Coronavirus (COVID-19) Resource Center
Information for our clients and partners
Here at McGriff, nothing is more important to us than the health and safety of our clients, partners and teammates. As COVID-19 continues to impact the world around us, we're committed to providing the guidance our clients and partners need from us during this unprecedented time. To that end, we've pulled together the resources featured on this page to help our clients, their businesses, and their employees navigate through this pandemic and approach the future with confidence.
This page is updated frequently, so please check back often for the latest information.
A message from McGriff's President and CEO on the coronavirus
Current situation in the United States
On March 11, 2020, the World Health Organization declared the rapidly spreading coronavirus a pandemic. A pandemic is a worldwide outbreak of a new virus that infects people easily and spreads in an efficient and sustained way. With a growing number of infections on almost every continent, the World Health Organization announced the outbreak has reached the “highest level” of risk for the world.
The exposure risk may be higher for some travelers and workers in certain industries, including:
- Death care
- Airline operations
- Border protection
- Solid waste and wastewater management
- Travelers to areas where the virus is spreading
The U.S. Department of Labor’s Occupational Safety and Health Administration (OSHA) published “Guidance on Preparing Workplaces for COVID-19”(opens in a new tab) to help companies respond in the event of coronavirus in the workplace. The document was developed in collaboration with the U.S. Department of Health & Human Services (HHS). This guidance provides practical guidance for preventing the spread of COVID-19 (also known as novel coronavirus) and includes information on safe work practices and appropriate personal protective equipment based on the risk level of exposure. In addition to this guidance, OSHA recently launched a COVID-19 webpage(opens in a new tab).
Planning and response for employers
Many businesses and organizations have been working to minimize the spread of the virus by limiting non-essential travel and practicing social distance. Per the CDC, coordination with state(opens in a new tab) and local(opens in a new tab) health officials is strongly encouraged for all businesses so that timely and accurate information can guide appropriate responses in each location where their operations reside. Since the intensity of an outbreak may differ according to geographic location, local health officials will issue guidance specific to their communities.
The CDC has developed guidance for employers which includes recommended strategies for the COVID-19 outbreak. Employers need to consider how best to decrease the spread of acute respiratory illness and lower the impact of COVID-19 in their workplace in the event of an outbreak in the U.S., the CDC said. Employers should identify and communicate their objectives, which may include one or more of the following:
- Reducing transmission among staff
- Protecting people who are at higher risk for adverse health complications
- Maintaining business operations
- Minimizing adverse effects on other entities in their supply chains
This information, along with recommendations for an Infectious Disease Outbreak Response Plan, can be found on the CDC website(opens in a new tab).
The CDC also has prepared free communication resources(opens in a new tab), including videos, fact sheets, and posters.
For information on Human Resources and Leave policies, HIPAA and Protected Health Information, consult with your Employee Benefits Broker or employment practices attorney.
Now that COVID-19 has been declared a pandemic, all businesses, health care systems and schools should execute their pandemic preparedness plans.
The following governmental templates and resources are available to assist organizations in developing their pandemic plan:
- FEMA's Pandemic Influenza Template(opens in a new tab)
- WHO Checklist for Influenza Pandemic Preparedness Planning (PDF)(opens in a new tab)
- CDC National Pandemic Influenza Plans(opens in a new tab)
- OSHA Guidance on Preparing Workplaces for an Influenza Pandemic(opens in a new tab)
- Missouri Department of Health and Senior Services: Pandemic Influenza Business Planning Toolkit (PDF)(opens in a new tab)
The nature and magnitude of claims related to COVID-19 and the financial impact are not yet known. In most scenarios, businesses would be challenged to find coverage for losses stemming from this pandemic; however, with ever-changing legislative landscape, coverage could be afforded under some policies. Below is a summary of key insurance coverages and how they would typically respond.
Many clients have inquired about potential Workers’ Compensation claims arising from employees contracting COVID-19 during the course of their employment. As with any communicable disease, the answer is not black and white. Circumstances regarding any alleged workplace exposure would need to be investigated.
As with any ordinary virus, if it’s a condition that the general public is equally exposed to, the workers’ compensation policy would likely NOT apply. However, if the employee could prove that their job put them at greater risk than the general public of contracting the virus, some jurisdictions may grant coverage. Employers who have conducted their hazard risk assessment will be better prepared and have a better understanding of their true workplace risk of exposure.
Property Business Income
Typically, in order for a Property policy to provide coverage, there must be “direct physical loss or damage” to covered property from a covered peril. That is, the property must be demonstrably altered in some fashion. A disease, virus, or threat generally does not constitute direct physical loss. However, in the absence of a specific exclusion related to virus or communicable disease, some jurisdictions may hold that the actual, proven presence of virus can be sufficient to trigger coverage. Individual policies, locations, and situations vary, so it is important to discuss this with your broker and/or claims person.
Likewise, for Business Income coverage to trigger, there typically must be “direct physical loss or damage” to covered property from a covered peril. So, as with a Property claim, the best chance for finding coverage is with the proven presence of virus in or on a property.
In these days of government-imposed shutdowns and quarantines, many businesses are facing lost revenues from simply not being able to operate, or operating at a reduced capacity. There is no virus present at their property or even at a neighboring or supplier property; they’re simply not able to operate to due imposed restrictions or lack of business. Many policies contain a coverage grant for Civil Authority, but this grant of coverage typically requires the shutdown to be the result of a covered peril. The threat of virus in the community, unfortunately, is not a covered peril, so there is little to no coverage to the typical business offered by these coverage grants. Again, consult your broker and/or claims person for specific advice relative to your individual case.
Commercial General Liability
Standard Commercial General Liability policies do not contain exclusionary language related to virus or communicable disease. Accordingly, these policies should typically respond in a situation where an individual alleges they were infected with the coronavirus while on the insured’s property or if they were sold a product that caused infection. The burden of proof would be with the injured party to prove causation and associated damages, but the policy would provide defense cost coverage in the process.
Environmental policies vary greatly by insurers and the type of risk being covered. Some may contain specific grants, outright exclusions, or remain silent related to communicable diseases and viruses. Most environmental policies contain some degree of coverage for both third parties (clients, customers, visitors) as well as first party (the insured). These policies can potentially respond to some degree of cleanup, legal expenses, decontamination, bodily injury, property damage, or business interruption. Your broker and/or claims person can help you navigate this coverage and the claims process.
Directors and Officers
Directors and Officers policies may provide coverage for the costs and liabilities arising from shareholder lawsuits alleging that the company failed to act reasonably and plan appropriately in response to the coronavirus. Examples of this may include a failure to create adequate supply chains or failing to reveal financial risks that would result in financial loss to the organization.
Employment Practices liability policies may respond if claims are submitted as a result of sick leave and other human resource-related policies associated with the company’s coronavirus response plan.
COVID-19 causes respiratory illness and seems to be spreading much like flu from person to person. This virus was first identified during an investigation into an outbreak in Wuhan, China.
For confirmed coronavirus infections, the impact has ranged from minor illnesses with little to no symptoms to severe illnesses and even death. Common signs of infection include respiratory symptoms, fever, cough, shortness of breath and breathing difficulties. In more severe cases, infection can cause pneumonia, severe acute respiratory syndrome, kidney failure and death.
There is currently no vaccine for the COVID-19 virus. The best way to prevent infection is to avoid exposure. As a reminder, the CDC always recommends everyday preventive actions to help stop the spread of all respiratory viruses:
- Wash your hands often with soap and water for at least 20 seconds. If soap and water are not available, use an alcohol-based hand sanitizer.
- Avoid touching your eyes, nose and mouth with unwashed hands.
- Avoid close contact with people who are sick.
- Stay home when you are sick.
- Use a tissue to cover your cough or sneeze, and then throw the tissue in the trash.
- Clean and disinfect frequently touched objects and surfaces.
Currently there is no specific antiviral treatment recommended for COVID-2019. People infected should receive supportive care to help relieve symptoms. For severe cases, treatment should include care to support vital organ functions. People who think they may have been exposed should contact their health care provider immediately.
Coronavirus Advisory Series webinars
COVID-19: Managing Risks in the Workplace
JOHN MOORE: Hi, this is John Moore.
SONYA CONNOR: And Sonya Connor.
JOHN MOORE: And we want to welcome you to Mcgriff Risk Solutions presentation regarding the novel coronavirus. This coronavirus, or COVID-19, has reached pandemic proportions around the world and is forcing all responsible businesses to plan and prepare to reduce the impact of the outbreak.
We're glad that you joined us today to explore the control measures that you, the employer, can implement based on specific occupational exposures for practical guidance for managing an outbreak in the workplace. In this presentation, we will discuss an overview of the key facts related to COVID-19 along with information about how it's spreading, the occupational risk associated with OSHA's risk exposure levels, various risk reduction strategies, COVID-19 controls for the workplace, crisis management planning that organizations should be undertaking, and finally, what to do if you have an employee who is exposed.
SONYA CONNOR: Let's begin with a few facts about COVID-19. It's called by a new respiratory virus named SARS-CoV-2, which causes coronavirus disease 2019, known as COVID-19. Illnesses range from very mild to severe, including illnesses resulting in death. We do know that older people and people of all ages with severe underlying health conditions seem to be higher risk of developing serious COVID-19 illnesses. Children, however, do not seem to be at higher risk than the general population.
The main symptoms include fever, cough, and shortness of breath. Though there is currently no vaccine or approved medications to treat COVID-19, there is, however, a vaccine in the clinical trial phases. Communities that are affected are recommended to stay current through state and local departments of health regarding current strategies such as screening and managing exposures.
On March 11, the World Health Organization declared COVID-19 to be a pandemic, as it is able to infect people easily and spread from person to person globally in an efficient and sustained way. On March 16, President Trump recommends no gatherings of 10 or more people, and the CDC also recommended that organizers cancel or postpone in-person events that consist of 50 people or more throughout the US. While these restrictions have been implemented at a national level, many regions have their own unique restrictions pursuant to local outbreaks and/or exposures.
