<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Iowa Employer Law Blog &#8211; Dickinson, Mackaman, Tyler &#038; Hagen, P.C.</title>
	<atom:link href="http://www.dickinsonlaw.com/feed/?media_category=iowa-employer-law-blog&#038;withoutcomments=1" rel="self" type="application/rss+xml" />
	<link>http://www.dickinsonlaw.com</link>
	<description>Des Moines, Iowa Law Firm</description>
	<lastBuildDate>Wed, 08 Jun 2016 18:20:28 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=4.5.2</generator>
	<item>
		<title>Employer reminder: Mandatory &#8220;military leave&#8221; includes short notice leave for &#8220;funeral honors duty&#8221;</title>
		<link>http://www.dickinsonlaw.com/2016/06/employee-reminder-mandatory-military-leave-includes-short-notice-leave-funeral-honors-duty/</link>
		<pubDate>Wed, 08 Jun 2016 18:08:16 +0000</pubDate>
		<dc:creator><![CDATA[Russ Samson]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[Russ Samson]]></category>
		<category><![CDATA[Top Story]]></category>
		<category><![CDATA[funeral honors duty]]></category>
		<category><![CDATA[Iowa employers]]></category>
		<category><![CDATA[Iowa employment laws]]></category>
		<category><![CDATA[military duty]]></category>
		<category><![CDATA[military leave]]></category>
		<category><![CDATA[Secretary of Defense]]></category>
		<category><![CDATA[US Airforce]]></category>
		<category><![CDATA[US Army]]></category>
		<category><![CDATA[US Marine Corps]]></category>
		<category><![CDATA[US Navy]]></category>
		<category><![CDATA[veterans]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8788</guid>
		<description><![CDATA[In locations like Iowa where there are many smaller communities geographically distant from military units/installations, meeting the obligation to provide at least two active members of the armed services may be difficult.  ]]></description>
				<content:encoded><![CDATA[<p style="text-align: center;">“The Secretary of Defense shall ensure that, <u>upon request</u>, a <u>funeral</u> <u>honors</u> <u>detail</u> is <u>provided</u> for the <u>funeral</u> of <u>any veteran</u> . . .”  <a href="https://www.law.cornell.edu/uscode/text/10/1491">10 U.S.C § 1491</a>.</p>
<p>The statute continues that a funeral honors detail “must be composed of at least two members of the armed services (other than members in a retired status), at least one of whom shall be a member of the armed force of which the veteran was a member.” The statute prescribes the minimum ceremony that is to be “performed” (the statute’s word) at the funeral: “the folding of a United States flag and presentation of the flag to the veteran’s family and the playing of Taps.” (The latter may be recorded.) The Department of Defense has established standardized language for the flag presentation:</p>
<p style="text-align: center;">On behalf of the President of the United States, (the United States Army; the United States Marine Corps; the United States Navy; or the United States Air Force), and a grateful Nation, please accept this flag as a symbol of our appreciation for your loved one&#8217;s honorable and faithful service.</p>
<p>In locations like Iowa where there are many smaller communities geographically distant from military units/installations, meeting the obligation to provide at least two active members of the armed services may be difficult. Federal law provides that members of reserve components, “may be ordered to funeral honors duty, with the consent of the member, to prepare for or perform funeral honors functions at the funeral of a veteran.”</p>
<p>While the statute says, “with the consent of a member,” as an employer you CANNOT interfere with your employees on whether or not the individual employee will give his or her consent. And while Congress has determined that a funeral honors detail should be statutorily required for any honorably discharged veteran, and Congress has determined that one who is ordered to “perform” (again, that is what the statute calls it) in a funeral honors detail is entitled to the protections provided by federal law for “military leave” generally, I suggest that when one considers the sacrifices that veterans made, one should not begrudge the absence of employees from work to provide those final honors.</p>
<p>Given the general practice in this country of a short time between death and the funeral, it is reasonable to anticipate that you, the employer, will receive very little advance notice of an “order” given to an employee to perform funeral honors duty. While the aspirational goal is that requests for such a detail will be made at least 48 hours in advance, a request won’t be denied based on a failure of 48 hours&#8217; notice. Regardless of how much notice an employer receives that one or more of its employees have been “ordered” (even with the employee’s consent) to funeral honors duty, that absence is USERRA-protected. The employee must be given the time off work needed to comply with the order.</p>
<p>Several years ago, Iowa established the right of veterans to take Veterans Day off work (without pay, and with advance notification to the employer). We discussed that law <a href="http://www.dickinsonlaw.com/2010/07/new-iowa-employment-law-veterans-get-a-day-off/">here</a> and <a href="http://www.dickinsonlaw.com/2010/09/iowa-veterans-day-law-part-ii/">here</a>. How many veterans in your employ know of the right to request a “funeral honors detail?” I became an Eagle Scout more than a half-century ago, but am instilled with “Be Prepared.” Be proactive: Tell all your employees of this right, so that those employees who are entitled to it (or who are related to someone who is entitled to it) can have a discussion today as to what their desires may be when the time comes.</p>
<p>The veteran who desires such honors could also assure today that the paperwork that might be required at the time the request is made following death (Form DD 214) is readily available.  One can request military service records on line at <a href="http://www.archives.gov/veterans/military-service-records/">http://www.archives.gov/veterans/military-service-records.</a></p>
<p>“Thank you. We appreciate your honorable and faithful service.”</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>OSHA&#8217;s revised recordkeeping requirements: Your injury and illness reports are going public</title>
		<link>http://www.dickinsonlaw.com/2016/05/oshas-revised-recordkeeping-requirements-injury-illness-reports-public/</link>
		<pubDate>Thu, 26 May 2016 19:03:59 +0000</pubDate>
		<dc:creator><![CDATA[Joan Fletcher]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Joan Fletcher]]></category>
		<category><![CDATA[OSHA]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[Dr. David Michaels]]></category>
		<category><![CDATA[OSHA recordkeeping]]></category>
		<category><![CDATA[OSHA workplace injuries and illness]]></category>
		<category><![CDATA[workplace injuries]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8753</guid>
		<description><![CDATA[OSHA has issued a final rule to "modernize" collection of data regarding workplace injuries and illnesses.]]></description>
				<content:encoded><![CDATA[<p>Under OSHA’s current Recordkeeping Regulation (29 CFR 1904) employers with more than 10 employees and whose businesses are not classified as a partially exempt industry must record work-related injuries and illnesses using OSHA Forms 300, 300A and 301.   These employers are required to keep the Form 300 Injury and Illness log, and post Form 300A, the summary of work-related injuries and illnesses, in the workplace every year from February 1 to April 30.</p>
<p>On May 11, 2016 OSHA issued a final rule to “modernize” collection of data regarding workplace injuries and illnesses.  The new rule requires employers to electronically submit to OSHA, on an annual basis, the injury and illness data they already collect on these forms.  Then OSHA will post the establishment-specific injury and illness data it receives on a publicly available website.  Personally identifiable information associated with the data will be removed before it is made available to the public.</p>
