The Federal Trade Commission (FTC) recently released final regulations implementing changes to the Telemarketing Sales Rule (TSR) prompted by the USA PATRIOT Act of 2001. In a welcome switch from last year's proposed regulations [see NN 02/02], telemarketing firms making fundraising solicitations will NOT be subject to a rule that will prohibit sales calls to people who have enrolled on a national "do not call" registry. (As of this writing, the Congress has not appropriated funding necessary to implement the registry, and because of the practical issues involved in the effort, the national registry will not take effect for at least seven months after funds are available.)

Although the amended TSR uses the term "charitable contributions," the regulations broadly define that term as "any donation or gift of money or any other thing of value." In addition, while the proposed rules had explicitly exempted political and religious organizations, the final rules do not. Thus, the new rules do not only cover 501(3) public charities, but professional fundraising on behalf of all types of organizations.

The TSR is intended to protect consumers from unwanted, misleading and coercive telemarketing calls by regulating the content and timing of calls and by prohibiting calls to individuals who have asked not to be called. Promulgated in 1995, the TSR originally covered only calls promoting the sales of goods or services. In 2001, the USA Patriot Act expanded the rule to cover professional telemarketers making solicitations [see NN 01/02].

Even though telemarketers soliciting on behalf of organizations will not be required to consult the national "do not call" registry, the expanded TSR does place new burdens on professional telephone fundraisers. For example, telephone fundraisers must make certain disclosures during calls and maintain lists of persons who have stated that they do not want to be contacted on behalf of particular organizations. The new amendments to the TSR do not affect nonprofit organizations directly: the rules do not apply to nonprofit organizations that conduct in-house fundraising or that rely on volunteer solicitors, nor do they require organizations that hire professional telephone fundraisers to maintain records.

Nonetheless, you should keep in mind the new rules when negotiating any contract for the services of a professional telephone fundraiser, particularly if you change telemarketing vendors. You should also investigate the laws of state in which you conduct fundraising campaigns. Several states have enacted, or are considering, their own "do not call" rules, and New York is even considering establishing do not mail and do not email lists.

For more information on the Telemarketing Sales Rule, see the FTC web site at http://www.ftc.gov/bcp/conline/pubs/buspubs/calling.htm.

By Amy Licht

District of Columbia Real Property Tax Exemption: Round 2 (and Round 3)

We recently reported on the court case Cato Institute v. District of Columbia, in which the Washington think-tank prevailed against the DC government after the Office of Tax and Revenue (OTR) denied the organization's real property tax exemption application [see NN 10/02]. At the end of that article, we suggested that it was unclear whether Cato Institute would have any effect on how DC grants the real property tax exemption.

The DC government quickly revealed its position by filing an appeal seeking to overturn the court decision granting Cato Institute's tax exemption. The case is still in its early stages before the District of Columbia Court of Appeals, and a resolution is not expected for some months.

In addition, the OTR has amended the regulations governing the real property tax exemption to narrow eligibility. Under these regulations, the definition of a "public charity" that can receive a real property tax exemption includes only organizations "which provide[] benevolent services to the public that otherwise would be provided by the District of Columbia or the United States of America."

This new position could hurt charities which are currently exempt as well as new applicants. Many public charities that do not provide "benevolent" services to the public that are traditionally considered government functions undoubtedly hold DC real property tax exemptions. If the OTR intends to strictly enforce its new regulations, it could re-examine the eligibility of currently exempt organizations as early as April 1, 2003 when it receives the next round of exempt-property use reports.

The new regulations look vulnerable to a court challenge on more than one ground; however, at least for the near future, the DC government appears intent on greatly restricting the availability of the real property tax exemption to charities.

By Paul J. Tanis





HIPAA Deadline Less Than a Month Away: What Your Organization May Need to Do If It Administers a Health Plan

If your organization has an employer-sponsored health plan and is directly involved in its administration, it may need to comply by April 14 with a privacy rule established under the Health Insurance Portability and Accountability Act (HIPAA).

The privacy rule is one of three sets of regulations published by the US Department of Health and Human Services to implement HIPAA. Essentially these efforts require healthcare providers, clearinghouses and health plans to implement safeguards aimed at protecting personal health information and reducing health care costs.

It's not too late for employers to review their health plan arrangements and determine whether they are subject to HIPAA and its regulations and to implement any necessary privacy changes within the next month.

Is Your Health Plan a "Covered Entity?"

Technically health plans, not employers, are subject to HIPAA and its rules. But health plans cannot operate by themselves, and frequently, where employers act as plan administrators, HIPAA indirectly regulates those employers' activities.

HIPAA includes in its definition of "health plan" those self-administered health plans, such as health flexible spending accounts administered by the employer, with 50 or more participants. HIPAA also includes in its definition those health plans of any size that are administered by an entity other than the employer who established and maintains the plan. Examples of the latter would be a group health plan run through a health insurance company or a health flexible spending account administered by a third party.