Most of you have heard how it spreads. But to review, it's mainly by way of person-to-person spread. Which means when people were within 3 to 6 feet from one another and the infected person coughs or sneezes, expelling respiratory droplets that could land in the mouth, nose, or be inhaled by others nearby. There have been rare cases of people spreading the virus prior to showing symptoms, but people are felt to be most contagious when they are showing the most symptoms, such as having a fever or cough. This is why it's crucial for sick people to stay home.
Another way it's spreading is from contact with contaminated surfaces or objects. It may be possible that a person can get COVID-19 by touching a surface or object that has the virus on it and then touching their own mouth, nose, or possibly their eyes. But it is not thought to be the main way the virus spreads. This virus is spreading easily, and evidence suggests that SARS-CoV-2 can remain alive for hours, up to three days, on surfaces made from a variety of materials.
As you can see on the slide, OSHA has broken workers risk exposure categories down into four levels of risk—very high, high, medium, and low. Much of this is based on industry type, need for close contact of people who are known or suspected to be infected with SARS-CoV-2 or are required to have repeated or extended contact with those persons. We will discuss each level. So let's start with the very high risk level.
The very high risk level are those workers who are working directly with and performing aerosol-generating procedures on patients. This would be procedures such as intubation, cough induction procedures, and some dental procedures. Examples of workers in this category are doctors, nurses, dentists, paramedic, respiratory therapists, and medical examiners. The high risk workers are very similar to those in the previous list, in that they work with persons with known or suspected COVID-19. But due to the circumstances of their job, they're not required to perform any procedures that would generate an increase in respiratory droplets or exposure to respiratory secretions from real or potentially infected persons. Examples of workers in this category our health care support staff, medical transport staff, phlebotomists, and mortuary workers.
As we move into the medium exposure risk jobs, you will see that these are workers that their job requires a great deal of close public contact, which could contain individuals that may be infected with SARS-CoV-2. Workers in this category can range from workers in airports who come in contact with travelers who are returning from locations with widespread COVID-19 transmission to workers who use public transportation.
Lower exposure risk jobs are those where the worker has minimal occupational contact with the public and other co-workers. When they are in contact with others, they can typically stay within six feet or further from co-workers and/or the public. Most American workers will likely fall in the lower exposure risk to medium exposure risk levels. For today's purposes, we will discuss the exposure reduction in those lower categories, as well as strategies all employers can implement to reduce occupational exposure to SARS-CoV-2. Guidance for higher risk categories continues to change rapidly, and is also based on the transmission rates occurring in each community. If you have workers who would be considered high to very high risk, please stay current with the CDC recommendations as well as your state and local health departments.
So now, let's discuss some key strategies every employer can take to reduce the risk of workplace exposures to SARS-CoV-2. First, develop and update your infectious disease preparedness and response plan. Basically, this is your pandemic plan. This involves planning, preparing your workplace for crisis due to the impact of the spread of COVID-19 in your community. John will go into greater detail on this plan later in the presentation.
Another key strategy is to implement basic infection control prevention measures. This probably isn't new to your organization, but can serve as a reminder to reinforce your current protocol. Key practices would include enforced thorough handwashing-- provide soap and running water. If this isn't immediately available, provide alcohol-based hand rubs containing at least 60% alcohol. Remind workers to stay home if they're sick.
Educate and remind workers to use respiratory etiquette by covering coughs and sneezes with a tissue or coughing into their elbow, provide your customers and the public with tissues and trash receptacles, discourage workers from using other workers phones, desks, offices, and other work tools and equipment if possible. Maintain regular housekeeping practices, including routine cleaning and disinfecting of surfaces, equipment, and other elements of the work environment. Pay close attention to frequently touched surfaces, such as door handles, elevator buttons, sink handles, entry key pads, office equipment, and other surfaces multiple workers would touch on a daily basis.
A key reminder here is to also educate your employees that if they wash their hands following contact with a high touch surface, they will likely prevent transmission, even if the surface was contaminated with SARS-CoV-2. The CDC, along with the EPA, provides several resources on appropriate cleaning and disinfecting techniques along with approved products that kill SARS-CoV-2 when used per manufacturer's instructions.
The CDC and the World Health Organization have downloadable posters and training videos to help educate workers, keep these measures in the forefront of everyone's mind. Strategy number three is develop policies and procedures for prompt identification and isolation of sick workers. This is a critical step in protecting workers, customers, visitors, and others within your organization.
It's imperative to educate your employees on signs and symptoms to self monitor if they suspect they have been exposed. If you identify workers with the signs and symptoms of COVID-19, isolate them and then send them home as soon as possible. Please contact your local health department for instructions on next steps. State and local health departments are best positioned to make such decisions within their jurisdiction based on the local situation.
Next, develop and implement and communicate about workplace flexibilities and protections. It's important to be aware of workers' concerns about pay, leave, safety, and health, and other issues that may arise during an infectious outbreak. Communicate with workers on any of your policy changes, what your organization is doing to prepare, how you're protecting them, and general education about workplace control. Please access our on-demand webinar, Employee Benefit Considerations in our Mcgriff Corona Advisory Series for more information on human resources and employee benefit policy and procedures.
The fifth strategy is implementation of workplace controls. During the COVID-19 outbreak, it may be impossible to eliminate the hazards. The most effective protection measures are implementing engineering controls, administrative controls, and providing personal protective equipment. OSHA has outlined examples of each of these controls in their recently published 2020 guidance on preparing workforces for COVID 19. We will discuss options of specific controls for workers who fall in the medium and low risk categories, as well as general SARS-CoV-2 exposure prevention in just a moment.
The final strategy is to follow the existing OSHA standards. These are the standards that most organizations already have procedures in place to manage, such as OSHA's personal protective equipment, respiratory protection, and bloodborne pathogen standards. Keep in mind-- OSHA's general duty calls requires employers to furnish each worker with a place of employment, which is free from recognized hazards that are causing or are likely to cause death or serious physical harm.
Now, let's discuss the workplace controls that all employers should consider. Routinely monitor public health communications about COVID-19 recommendations, and ensure that information is communicated to your workers. Frequently check the CDC's COVID-19 website. Encourage sick workers to stay home. Minimize contact among workers, clients, and customers by replacing face-to-face meetings with virtual communications and implementing telework if feasible.
Establishing alternating days or extra shifts that reduce the total number of employees in a facility at a given time, which allows them to maintain distance from one another while maintaining a full on-site workweek. Discontinue any non-essential travel to locations with ongoing COVID-19 outbreaks. Don't necessarily rely on the CDC for travel information when you are sending employees to other countries or regions in the US. Go to the public health department websites for those areas to review their travel advisories.
Develop a way to communicate with your employees and customers to force out messages, as well as answer questions. Internet-based communications and applications are great ways to accomplish this. But remember to collaborate with your workers to identify the most effective way that works for them. Provide personal protective equipment, or PPE, and train workers on which tasks should require use of PPE, how to put it on, and how to take it off correctly.
Training materials should be easy to understand and available in appropriate language and literacy levels for all workers. Examples of PPE would include gloves, goggles, face shields, face mask, and respiratory protection when appropriate. These will be primarily used for those workers who fall in the medium to very high categories.
During an outbreak of an infectious disease such as COVID-19, recommendations for PPE specific to occupations or job tasks may change depending on the geographic location. Employers should check the OSHA and CDC websites regularly for updates about recommended PPE. Many of the other controls will be a part of your infection prevention measures that we discussed earlier, such as providing the workers with the up-to-date education and training COVID-19, risk factors, and protective behaviors such as cough etiquette, promoting personal hygiene by providing the tissues, no-touch trash cans, handsoap, alcohol-based hand roads containing at least 60% alcohol, disinfectant, and disposable wipes for workers to clean their work surfaces, requiring regular handwashing for at least 20 seconds or use of alcohol-based hand rubs, and finally, posting handwashing signs and restrooms and other educational posters, available on the CDC website, in high traffic areas in the workplace.
So for the workers who may fall in the medium risk category, some additional workplace controls could be to install physical barriers such as clear glass sneeze guards where feasible. Consider offering face masks to ill employees and customers to contain respiratory secretions until they are able to leave the work site. Where appropriate, limit customers' and public access to your work site, or restrict access to only certain areas.
Consider strategies to minimize face-to-face contact, such as drive-through windows, phone-based communications, and telework. Communicate the availability of medical screening or other health resources to your workers, such as an on-site nurse or telemedicine services. It's important to also note that there's specific guidance available for some high risk industries such as various health care providers and for special populations that typically involve large groups of people in one area, such as schools and churches.
Here's a list from the CDC website. This list continues to grow and change as the pandemic worsens. And many of these have become irrelevant due to cancellations and closings. Now, I'd like to turn it over to John to discuss crisis management planning that organizations should be undertaking, and what to do if you have an employee who is exposed.
JOHN MOORE: Thanks, Sonya. Despite mixed guidance regarding the COVID-19 pandemic from the World Health Organization, CDC, or OSHA, all businesses should remember their duty to protect employees from known hazards at work. Under the Occupational Safety and Health Act, these hazards include infectious diseases which may be contracted in the workplace, like the coronavirus. Organizations should establish, if you haven't already done so, a crisis management plan that outlines the processes the organization will use to respond to the COVID-19 pandemic. The failure to plan may negatively affect the company's profitability, reputation, or ability to operate.
While you likely have already initiated crisis management strategies associated with COVID-19 pandemic, we're going to review some key considerations for the planning process. First, plan for the impact of the pandemic on your business. Identify a pandemic coordinator or team with defined roles and responsibilities for preparedness and response planning. The planning process should include input from labor representatives, as their frontline perspective helps ensure the plan is feasible.
Identify essential employees and other critical contributors required to maintain business operations by location and function during the pandemic. Depending on your business, these may include material suppliers, subcontractor services, and/or logistics. Train and prepare an ancillary workforce, which may include contractors, temporary staffing, employees from other departments or locations, or even retirees.
Develop and plan for scenarios likely to result in an increase or decrease in the demand for your products or services during the pandemic. Consider fluctuations in company financials using multiple possible scenarios that affect different product lines or production sites. Understand that business-related domestic and international travel will be disrupted. Sign up to reliable pandemic information from community public health, emergency management, and other sources, and make sustainable links. The internet is a great resource for your search.