<p>According to Assistant Secretary of Labor for Occupational Safety and Health Dr. David Michaels:</p>
<p style="padding-left: 30px;">“Our new reporting requirements will ‘nudge’ employers to prevent worker injuries and illnesses to demonstrate to investors, job seekers, customers and the public that they operate safe and well-managed facilities.  Access to injury data will also help OSHA better target our compliance assistance and enforcement resources at establishments where workers are at greatest risk, and enable ‘big data’ researchers to apply their skills to make workplaces safer.”</p>
<p>The new rule requires all establishments with 250 or more employees in industries covered by the recordkeeping regulation to electronically submit to OSHA injury and illness information from OSHA Forms 300, 300A and 301.  Establishments with 20 to 249 employees in certain wide-ranging high-risk industries must electronically submit information from OSHA Form 300A only. <a href="https://www.osha.gov/recordkeeping/NAICScodesforelectronicsubmission.pdf">Click here</a> to see the high-risk industry list for establishments of 20-249 employees.</p>
<p><strong><u>Iowa Angle</u></strong></p>
<p>Iowa is an OSHA State Plan state, meaning this new rule doesn’t apply in Iowa—yet!  However, OSHA State Plan states must adopt requirements that are substantially the same as the requirements in this final rule within six months after publication of the final rule, which would be by November 12, 2016.  So even though the effective date of this new OSHA rule will be delayed in Iowa, employers still should pay heed to what will be coming soon.</p>
<p><strong><u>Impact on Employment Policies and Procedures</u></strong></p>
<p>Included in the new rule are employee notification and anti-retaliation provisions.  The old rule simply required that the employer “set up <strong><em>a way</em></strong> for employees to report work-related injuries and illnesses promptly” and tell each employee how to report the injuries and illnesses.  By contrast, the new rule requires employers to “<strong><em>establish a reasonable procedure</em></strong> for employees to report work-related injuries and illnesses promptly and accurately.”    It specifically states that “A procedure is not reasonable if it would deter or discourage a reasonable employee from accurately reporting a workplace injury or illness.”</p>
<p>To be compliant with the new rule, employers will need to examine and likely modify existing policies and procedures to ensure they are compliant with these reporting procedures and anti-retaliation protections. Employers must also inform each employee (1) of the right to report work-related injuries and illnesses, and (2) of the fact that employers are prohibited from discharging or in any manner discriminating against employees for such reporting.  Employers not in State Plan states must complete this notification and update policies by August 10, 2016.  Because Iowa is a State Plan state that has not yet acted to adopt a similar rule, the effective date will be later for Iowa establishments, and is yet to be determined.</p>
<p><strong><u>Timing of Implementation </u></strong></p>
<p>The new reporting requirements will be phased in over two years.  Establishments of more than 250 employees in industries covered by the recordkeeping regulation required to submit the information from their 2016 Form 300A by July 1, 2017.  2017 Forms 300, 300A and 301 must be submitted by July 1, 2018.  Beginning in 2019 and thereafter, all three forms must be submitted by March 2 (i.e., 2018 forms are due on March 2, 2019; 2019 forms are due on March 2, 2010, and so forth).</p>
<p>Establishments with 20 – 249 employees in certain high-risk industries must submit their 2016 Form 300A by July 1, 2017.  2017 Form 300A must be submitted by July 1, 2018.  Beginning in 2019 and thereafter, Form 300A must be submitted by March 2(i.e., the 2018 form is due on March 2, 2019; the 2019 form is due on March 2, 2010, and so forth).</p>
<p>Again, because Iowa has not yet adopted a similar rule for its State Plan, effective dates for report submissions are not yet known and may vary slightly from this schedule.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>SUB plans and annualization under the Davis Bacon Act</title>
		<link>http://www.dickinsonlaw.com/2016/05/plans-annualization-davis-bacon-act/</link>
		<pubDate>Wed, 25 May 2016 12:21:07 +0000</pubDate>
		<dc:creator><![CDATA[Mike Staebell]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Davis Bacon Act]]></category>
		<category><![CDATA[DOL Wage and Hour Division]]></category>
		<category><![CDATA[SUP]]></category>
		<category><![CDATA[Supplemental Unemployment Benefits]]></category>
		<category><![CDATA[Wage and Hour]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8714</guid>
		<description><![CDATA[Employers should know about an important change to avoid paying back wages to employees if Wage and Hour investigates.]]></description>
				<content:encoded><![CDATA[<p>Supplemental Unemployment Benefits (SUB) Plans provide privately funded unemployment benefits through employer trust funds established under <a href="https://www.irs.gov/charities-non-profits/other-non-profits/supplemental-unemployment-benefits-trust-501-c-17">section 50l(c)(17)</a> of the Internal  Revenue Code. These plans are marketed by financial service firms to employers such as construction contractors, whose work weeks vary due to seasons, weather conditions and other factors.</p>
<p>Last fall, USDOL’s Wage and Hour Division issued a letter that reversed a 13-year policy of how much credit federal contractors may take under the Davis-Bacon Act (DBA) for contributions to SUB Plans.  Employers who are not aware of this change may be required to pay back wages to employees if Wage and Hour investigates.</p>
<p>Employers participating in SUB Plans make periodic contributions for each eligible employee, based on hours of work performed on projects covered by federal and state prevailing wage requirements.  Most SUB plans also allow contributions for non-prevailing wage work, at the employer’s option.    Although these contributions are fully vested when made, employees have no right to or interest in their account balance until they meet the plan’s eligibility requirements for benefit payments.</p>
<p>Employees eligible for state unemployment benefits who participate in a SUB Plan are usually entitled to plan unemployment benefits in addition to state unemployment compensation.  In certain situations, some SUB Plan’s eligibility rules allow participating employees to receive supplemental unemployment benefits even if they are not eligible for state unemployment insurance payments.</p>
<p>The majority of employers make contributions to SUB plans only for the hours worked on federally funded prevailing wage contracts.  The Wage and Hour Division generally bars an employer from applying 100% of its fringe benefit contributions to a plan in a given year to meet prevailing wage and fringe benefits obligations if employees also work on private projects that year for which no contributions are made.  Wage and Hour calls this the annualization principle, and has historically applied it to contributions for other fringe benefits, including plans for health insurance, apprenticeship training, vacation, and defined pension benefits. This precludes the use of DBA work as the disproportionate or exclusive source of funding for benefits that are continuous in nature and are compensation for all the employee’s work, both DBA and private.</p>
