel will still have the right to opt-out of their information being sold and be entitled to bring a private right of action under the CCPA with respect to a data breach.
To learn more about all of the CCPA amendments and how McGrath North data privacy experts can assist you in preparing a comprehensive, tailored and practical CCPA compliance plan, contact one of our privacy experts.
As we have seen the last two years, there are changes to the U.S. immigration system almost daily. Whether it be a new proposed regulation, case, executive order, blocking of court order, policy, or tweet, immigration has been a moving target. Some policies are proposed, suspended, and some are passed and now in place. Now more than ever it is imperative to keep up to date with the never-ending changes the immigration system is experiencing as increased scrutiny continues.
Social Security “No-Match” Letters
Social Security No-Match Letters are back again. In 1993, The Social Security Administration (SSA) began issuing notices called “Request for Employer Information” soon to be known as “No-Match Letters.” The purpose of the letters was to ensure the accuracy of earning records that are used to determine social security benefits. In 2012, the Obama Administration decided to stop issuing the letters. The No-Match Letters returned in 2019 advising employers that certain employee names and Social Security numbers on a named employee’s W-2 do not match Social Security records. The new notices now impose an affirmative duty to employers to respond to the SSA within 60 days of receipt of the notice. (See sample No-Match Letter at https://www.ssa.gov/employer/notices/EDCOR.pdf.) It is important to note that the letter is not, by itself, proof that the employee lacks employment authorization. However, total disregard of the letter combined with other evidence might establish that the employer had “constructive knowledge” that an employee does not have employment authorization. The notice imposes on employers a duty to resolve the question of whether an employee is authorized to work in the U.S. Therefore, employers must notify employees and request that they correct the discrepancy of information and provide evidence it is corrected or resolve the issue with the SSA. No specific penalties have been established on employers from failure to respond to the SSA. In fiscal year 2018, Homeland Security Investigations (HSI) opened 6,848 worksite investigations compared to 1,691 in FY17; initiated 5,981 I-9 audits compared to 1,360; and made 779 criminal and 1,525 administrative worksite-related arrests compared to 139 and 172, respectively. All of these categories surged by 300 to 750 percent over the previous fiscal year. Given the rise in compliance audits and investigations by the SSA, HSI, and ICE, it is essential to establish consistent policies of maintaining records and responding to No-Match Letters.
Last month, USCIS announced that until further notice, employers should continue using the Form I-9 with edition date July 17, 2017, even after the expiration date of August 31, 2019, has passed. We will provide further information regarding the new Form I-9 as it is provided.
USCIS Announces Increase in Fee for H-1B Cap Petitions
In January 2019, Department of Homeland Security (DHS) amended its H-1B regulations, which now requires petitioners (employers) filing H-1B cap-subject petitions to first electronically register with USCIS during a designated registration period, whenever that may be. Only those petitioners whose registrations are selected will be eligible to file an actual H-1B cap-subject petition. Although the rule took effect on April 1, 2019, USCIS suspended the electronic registration requirement for the FY2020 H-1B cap filing season. On September 4, 2019, USCIS proposed a rule that would require petitioners filing H-1B cap-subject petitions to pay a $10.00 fee for each electronic registration they submit to USCIS. Please note that USCIS has not yet announced whether it anticipates utilizing the H-1B registration for the upcoming FY2021 H-1B cap filing season which begins on April 1, 2020, even though it has announced the fee increase.
Form I-539 No Longer Eligible for Premium Processing
In March 2019, USCIS revised Form I-539, Application to Extend/Change Nonimmigrant Status, and published new Form I-539A, Supplemental Information for Application to Extend/Change Nonimmigrant Status. The Form I-539 is used for certain nonimmigrants whom request to extend their stay or change to another nonimmigrant status. The most notable change of the revised Form I-539 is the requirement that every applicant pay an $85.00 biometrics fee and attend a biometrics appointment, regardless of age. Applicants usually receive a biometrics appointment within a few weeks after filing Form I-539. Thereafter, it takes at least another three weeks for biometrics to be completed. Due to this new biometrics requirement, Form I-539 applications are now separated from the primary applicant’s Form I-129 petition and processed on their own. Consequently, USCIS can no longer continue premium processing Form I-539 applications filed concurrently with Form I-129 petitions, such as an H-1B petition. As a result, H-4 spouses and children are now having to wait substantially longer to have their Form I-539 applications adjudicated and approved.