Establish an emergency communications plan, and revise periodically. This plan includes identification of key contacts, including backups, chain of communications, including suppliers and customers, and processes for tracking and communicating business and employee status. Normally, I'd say to practice your plan and revise it periodically, which should absolutely be done. But this plan, depending on your scenario, may need to be acted upon immediately.
Next, plan for the impact of the pandemic on your employees and customers. Allow for employee absences due to the pandemic, due to factors such as personal or family illness, community containment measures and quarantines, or school, business, or public transportation closures. Implement guidelines to modify the frequency and type of face-to-face contact among employees and between employees and customers, such as handshaking, seating in meetings, office layout, and shared workstations.
The Centers for Disease Control has numerous recommendations regarding this issue. Evaluate employee access to and availability of health care services during the pandemic, and seek improved services needed. Also, evaluate employee access to and availability of mental health and social services during the pandemic-- again, including a corporate community and faith-based resources. And again, seek improved services as needed.
The next step is for companies to establish policies to be implemented during the pandemic. Be non-punitive regarding employee compensation and sick leave absences unique to the pandemic. Seek guidance from your local health department. Be open to remote work options, such as telecommuting or working staggered shifts. Promote coronavirus prevention in the worksite regarding the controls Sonya previously mentioned. Establish infection control response and immediate mandatory sick leave policies for employees who have been exposed to COVID-19, are suspected to be ill, or become ill at the workplace.
As previously mentioned restrict travel to affected geographic areas, which at this point could either be domestic or international sites. Evacuate employees working in or near affected areas when an outbreak begins, and provide guidance for employees returning from those infected areas. Set up authorities, triggers, and procedures for activating and terminating the company's response plan, altering the business operations, and transferring business knowledge to key employees.
Next, allocate resources to protect your employees and customers during the pandemic. Provide sufficient and accessible infection control supplies in all business locations. This includes products such as hand sanitizers, tissues, and receptacles for their disposal. Enhance communications and information technology infrastructures as needed to support employee telecommuting and remote customer access. Ensure availability of medical consultation and advice for emergency response. Know who to call, what their number is, and their hours of operation.
Next, companies need to consider how best to communicate to and educate their employees. Develop and distribute programs and materials covering pandemic fundamentals, such as signs and symptoms of the coronavirus and modes of transmission, personal and family protection and prevention strategies, such as the aforementioned hand hygiene, coughing and sneezing etiquette, and contingency plans.
Anticipate employee fear and anxiety, rumors and misinformation, and plan communications accordingly. Ensure that communications are culturally and linguistically appropriate, translating as required and using visuals as much as possible to help relay the message. Disseminate information to employees about your pandemic preparedness and response plan. Let them know you care and you're making the efforts to be ready, if needed.
Provide information for the at-home care of ill employees and family members. Your health insurance provider is a great place to start for that information. Develop platforms, such as hotlines or dedicated websites, for communicating pandemic status and actions to employees, vendors, suppliers, and customers inside and outside of your organization in a consistent and timely way, including redundancies in the emergency contact information.
Identify community sources for timely and accurate pandemic information and resources for obtaining countermeasures. Keep in mind that while continuous news TV channels and internet search engines are great resources for the broad view of the coronavirus outbreak and controls thereof, your local health department and other community resources will inform you of local outbreaks and controls.
Finally, coordinate with external organizations and help your community. Collaborate with insurers, health plans, major local health care facilities, public health agencies, and emergency responders to share your pandemic plan and understand their capabilities and services. When possible, participate in the planning process of public health agencies and emergency responders. Communicate with public health agencies and/or emergency responders about the assets and services your organization could contribute to the community during the pandemic. Share best practices with other businesses in your communities, chamber of commerce, or trade organizations to improve community response efforts.
OK, now that you've planned for the pandemic, let's discuss what happens in the event of a coronavirus infection in your facility. The US Department of Health and Human Services advises the following. First, call your county health department to the location of your organization. Inform them of the outbreak at your facility, provide the names of all persons potentially exposed to the coronavirus, and, once informed, the health department should assist in managing the potential outbreak from there.
Disinfect everything as well as possible. Consider using an environmental cleanup company to help deep clean the affected workspaces. Their workers have been trained on effective disinfection processes and have the appropriate equipment and specialized PPE for the work. If you work in a building shared with other companies, such as an office building or strip mall or other, you should inform the building manager so they can take the necessary precautions they deem appropriate for the situation. This procedure will also apply to scenarios in which an employee informs the employer that they lived with someone or may be in close contact with someone with COVID-19.
Thank you for participating in this presentation about managing COVID-19 risk in the workplace. We hope you have a better understanding of the control measures to take in helping prevent an outbreak and practical guidance for managing an outbreak in the workplace, should it occur. This is John Moore.
SONYA CONNOR: And Sonya Connor.
JOHN MOORE: Reminding you to be safe.
COVID-19: HR and Employee Benefit Challenges
ANNE HENSLEY: Good afternoon, everyone. Welcome to today's webinar, COVID-19, Human Resources and Employee Benefit Issues. My name is Anne Hensley with McGriff Employee Benefits. And I will be one of your three speakers today. Two of my colleagues, Laura Clayman and Christy Showalter will also be joining me on this webinar today as well.
This is one webinar in a series of three in McGriff's Coronavirus Advisory Series. We ask that you tune in to those webinars as well as they will cover issues related to property and casualty insurance topics, among other topics that will not be covered in today's webinar.
Let's start by acknowledging what everyone is well aware of at this point that COVID-19 issues are changing rapidly. This presentation is being recorded on March 19, 2020. Congressional actions, regulatory guidance, and state mandates relating to COVID-19 are in a constant state of flux.
McGriff is committed to bringing you the most up to date and relevant information on this topic. The information contained in this presentation is current as of the date of this recording. So please keep this in mind if you review this material at a later date.
We will continue to supplement this with additional webinars, publications, et cetera as we navigate the evolving landscape that is COVID-19. Our presentations are intended to provide general information. This does not constitute legal text or medical advice. Therefore the material presented today is for information purposes only.
McGriff has all of the in-house resources you need to help you get the most out of your employee benefit program. Our subject matter experts are committed to providing creative solutions to help clients manage overall costs, mitigate risks, and educate and engage employees. As I said earlier, my name is Ann Hensley, joining me today is Laura Clayman and Christy Showalter. They will be speaking a little bit later in our webinar.
Let's go over the agenda for today. We will discuss the evolving status of COVID-19. We will discuss HIPAA and ADA implications, health benefit implications, HDHPs, health savings accounts, telemedicine programs, and employee assistance programs. We will discuss the staffing challenges facing employers right now. We will talk about employee leave protections and benefits. And then we will leave you with additional resources that we think you might find particularly useful during this time.
The new coronavirus disease, COVID-19, is a respiratory disease as everyone knows by now, caused by a novel or new coronavirus that had not been previously identified in humans. It was first detected in China and has now been detected in more than 150 locations internationally, including of course, the United States. The virus causes respiratory illness like the flu with symptoms, such as a cough, fever, and in severe cases, pneumonia.
So taking a look at the timeline here. On January 21st, the first coronavirus case in the US was reported in the state of Washington. The man in his 30s developed symptoms after returning from a trip to the region in China where the outbreak began. On January 29th, the White House announced the formation of a new task force to help monitor and contain the spread of the virus and ensure Americans have accurate and up to date health and travel information.
On January 30th, the US reported its first confirmed case of person-to-person transmission of the coronavirus. On the same day, the World Health Organization determined that the outbreak constitutes a public health emergency of international concern. On February 11th, the World Health Organization named the coronavirus, COVID-19.
On March 11th, the World Health Organization declared COVID-19 outbreak a global pandemic. And on March 13th, President Trump declared a Federal Emergency. We are left with employers who are now trying to navigate these uncharted waters to best protect their employees while continuing to operate their business.
You can see here a state map provided on the CDC website with an overview of reported COVID-19 cases. Most heavily affected states being of course, Washington, California, New York, Florida, and Georgia. This is going to continue to change, obviously, and it will change rapidly. So please continue to check the Centers for Disease Control website regularly for updated information.
Let's move on to HIPAA and ADA implications. Over the past couple of weeks as COVID-19 has progressed and more employees are affected, we have been asked about HIPAA and the Americans with Disabilities Act implications and whether or not those rules still apply during a pandemic or other emergency situation. Both of those are still in full effect.
In fact, we have newly issued communication pieces from the agencies in charge of enforcing these rules with a rather stern reminder that they are in effect and employers should still adhere to the rules. On the next few slides, I will go over some common scenarios and questions we have received that hopefully will provide clarity on what employers may ask and require of employees during this time and what is prohibited by these rules.
As employers are looking to protect their employee populations and prevent the spread of the virus, this is a very common question that we are receiving. Can we administer medical tests or take an employee's temperature as a condition to work? Obviously, employers are wanting to prevent the spread of the virus in their workplace. So they are wanting to control that to the best degree possible. The ADA still applies during a pandemic however. So we are bound by the ADA guidelines.
Generally speaking, the ADA protects employees during employer inquiries into their medical status or employer conducted medical examinations. The ADA covers employers with 15 or more employees, including state and local governments. So in the above question, the taking of the employee's temperature would be considered a medical examination under the ADA.
Generally, this would be prohibited by the ADA unless an employer can show the medical examination is job-related and consistent with business subsidy, or the employer has a reasonable belief that the employee poses a direct threat to the health or safety of the individual or others that cannot otherwise be eliminated or reduced by a reasonable accommodation.
And that last one is really key now in the current climate. Normally without having officially been declared a pandemic, a normal cold or flu wouldn't give rise to the level of direct threat which would allow for a medical exam. That has been confirmed by prior EEOC guidance.
But if the CDC or other health authority like a state or local authority, or other local authority, determines that the pandemic is more severe in nature, then that could be categorized as a direct threat. And a medical exam would be warranted and allowed under the ADA. But we really have to have that CDC guidance or another health authority to justify this.
A word of caution here, this is a fact-specific analysis, it will depend on the employer and specific set of employment circumstances. The EEOC is clear in its position that during the pandemic employers should rely on the latest CDC and state or local public health assessments to determine whether the pandemic rises to the level of direct threat or not.