<p>The annualization principle requires averaging the contributions an employer makes to the plan over all the employee’s hours of work for the employer in that year.    For example, if an employer contributes $5000 to a plan on behalf of an employee who works 1000 hours of DBA work and 1000 hours of non-DBA work, it may claim a credit of $2.50/hr towards DBA fringes.  ($5000/2000hrs = $2.50/hr.)</p>
<p>Contractors with SUB Plans who undertake construction projects subject to the prevailing wage requirements of the Davis-Bacon Act naturally want to take credit for the contributions they make to their plan under the DBA’s provisions for crediting employer fringe benefits costs.   In 2002, the Prevailing Wage Contractors Association (PWCA) asked the Administrator of the Wage and Hour Division to rule on the validity of their SUB Plan under the DBA.   In a 2002 letter, the Wage and Hour Administrator declared the PWCA Plan to be a bona fide fringe benefit plan for Davis-Bacon purposes.    The letter also exempted the SUB Plan from DOL’s requirement to annualize contributions, meaning employers could receive full credit towards Davis-Bacon fringe benefits requirements for all contributions, even if they only contributed for prevailing wage work.  This position was reinforced in a 2007 letter to the National Association of Prevailing Wage Contractors (NAPWC), in which Wage and Hour approved their plan and exempted it from annualization requirements.</p>
<p>In July of 2013, a complaint was filed by the Indiana-Illinois-Iowa Foundation for Fair Contracting requesting that Wage and Hour revoke the annualization exception for SUB plans.   At about the same time, the NAPWC requested that Wage and Hour confirm the annualization exception for its SUB plan.   On October 22, 2015, Wage and Hour Administrator David Weil responded to NAPWC, reiterating the bona fide nature of NAPWC’s SUB Plan as creditable towards DBA fringes, but <a href="https://www.dol.gov/arb/briefs/16-019_16-021/index.htm">revoking the exception to the annualization requirement</a>.    Administrator Weil concluded that it would not be appropriate to provide an annualization exception to a contractor’s contributions to a SUB plan “<em>if the benefit is continuous in nature and constitutes compensation for both private and Davis-Bacon work”</em>.   The effective date of enforcement was set at 90 days after the date of the letter: January 22, 2016.</p>
<p>In November 2015, NAPWC filed a Petition for Review with DOL’s Administrative Review Board (ARB).  In effect this was an appeal of Wage and Hour’s revocation of the annualization exception.   As of this date, ARB has not issued its decision.</p>
<p><em>At present, any firm with a SUB Plan that contributes only for Davis-Bacon covered work and takes credit towards DBA fringe benefits for 100% of SUB Plan contributions may be incurring a liability for the claimed credit that is greater than the amount that would result from doing the annualization math as noted previously.</em></p>
<p>As we approach the 2016 construction season, if your firm has a SUB Plan and does Davis-Bacon work, you will want to stay abreast of these developments, and how the ARB rules on this matter.   This is also an appropriate time to check your payroll calculations to ensure that you are properly claiming all fringe benefit credits, if you are not paying them hourly on the payroll.</p>
<p>Stay tuned: we will report when the ARB decision is issued.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>The wait is over: Final Rule changing the salary test for four categories of white collar workers released</title>
		<link>http://www.dickinsonlaw.com/2016/05/wait-over-final-rule-changing-salary-test-categories-white-collar-workers-released/</link>
		<pubDate>Wed, 18 May 2016 11:45:02 +0000</pubDate>
		<dc:creator><![CDATA[Jill Jensen-Welch]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Jill Jensen-Welch]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[DOL Wage and Hour Division]]></category>
		<category><![CDATA[EAP exemption]]></category>
		<category><![CDATA[final rule]]></category>
		<category><![CDATA[Joe Biden]]></category>
		<category><![CDATA[Mike Staebell]]></category>
		<category><![CDATA[minimum salary for exempt workers]]></category>
		<category><![CDATA[minimum salary threshold]]></category>
		<category><![CDATA[U.S. Department of Labor]]></category>
		<category><![CDATA[Wage and Hour]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8695</guid>
		<description><![CDATA[The new Final Rule changing the salary tests on four white collar exemptions could be devastating for many employers.]]></description>
				<content:encoded><![CDATA[<p>Late yesterday, May 17, the Department of Labor, Wage and Hour Division, released materials related to the new Final Rule changing the salary tests on four of the six White Collar Exemptions. The rule itself will be made available to the public today, May 18. It is scheduled to be published in the Federal Register on Monday, May 23. A pre-publication version is <a href="https://www.federalregister.gov/articles/2016/05/23/2016-11754/defining-and-delimiting-the-exemptions-for-executive-administrative-professional-outside-sales-and">available here</a>.</p>
<p>The changes are relatively simple, yet still devastating for many employers, and become effective December 1, 2016.</p>
<ol>
<li style="padding-left: 30px;"><strong>$47,476/year ($913/week)</strong> – This is the new minimum salary threshold for Executive, Administrative, and Professional (EAP) white collar exemptions. This is less than anticipated in the proposed rule.  It is the 40<sup>th</sup> percentile of full-time salaried workers in the lowest-wage census region (the South), taking into account the geographic concerns raised after the proposed rule issued.  Still, it is more than double the current threshold of $23,660/year ($455/week).</li>
<li style="padding-left: 30px;"><strong>New 10% Rule</strong> – For the first time, up to 10% of the minimum salary threshold for the EAP exemptions can be made up of commissions and non-discretionary bonuses.</li>
<li style="padding-left: 30px;"><strong>3-Year Indexing</strong> – Beginning on January 1, 2020, and every three years thereafter, the minimum salary threshold for EAP exemptions will be automatically updated to the 40<sup>th</sup> percentile of earnings of full-time salaried workers.</li>
<li style="padding-left: 30px;"><strong>$134,004/year</strong> – This is the new minimum total compensation threshold for the Highly Compensated Employee (HCE) exemption. It is the 90<sup>th</sup> percentile of full-time salaried workers nationally, providing no relief to employers in lower wage-earning regions.  This is more than anticipated in the proposed rule, and it is a 34% increase over the current threshold of $100,000/year.</li>
</ol>
<p>No changes were made to the duties tests for the White Collar Exemptions.</p>
<p>If your organization planned ahead, the above summary provides the numbers you need to move those plans forward. If your organization has not done anything to prepare for these changes, there is much work to be done. Either way, we are here for employers. With the recent addition of Compliance Specialist Mike Staebell, to the Dickinson Labor and Employment team, we are uniquely positioned to help all kinds of organizations through these changes. <a href="http://www.dickinsonlaw.com/michael-j-staebell/">See Mike’s bio here</a>.</p>
<p>We will digest the rules and materials issued by the DOL over the coming days and update you if more details need to be known.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>The critical role of an MRO in drug testing &#8211; Federal and Iowa</title>
		<link>http://www.dickinsonlaw.com/2016/05/critical-role-mro-drug-testing-federal-iowa/</link>
		<pubDate>Tue, 10 May 2016 19:27:56 +0000</pubDate>
		<dc:creator><![CDATA[Russ Samson]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[Russ Samson]]></category>
		<category><![CDATA[amphetamine use]]></category>
		<category><![CDATA[drug testing]]></category>
