In today’s digital world, charitable giving can be a click away—but so can the risk of falling victim to scams. Charitable Giving Fraud and Other Online Dangers dives into the emotional tactics cybercriminals use to deceive generous donors, especially in times of crisis, from Veterans Day to natural disasters like the Maui fires. With millions lost to online charity scams, this article reveals eye-opening statistics and outlines essential steps to protect yourself and ensure your support reaches the right hands. Ready to learn how to spot red flags and give with confidence? Read on! (PDF) 

As published in DRI’s In-House Defense Quarterly, Fall 2024, pp 20-22.

Barry S. Herrin, JD, FAHIMA, FACHE, is the founder of Herrin Health Law, P.C., in Atlanta, Ga. Herrin offers more than 30 years of experience practicing law in the areas of healthcare and hospital law and policy, privacy law and health information management, among other healthcare-specific practice areas. He is a Fellow of the American College of Healthcare Executives and a Fellow of the American Health Information Management Association. He also holds a Certificate in Cyber Security from the Georgia Institute of Technology. Reach him at 404-459-2526 or barry.herrin@herrinhealthlaw.com.

You may have heard the phrase, “All I need to know about life I learned in kindergarten.”  Well, all I need to know about race, diversity, and inclusion I learned on the Naval JROTC drill team in Valdosta, Ga., in 1980. Oh, I’ve learned lots of supplemental things about these subjects, and about myself, in the time between then and now, but the bedrock principles were established then.

In 1980, Valdosta High School was a racially divided school in many ways. Still under a supervised court order for desegregation, the school enacted what even today is a bizarre structure for the integration of school activities. For example, the race of our homecoming queen was pre-selected and alternated: even years, black; odd years, white. The beautiful Carol Johnson was our 1982 homecoming queen and could have won in an honest vote against any white competitor hands-down. Similarly, class officer elections were required to have two white and two black officers. So, when we elected a white class president (local football family scion Blake Belue), we were obligated to elect a black vice-president, which we did in the person of the very capable and talented Irwin Thomas. The same thing occurred in the elections of class secretary (Letitia Hart, black) and treasurer (Juliet Purvis, white/Native American). In most other respects, VHS was divided into the typical cliques: jock, country club, nerd, band, sorority girls, bad boys.

Drill team, however, was a different place. Our naval science instructor, Petty Officer Sam Wright, himself an avowed redneck from Ray City, did not tolerate any racism or gender bias in our JROTC battalion generally or our elite teams (drill team, color guard, rifle team, orienteering) specifically. The life-changing lesson I referred to earlier was delivered by our drill team commander, Cadet Lieutenant (junior grade) Columbus Carter, a black kid who is, the last time I kept track, a deacon at the Resurrection of Our Lord Catholic Church. To the best of my recollection, our introduction to drill team went something like this:

“My name is Cadet Lieutenant (junior grade) Columbus Carter. You may call me Lieutenant Carter. Outside of drill team, you can call me CC, which also stands for ‘Chocolate Chip’, ‘cause I’m black and sweet, baby [HUGE grin]. The first thing all y’all need to know about drill team is that there ain’t no black folk on the drill team, and there ain’t no white folk on the drill team. We’re all purple. And the purple people got to stick together or this drill team ain’t gonna be no damn good.”

We’re all purple. Rather than play the race/hate card that seems so easy to play these days, CC led by positive example and held all of us accountable – white and black – to his personal standard of excellence and respect. He wanted his team to look sharp, march well, and reflect positively on him as the leader.

A lot has changed on high school and college campuses since 1980. We’ve seen a push to avoid teaching standard English in favor of “ebonics” come and go, to be replaced with the insane notion that math somehow is racist. We’ve seen California enact and then sustain race-neutral admissions criteria in education alongside the removal of Abraham Lincoln’s name from a public high school because the Great Emancipator isn’t “woke” enough for the idiot left. Asian students are suing Harvard for racial discrimination. Words like “Black Lives Matter,” “critical race theory,” and “cancel culture” are part of dialogue at school board meetings. Similar changes are happening in the workplace. The “affirmative action” of the 1970s is being replaced with “diversity and inclusion initiatives,” claims of “systemic racism,” and the Cultural Revolution style “struggle sessions” over “white privilege.”

We have to find a way for each of us to express his own individual unique talents and skills and pursue excellence as individuals – as purple people – instead of letting schools, governments, employers, rioters, and social justice elites divide, define, and sort us into categories that often create more problems than they solve.

And none of us needs to pull any punches when fighting for our purpleness. Being a purple person is serious work, and there aren’t any “safe spaces” for bigots or racists or anti-racists or “snowflakes” or social justice warriors or any of the other “rebels without a clue.” I personally am not going to let you dilute my purpleness with any of that crap. And you shouldn’t let anyone dilute yours, either.