And again, more caution should be used. And keep in mind that an employee infected with COVID-19 really may or may not display physical symptoms, such as a fever. So temperature checks really might not be that useful in this scenario.
We've talked a lot about what employers cannot do. But we do have some guidance and insight on what can be done under the conditions we are currently experiencing. Employers are permitted to ask about any recent travel and exposure to COVID-19 or contact with others who have recently traveled to at risk countries or been exposed to the virus.
If an employer has a reasonable belief based on an objective evidence that the employee is a threat to others, it can ask the employee to stay home for the 14-day incubation period. Employees may be eligible for some paid and/or job protected leave depending upon state or federal legislation and company policies that might play a part there too. We will talk about the federal and state legislation a little bit later in this presentation.
We do have direct guidance from the EEOC. The EEOC is pandemic preparedness in the workplace and the Americans with Disabilities Act document that is given in the link below. That was issued as a result of the H1N1 pandemic in 2009. And the EEOC has confirmed it is relevant and remains in effect today to help us with the COVID-19 virus. It identifies established 88 principles to answer questions frequently asked about the workplace during a pandemic.
So for the question above, during a pandemic, how much information may we request from employees who call in sick? And can we send them home if they display influenza like symptoms during a pandemic? The answer is yes. After a pandemic has been declared, ADA covered employers have a bit more leeway in such situations. Here's what they actually can do.
Those employees showing signs of respiratory illness can be asked to leave the workplace and stay at home until they are symptom free. ADA covered employers, which we talked about previously, may ask employees if they are experiencing influenza like symptoms. Recall that this guidance was given as a result of the H1N1 influenza pandemic in 2009. So influenza like symptoms such as fever or chills and a copper sore throat, that all translates over to COVID-19. All information must be maintained as a confidential medical record.
If an employee becomes ill with symptoms of influenza like illness at work during a pandemic, the CDC states that the employee should leave the workplace. Advising workers to go home is not a disability related action if the illness is akin to a seasonal influenza. Additionally, the action would be permitted under the ADA if the illness were serious enough to pose a direct threat, which we again talked about on the prior slide.
The World Health Organization has declared COVID-19 as we talked about during the timeline to be an international pandemic. And this EEOC pandemic complication we're discussing right now includes a separate section that answers common employer questions about what to do after a pandemic has been declared and then takes those questions and applies those principles to the actual COVID-19 pandemic with results that are very similar to the ones we just discussed.
But we think that the following might be useful. And it would be useful to click on that link in the lower left hand corner to go review these questions. Those questions are, how much information can an employer request for an employee who calls in sick in order to protect the rest of its workforce during the COVID-19 pandemic?
When may a ADA covered employer take the body temperature of employees during the COVID-19 pandemic? And does the ADA allow employers to require employees to stay home if they have symptoms of the COVID-19? And as we've discussed, there is a great deal more leeway here in taking someone's temperature, sending someone home, and then making them stay home while they are either tested or symptoms manifest, et cetera.
The last FAQ on the separate Q&A on the EEOC's pandemic publication pertains to doctor's notes for those employees who have been away from their workplace during a pandemic and the requirement to provide a doctor's note certifying their fitness to return to work. The requirement to provide such a note is permitted under the ADA. But the EEOC brings up a really important matter of practicality right now.
Doctors and other health care workers are inundated now during this time to provide fitness for duty documentation. And therefore new approaches might need to be relied upon such as a standardized form, or a stamp or email to certify if someone does not have a pandemic virus. So how much information may I share if someone has been exposed, if an employee has been exposed to COVID-19 or actually tested positive for the virus? Here are some good guidelines. Maintain privacy of all disability related inquiries and medical examinations. It is just a great idea off the bat.
Information must be collected on separate forms and certain separate medical files can be treated as a confidential medical record. In the event of potential exposure and without releasing individual information, just let employees know that they might have had contact with someone who was recently exposed to the virus or actually tested positive for the virus. Speak in general terms to the extent you can do so to preserve that confidentiality.
Let's move over to a little bit of a HIPAA discussion here, a little bit more in depth on HIPAA. The US Department of Health and Human Services Office for Civil Rights recently issued a bulletin that reinforces HIPAA. Privacy and security rules still apply in an emergency situation such as a pandemic. To give you a brief overview of HIPAA, only covered entities and business associates are actually subject to HIPAA. Coverage entities include group health plans, health care providers, and health care clearinghouses.
The HIPAA privacy rule prevents covered entities to use and disclose Protected Health Information, PHI, without a patient's authorization for treatment, payment, and health care operations. It's really important to consider where the health information comes from to determine if it's PHI or not PHI. So for example here, if we have an employee who approaches his or her employer with the news that he or she has been exposed to or tested positive for the virus, that would not be protected health information and not covered by HIPAA because it is not coming from the group health plan, a covered entity.
However, other privacy laws or company privacy policies might still apply. If however the information comes from the group health plan, this information would be protected health information and subject to HIPAA. It should be handled according to the privacy and security rules and should not be used in an adverse employment matter. It should not be released without an authorization.
HHS rule 10 that we just talked about emphasizes that HIPAA does not preclude the use and disclosure of the minimum amount of protected health information necessary to treat a patient, to protect the nation's public health, or to prevent a serious and imminent threat to the health and safety of a person of the public. However, in a public health emergency, HIPAA permits covered entities to disclose PHI without a patient's authorization to the following categories of individuals and entities-- foreign government authorities at the direction of public health authorities, persons at risk, family, friends, police, disaster relief organizations who are involved in the patient's care, and anyone else if it would lessen or prevent a serious and imminent threat to the health and safety of the public at large, or an individual person.
Let's move on to how employers may leverage their group health plan right now to best assist employees. So what happens when an employer offers a high deductible health plan with a health savings account? Can that plan cover COVID testing and treatment costs without a deductible or one with below the minimum deductible required for HDHPs without destroying HSA eligibility? We know that there's great concern over that right now.
Thankfully, we do have some relief in this area. On March 11th, the IRS issued notice 2020-15 clarifying that COVID-19 vaccines are considered preventative care. And that until further notice, all medical care services received and items purchased associated with testing for and treatment of COVID-19 may be provided by a health plan without a deductible or at reduced or no cost to participants without disqualifying the HDHP or contributions to an HSA.
So an HDHP can provide benefits under the plan's deductible for medical care services and supplies to test for and treat COVID-19. Individuals enrolled in an HDHP that covers COVID-19 related costs before the deductible is met or will remain eligible to contribute to a health savings account. So that's great news.
Remember, generally, HSA holders can only make or receive contributions to an HSA connected to an HDHP with no other disqualifying pre-deductible coverage. Now, keep in mind, this is not required under federal tax law. Therefore, employers do have the option to choose to adopt it. Or they can choose to not adopt it.
However, some states have taken steps to require insured plans to provide this coverage. I fully expect that that number of states that required so will grow as the days go on. Employers with self-insured plans should consider whether to make such an amendment. If they do decide to do this, plan sponsors must comply with all the normal requirements for a change in the plan coverage, such as an amendment, the summary material modification distribution, and should work with their TPAs on this issue as well.
If your plan so offers telemedicine and employee assistance programs, now might be the time to encourage use of such programs. Telemedicine, particularly right now might be a very valuable option for those seeking medical help for non-emergency care. These services often provide access to care and specialist referrals. They also very importantly minimize external exposure as we are all trying to limit the amount we expose others and we are exposed by others. They also preserve emergency services and resources for those who absolutely need it most.
EAP programs provide helpful benefits for physical and mental health services but also personal finance, stress management, services that will help with life changes and challenges which are critical in uncertain times, such as the time we are finding ourselves in right now. And then health plans may cover the cost of COVID-19 testing.
Many states have mandated again that fully insured plans must cover costs of COVID-19 testing and treatment at no cost to members. And while self-funded plans generally aren't subject to those state mandates as fully insured plans are, we've been hearing that most claims administrators are automatically waiving cost sharing for COVID-19 testing and treatment unless the plan sponsor actually opts out of that. Let's move on to some staffing challenges with Laura Clayman.
CHRISTY SHOWALTER: Thank you, Ann. As a result of the COVID-19 pandemic, employers are having to change the way they do business. And they're having to change it really quickly. We're going to talk about some DOL items related to compensation. And then my colleague, Christy Showalter is going to talk about certain employee benefits that might be available to employees if or when these business decisions have to take place, as well as the family first legislation that was signed into law yesterday.
The one stop that employers are taking around the country is allowing their employees to telework. According to the CDC and other health authorities, teleworking really is one of the most effective ways of reducing the spread of this virus. Teleworking significantly reduces the frequency and duration of that in our personal contact during the workday and allows for social distancing during the day that would otherwise not be possible.
In addition, it limits the need to physically commute to and from the workplace. In larger cities, that reduces a great deal of interpersonal contact for a public transit system. And let's face it, in some places those transit systems have already altered their operations or halted them completely. And of course, with school closures across the country, parents often need to be able to work from home because of childcare issues.
So with this shift in business and encouragement for telework, we did receive some guidance from the DOL directly relating to this subject. So the first question that the DOL answered for us was, can an employer require employees to telework? And the DOL tells us yes. An employer can require employees to telework as an infection control or prevention strategy.
This can also be a reasonable accommodation under the Americans with Disabilities Act, ADA, with a couple of caveats. Employers cannot single out employees to telework based on protective class which isn't as much of an issue right now that federal guidance is strongly encouraging all Americans to maintain social distancing through telework if at all possible.
But if telework was granted as a reasonable accommodation for an employee with a disability, that employee must be compensated at the same hourly rate or salary as if they would have received their hourly rate or salary if they're working on site.
The DOL provides some additional guidance to telework and compensation. Does an employer have to pay employees the same hourly rate salary for telework? We talked about reasonable accommodation. But it also may be the case if the employee is part of a collective bargaining agreement or another employment contract. Otherwise the following guidelines that you're familiar with already with non-exempt and exempt employees apply.
For non-exempt employees, the Fair Labor Standards Act, FLSA, requires an employer to pay non-exempt employees for hours actually worked. In order to do that for teleworking, the employer must have a method in place for employees to track those hours, and also very importantly to account for any and all overtime owed to that employee.