		<category><![CDATA[employee drug testing]]></category>
		<category><![CDATA[FMCSA]]></category>
		<category><![CDATA[medical review officer]]></category>
		<category><![CDATA[MRO]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8678</guid>
		<description><![CDATA[The role of an MRO is that of a check and balance, inserted into drug testing for the protection of the employee, co-workers, the employer, and the general public.  ]]></description>
				<content:encoded><![CDATA[<p>The unpublished May 3, 2016, decision of the United States Circuit Court of Appeals for the Fourth Circuit in <em>Lisotto v. New Prime, Inc.,</em> <a href="http://www.ca4.uscourts.gov/Opinions/Unpublished/151273.U.pdf">Docket No. 15-1273</a> (4<sup>th</sup> Cir. 2016) contains some important reminders for employers regarding the proper roles of a Medical Review Officer (MRO) in substance abuse testing.  While <em>Lisotto</em> arose under federal DOT testing, the role of an MRO under Iowa’s Private Sector Drug-Free Workplaces law, <a href="https://coolice.legis.iowa.gov/Cool-ICE/default.asp?category=billinfo&amp;service=IowaCode&amp;input=730.5">Iowa Code Section 730.5</a> is essentially the same.  Iowa’s law defines an MRO as one who is “responsible for receiving laboratory results generated by an employer&#8217;s drug or alcohol testing program, and who has knowledge of substance abuse disorders and has appropriate medical training to interpret and evaluate an individual&#8217;s confirmed positive test result together with the individual&#8217;s medical history and any other relevant biomedical information.”  In contrast, the U.S. Department of Transportation devotes <a href="https://www.transportation.gov/odapc/part40#SubpartG">Subsection G of 49 CFR Part 40</a> to the establishment of expectations for Medical Review Officers.  Given that there is no agency in Iowa with the authority to establish standards for MROs operating under Iowa’s laws, my experience is that most MROs reviewing Iowa drug test lab results will revert to the standards of federal law – primarily because the great preponderance of persons operating as MROs under Iowa’s laws are in fact MRO’s under the DOT testing standards as well.</p>
<p>Lisotto’s lawsuit had been dismissed by a federal district court based solely on the allegations of the pleadings.  Thus, everything that was alleged in Lisotto’s complaint was presumed to be true.  What follows as being reported as a “fact” may or may not be objectively accurate.  The statements do accurately reflect what Lisotto alleged &#8212; apparently without, at the initial juncture, dispute from the defendant Prime, Inc.</p>
<p>In August 2010, Lisotto applied for a truck driver position with Prime, Inc.  At the time of the application Lisotto was employed as a correctional officer in South Carolina at a salary of about $30,000.00 per year.  However, Lisotto had about seven years’ experience as a long-distance truck driver.  Roughly a week after receiving Lisotto’s application, Prime sent Lisotto an email informing him that he was approved to attend Prime’s orientation program in Springfield, Missouri.  Lisotto was told that in accordance with Federal Motor Carrier Safety Administration (“FMCSA”) standards, he would be required to pass a physical examination and a drug screen.  Prime gave Lisotto a one-way bus ticket to Springfield – explaining that upon completion of a successful orientation, he would receive an “assigned truck” and would be expected to drive it back to South Carolina, where he would work out of Columbia, South Carolina.</p>
<p>Lisotto had been told that he had a sleep disorder “believed to be or diagnosed as narcolepsy.”  (Remember, this is just the pleadings.)  Anticipating the FMCSA physical and drug screen required for over-the-road truck drivers, Lisotto obtained a letter from his physician.  The letter explained that Lisotto took a type of prescription amphetamine (specifically Dexedrine) to manage the sleep disorder.  The physician opined in the letter, “that the prescribed medication would not adversely affect [Lisotto’s] ability to safely operate a commercial motor vehicle, as [he] had for many years been driving commercial trucks safely . . . while taking [Dexedrine] and had experienced no problems with narcolepsy.”  Armed with the information from his treating physician and the one-way bus ticket from Prime, Lisotto quit his job and went to Springfield, Missouri.</p>
<p>As required, Lisotto reported for his physical examination and drug test.  Lisotto gave Dr. Abraham the letter from Lisotto’s personal physician, and showed Dr. Abraham the prescription for Dexedrine.  Dr. Abraham noted that under Prime’s standards, the only medication that Prime would accept for narcolepsy is “Provigil.”  (By implication, Dr. Abraham did not determine that the diagnosis of narcolepsy precluded Lisotto from being qualified to drive for Prime.)  Dr. Abraham instructed Lisotto that he needed to be off Dexedrine for at least one month and needed to be on Provigil for at least 6 weeks and “document[] [his] stability” before beginning employment with Prime.</p>
<p>About an hour after he had left Dr. Abraham and was sitting in the orientation program, one of Prime’s nurses took Lisotto out of the classroom.  The nurse told Lisotto, “he could not work for Prime because he had tested positive for amphetamines.”  Remember, these are, at this juncture, all just the allegations in the initial pleading of the lawsuit.  The nurse (allegedly) tempered her statement by telling him to return home and take Provigil for six weeks to see how it would affect him.</p>
<p>Two days following the events in Springfield, Missouri, Lisotto received a telephone call from one “Dr. Mauldin,” who identified himself as Prime’s MRO.  In describing the call from MRO Maudlin, the Fourth Circuit’s written opinion specifically cites to <a href="https://www.law.cornell.edu/cfr/text/49/40.129">49 CFR § 40.129(a)(4)</a> and <a href="https://www.law.cornell.edu/cfr/text/49/40.131">49 CFR § 40.131(a)</a> Those regulations each talk about the federal requirement that if the laboratory reports a positive lab result to the MRO, the MRO speak personally with the employee.  The federal court complaint alleged that Dr. Mauldin told Lisotto that he (Dr. Mauldin) needed to hear from Lisotto’s doctor about the medical condition and the prescribed medication.  The federal court complaint apparently alleged that Lisotto “right away” contacted his personal physician, who promptly and repeatedly attempted to contact Dr. Mauldin, but the personal physician was never able to reach anyone in Dr. Mauldin’s office.</p>
<p>One can appreciate that the Fourth Circuit was looking, as was the district court, solely at the pleadings.  So everyone had to take at face value the report that Dr. Mauldin said if he didn’t hear from the personal physician within five days, he (Dr. Mauldin) would report a positive test to the DOT.  (I make this observation because I know that confirming reports of test results do NOT go to the DOT.  <a href="https://www.law.cornell.edu/cfr/text/49/40.165">See, 49 CFR § 40.165</a> &#8211; To whom does the MRO transmit reports of drug test results?</p>
<p>Continuing, it is alleged that Dr. Mauldin in fact reported Lisotto as having a “positive” drug test.  It is also alleged that upon Lisotto’s return from the Springfield orientation, Lisotto’s personal physician changed his medication to Provigil, and that Lisotto took the new medication as directed and experienced no detrimental side effects.   It is asserted that on November 1, Lisotto called Prime (not Dr. Abraham, however) to report that he had complied with the directives of Dr. Abraham and of the nurse, such that he was ready to re-start the orientation/hiring process.  Allegedly Lisotto was transferred to Prime’s personnel office, where an employee told him that, “You cannot work for Prime because you tested positive for amphetamines” and hung up.</p>