Changes to Immigrant and Nonimmigrant Visa Application Forms
Forms DS-160/DS-156, Nonimmigrant Visa Application are used for nonimmigrant, temporary travel to the United States and for K (fiancé(e)) visas. Form DS-260, Immigrant Visa Application is used for immigrant visa applicants. These forms are filed electronically to the Department of State. On May 31, 2019, new questions were added to the Forms DS-160/DS-156 and Form DS-260. These additional questions require applicants to disclose five years of social media and contact history when applying for a nonimmigrant or immigrant visa. Specifically, applicants are now required to disclose the social media platforms they have used within the previous five years, as well as provide their username for each platform. Please note that passwords for these accounts are not required and should not be provided. In addition, the applications request the applicant’s email addresses and phone numbers used in the past five years. Despite concerns raised by stakeholders, the Forms DS-160/156 and DS-260 have been updated to solicit this information. On September 4, 2019, DHS proposed changes to several immigration and travel forms to also collect social media information from applicants. The forms that would be affected by the new social media questions include USCIS Forms N–400, I–131, I–192, I–485, I–589, and I–751; CBP’s ESTA; and others.
Supreme Court Agreed to Review Three Cases Challenging the End of DACA
On June 28, 2019, the Supreme Court agreed to review three cases challenging the Trump Administration’s decision to end Deferred Action for Childhood Arrivals (DACA or “Dreamers”). In total, four federal appeals courts have heard arguments on whether President Trump went through the proper procedure to end DACA. Both the Ninth Circuit and the Fourth Circuit held that Trump’s decision to end DACA was improper. Decisions are still pending in the Second Circuit and D.C. Circuit. The Supreme Court is expected to issue its decision by June 2020. This means that current DACA recipients can continue to submit their renewal applications until that decision. DACA recipients will continue to receive protection from deportation and work permits, unless and until the Supreme Court issues a decision otherwise.
What are the Numbers for H-1B Petition Denials?
The National Foundation for American Policy analyzed the report from the H-1B Employer Data Hub and found that, “Between FY 2015 and FY 2018 the denial rate for new H-1B petitions quadrupled from 6% to 24%. To put this in perspective, between FY 2010 and FY 2015, the denial rate for initial H-1B petitions never exceeded 8%, while today the rate is 3 to 4 times higher.” Denial rates for initial H-1B petitions nearly doubled from 13% in FY 2017 to 24% in FY 2018 and climbed to 32% in the first quarter of 2019 due to Trump’s “Buy American, Hire American” Executive Order. H-1B extensions and transfers also had comparable denial increases. Petitions filed for the same workers with the same jobs that were previously approved, are now being denied. In FY 2017 the denial rate for these petitions was 5%. The rate more than doubled in FY 2018 to 13%.
Denial Rate: H-1B Petitions for Initial (New) Employment
|FISCAL YEAR||DENIAL RATE|
Source: USCIS, National Foundation for American Policy. *FY 2019 data through the second quarter of FY 2019. Percentages are rounded off. Data extracted and analyzed from USCIS H-1B Employer Data Hub.
Denial Rate: H-1B Extension Petitions for Continuing Employment
|FISCAL YEAR||DENIAL RATE|
Source: USCIS, National Foundation for American Policy. *FY 2019 data through the first two quarters of FY 2019. Percentages are rounded off. Data extracted and analyzed from USCIS H-1B Employer Data Hub.
* “Changes” by David Bowie (1971)
Participant Data And Fiduciary Liability: The Current Regulatory Environment, The Vanderbilt Lawsuit, And Best Practices For Benefit Plan Sponsors
With cybersecurity risks on the rise and increased awareness of the sophisticated ability of hackers in the modern world, many plan sponsors have expressed growing concerns that they may have fiduciary liability with respect to protection of participants’ personal information. By now, most plan sponsors have become accustomed to complying the Health Insurance Portability and Accountability Act (“HIPAA”) with respect to participant data within their employer-sponsored health plan. However, employers are not accustomed to applying such standards in the retirement plan context. Given the heightened cybersecurity risks in today’s digital society, employers serving as plan sponsors of retirement and welfare benefit plans should begin to implement policies and procedures to protect participant data and carefully monitor their service providers as they handle participant data.
In recent years, there has been a push for regulation governing protection of personally identifiable information (“PII”) in the retirement plan context. In 2011, an ERISA advisory council that serves as an advisor to the Secretary of Labor issued a report urging the Department of Labor (“DOL”) to issue guidance or regulations relating to the obligation of plan fiduciaries to protect the PII of plan participants and beneficiaries. The counsel expressed concern over insecurity of plan financial data, asking the DOL to provide guidance on whether ERISA fiduciaries must secure PII and develop educational materials for participants. Specific areas of concern included theft of PII or money from accounts, unsecured/unencrypted data, hacking into plan administration and service provider systems, outdated password protections, phishing emails, and stolen hardware. The counsel met again in 2016 and once again urged the DOL to issue guidance and hoped that the report could serve as a reference for plan sponsors to secure plan data and assets from cybersecurity risks.