In addition, an employer should decide prior to telework assignments whether or not there will be limits on non-exempt employee hours, establish whether overtime meets prior approval for those employees. Another consideration to take into account for your non-exempt telework employees is that meal and rest breaks must be taken into account. There are approximately 20 states, I believe that have required meal and rest breaks.
The non-exempt employee can't volunteer their hours to fill in for others without being paid. They certainly can work additional hours to help out in a workforce as long as they are compensated for that. And finally, on-call time might be an issue for a non-exempt employee as well, whether or not a non-exempt employee is paid for on-call time for telework depends on whether they're waiting to be engaged or engaged to wait.
If that non-exempt employee must be available if needed or expected turnaround projects quickly such that the non-exempt employee cannot effectively use the time for his or her own purposes, that's engaged wait. And that is working while on call and needs to be compensated for non-exempt employees.
For exempt employees there are different rules. By the nature of the definition of an exempt employee, that employee must have a guaranteed weekly salary for any week in which they perform work, which means any work, even if that work is minimal. And the most common example is if that exempt employee is checking his or her email for work. That means that they're working and they must receive that full salary for their week.
The FLSA requires employers to maintain accurate records for hours for non-exempt employees. But is certainly a best practice to maintain accurate records for all hours worked by all employees, including those exempt employees who participate in telework.
Now, if employees are suddenly asked to telework, there will likely be some expenses associated with that to allow that employee to be able to effectively do his or her job from their home. The employer should furnish or reimburse employees for the tools necessary to telework. But an employer must reimburse the employee to the extent that those expenses cause that employee's wages to dip below minimum wage. So some of those DOL examples of these expenses are the things that you think about, internet access, computers, laptops, phone lines, and anything that is necessary for that employee to be able to effectively do their job.
So what about those jobs that can't be performed on a telework basis? And there are certainly many of those out there. The DOL encourages employers to think about other options to help promote that social distancing to give us that protection, such as staggered work shifts and more physical distance between work spaces. And those are some ways that can help if telework is not an option.
Another option is possibly assign those employees special projects that might be able to be done on a telework basis. But be sure you're compensating those non-exempt employees for those hours worked.
So what should employers do now? Well, if you haven't thought about it already, a company does need to consider implementing teleworking as an option of the company, or expanding your current program if you are already allowing a segment of your employees to telework.
The CDC guidance strongly encourages employers to allow this as an option. And the DOL is asking employers to be flexible in this difficult time for all of us. The first, determine which employees are essential to work in certain physical locations, who can't telework and who can?
Establish a policy if you don't already have one in place. And a checklist, which would include things like performance expectations for employees with different job descriptions, the need for overtime approval if there are going to be limitations on the hours that non-exempt employees will be working, an acknowledgment of any company equipment provided by the company for that employee to do their job.
Unfortunately, in many areas of the country, in many industries, telework just isn't an option. States are advising certain businesses to close their doors for a certain time period to help slow the spread of COVID-19. For example, many cities have instructed bars, casinos, movie theaters, gyms to close immediately. And in many parts of the country, restaurants are only doing takeout delivery and don't have dine in options at this time. So many of these businesses are having to lay off employees or place employees on specific furloughs while the office temporarily closes its doors.
The DOL gives us guidance here as well. These rules are similar to teleworking. Does an employer have to pay an employee who is sent home due to a temporary office closure? And for non-exempt employees, no. The DOL rules are that the employer can generally schedule non-exempt employees for fewer days or hours without liability concerns. And employers do not need to pay wages to non-exempt employees for hours not worked.
Exempt employees, the rules are very similar to ones we've discussed with telework. Note that if an exempt employee is on a furlough, employers need to have appropriate expectations that those exempt employees will not be working. And that includes checking email and voice mail.
The employer should have clear communication with employees, exempt employees that that work is not authorized during that time without advance written approval so that you don't run into a problem with an exempt employee doing work during that week and needing to be compensated for the entire weekly salary.
The next question is, can an employer direct salaried exempt employees to take vacation or leave without pay due to COVID-19 office closure? The FLSA does not require employer paid vacation time. An employer can require an exempt employee to use paid leave for any partial or full day absences as long as the exempt employee still receives payment for an amount equal to the employee's guaranteed salary.
We talked a lot about exempt employees and requirements for a full weekly salary. But on your screen on the right, there is a list of permissible deductions that are allowed even during COVID-19 situations. When an employee is absent from work for one more days for personal reasons, when those absences the deduction is made in accordance with a bona fide plan policy or practice, if they're offsetting amounts of the employee receives a jury or witness fees, or temporary military duty pay might be something that comes up more right now in our society with what we're doing with COVID-19.
Penalties imposed in good faith for safety rules, disciplinary suspensions, or in the employee's initial or terminal week of employment. For unpaid leave under the FMLA is up there as well, Chris is going to talk about how the Family's First Coronavirus Act might have some effects on FMLA.
And then finally, things are happening so quickly. Does an employer have to give advance notice for a mass layoff right now with COVID-19 closings?
The Worker Adjustment and Retraining Notification, the WARN Act, helps insure advance notice in cases of certain plant closings and mass layoffs. And depending on this WARN Act or state mini-WARN statutes may require employers to provide advance notice to employees and government officials in certain situations.
Here, it's not clear if there is a blanket exception for COVID-19 closings. The federal WARN and most state mini-WARN statutes have provisions addressing terminations due to natural disasters. And there are exceptions, like a short notice period if terminations results in circumstances that were not reasonably anticipated 60 days before employees are terminated.
But even a shortened notice under the WARN Act and many of these state mini-WARN statutes requires giving actual written notice with advance notice. So what we would recommend is if your company would normally fall under the WARN Act to consult with counsel for guidance on these issues.
CHRISTY SHOWALTER: Well, great, thank you so much, Laura. And again, I'm Christy Showalter. And we are now going to take a look at potential protections and benefits that might be available in the event that leave is required. As Laura just discussed, a number of employers are dealing with the very real possibility that employees are going to need leave, whether it's due to exposure to or illness from the virus itself. Potentially the need to care for children due to school or daycare closures, or even temporary layoffs or furloughs due to business downturns and closures.
So let's take a look at some of the benefits and protections that may be available. Certainly the answer to this question is developing on a daily basis. But there are several benefits that we are aware of that may be available to employees depending on the reason for leave.
These include the Family Medical Leave Act, potentially company sponsored PTO, vacation or sick leave, state mandated sick leave, short-term disability, and unemployment insurance. And as of just yesterday afternoon we now have a new acronym to become familiar with, the FFCRA, or the Federal Families First Coronavirus Response Act. Let's start with a deeper look into this new legislation.
And that's where this act was passed by the House on March 13 and amended on March 16 and then passed by the Senate and signed by the president yesterday, March 18th. It's anticipated that this act is required to take effect no later than April 2nd, potentially sooner. McGriff will definitely be providing more detailed guidance as it's available. But for now, let's take a look at the general overview of the new legislation.
That's where the act itself applies to private employers with 500 or fewer employees. And it contains two significant components, the emergency paid sick leave act and the Emergency Family and Medical Leave Expansion Act. So first taking a look at the Emergency Paid Sick Leave Act, or EPSLA.
The Act requires up to 80 hours of leave for full-time employees, or the equivalent of two weeks of pay for part-time employees based on their prior two week average of hours. And this is for the following reason. This is if the employee is subject to a federal, state, or local quarantine related to COVID, if the employee has been advised by a health care provider to self quarantine due to concerns related to COVID, or if the employee is actually experiencing symptoms of COVID in seeking a medical diagnosis. The amount that EPSLA paid to an employee for these purposes is going to be capped at $511 per day, or $5,110 in the aggregate.
2/3 of these amounts for leave are going to be required if the employee is caring for an individual who is subject to a quarantine order or health care provider advice to self-quarantine. And note that this is any individual. It's not just family members.
Also if the employee is caring for his or her child, if the school or place of care of the child has been closed, or if the child care provider is just unavailable due to COVID precautions, or also if the employee is experiencing any other substantially similar conditions specified by Health and Human Services. In these cases, the amount of EPSLA paid to an employee would be capped at $200 a day.
There's also the second component to this Act, the Emergency Family and Medical Leave Expansion Act, which as the title indicates, amends and expands the FMLA adding a qualifying reason for leave for an employee needing to take time off to care for a child under the age of 18 due to a school closure or other lack of childcare.
The first requirement of this component is the allowance of 10 days of unpaid public health emergency leave. It's expected that most employees are going to qualify for some paid leave during these first 10 days under the Emergency Paid Sick Leave Act. If additional leave is required, the Emergency Family and Medical Leave Expansion Act provides for paid leave for the duration of the qualified leave. This leave will be paid at a rate of 2/3 of the employee's regular rate up to $200 per day.
It's important, one thing to note is that this act does not increase the amount of FMLA available to an eligible employee. Eligible employees are still eligible for up to 12 weeks of FMLA leave during the designated 12-month period. So if an employee has already used all or a portion of their FMLA, the available balance may be reduced from the 12-week period.
This act will apply to employers with 500 or fewer employees. And as we know, the FMLA typically only applies to employers with 50 or more employees. So are there any special considerations for small employers with these new expanded FMLA requirements? And thankfully the answer is yes.
Employers that are subject to the PHEL requirement but who do not otherwise meet the requirement to be a covered employer under the FMLA are not subject to a private right of action by employees for damages, although they do remain subject to an enforcement action by the DOL. The DOL has the authority to exempt small businesses if that's going to jeopardize the viability of the businesses of going concern. So obviously, we still have a lot to be fleshed out in regards to this new act. And so be on the lookout for additional guidance from your McGriff advisors.
So while we discussed a little bit about the expansion of FMLA, let's take a step back and look at just the FMLA's basic protections. As we just mentioned, the act is the new Families First Coronavirus Response Act that applies to employers with 500 or fewer employees. And obviously, FMLA is going to have further expanded reach affecting employers with 50 or more employees. So it's going to affect those larger employers as well.
And that's where the DOL's released Q&A document reminding employers that employees out with the flu or caring for ill family members may be entitled to FMLA leave. Under the FMLA, covered employers are required to provide job protected unpaid leave for specified family and medical reasons, which is going to include a serious health condition. And this is where the DOL has clarified that the flu or the virus such as COVID may qualify where complications arise.