<p>Some two months later, Lisotto – who remained unemployed &#8212; reportedly wrote to the MRO. Lisotto acknowledged that the laboratory test was accurate, but contended that he had medical diagnoses and a prescription for the amphetamines.  In January 2011, some two months after the letter from Lisotto, Dr. Mauldin reportedly responded: “Even though you had a prescription for amphetamines, in my opinion you have a disqualifying medical condition since narcolepsy is a safety concern.”</p>
<p>Prime, Inc. sought to have Lisotto’s federal court complaint, predicated upon an alleged violation of the Americans with Disabilities Act, dismissed.  Prime based its action on a contention that there was a bona fide dispute as to whether Lisotto was qualified for the position he sought, and that underlying that dispute was “a disagreement between the physician for the driver and the physician for the motor carrier concerning the driver’s qualifications” within the meaning of <a href="https://www.law.cornell.edu/cfr/text/49/391.47">49 C.F.R. § 391.47(b)(2)</a><u>, which</u> provides an administrative means for resolving the disagreement and which Prime contended Lisotto should have utilized before bringing suit.  Under the specific terms of that regulation, it is required that as part of the invocation of the administrative process, the “applicant must submit proof that there is a disagreement between the physician for the driver and the physician for the motor carrier concerning the driver&#8217;s qualifications.”</p>
<p>Contrary to the district court below, the Fourth Circuit noted that the pleading did not indicate that there was a dispute between Dr. Abraham – Prime’s physician, who conducted the medical examination of Lisotto – and Lisotto’s personal physician.  Neither of those two physicians had expressed a concern that the diagnosis of narcolepsy (if there was one) barred Lisotto from being qualified as a driver.  Dr. Abraham, as Prime’s physician, was willing to permit Lisotto to try Prime’s “approved” drug for at least 6 weeks and then document that Provigil in fact worked to control the situation.</p>
<p>Dr. Mauldin, while a “physician,” was acting in his capacity as an MRO.  He was not retained to opine on Lisotto’s medical qualifications as a driver beyond the results of the urine test.  If it were not for the quoted letter from January 2011 from MRO Maudlin to Lisotto, I can envision a number of situations where there might be a “positive” drug test reported even if the individual had a valid prescription:  As an example, because the tests are quantitative, it is possible to say with some degree of medical certainty that an amount detected by the laboratory is inconsistent with the amount that would be found if the individual were taking the medication as prescribed.  A prescription is not a license to take what one feels is appropriate.  Per the Substance Abuse and Mental Health Services Administration’s (“SAMHSA”) MRO Manual,</p>
<p style="padding-left: 30px;"><em>Amphetamine and methamphetamine exist in two isomeric structural forms known as enantiomers.  Enantiomers are non-superimposable mirror images. . . .  Generally, the amphetamine/methamphetamine result reported by the laboratory does not indicate the specific enantiomer because the laboratory procedure is set up to only identify and quantitate the presence of amphetamine and/or methamphetamine.  In order to determine which enantiomer is present, an additional analysis must be performed. The enantiomer identification may be useful in determining if a donor has been using an OTC product such as the Vicks® VapoInhaler® that contains l-methamphetamine (also called l-desoxyephedrine or levmetamfetamine), a prescription medication, or abusing an illegal drug. However, the presence of the l- isomer of either amphetamine or methamphetamine does not by itself rule out illegal use.</em></p>
<p>This is a very long way of saying and explaining why the fact there is a prescription “does not by itself rule out illegal use.”  In part, that explains why there is an MRO – to evaluate the laboratory results and the relevant biomedical information and make a medical determination, and communicate that determination to the employer.</p>
<p>Based on its determination that there was no dispute between the physicians for each of the two parties on Lisotto’s qualifications, the Fourth Circuit directed that the ADA lawsuit should proceed.  There is nothing really earthshaking in that action.  The take-away from the decision is that it is important that an employer which is doing drug testing under any DOT regulation, or that an Iowa employer doing drug testing under Iowa Code Section 730.5, have open lines of communication with the MRO who is reviewing laboratory results and communicating with the employer.</p>
<p>The role of an MRO is that of a check and balance, inserted into drug testing for the protection of the employee, co-workers, the employer, and the general public.  While the fees of an MRO are generally paid by the employer, the MRO is not “the employer’s doctor.”   The MRO’s role, I suggest, should be limited to doing what the MRO is supposed to do &#8212; receive the laboratory results, review the paperwork and process, receive relevant biomedical information and make (and communicate) an informed decision to the employer on what the results of the test are.</p>
<p>If an employer has a question about a report received from an MRO, seek clarification.  If an individual raises a question with you, the employer, about a test result, don’t blindly assume the MRO cannot be wrong:  Ask for clarification.  Sometimes doctors, like lawyers, speak in a language not readily understood.</p>
<p>And take some solace in the fact that an MRO is not obligated to forever hold in confidence any medical information the MRO learns as part of the review process.  The DOT’s federal regulations, at least, require disclosure to third parties (including the employer) in some instances:</p>
<p>When must the MRO report medical information gathered in the verification process?</p>
<p>As the MRO, you must, except as provided in paragraph (c) of this section, report drug test results and medical information you learned as part of the verification process to third parties without the employee&#8217;s consent if you determine, in your reasonable medical judgment, that:</p>
<p style="padding-left: 30px;">(1)          The information is likely to result in the employee being determined to be medically unqualified under an applicable DOT agency regulation; or</p>
<p style="padding-left: 30px;">(2)          The information indicates that continued performance by the employee of his or her safety-sensitive function is likely to pose a significant safety risk.</p>
<p style="padding-left: 30px;">(b)     The third parties to whom you are authorized to provide information by this section include the employer, a physician or other health care provider responsible for determining the medical qualifications of the employee under an applicable DOT agency safety regulation, a SAP evaluating the employee as part of the return to duty process (see § 40.293(g)), a DOT agency, or the National Transportation Safety Board in the course of an accident investigation.</p>
<p><a href="https://www.law.cornell.edu/cfr/text/49/40.327">49 CFR § 40.327</a>.</p>
<p>One returns to the particular posture of the <em>Lisotto</em> case – the Fourth Circuit was reviewing the dismissal of litigation based upon an alleged failure to exhaust FMSCA administrative remedies.  The Fourth Circuit – like the district court it was reviewing &#8212; was absolutely bound to accept the plaintiff’s allegations as true at that stage of the proceedings.  Lisotto did not <em>allege </em>that Prime failed to hire him because of MRO Mauldin’s January 2011 letter, or that MRO Maudlin even reported his concerns about narcolepsy to Prime.  In the absence of such allegations, and in the face of allegations about what Prime’s medical examiner determined, it was not difficult for the Fourth Circuit to conclude that, “any opinion [MRO] Dr. Mauldin may have had about Appellant’s qualifications did not serve as a basis for Prime’s refusal to hire him.”</p>