Power to the Purple People.

William M. Satterwhite, JD, MD, CPE and Barry S. Herrin, JD, FACHE 

Everyone in business understands the term “ERISA”. Yet few people, even those in the benefits industry, actually really understand the incredible power to improve health and save money that is contained within the provisions of the Employment Retirement Income Security Act of 1974, as amended. Though originally ERISA only addressed pension plans and individual retirement plans, the Act has been amended several times and now covers employment-based medical and hospitalization benefits plans, called “welfare benefit plans” (WBP) in ERISA parlance.

Most companies offer traditional health benefits plans that have the usual monthly premiums, copays and deductibles, and some companies even offer a choice of plans each year. These plans are almost always a very “one-size-fits-all” approach, much the same as if the company said it was going to give every employee a free pair of socks — all of the same size! Who would do such a preposterous thing, you ask? Answer: almost every company in the US with more than 50 employees!

Welfare benefit plans (WBPs) as defined by ERISA, however, let a private employer create extra health benefits that are tailored to specific people or conditions, and these can be provided in addition to the company’s traditional health insurance benefit plans.  Moreover, ERISA allows an employer to determine who gets this benefit, what it is they actually get, and how it is given and paid for.

For example, in addition to a major medical plan, an employer can provide any or all of the following WBPs:

• A plan for employees or beneficiaries who have been diagnosed with depression, anxiety, or other mental health disorders. This WBP can cover all visits to the psychiatrist and counselor at 100% without deductibles or copayments, along with all generic medications.
• A plan for employees or beneficiaries with the diagnoses of diabetes and high blood pressure. This WBP covers all visits to the doctor at 100% without deductibles or copayments when the purpose is addressing these diagnoses. Under this plan, insulin and all generic medications can be covered at 100% without deductibles or copayments.
• A plan establishing an onsite clinic for all employees, regardless of whether they are on the company’s health benefit plan or not, where all visits can be free and may be done ‘on the clock’ (that is, without the need for the employee to ‘clock out’ of work hours). Onsite visit-related generic medications can be free as well.[1]
• Each WBP can have a designated ‘Nurse-Health Coach’ who is available onsite in person at certain intervals and available by phone at other times. These Nurse-Health Coaches are the ‘go-to’ people for these WBP participants and a key operational component to decreasing the cost of care, triaging those with acute needs, and coaching them regarding relevant lifestyle changes.

WHY THIS WORKS

Insurance companies generally price coverage for employers on a year-to-year basis, which means that the insurer builds in its risk of loss to both known and unknown health conditions. This is why, for example, dental insurance benefits punish insureds that have to have a crown replaced with a bridge within 5 years of the placement of the crown. The insurer would rather have paid for a bridge that creates a risk of bone loss and damages two healthy teeth instead of trying (albeit unsuccessfully) to save a damaged tooth before resorting to a bridge. This kind of pricing and payment strategy makes no sense to most employers, because the average tenure for employed professionals is five years, with 23 percent of professional workers having tenure greater than 10 years.[2] Indeed, one of the authors notes in a prior article[3] that, with this information, it might be better for an employer to pay for LASIK (at an average cost of $2500) rather than years and years of eyeglasses (at an average cost of $200 per year) because the total cost to the employer over time might well be less.

Similarly, delivering more care up front — as these models suggest — would in many cases save the employer money over time for long-term employees. It has been known for decades (at least) that the administration of a six-month course of beta blockers (available as a generic at low cost) following an acute heart attack lowers the rather substantial likelihood of a typical second heart attack occurring within the next 12 months and its attendant costs.[4] Recent studies[5] show that the use of statins combined with cardiac rehabilitation also proves cost-effective over the lifespan of the patient, and perhaps even a shorter period of time. However, insurers looking only at a yearly expense might not choose to pay for therapy that only has benefits to the patient over a multi-year period, whereas an employer who knows he will have that employee as an insured for several years, if not decades, might want to make that early expense in order to save overall dollars.

Additionally, early and persistent intervention in diabetes care and chronic obesity can prevent increases in care costs and progression of disease that could lead to short-term disability, long-term disability, and perhaps death. Such intervention can be in-person with or without the addition of drug therapy, but such interventions are a long-term commitment to decreasing long-term costs of care.[6] The attendant weight loss from such therapy also can improve cardiac health as well as reduce stress on the musculoskeletal system caused by excess weight.