So in these situations, you're going to want to be sure if the employee is taking leave due to their own illness or caring for a family member who is sick due to the virus, you'll want to be sure that you've issued the required notifications and classified the leave under the FMLA to ensure its protections, such as continuation of benefits and job protection.
In a situation, maybe, there are situations where the employees have demonstrated no symptom but may be either self-quarantined or is asked to quarantine due to potential exposure, or to take care of an immediate family member who is quarantined, how does the FMLA apply to that? And this is where, if the employee demonstrates no symptoms of the coronavirus, the employer should be careful not to count any of this leave against the employee's FMLA allotment, as at that point, there's no evidence of a serious health condition.
Ideally, these employees would be able to work from home as Laura mentioned, remote telework, as they're probably healthy enough to continue working. However, if remote work is not available and leave is required, employees should be instructed to self-monitor for symptoms of the virus, which could include the fever, coughing, shortness of breath, or difficulty breathing. And if those symptoms develop, the employee should immediately inform the company, at which time that's when you can initiate the FMLA process and issue notices classifying the leave is FMLA.
Then another question we've been receiving is, employees, can they stay home or refuse to work due to just simply fears of being exposed to the virus and to minimize the risk of contracting the virus? In this scenario, again, there's no actual serious health condition necessitating the leave. Some FMLA would not apply.
And while there are some potential considerations under the Occupational Safety and Health Act, or OSHA, these are going to be discussed in more detail by our teammates in other presentations in the McGriff Coronavirus Advisory Series. But the general rule is that employees are only entitled to refuse work if they believe they're in imminent danger.
So kind of turning to the next potential protection and benefit, employees may also have benefits under a company sponsored PTO or vacation or sickly policy. And as has been mentioned, the CDC has encouraged employers to make sure workers stay home when they're sick to help prevent spread of the virus.
So this is a really good time to review your company's policies and consider several best practices. Really looking at, are your policies flexible and do they encourage employees who might have been exposed to the virus to self-quarantine? Or could workers feel inadvertently pressured to report to work?
A number of employers have even offered to now pay employees for quarantine periods and to encourage employees to comply and self-report to help minimize workplace exposure. Are employees permitted to use sick leave for not only their own personal illness but also the illness of immediate family members. Some employers have expanded their sick leave policies to include care of family members.
And then another issue to consider and discuss is the common requirement for a doctor's note for absences. Just as a practical matter, doctors and many other health care professionals may be too busy during and immediately after this outbreak to provide a doctor's note for an absence. So this is where new approaches may be necessary, maybe considering reliance on clinics to provide a forum, or an email to certify the employee's absence, and just to reconsider the position on that.
And then finally, another potential consideration is the offer of additional paid or unpaid leave through emergency leave banks, or leave sharing policies, donated leave. In just one word of caution on leave banks, this does potentially have tax consequences regarding leave sharing arrangements. And this is where the IRS has outlined several important steps an employer should take who is looking at offering a leave sharing plan. Specifically, that you must have a formal written leave-sharing program that meets IRS requirements. So we recommend really consulting with the tax professional, as well as reviewing IRS notice 2006-59 for detailed guidance on what must be contained in a leave sharing plan.
And then now in addition to our new federal legislation requiring emergency paid sick leave, a number of states and localities have also passed their own sick leave regulations. And this is where for employers with employees in the highlighted state, it's going to be really important to review state laws to determine if paid leave is available. And what we've seen is that many of these states have expanded the availability of benefits to employees who are unable to work due to having symptoms or having been exposed to the coronavirus or being unable to work to care for a family member who's ill or quarantined.
In any event, the employees actually affected by the virus, employees may also have access to short-term disability through an employer-sponsored disability plan, or even a state-mandated disability plan. Particularly if the employee has actually been diagnosed with the illness and is sick or unable to perform the major duties of his or her job, short-term disability benefits will likely be available.
Of course, eligibility for benefits is going to depend significantly on the plan's definition of a disability. So we recommend working closely with your employee benefits advisor and the carrier to review your plan's definition of disability and what benefits might be available. Typically, simply staying at home due to a quarantine may not fit under the definition of a disability as there's not a corresponding physical or mental impairment. However, some policies do contain a quarantine benefit rider which could provide benefits to your employees in a quarantine situation as ordered by a doctor.
So we've also received several questions asking if an employer can enhance its benefits or waive the elimination period due to illnesses related to the virus. And the answer is, possibly. For employers simply offering a salary continuation program, programs can generally be amended at the employer's discretion.
Fully insured disability programs are going to have some additional requirements. In addition to the critical step of securing the approval of your carrier, which is the most important step, insured disability programs are also governed by ERISA and are going to require a formal amendment to your plan as well as certain disclosures participant.
And then finally, in the event the employee's leave is due to a downturn in business or business closure, state unemployment benefits could also be available. Each state establishes its own criteria for eligibility for benefits as well as defining the benefits that are available. So it's going to be important to consult your state's unemployment division for details.
The DOL has issued some guidance to states, outlining state flexibility in administering their programs and allowing them to elect to pay benefits if the employer temporarily ceases its operations due to COVID, if an individual quarantines with the expectation of returning to work after the quarantine is over, and also if an individual leaves employment due to the risk of exposure or infection or to care for a family member. And this in another area, we're seeing daily changes, several states currently including Washington, Ohio, and Rhode Island have already specifically expanded their unemployment programs in response to the COVID virus.
So now we've got an employee on leave. So let's take a closer look at how an employee's benefits may be handled during a leave of absence. It's really important to understand whether an employee remains eligible for your benefit plans and not to assume that coverage can be continued indefinitely. Otherwise, employers could inadvertently find themselves self-insuring all claims in the event a carrier challenges an employee's eligibility.
So how long can you continue benefits during a leave of absence? And I truly wish there were a simple answer to this question. Instead, there's more of a series of questions and considerations that we will get in addressing this one. First, and what I would consider most importantly is, how does your plan document define eligibility? And termination of benefits, when are benefits required to be terminated?
Plans vary significantly. We have seen some plan documents that allow continuation of benefits certainly up to 12 weeks during FMLA. However, if it's a non-FMLA option, it may be limited to 30 days. So if an employee's leave extends beyond 30 days for a non-FMLA reason, benefits may need to be terminated and Cobra offered due to the reduction in hours worked. Other plans provide for longer periods of coverage during a leave of absence. So it's important to know how your specific plan defines eligibility.
Another important question is, is the leave protected by FMLA or some other state leave regulation that would require continuation of benefits during that protected leave? What measurement method have you adopted for determining full time status under the Affordable Care Act? For those of you who have adopted the look-back measurement method, you're familiar with the measurement instability period.
So if an employee is currently in a stability period, they may still be considered full time and eligible for benefit through the end of that stability period, even if they're currently on a leave of absence. So it's important to know what measurement method you've selected and how that could impact eligibility for benefits.
So also, is there a company policy addressing how long benefits can be continued during leave? This is an area we would strongly recommend developing a proactive policy of how long your company is willing to extend benefits during an employee's leave of absence. And working closely with your benefits advisor and the carrier to make sure that decision is incorporated into your plan document.
And maybe there are some situations where this question is not addressed in any of the above considerations. So then we also look at, what is your company precedent? How long have you continued benefits for other employees on a leave? So as you can see, it's not just a simple answer of how long benefits can be continued. It really is a discussion of diving into your plan documents, your company policies, and looking at how long benefits could be continued before Cobra would be offered during an employee's leave of absence.
And then of course, if an employee is not working, it raises the additional question of, what about their premium payment? What happens if the employee is unable to-- they don't have any current payroll, so what do we do about their premium deductions?
And this is where it is really important to establish your expectations on the front end and communicate with employees as employees are going on leave and are unable to work. Can you provide written communication outlining, how much are they required to remit? When are those premiums due? And what grace periods might apply?
You're required to have a minimum of a 30-day grace period for payments. And in many cases, employers are extending that to a longer period in light of the challenges of the COVID virus. Address to whom payment should be made. And what happens if the employee fails to pay timely?
Are benefits going to be terminated retroactive to the date of the last payment? Will they be terminated just from that point forward. Address what the consequences are. Keeping in mind that if coverage is terminated due to the failure to remit a timely payment, this is not a Cobra event. So extended coverage would not be available.
And then note, if the employee is actually on FMLA leave, additional notifications are required under the FMLA before coverage can be terminated. Then we also received several questions of can we adjust, either increase or decrease our employee's premium contributions while they're on furlough or leave? And possibly, generally employers can change welfare plan terms at any time in their discretion unless they may have given up that right through communications they provided to employees, maybe either the plan document language, language that was in benefit enrollment materials. It's important to go back and see what was promised to employees. If changes are made, a summary of material modifications is need to be prepared and issued to participants.
And then additionally, if premiums are included or mentioned in the summary of benefits and coverage that's distributed to employees during renewal, a 60-day advance notification is going to be required under the ACA. So it would be at least 60 days before changes could be made to those premiums. And then of course, if a plan is offered on a pre-tax basis, it raises some additional considerations.
One question would be, if the change is significant, employees could be permitted to make mid-year election changes, add coverage or drop coverage. And many of those changes may require carrier approval. So it would be important to coordinate any changes with the carrier before they're made to the plan.
So as you can see, there's a number of additional challenges that we know you're dealing with. We are in the process of preparing information as quickly as we can to get it in your hands. And we're very dedicated to keeping our clients up to date with any new information on COVID. We've prepared some additional resources that you might find useful as things continue to progress.
We've got links that are available that there should be active links on the handouts that you've received. And please be on the lookout for additional materials. We're preparing them daily, including additional webinars from our McGriff series, as well as additional publications. We're going to work through this together. And we're definitely dedicated to keeping you up to date.
And Laura, thank you so much for your participation and the information you shared today. And we certainly thank all of you listening for joining us for this presentation. As I mentioned, be on the lookout for the additional presentations in the McGriff Coronavirus Advisory Series. And we will continue to be in touch. Thank you so much.
Executive Risk Considerations
AUTOMATED VOICE: Meeting is being recorded.