<p>That said, if there was a “positive drug test” result reported by MRO Mauldin, the FMCSA regulations would impose a substantial impediment to Lisotto’s employability in positions requiring a CDL.  <a href="https://www.law.cornell.edu/cfr/text/49/part-382/subpart-E">49 CFR Part 382, Subpart E</a> – “Consequences for Drivers Engaging in Substance Use-Related Conduct.”</p>
<p>Under both DOT / FMCSA regulations and Iowa’ private sector drug testing law, it is ultimately the employer which is responsible for making employment decisions – and which is very likely to be named as a defendant in litigation if there is alleged to be some hiccup in the process.  If you, as an employer, have some question about information you get from an MRO, don’t hesitate to obtain an answer.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>OSHA updates eye and face protection standards in final rule</title>
		<link>http://www.dickinsonlaw.com/2016/04/osha-updates-eye-face-protection-standards-final-rule/</link>
		<pubDate>Mon, 04 Apr 2016 14:50:39 +0000</pubDate>
		<dc:creator><![CDATA[Joan Fletcher]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Joan Fletcher]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[American National Standards Institute]]></category>
		<category><![CDATA[employers]]></category>
		<category><![CDATA[eye and face protection]]></category>
		<category><![CDATA[Occupational Safety and Health Administration]]></category>
		<category><![CDATA[OSHA]]></category>
		<category><![CDATA[workplace safety]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8620</guid>
		<description><![CDATA[New rule allows employers to continue to follow existing ANSI standards.]]></description>
				<content:encoded><![CDATA[<p>The Occupational Safety and Health Administration recently published a final rule updating the references in OSHA’s eye and face protection standards to reflect the most recent edition of the American National Standards Institute (ANSI) / International Safety Equipment Association (ISEA) eye and face protection standard.  The new rule will allow employers to continue to follow the existing ANSI standards referenced,   or allow employers to follow the latest version of the same ANSI / ISEA standard.</p>
<p>The rule has no associated compliance or economic burden on employers.  Employers are not required to update or replace protection devices solely as a result of the new rule, and may continue to follow their current and usual practices for eye and face protection. The new rule becomes effective on April 25, 2016.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>Scary reminder: HR directors may face liability for FMLA violations</title>
		<link>http://www.dickinsonlaw.com/2016/04/scary-reminder-hr-directors-face-liability-fmla-violations/</link>
		<pubDate>Mon, 04 Apr 2016 13:51:30 +0000</pubDate>
		<dc:creator><![CDATA[Melissa Schilling]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Melissa Schilling]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[compliance]]></category>
		<category><![CDATA[Culinary Institute of America]]></category>
		<category><![CDATA[employment discrimination]]></category>
		<category><![CDATA[Family Medical Leave Act]]></category>
		<category><![CDATA[FMLA]]></category>
		<category><![CDATA[HR directors]]></category>
		<category><![CDATA[human resource]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8615</guid>
		<description><![CDATA[Employers should be reminded that HR professionals could be held liable for FMLA missteps.]]></description>
				<content:encoded><![CDATA[<p>Managing FMLA leave and the FMLA certification process is typically one of the most challenging assignments for HR professionals. Now imagine facing individual liability under the FMLA for your company’s FMLA violations. In the Eighth Circuit Court of Appeals (the federal court of appeals that covers Iowa), that idea has been a reality for several years, but a recent decision from the Second Circuit provides a good reminder to employers that the job of HR professionals is much more challenging than others can even imagine.</p>
<p>In <em>Graziadio v. Culinary Institute of America, et al.</em>, 15-888-cv (2<sup>nd</sup> Cir. March 17, 2016), the Second Circuit found that a human resources professional can be held personally liable for her company’s FMLA violations. The Plaintiff, Cathleen Graziadio, was a payroll administrator at the Culinary Institute of America (“CIA”).  Her dispute with CIA began after she took FMLA leave to care for her diabetic son. After she returned to work, she then took additional leave to care for her second son who broke his leg. During this leave, the HR Director questioned the validity of her leave and would not allow the Plaintiff to return to work until she provided new FMLA documentation.</p>
<p>The parties then engaged in what the court labeled an “excruciating exchange” – the  Plaintiff repeatedly attempted to determine what additional paperwork was necessary and the HR Director continued to request unspecified “documentation” and “certifications.” Ultimately, the parties stopped communicating and the Plaintiff was terminated for abandoning her job. The Plaintiff then filed a lawsuit against CIA and the HR Director, in her individual capacity.</p>
<p>The question of whether the HR Director could be held individually liable under the FMLA boiled down to the meaning of the word “employer.” Under the FMLA, “employer” is defined as encompassing “any person who acts directly or indirectly, in the interest of an employer to any of the employees of such employer.” In determining whether the HR Director met this definition, the Second Circuit applied the “economic-reality test,” which is used to analyze whether an individual is considered an “employer” under the FLSA and requires courts to evaluate whether the alleged employer had the power to control the worker in question, while keeping an eye to the “economic reality” presented by the facts.</p>
<p>The Second Circuit found that the HR Director did meet this definition because she “played an important role in the decision to fire” the Plaintiff, she exercised control over the Plaintiff’s schedule and conditions of employment with respect to her return from FMLA, she reviewed and determined the adequacy of the Plaintiff’s FMLA paperwork, and she was in exclusive communication with the Plaintiff regarding the FMLA issues. As a result, the Second Circuit determined that a jury could find that the HR Director was an “employer” under the FMLA.</p>
<p><strong>Takeaways: </strong>While the threat of individual liability is not new to Iowa employers (individual supervisors can also be held liable for employment discrimination under Iowa’s Civil Right Act), this case is a good reminder that employers should ensure that their HR professionals: (1) are aware of their potential exposure to liability; (2) are regularly trained on FMLA compliance; and (3) are encouraged to work with experienced legal counsel on sticky and complex FMLA issues. In addition, employers should consider whether it will indemnify an HR professional who is sued individually, and to what extent.</p>
<p>If you have any questions regarding the FMLA or the FMLA training provided by Dickinson Law, please contact a member of Dickinson’s employment law group.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>Seeking damages for pain and suffering? Harsh lessons from playing hide-the-ball</title>
		<link>http://www.dickinsonlaw.com/2016/03/seeking-damages-pain-suffering-harsh-lessons-playing-hide-the-ball/</link>
		<pubDate>Mon, 28 Mar 2016 12:07:21 +0000</pubDate>