Finally, for many employees with diabetes, for example, the dual barriers of high cost and inconvenient care result in poor care and poor outcomes, incurring average health care spending of $16,572 to remediate these issues.[7] With the right kind of WBP, many employers could see a drop in Year 1 costs of care for their diabetic employees. It is also not uncommon to see reductions in emergency department costs from 35% of the care spend on these employees to the single digits.

Only a payor that knows it has “bought” the risk of an insured for a longer period of time would engage in these strategies; however, most employers on the short-term financial advice of their insurers don’t do these things. The result? Less long-term improvement in employee health and higher overall health care costs to the employer.

GETTING PROVIDER BUY-IN

To be honest, the average health care provider doesn’t have any interest in lowering the health care costs its customers pay unless there is something in it for them. The alternative WBPs listed here offer the employer and a narrow network of providers the opportunity to share the rewards of a successful health care payment strategy. For example, Wake Forest Baptist Health as an integrated service provider (meaning a health care provider that owns and controls hospitals and ambulatory surgery centers and employs physicians) can offer a direct contract to self-insured employers in its service area, using only its owned and controlled resources, that could include an agreement to share any savings that these WBPs achieve each plan year with the employers. Because of the pre-emption of certain state insurance laws afforded by ERISA, such plans cannot be characterized as insurance under North Carolina law, thereby removing the necessity that an insurer (with its cost structure) be involved in the plan’s administration. In summary, a well-articulated strategic deployment of WBPs with select employers can provide a health system with steady cash flows, upside gain, and highly satisfied physicians who are not compensated by the “volume wheel.”

WHAT ARE THE POTENTIAL DOWNSIDES?

Most employers will not have the internal capacity to monitor and administer these programs and will therefore rely on their third-party administrators (TPAs) to do it for them. However, if the TPA is a subsidiary or affiliate of a major health insurer, it will be virtually impossible to get the TPA to agree to load these providers as in network and administer their claims, especially if the narrow networks compete with their other in-network providers. This is one of the dirty little secrets of health care insurers: even though ERISA permits the self-insured employer to direct the makeup of network providers, insurer-based TPAs rebel at this because it breaks the leverage that the insurer has to exclude providers who do not agree to their (usually very low) payment rates from the networks of self-insured employer plans.

One other important point needs to be mentioned and that is the other big federal law controlling employer health plans: the Consolidated Omnibus Budget Reconciliation Act of 1986, known to every human resources professional as simply COBRA. COBRA is what requires employers with 20 or more employees to allow former employees to extend their health care benefits post-employment. That means that, even though the employer has lost the potential future savings these WBPs offer, it must continue to allow former employees (and others qualified under COBRA) to continue to access these benefits.

CONCLUSION

As with many great ideas that can transform modern industry, nothing in this article is really new, as the laws have been on the books for decades and the evidence of what we’re advocating has been around for many years. However, employers find it easier simply to follow their broker’s advice and pay an insurance company or an insurer-controlled TPA to make decisions about the health and wellbeing of the employer’s most valuable resource, chalking up the ever-increasing cost of care as an expense of doing business. Employers owe it to themselves to explore every avenue to increase worker health and productivity and decrease costs. Happily, the strategies suggested here can in many cases do both. If you’d like to explore these ideas for your company, or begin a direct-to-employer offering as a healthcare provider, let us know.

Barry S. Herrin, JD, FAHIMA, FACHE, is the founder of Herrin Health Law, P.C., in Atlanta, Ga. Herrin offers more than 30 years of experience practicing law in the areas of healthcare and hospital law and policy, privacy law and health information management, among other healthcare-specific practice areas. He is a Fellow of the American College of Healthcare Executives and a Fellow of the American Health Information Management Association. He also holds a Certificate in Cyber Security from the Georgia Institute of Technology. Reach him at 404-459-2526 or barry.herrin@herrinhealthlaw.com.   

ENDNOTES

Dr. Satterwhite is admitted to the Bar of North Carolina and is Chief Wellness Officer of Wake Forest Baptist Medical Center. Mr. Herrin is also admitted to the Bar of North Carolina and is outside counsel to Wake Forest Baptist Medical Center. © 2020 William Satterwhite and Herrin Health Law, P.C. All rights reserved.

[1] This might not be truly a welfare benefit plan in the ERISA sense but another nonmonetary benefit of employment. The distinction, although at first seemingly unimportant, affects how the employee’s health information is used and disclosed under HIPAA. Additionally, such benefits cannot, for example, be extended to dependents of employees under the employer’s health plans.