Plans that provide only "excepted benefits," such as workers' compensation or coverage for accident or disability income insurance, are not health plans under HIPAA. Whether an Employee Assistance Plan (EAP) is subject to HIPAA rules depends on what it provides to the employees. It is subject to HIPPA rules if it provides mental health counseling and substance abuse services. It is not subject to HIPAA rules if it only refers employees to providers.

What are Your Organization's Obligations?

If your organization provides group health insurance to its employees, you probably have a health plan that is subject to HIPAA. However, if your organization's role is limited to contracting with a health insurance company to provide health insurance, you will be able to rely on the insurance company to satisfy the health plan's HIPAA obligations.

That is because employers in your organization's situation will not be creating or receiving personal health information (PHI). Merely gathering enrollment information, for example, is not receiving PHI and therefore is not enough to impose HIPAA obligations on these organizations.

However, those organizations with self-funded plans with 50 or more participants or that are more than mere sponsors of a group health plan must comply with the privacy rules. An organization is merely a sponsor of a health plan, if it, for example, only establishes, amends and terminates plans, performs enrollment activities or obtains insurance bids.

By comparison, a plan administrator is involved in operations of the health plan including plan management, claims processing or payment. Generally, the more involved the employer is in the actual administration of the plan, the more obligations it will have under HIPAA. Organizations should seek legal advice if they have any questions regarding whether they are plan sponsors or are plan administrators.

What Needs to be Done by April 14?

Once an organization determines it is obligated to comply with HIPAA rules because of the nature and operation of its health plan, the next step is for the organization to take the following steps before April 14, 2003, or if it is a small health plan (one with annual receipts of $5 million per year or less), by April 14, 2004:

Notify plan participants of privacy practices: Under HIPAA's privacy rule, individuals enrolled in the covered health plan must receive a "Notice of Privacy Practices" by the relevant April 14 deadline.

Among the required provisions, the notice must describe how the employee's personal health information (PHI) may be used and when it may be disclosed. The notice also must describe the employee's rights regarding their PHI. Health care plans are not required to ask the employees to acknowledge receipt of the notice. To make the notice easier to understand, HHS suggests attaching to it a brief summary of the provisions.

Establish procedures and implement training: Operational and physical boundaries must be established based on the organization's role as employer, plan sponsor and plan administrator. This may entail establishing new policies, procedures and safeguards, and training employees as to their roles and responsibilities under HIPAA. These procedures may include methods for investigating complaints. The organization also should document its compliance with HIPAA and the outcome of related actions.

An organization with a covered self-funded plan also will need to consider amending its plan documents to incorporate provisions required by the privacy rules. Each covered plan must, for example, describe how the plan may use or disclose PHI not inconsistent with the privacy rules, and require the plan sponsor to identify specific categories of employees who may have access to PHI and restrict access to those categories.

Differentiate between employment records and personnel health information: While the privacy rule does not explicitly define "employment records," an organization's employment records are not considered personnel health information (PHI). For example, the employee's medical record is PHI if the employer receives it while instituting a covered health care plan. By comparison, that same record, or a doctor's statement, given to the employee's supervisor to explain her reason for being absent from work does not need to be treated as PHI. It relates to an employment issue.

Other health information also is considered employment related rather than PHI. For example, an employee may give her employer medical information needed for the organization to carry out its obligations under the Family Medical Leave Act or Americans with Disabilities Act. She may also provide her employer with medical information related to an injury on the job, results from a drug screening or eligibility for disability insurance.

Review arrangements with others: Employers need to review their contracts and other arrangements with business associates to make sure that those associates protect personal health information to the same extent required by the employer group health plan. Business associates range from consultants to auditors to third party administrators; they are any person or entity that performs a service on behalf of the group health plan that involves personal health information. These contracts and arrangements may need to be modified to protect this information.

These are only a few of the issues that arise under the HIPAA privacy rule. Organizations should seek legal advice for more specific questions regarding whether their health plans are subject to HIPAA and how best to implement all aspects of the privacy rule.

Also keep in mind that the privacy rule establishes a national standard for protecting personal health information, but it does not supercede more stringent applicable state laws that better protect such information. Organizations should review state requirements to make sure they are in compliance with these provisions as well.

A covered health plan's responsibilities do not end on April 14. Employees should receive periodic training, and policies, procedures and safeguards should be reviewed on an on-going basis to make sure the HIPAA regulations are being implemented correctly. Organizations should take the time now to also review whether they must comply with the other two HIPAA rules that focus on Electronic Information and Security.

By Ann Peters






This publication is designed to provide accurate and authoritative information about the subject matter covered. It is not distributed with the intent to render legal, accounting, or other professional advice. The services of a competent professional should be sought if legal advice or other expert assistance is required.

Newsletter Home | HarmonCurran Home