		<dc:creator><![CDATA[Melissa Schilling]]></dc:creator>
				<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[Melissa Schilling]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[Americans with Disabilities Act]]></category>
		<category><![CDATA[Civil Rights Act]]></category>
		<category><![CDATA[computation]]></category>
		<category><![CDATA[damage awards]]></category>
		<category><![CDATA[damages]]></category>
		<category><![CDATA[emotional distress damage]]></category>
		<category><![CDATA[Iowa Court of Appeals]]></category>
		<category><![CDATA[motion in limine]]></category>
		<category><![CDATA[pain and suffering]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8583</guid>
		<description><![CDATA[Pain and suffering awards often make up the lion’s share of judgments in employment lawsuits in Iowa.  ]]></description>
				<content:encoded><![CDATA[<p>In employment lawsuits, pain and suffering damage awards (sometimes referred to as emotional distress damage awards) have come to play an increasingly prominent role over the last 15 years, due in large part to the enactment of the Americans with Disabilities Act in 1990 and the Civil Rights Act of 1991, as well as the increase in statutory and tort-based causes of actions under Iowa law that allow the recovery of damages for pain and suffering. In fact, pain and suffering awards often make up the lion’s share of judgments in employment lawsuits in Iowa.</p>
<p>Given the large role that these damage awards play, state and federal courts have implemented rules that require plaintiffs to disclose the specific figure of damages that they seek at the outset of the lawsuit.  Despite these rules, plaintiffs frequently refuse to disclose a computation of pain and suffering damages until they present their case to a jury. For example, during discovery, plaintiffs frequently claim that they cannot prove such damages with “mathematical certainty.” But such a claim is disingenuous. After all, if a plaintiff presents a specific amount to the jury for pain and suffering damages, then presumably s/he has a basis and means for arriving at the amount s/he is seeking. And, such a “hide-the-ball approach” leaves defendant employers at a disadvantage because they are unable to discover the basis for the computation and rebut that basis during trial.</p>
<p>At this point, you may be asking yourself: is there any penalty for failing to comply with state and federal disclosure requirements? According to a recent decision from the Iowa Court of Appeals, the answer to this question is YES!</p>
<p>In <em>T.D. Il. v. Des Moines Indep. Cmty. Sch. Dist.</em>, No. 14-2166 (Iowa Ct. App. Jan. 27, 2016), <a href="http://www.iowacourts.gov/About_the_Courts/Court_of_Appeals/Court_of_Appeals_Opinions/Recent_Opinions/20160127/14-2166.pdf" target="_blank">the Iowa Court of Appeals upheld</a> perhaps the harshest sanction after the plaintiff failed to disclose his computation of pain and suffering damages during discovery. The Court affirmed the District Court’s decision to preclude the plaintiff from submitting <strong><em><u>any</u></em></strong> proof of pain and suffering damages to the jury. As a result, the jury did not award plaintiff any damages for pain and suffering. In reaching its decision to impose such a severe sanction, the District Court highlighted the plaintiff’s blatant failure to follow Iowa law and Iowa’s rules of civil procedure regarding the disclosure of damages, and emphasized the importance of affording the defendant the opportunity to discover the information before trial.</p>
<p><strong>Take Aways: </strong>While harsh, the decision to exclude the plaintiff from submitting any proof of pain and suffering damages in the <em>T.D. Il. </em>case represents a likely outcome for a failure to comply with the disclosure requirements of state and federal court. Therefore, it is well advised for defense attorneys to request a computation of damages during discovery, insist on the plaintiff providing such a computation, and to file a motion in limine when the plaintiff refuses to do so.</p>
<p>If you have any questions regarding discovery and the duty to disclose damage computations, please contact a member of Dickinson’s employment law group or litigation group.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>Weakest link: Your employees jeopardize cyber-insurance coverage</title>
		<link>http://www.dickinsonlaw.com/2016/03/weakest-link-employees-jeopardize-cyber-insurance-coverage/</link>
		<pubDate>Wed, 23 Mar 2016 13:00:09 +0000</pubDate>
		<dc:creator><![CDATA[John Lande]]></dc:creator>
				<category><![CDATA[Banking Law]]></category>
		<category><![CDATA[Cybersecurity Law]]></category>
		<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[John Lande]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[bank employees]]></category>
		<category><![CDATA[bank liability]]></category>
		<category><![CDATA[cyber attack]]></category>
		<category><![CDATA[cyber insurance]]></category>
		<category><![CDATA[cyber insurance coverage]]></category>
		<category><![CDATA[cybersecurity]]></category>
		<category><![CDATA[fraudulent wire transfer]]></category>
		<category><![CDATA[fraudulent wire transfers]]></category>
		<category><![CDATA[hackers]]></category>
		<category><![CDATA[State Bank of Bellingham]]></category>
		<category><![CDATA[Zeus virus]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8540</guid>
		<description><![CDATA[This blog has repeatedly covered risks to banks and businesses from cyber-attack. Prudent banks and businesses need to train employees, develop an incident response plan, and purchase insurance to cover the inevitable cyber-attack. A recent case from Minnesota demonstrates how even the most robust cyber-attack response plan can be jeopardized by every plan’s weakest link: [&#8230;]]]></description>
				<content:encoded><![CDATA[<p>This blog <a href="http://www.dickinsonlaw.com/2015/09/national-attention-corporate-account-takeover/">has repeatedly covered</a> risks to banks and businesses from cyber-attack. Prudent banks and businesses need to train employees, develop an incident response plan, and purchase insurance to cover the inevitable cyber-attack. A recent case from Minnesota demonstrates how even the most robust cyber-attack response plan can be jeopardized by every plan’s weakest link: employees.</p>
<p>The case of <u>State Bank of Bellingham v. BancInsure, Inc.</u> began with a fraudulent wire transfer by State Bank of Bellingham in the fall of 2011. The fraudulent wire transfer occurred through the Federal Reserve’s FedLine system. The bank had a desktop computer that connected to FedLine’s Virtual Private Network (“VPN”) where the bank initiated wire transfers. In order to complete a wire transfer a user had to enter an authorized username, two passwords, a third password generated by a security token issued by FedLine, and enter a second username and set of passwords.</p>
<p>On the morning of October 28, 2011, a bank employee arrived at the bank to find that two wire transfers totaling $940,000 had been initiated to bank accounts in Poland. The bank employee immediately tried to stop the wires, but the bank was experiencing a denial-of-service attack (“DoS”) that crippled the bank’s ability to access the Internet. The bank contacted the Federal Reserve and the Federal Reserve contacted intermediary banks that were able to reverse one of the two wires. The bank ultimately lost $485,000.</p>
<p>The bank made a claim on its bond, but the carrier denied coverage. As part of the dispute with the carrier the bank conducted its own forensic examination of the computer that initiated the wire transfers. The forensic examination revealed:</p>
<ul>
<li>The bank had failed to implement automatic software and hardware security updates;</li>
<li>A bank employee had received a spam email message and clicked on a link that downloaded multiple pieces of malware;</li>