[2] U.S. Bureau of Labor Statistics. (2018, Sept. 20). Employee Tenure Summary. Retrieved from https://www.bls.gov/news.release/tenure.nr0.htm

[3] https://herrinhealthlaw.com/disrupting-the-talk-about-disruption/

[4] https://herrinhealthlaw.com/wp-content/uploads/2018/12/AHLA-2004-Feb-Herrin-Health-Law-Analysis-Pay-Performance.pdf

[5] https://heart.bmj.com/content/104/17/1403

[6] https://care.diabetesjournals.org/content/39/Supplement_1/S47

[7] https://www.diabetes.org/resources/statistics/cost-diabetes#:~:text=People%20with%20diagnosed%20diabetes%20incur,in%20the%20absence%20of%20diab

The overbroad and ubiquitous use of the term “disruption” in the technology context, particularly with reference to computer data privacy and security, may backfire among certain audiences. Here’s how to not lose your credibility.

As published in the ISSA Journal August 2020, volume 18, issue 8, pages 23 to 25. ISSA is the Information Systems Security Association International.

For the entire article, please click this link for the printer-friendly PDF.

Barry S. Herrin, JD, FAHIMA, FACHE, is the founder of Herrin Health Law, P.C., in Atlanta, Ga. Herrin offers more than 30 years of experience practicing law in the areas of healthcare and hospital law and policy, privacy law and health information management, among other healthcare-specific practice areas. He is a Fellow of the American College of Healthcare Executives and a Fellow of the American Health Information Management Association. He also holds a Certificate in Cyber Security from the Georgia Institute of Technology. Reach him at 404-459-2526 or barry.herrin@herrinhealthlaw.com.

Printer-friendly PDF

By DRI Cybersecurity and Data Privacy Committee and the DRI Center for Law and Public Policy

Authors:
Stephen E. Reynolds, Ice Miller LLP
Barry S. Herrin, Herrin Health Law, PC
Leon Ravenna, KAR Global
Laura C. Fey, Esq., Fey LLC

We hope that all of you are feeling well and staying safe. Recognizing that many of you and your colleagues are confronting significant information security and data privacy challenges right now, the DRI Cybersecurity and Data Privacy Committee and the DRI Center for Law and Public Policy have teamed up to prepare and provide you with DRI’s Top 12 Information Security Recommendations for Law Firms and Other Businesses Operating in a Quarantined World.

1. Use a Virtual Private Network (VPN): Businesses should consider using a VPN to secure remote access to their organization’s systems, documents, and contacts. If a business does not have remote VPN available, remote workers should be encouraged to assess their home network security and consider changing the password to their home internet routers.

2. Advise Employees to Confirm Home Routers are Updated: Businesses should advise all employees working remotely to update their home routers to the current revision.

3. Install Multi-Factor Authentication (MFA): Businesses should consider utilizing MFA, which creates an additional authentication step on top of inputting a password, adding an extra level of security to network login or email credentials.

4. Use Antivirus Software: Businesses should require antivirus software on any computer accessing your infrastructure.

5. Monitor Online Behavior and Consider Disabling Certain Access: Businesses should enable online auditing software to make sure employees aren’t navigating around the Internet unsafely. Consider disabling access to personal emails and Facebook from business supplied technology. Consider limiting remote access to ‘trusted’ devices. Consider enabling ‘lock, wipe, kill’ technology for personal devices connecting to business platforms.

6. Beware of Phishing Emails: Businesses should circulate regular reminders to remote workers to stay vigilant for phishing emails and working with their information technology team to enhance their spam and phishing filters.

7. Disable Virtual Assistants: Employees should be required to turn off Alexa and other virtual assistants while any work-related information is being discussed — they are always listening.

8. Securely Store and Transmit Confidential Electronic Information: Where appropriate, businesses should consider acquiring secure cloud storage and requiring remote workers to store all confidential information on the cloud where only authorized employees are permitted access, rather than on their local machines. Remote workers should encrypt documents and email communications that contain confidential information. Alternatively, if possible, consider disabling saving to remote terminals and drives and disabling USB ports to prevent use of portable drives.

9. Securely Store and Share Physical Copies of Confidential Information: Remote workers should be reminded not to leave confidential information out in the open and to store such documents in a secure location. Maintain a ‘clean desk’ policy for work at home. Any sharing of physical copies of confidential information should be handled in a secure manner. Documents with confidential information should be shredded when no longer needed. Consider disabling remote printing or printing to other than networked printers.

10. Install Home Firewall: If possible, executives and other employees should set up a home firewall for an extra level of security.

11. Securely Take Confidential Phone Calls: When conducting phone conversations, especially where confidential information will be shared or discussed, remote workers should take such calls in a private room away from other persons.

12. Remember Physical Security: Remote workers should always lock their devices (whether a computer or mobile device) when unattended. Remote workers should also always lock their doors when leaving their home without their devices, even for a short period of time.