To date, the DOL has issued no direct guidance on cybersecurity considerations for PII within retirement and welfare plans. However, a new argument has emerged under ERISA fiduciary standards that the “prudent man” rule, exclusive benefit rule, and the obligation to select and monitor service providers include the obligation to maintain the privacy and security of plan data and monitor service providers’ use of the data. Under ERISA, fiduciaries must act prudently, taking the course of action that a similar, prudent man would in like circumstances and with like knowledge. Furthermore, ERISA requires fiduciaries to act only for the exclusive benefit of plan participants and their beneficiaries. Finally, ERISA fiduciaries must prudently select and monitor a plan’s service providers.
Some have begun to use Interpretive Bulletin 96-1 as a reference point to establish a requirement of prudence in service provider selections, including the prudent selection of a service provider that securely maintains electronic plan data. Additionally, one of the arguments in a lawsuit against Vanderbilt University stated that the University failed to protect plan assets by allowing third parties to market services to participants, referring to participant and financial data held by the plan as “plan assets” protected by fiduciary obligations. In that case, the plaintiffs argued that the University allowed the plan’s recordkeeper to obtain access to participants’ private and sensitive information, including investment choices, account information, contact information, proximity to retirement, age, and more, in order to market and sell its own insurance products to participants outside the plan. The plaintiffs claimed that such an action violated the University’s fiduciary duty to work for the exclusive benefit of the participants. Unfortunately, the parties recently came to a settlement agreement before the courts had a chance to rule on whether ERISA protections will apply to personal plan information.
Although there is no direct guidance from the DOL on fiduciary standards as applied to the privacy and security of participant data, it is likely in the coming years the DOL will find that retirement and welfare plan fiduciaries have a responsibility to safeguard participant data in compliance with the prudence standard, given the common knowledge of cybersecurity risks in today’s society. Specifically, plan sponsors should be aware of their duty to monitor service providers and their security measures in place for protecting plan data. Going forward, plan sponsors should implement security policies and procedures relating to the protection of PII and participant data. Some companies have formed cybersecurity committees for purposes of implementing these procedures and increasing awareness internally about the seriousness of cybersecurity. Further, in choosing service providers, plan sponsors should exercise due diligence in questioning the providers’ security measures, breach reporting practices, and contract provisions relating to the protection of plan data.
Recent FDA Warning Letter Valuable Reminder To CBD Industry – Don’t Ignore Basic Regulatory Compliance
Following similar announcements by CVS and Walgreens, Kroger became the latest retailer to join the CBD craze when it announced plans to sell CBD-infused products. Sales of products containing CBD are expected to top $5 billion this year, a 700% increase from 2018, and could reach nearly $24 billion in sales by 2023, according to analysts. However, a recent warning letter from the FDA contains important reminders for the industry.
Although hemp-derived cannabidiol (CBD) was de-criminalized by the federal government in the 2018 Farm Bill, the Bill did not affect FDA or the States’ authority to regulate CBD or other cannabis or hemp products in FDA-regulated products. To date, the FDA has not approved CBD in food or drinks for humans or animals, dietary supplements or topical cosmetics and maintains its current position that it is illegal to sell a food or dietary supplement that contains added CBD in interstate commerce. Historically, however, the FDA has generally taken a passive approach to the enforcement of hemp-derived CBD products.
On July 22, 2019, FDA issued a warning letter to one of the largest producers of CBD-based products, Curaleaf, Inc. The FDA reiterated that certain hemp substances, including CBD, have a questionable regulatory and safety status in the eyes of FDA and some state governments despite the 2018 Farm Bill. But the more likely trigger for the action was the marketing claims that were associated with Curaleaf’s products.
The FDA surveyed Curaleaf’s website and social media pages, and found claims like:
• “[S]oothing tincture for chronic pain.”
• “CBD has been demonstrated to have properties that counteract the growth of spread of cancer.”
• “CBD has also been shown to be effective in treating Parkinson’s disease.”
• “CBD oil can be used in a variety of ways to help with chronic anxiety.”
• “CBD is being adopted more and more as a natural alternative to pharmaceutical-grade treatments for depression and anxiety.”
These are clear drug claims related to treating or preventing diseases, and FDA concluded that the products were misbranded and unapproved new drugs.
In response to the warning letter, the company stated that it’s removing statements from its website and social media that FDA identified as noncompliant. Also of note, following the warning letter, CVS immediately removed all Curaleaf products from its shelves, and Curaleaf’s stock tumbled.
The bottom line is that fundamental regulatory compliance matters. The full list of Curaleaf’s claims reinforce best practices for drafting and substantiating claims appearing on any food or dietary supplement labels (not just those containing CBD). And if the claim is on a product that is already under scrutiny for regulatory discretion, then compliance is especially important.