<li>The malware, known as the Zeus virus, allowed hackers to obtain all of the passwords and usernames for initiating wire transfers;</li>
<li>One of the reasons Zeus was able to obtain all of the passwords is because bank employees left the FedLine secure token—a USB drive—plugged into the computer at all times;</li>
<li>Antivirus software detected the Zeus virus and warned employees, but it appears bank employees failed to command the antivirus software to remove the Zeus virus;</li>
<li>Multiple non-business websites were accessed on the FedLine computer, including Facebook and personal email accounts;</li>
<li>There was a history of spam email messages being opened from personal email accounts; and</li>
<li>The FedLine computer was accessible by any bank employee because the computer was not password protected.</li>
</ul>
<p>Employees’ use of the FedLine computer created a gaping hole in the bank’s cyber-defenses. Moreover, all of the problems identified by the forensic investigation were problems associated with human behavior, not with a deficiency in the bank’s technical cyber-defenses.</p>
<p>The bond carrier asserted three policy exclusions that barred coverage for the attack: (1) the employee exclusion, (2) loss from theft of confidential information exclusions, and (3) loss from a mechanical failure or gradual deterioration of a computer system exclusion. Applying Minnesota law, the court concluded that none of the exclusions applied because the overriding cause of the loss was the hackers’ fraud.</p>
<p>While the bank was ultimately made whole, the case came down to whether a court viewed the employees’ conduct as the overriding cause of the bank’s loss. While there is no doubt that but for the actions of the hackers the fraudulent wire transfers would not have occurred, it is also true that but for the conduct of the employees the FedLine computer would not have been vulnerable. This case presents a close question and it is not hard to imagine a different court deciding the case differently. A court could also easily decide that because the question of cause is so close a jury would need to decide the outcome.</p>
<p>The State Bank of Bellingham was made whole, but it isn’t clear that every bank in the same position will be made whole too. The better course is to learn from the mistakes in this case, and spend time thinking about how to strengthen every organization’s weakest links: its employees.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
		<item>
		<title>Not so friendly ghosts: Email ghosting represents threat to organizations</title>
		<link>http://www.dickinsonlaw.com/2016/03/friendly-ghosts-email-ghosting-represents-threat-organizations/</link>
		<pubDate>Mon, 14 Mar 2016 13:00:22 +0000</pubDate>
		<dc:creator><![CDATA[John Lande]]></dc:creator>
				<category><![CDATA[Banking Law]]></category>
		<category><![CDATA[Cybersecurity Law]]></category>
		<category><![CDATA[Employment & Labor Law]]></category>
		<category><![CDATA[John Lande]]></category>
		<category><![CDATA[Posts]]></category>
		<category><![CDATA[cyber attacks]]></category>
		<category><![CDATA[cyber threats]]></category>
		<category><![CDATA[cybersecurity]]></category>
		<category><![CDATA[email ghosting]]></category>
		<category><![CDATA[employee training]]></category>
		<category><![CDATA[FBI]]></category>
		<category><![CDATA[hackers]]></category>
		<category><![CDATA[Krebs]]></category>
		<category><![CDATA[Krebs on Security]]></category>
		<category><![CDATA[suspicious email]]></category>

		<guid isPermaLink="false">http://www.dickinsonlaw.com/?p=8529</guid>
		<description><![CDATA[Most email ghosting attacks can be deflected by training employees to identify suspicious messages and requiring them to speak to managers before performing certain tasks, such as transferring money.]]></description>
				<content:encoded><![CDATA[<p>Managers and supervisors expect that employees will follow instructions. This is such a central part of the employment relationship that it goes without saying. However, employees’ instinctual execution of instructions from supervisors can also jeopardize an organization.</p>
<p>This <a href="http://www.dickinsonlaw.com/2015/09/national-attention-corporate-account-takeover/">blog has previously covered</a> cybersecurity threats faced by businesses large and small. One particularly insidious threat comes from what is known as &#8220;email ghosting.&#8221; An email ghosting attack involves hackers setting up a phony email address that mimic the email address of an employee or manager at an organization. Hackers will then send fraudulent requests for information or money.</p>
<p>Krebs on Security <a href="http://krebsonsecurity.com/2016/01/firm-sues-cyber-insurer-over-480k-loss/">recently reported</a> an incident involving the company AFGlobal Corp. According to court filings, the director of AFGlobal’s accounting department received email from an individual claiming to be the CEO of the company:</p>
<p style="padding-left: 30px;"><em>This is a strictly confidential financial operation, to which takes priority over other tasks. Have you already been contacted by Steven Shapiro (attorney from KPMG)? This is very sensitive, so please only communicate with me through this email, in order for us not to infringe SEC regulations. Please do no speak with anyone by email or phone regarding this. Regards, Gean Stalcup.</em></p>
<p>Shortly after receiving this email the director of accounting received a phone call and email from someone purporting to be Mr. Shapiro requesting $480,000. The director of accounting wired the money to the provided bank account located in China.</p>
<p>In another example, Krebs <a href="http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/">reported on another company</a> whose controller received an email purportedly from the company’s CEO requesting all employee W-2s. Employees at the company had recently completed training on identifying suspicious emails, so they were not fooled by the purported CEO’s request.</p>
<p>In even more sophisticated versions of this kind of attack, hackers will gain access to an organization’s internal email server in order to observe patterns of communication between employees and management. When a manager leaves for a scheduled vacation, the hackers can take advantage of the absence by sending emails to employees requesting sensitive information, or authorizing movement of funds to bank accounts overseas. These attacks depend on employees’ willingness to follow instructions, and weak internal controls to verify the authenticity of a request.</p>
<p>The FBI reported the following statistics from these email ghosting attacks for the period October 2013 through August 2015:</p>
<table>
<tbody>
<tr>
<td width="295">Total U.S. Victims</td>
<td width="295">7,066</td>
</tr>
<tr>
<td width="295">Total U.S. Exposed Dollar Loss</td>
<td width="295">$747,659,840.63</td>
</tr>
<tr>
<td width="295">Total Non-U.S. Victims</td>
<td width="295">1,113</td>
</tr>
<tr>
<td width="295">Total Non-U.S. Exposed Dollar Loss</td>
<td width="295">$51,238,118.62</td>
</tr>
<tr>
<td width="295">Combined Victims</td>
<td width="295">8,179</td>
</tr>
<tr>
<td width="295">Combined Exposed Dollar Loss</td>
<td width="295">$798,897,959.25</td>
</tr>
</tbody>
</table>
<p>&nbsp;</p>
<p>These statistics reflect the increasing volume and risk posed by email ghosting attacks. In many of these cases, stronger internal controls will help employees identify unusual requests. For example, many of these attacks can be defeated by requiring employees to talk to managers before performing certain tasks like transferring money. Organizations should consult with legal counsel about developing policies to identify and prevent these kinds of attacks.</p>
<p><em>The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.</em></p>
]]></content:encoded>
			</item>
	</channel>
</rss>