ROBERT REGUEIRO: Hello. This is Robert Regueiro at McGriff, Senior Vice President and part of the Executive Risk Advisor Division. As the world reacts to news of coronavirus spreading throughout the globe, financial markets are tumbling amid the economic uncertainty. Disruption in supply chains and market demand has created volatility in share prices with certain industries taking a bigger hit than others.
The airline and cruise industry, for example, have experienced a drastic fall in consumer demand as a result of travel restrictions and social distancing. Retail and hospitality industries are also expected to take a financial hit as a result of health officials encouraging businesses to close and individuals to stay home. Additionally, and as a result of price wars between Saudi Arabia and Russia, as well as an outlook that includes decreasing demand, the oil and gas industry is undergoing an extremely tough market with the price of oil well below $30.
During this uncertainty, companies are evaluating all insurance policies to assess whether or not coverage could apply to the losses they expect to experience. Though the devil's in the details and how claims take shape and form is still unknown, we wanted to provide everyone with some things to think through as it relates to executive risk policies.
First, we'll dive through directors' and officers' liability marketplace, identifying regulatory environment, litigation landscape, and reviewing your policy to see how coverage could apply. Additionally, we'll go through other executive risk policies to see how those policies can be impacted as well. To understand the current environment from a regulatory standpoint, it is important to know that agency statements on appropriate disclosures for coronavirus-related risks. As early as January 2020, the SEC recognized that though the potential effects of coronavirus are difficult to assess or predict with meaningful precision, if and how companies respond to events as they unfold can be material to an investment decision. As a result of such statement from the SEC, over 600 companies specifically mentioned coronavirus as a risk factor in the public disclosures as of the end of February.
As companies grappled with whether or not to disclose additional coronavirus-related risk factors, management should also consider how much detail should be provided. The SEC encourages companies to go beyond standard risk factor language and be specific to the overall potential impact. As the coronavirus crisis continues to evolve on a daily basis, what a company says or doesn't say could result in heightened scrutiny by investors, potentially leading to litigation. We've already seen litigation as a result of a company saying the wrong thing and another company saying too little.
Finally, to allow companies time to evaluate whether to disclose coronavirus-related risk factors, the SEC has advised companies that they will have an additional 45 days to file certain matters otherwise due between March 1 and April 30. This could include year-end financials for companies with different financial calendars and 8-Ks for notable events.
From a litigation environment, companies have seen the likelihood of securities class action litigation rise the past few years to 8.9% in 2019. The likelihood percentage falls to 5.5% if merger objection lawsuits are removed. The increased litigation likelihood is as a result of a large number of securities class action filings against the diminishing number of publicly-traded companies.
In 2019, there were 428 securities class action filings. Taking a closer look into the filings, we can extract a number of trends. One of those trends is what has been commonly referred to as event-driven litigation. As opposed to more common securities class filings alleging accounting improprieties or financial misrepresentation, in event-driven litigation, a lawsuit's alleging a company misrepresented and misled investors by making inaccurate statements about the risk of a major negative event. Most often these lawsuits are operational in nature as opposed to financial.
Recent events that have resulted in securities class action filings include the opioid crisis, the MeToo movement, and cyber-related breaches. Many fear that coronavirus-related events could impact—negatively impact a company's operations or financials, causing shares to drop even further and sparking litigation that keeps up with the event-driven litigation trend we've already seen. As previously mentioned, the SEC's continue to focus on coronavirus-related disclosures could trip up companies and invite litigation.
As of March 17, there have been two coronavirus-related securities class action filed-- one against a cruise line company, and the other against a pharmaceutical company. One of those lawsuits alleged the company misrepresented customers by stating booked revenue remained ahead of the prior year on a comparable basis despite the current known impact a coronavirus on the company and the industry. The other lawsuit alleged the company misled investors by misstating the company had developed to COVID-19 vaccine in a matter of hours. Though the allegations are very different, both point to the importance of disclosing and reporting coronavirus-related risks in a well-thought-through manner.
D&O policies and most all executive risk policies are not designed to provide coverage to law as a direct result of bodily injury, including sickness, disease, or death of a person. However, it is important to note that D&O policies are all risks policies not requiring a named peril to trigger the policy. The policy is purposefully written and intended to be broad in scope, extending to any alleged breach of duty made by an insurance company or injured person, subject, of course, to the terms and conditions of the policy.
Within those terms and conditions of the traditional D&O policy is commonly a bodily injury or property damage exclusion precluding claims for bodily injury, sickness, mental anguish, emotional distress, disease, or death of any person. How that exclusion is worded is extremely important. Some exclusionary language includes absolute lead-in language precluding claims based upon, arising out of, or in any way related to such bodily injury. Other exclusionary language may have a more simplified and pointed lead-in language that would simply preclude claims for bodily injury. We recommend insureds review this specifically lead-in language to BIPD exclusion.
Additionally, though the [INAUDIBLE] lead-in language is typically thought of as providing coverage for securities claims, we recommend insureds review whether or not a securities claim exception or carve-back to the exclusion is included in the policy. Having these wordings within the exclusion could mean a difference in having a coronavirus-related claim excluded.
It is important to note that in the event of a non-indemnifiable claim against the director or officer, there could be coverage under the Side A only difference in conditions policies, as most Side A DIC policies do not contain a BIPD exclusion. Cited claims from the coronavirus event could include a derivative claim in which the entity bring suit against individual directors and officers for breaches of fiduciary duty with respect to crisis mismanagement.
In addition to securities claim coverage within the traditional D&O policy, and depending on how a claim might be brought, a number of sublimited coverage could apply to certain costs incurred by the company, including crisis or special event coverage. For these companies whose share price has fallen over a certain threshold, generally 10% to 25% or $5 per share within 24 hours, there may be coverage for public relations, crisis management, or law firm expenses related to a crisis event. Events that may trigger a material impact on share price include a restatement of financials, elimination or suspension of the dividend, write off of assets, bankruptcy, and others.
Although recent marketplace volatility has created large share price decreases and almost everyone has experienced an over 20% to 25% stock price drop, insureds will need to point to a company-specific crisis in order to trigger the coverage as opposed to a more general macro factor. A determining factor as it relates to claims will be whether or not a significant drop in market share was caused by board or executive mismanagement.
With respect D&O market conditions, the current D&O liability marketplace is firming to hard depending on industries and other risk factors, such as IPOs or Section 11 exposure. Market volatility and coronavirus-related events can further tighten the market, causing carriers to reduce capacity, increase premiums, and increase retentions. We expect D&O underwriters to ask questions regarding the impact of coronavirus crisis and steps their insureds have taken to mitigate the risk. How a company response to the crisis will matter a great deal to underwriters.
Other executive risk insurance policies may also be impacted by the coronavirus-related crisis. In addition to reviewing the D&O liability policy, we recommend insureds review all executive risk lines of insureds, including special crime, employment practices liability, fiduciary liability, and commercial crime. Special crime policies provide coverage for kidnap, ransom, and extortion demands, as well as crisis management expenses associated with an insurer. They may contain sublimited amounts for evacuating expatriates to the resident country, as well as evacuating insured persons to their resident country for security-related reasons.
Though the actual threat of evacuation of insured persons as a result of the pandemic might highly be encouraged by countries and insureds alike, a pandemic-related evacuation would not trigger coverage unless, of course, it is a security-related event. With respect to employment practices liability, we've seen a significant amount of companies [INAUDIBLE] of over 30%. In addition, the number of companies have also recently announced temporary leave for thousands of employees, including hotel chain Marriott and oilfield service giant Halliburton.
In addition to the temporary leave, we anticipate a number of companies reducing their force and implementing mass layoffs. As with any mass layoff, the risk of litigation increases, and employers are forced to determine-- or to terminate employees, triggering wrongful termination suits, discrimination suits, and harassment suits. Additionally, with a number of companies adopting work-from-home procedures, a number of non-exempt employees will be working remotely, potentially creating wage and hour exposure.
In addition to reviewing travel policies, communicable diseases procedures, and crisis response plans as it relates to employees, we recommend all insureds review the overall EPLI or Employment Practices Liability Insurance limit of liability, as well as review the policy to identify any Fair Labor Standards Act or FLSA-related exclusions that would preclude claims brought against alleging wage and hour exposure.
Fiduciary liability, which provides coverage for any benefit plan, the plan sponsor, or any planned fiduciary for any allegations of a risk of violations, also contains a bodily injury and property damage exclusion similar to that of the D&O policies. Though the likelihood of fiduciary litigation seems relatively low as it relates to coronavirus crisis, we recommend insureds review their policy language as well as the various supplements that could be applicable for violations of HIPAA.
Finally, the commercial crime policy provides coverage money and securities—for loss of money securities as a direct loss to certain causes, including employee theft. As companies are forced to adopt work-from-home policies, a company's operations may become decentralized, leading to more opportunities for employees to embezzle company funds. Additionally, as with mass layoffs, spending mass layoffs, disgruntled employees, or employees who feel they may soon be terminated may look to create elaborate plans stealing from the company for short-term gain. We recommend all insureds review the commercial crime policy of limited liability and coverage trigger to ensure adequate coverage is available in the event of any increase in claims.
Well thank you for your time today, and of course, if you have any questions or would like to discuss further how the current coronavirus-related crisis could impact your executive risk policies, please reach out to your McGriff executive risk advisor. That's all we have for today. Please stay safe out there, and of course, please let us know if you have any questions. Until next time, goodbye.
Examining Cyber Security Risks
SUZANNE GLADLE: Hello, everyone. This is Suzanne Gladle, and I'd like to welcome you to the McGriff Coronavirus Advisory Series. I'm the cyber practice leader in McGriff Executive Risk Group. And joining me today is Aarti Soni, our cyber director and product innovation counsel.
And today's forum is going to focus on examining cybersecurity risks and the evolving coronavirus environment. And joining us today we have an expert from G2S Global. G2S Global is our trusted cybersecurity partner that many of our clients have come to know through the demonstration of our jointly developed proprietary tool, which is used to assist our clients in cyber risk quantification.
The highly specialized G2S team comes from a variety of commercial and government experience in various cybersecurity operations. Their focus is making business decision based on the return on investment rather than a patchwork compilation of endless products and tools. And with that, I'll turn it over to Aarti to ask her question.