In addition to regulatory enforcement action, publicly issued warning letters may also lead to class action lawsuits based on a claim that statements are false and misleading and actionable under state consumer protection laws. While the statute the FDA is tasked with implementing (the Federal Food, Drug, and Cosmetic Act) does not include a private right of action, litigants and courts often use FDA warning letters for guidance as to whether a marketing claim is, or is not, susceptible to challenge under various consumer protection laws.
It is crucial for companies that market or sell CBD products to confirm that their marketing materials and labeling generally comply with FDA requirements and avoid making unapproved human or animal drug claims. If you currently market or are considering marketing CBD products, contact our Food and Dietary Supplement regulatory team to guide you through state and federal labeling and advertising requirements.
Financial Institutions have always banked their privacy practices on the requirements under Title V of the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations. That day is now over! The California Consumer Privacy Act (CCPA) is sweeping in and changing the financial privacy landscape. Many had hoped the CCPA would have an all-inclusive exemption for financial instructions already subject to compliance under GLBA; however, the California legislature has made clear that CCPA’s application will apply to portions of data held by financial institutions.
Scope of Financial Institution Exemption
CCPA exempts certain types of information that are subject to GLBA. The impact for financial institutions – all of the personal information collected today that is not subject to GLBA will be subject to CCPA (to the extent the financial institution is subject to CCPA). This includes the following information: personal information collected through general advertising and website marketing; personal information obtained from non-financial institution partners; and personal information obtained for commercial (non-personal or household) purposes.
A financial institution will be subject to CCPA if it does business in California and either (1) has at least $25 million in annual gross revenues; (2) buys, sells, shares or receives information from at least 50,000 California consumers; or (3) derives at least 50% of its annual revenue from selling California personal information.
Financial Institution Data Likely Subject to CCPA
The initial action financial institutions should take is to perform an internal data mapping exercise. Once the financial institution has determined what personal information it collects that is not subject to GLBA, the financial institution can prepare a practical and efficient CCPA compliance plan for all “non-GLBA” information.
As you are formulating a plan to comply with CCPA, our experienced privacy team is ready to partner with you in determining the most practical approach that minimizes disruptions to your already existing GLBA obligations. Here is a link for more information about our team: Privacy Team
With the California Consumer Privacy Act’s (CCPA) compliance deadline fast approaching (January 1, 2020), companies are preparing to comply with the additional complex data privacy and security requirements. HIPAA-Covered Entities may mistakenly overlook the fact that the CCPA does not wholly-exempt personal information collected by HIPAA-Covered Entities, but in turn only exempts information already protected by HIPAA. HIPAA, the Health Insurance Portability and Accountability Act, requires health care organizations, employer-sponsored group health plans, healthcare clearinghouses, and other Covered Entities to ensure the privacy and security of Protected Health Information (“PHI”). Although the CCPA exempts data that constitutes PHI, a HIPAA-Covered Entity or related Business Associate must still protect personal data (or even health data) that is covered by the CCPA but does not satisfy the definition of PHI under HIPAA.
HIPAA-Covered Entity Data Could Be Subject to CCPA
What type of data is governed by HIPAA and, as a result, exempt from the CCPA? PHI is defined as “individually identifiable health information” held or transmitted by a Covered Entity or its Business Associate, in any form or medium, whether electronic, paper, or oral. For example, health information, demographic data, medical histories, test results, and insurance information are forms of PHI if they can reasonably be used to identify a patient. Identifiers coupled with health information such as names, geographic locations, dates, contact information, social security numbers, and more can also constitute PHI. If the data amounts to PHI, that data is exempt from the CCPA.
Not all data collected by a HIPAA-Covered Entity amounts to PHI. For example, employment records held in the hands of an employer (rather than held by the group health plan sponsored by the employer) are not PHI. Any data collected by a HIPAA-Covered Entity that is not PHI will be subject to the CCPA (to the extent the entity is subject to the CCPA). However, the CCPA provides for an exception. When a Covered Entity or health care provider maintains health information in the same manner as PHI, even though the health information is not PHI, the CCPA rules do not apply. That being said, applying HIPAA privacy and security rules to non-PHI could be a burdensome task and cause confusion amongst a Covered Entity’s employee population.
What This Means for HIPAA-Covered Entities
Start your data mapping now. To determine what information is collected that is not protected under HIPAA and, to what extent the CCPA applies to such data, you must understand what categories of information are collected, who it is received from, what’s being done with the data and who it is shared with. From there, you can formulate a CCPA plan that correlates and flows with obligations under HIPAA to ensure efficiencies throughout your data compliance program.
As you are reviewing CCPA application to your entity, reach out to our experienced privacy and ERISA team to partner with you to develop a practical plan that minimizes risk and syncs to your already existing HIPAA obligations. Here is a link for more information about our team: Privacy Team