AARTI SONI: Thank you, Suzanne, and thank you all for joining us. So our first question today is really when we're looking at the COVID-19 and the coronavirus risk, I think most people are thinking of physical health. And with social distancing and the other measures taken in place, I'm not sure that a cyber threat sort of comes our top of mind. So can you tell us what kinds of threats you're seeing or what kinds of threats we should be anticipating?
MARK: Yeah, sure. First, thanks for having me. A nice break from what is quickly turning into everyone's day to day working from home here. Not sure what you guys have going on, but mine has turning into a distinctly Lord of the Flies feel with the kids and family all in the same house.
It's funny we kind of talked about these questions yesterday. And we talked about what threat do we expect to see. And just in 24 hours, it's changed to very clearly what are we seeing? So I'd probably start there and then maybe backtrack into what we still expect to come down the pike.
But the first and foremost that we've absolutely seen an uptick in, that's just an uptick. It's a hockey stick curve, because it didn't take long for the kind of traditional business process fraud—the one that's telling you, hey, we have to pay a vendor differently, et cetera, to just skyrocket.
And they're trying to take advantage of the gap of a suddenly—they've got accounts payable who has, hopefully, a two-person sign off on any changes to supplier payment. But there used to be maybe in the cubicle next to them or in the office next to them. And now they're suddenly distributed.
And we're seeing a lot of incoming well-written business process fraud type social engineering scams with the typical theme being something around, hey because of xyz from coronavirus, we're going to have to pay some of our suppliers mid-month. And in order to process that payment, we've changed some of the payment terms. Can you please process a March 1st and March 15th payment to this account?
I mean, they do it better than I just—I didn't do it justice with how I just described it. So that's first and foremost. And that's not hypothetical. That's happening now. They were happening before this. But now we're seeing them specifically pulling on the strings of AP.
There's a new process everywhere. You're working from home. You're coming in hopefully through a VPN. You've got suppliers that maybe you have to stop or extend payment terms. And so when something comes in that says, we just need something mid-month here, it doesn't seem so out of place versus what maybe a month ago would have been normal. That's the first place I'd start is the business process fraud that is absolutely happening today.
SUZANNE GLADLE: What about other phishing schemes that you're seeing, perhaps taking advantage of employees' guard being down because they were expecting communications from their school's principal or other folks?
MARK: Yeah, definitely. And that's the one that we are already seeing some from work-related and from what we've just bucket as personal-related, like schools, et cetera. So definitely increased phishing scams in that sense as well, our social engineering.
They seem to be simply right now preying on the idea that there's a thirst for information, which is hard to believe, because to me, it's almost too much information. But like you said, a principal or an e-learning, like our kids are going through right now-- click on this link, reset your password-- all that stuff where I'd say it's a modest uptick.
But we should just expect it to continue, because, really, if I could segue into another thought that we're having here is they might be taking advantage of this kind of instability right now, not just in the US, but globally with these distributed workforces. But it's also a new normal. And so that's what we need to expect here.
It's a new normal in that there's going to be, I think, a switch in the volume of people that end up working remotely. And as such, if business process fraud since it was already a big business, they really only have to be right once or twice a day to make significant amount of money with almost no repercussions based on the geographic distances and lack of prosecution.
Well, now they've got a much more fertile ground to go after. And you've got companies that are worried, including us, right? And everyday companies who are worried about operations and cash and keeping customers happy and getting new customers and our projects going to pause-- all of a sudden and mentally if you think about it as a human, you're much at lower guard of the other things that you've been taught or learned to behaviors rather than innate. And one of those learned behaviors that people are already poor at is not clicking on those things. I mean, we hear the failure rates all the time.
So now, maybe you're distracted. You're tired. You've got somebody pulling on your leg asking you to help something, help you with homework. Whatever it might be-- whatever phase of life you're in, you're now going from 25% of the workforce if you were lucky clicking malicious links. And maybe it goes up to 45%. Well, 20% is a huge jump when you only need to be right once in order for something bad to happen.
AARTI SONI: You mentioned a couple of times more people working remotely. And just following the news, it looks like a lot of US governors, at least, are mandating that companies of certain size don't have over 50% of their workforce in any sort of physical office. What is that doing to the overall system that, for example, we're using Webex right now. What is that doing for overall technology systems that are being more widely utilized?
MARK: Yeah, great question. So our products that just in case I use the term, it's Cybeta, right? And I'm going to give you a real example here with real numbers to hammer home what it's doing. So our Cybeta products, that includes a portion of it that has to do with monitoring and reporting on connections and alerting on potential problems with connections. And I'll leave it at that for what we're talking about here.
We have one particular customer who on a typical day up until a week ago, I guess, not even a week now, had 3%. This is a customer with, I think, 4,000 employees worldwide—something along those lines—or 3,000 employees worldwide. They had 3% of their workforce working from home.
So not necessarily remote because they had a lot of people traveling too. But actually tagged to work from home. So 3% of 3,000 is-- let's just call it-- what's that? 100 people—something like that. Then last Wednesday, a week ago today, they sent 50% home-- exactly like you just said.
So now they go to approximately 1,500 people. As of last Friday starting with two days ago, then, it's 100% except for maybe a few production facilities for what they do that they need to keep running some food, right? So we don't want production of food to stop. That be the worst thing.
So they do have some of those still going into their factories. Well, so now you've gone—let's call it—2,700 out of 3,000. And they had to set up a system for their VPNs that they figured a surge which could take them from 3% to 10%.
So what they immediately faced and one of the reasons they reached out to us because we helped them with their security, not necessarily their infrastructure, but we have save it as partnerships in this field is they had availability issues. They had volume of user issues. They had people that were saying, well, I can't get on the VPN. But I need to do this work. So now they're bypassing protocol and attempting to do things through personal computers or through insecure connections.
And so from a pure just numbers perspective, if you had a VPN license that said you could have up to 100 concurrent logins in a 24-hour period—you go from 30 to 300 or whatever the number worked out to—it might work for a little bit because of time zone differences. But now you go from 300 to 2,700—it doesn't matter if you're spread across the entire world.
You're going to be over your limits. You're not going to be able to transfer data. Now, and I'll keep going on that thought because it hadn't occurred to me until it started happening to this client. We think of it as, oh, I can't get to my email, right? Annoying, but you can always call and or maybe call and get things done.
We're talking about systems here that have to send orders. It's a supply chain issue-- have to pass payments-- have to receive orders from vendors and from customers and then send them to vendors and suppliers. We're talking about very important things that are well beyond email. And if those start to shut down, now you've got an increase of email saying, hey, I can't get onto this system.
So it's kind of a snowball effect when these systems can't handle it. And then you add in Webex and all the free conference call, other tools that we use that are suddenly seeing this increased volume. So on the flip side or on the positives, though not to paint a picture, it's not like the technology doesn't exist to suddenly go from 100 licenses the 3,000. It does, but it also takes 48 to 72 hours to get it set up.
Those companies are being inundated with requests for us. They've got to open up the pipes. They have to work with the IT shop to set up the right landing spots for the VPN. So a lot of the business functions that people are used to getting set up with really little urgency over the course of a few days are suddenly being rushed into, can you do it tomorrow because my whole workforce is remote.
And those are just a couple of the examples that we're seeing. Then you layer on top of that everything I just said, we didn't even talk about security yet. What happens when you start putting 3,000 people on a VPN? Are they doing safe surfing practices? Are they using reliable internet? What order are they connecting to? Or in, what process are they taking to connect to the VPN?
Are attackers going to be looking more closely or insecurely set up VPN connections? And the answer to that one I can tell you already is yes. It was happening before anyway. But if you've got a particular transport layer that's insecure and that's how you set up your VPN, you've gone from 30 out of 3,000 chance that somebody notices and attempts to exploit it to 2,700 out of 3,000. And that's just for one company. So security is on top of the actual productivity issues that we're seeing.
SUZANNE GLADLE: So to that point, is there any way that we could be more resilient through this time period?
MARK: For sure. And that's kind of why I was trying to be a little positive at the end there. The technology exists to get through this. And that's what I think will become the new normal. I think what you're going to see are like the VPN product that we work with through Masergy. The licensing going to 3,000 or 6,000 or 9,000—they're going to sell it in those nodes. And it's going to allow that kind of upward capacity.
So I think the companies who are really starting to get it right now are limiting the use of their current environments to the critical thing to keep the business running while the IT and tech shops are working with whatever company they're using to up that total ceiling bandwidth and just get it above or to your total employee level knowing that you should never really go above that.
And then we can deal in three, six months or whatever this takes to go back down. Do we need to lower that ceiling? Or do we just keep it there so that we always think of it more of as a contingency planning or business interruption planning to use some of your insurance language.
Maybe that's the new normal. Maybe my own company instead of thinking of saving $7 a month on licenses said let's get licenses for every single employee. And if we ever need it, we know they're there. And I think that's probably the best way that companies can, not only get through this period, but think of it moving forward as the way to operate.
AARTI SONI: In looking at our sort of standard pie chart of threat actors, who are the standouts here? Where do you see the uptick in a particular group of actors sort of taking advantage of the global vulnerability?
MARK: Currently it's definitely the criminal element-- that business process fraud I was referring to. That's for sure. And that's annoying, right? We're seeing hospitals—what [INAUDIBLE] already happening. But you're seeing hospitals and ransomware at a time where you're basically vulnerable. We're seeing on a concerted focus on those types of things.
So that's without a doubt the one staring us right in the face, and it's worrisome. But the one I worry about and we're not seeing yet-- I know Suzanne already knows this about me—but I don't have much faith in humanity particularly on politics. I'm worried about the idea that never waste a good crisis from a geopolitical perspective.
Without pointing any fingers, I'm making a hypothetical statement here. But I'm more worried about the long-term or even medium-term focus meant for maybe state actors who can thread the needle of this chaos and maybe not create damage now but get a foothold onto networks maybe at a time of increased exposure and decreased security to do potential attacks down the road.
We have an election coming. We all know the potential things that could happen there. So for me, we've got to deal with the criminal element now. But we need to also be mindful that there's always the state element looking for the opportunity, particularly if their country either isn't fully affected or has it under control looking for the opportunity to exploit maybe when our guards are a little bit doubt on those types of risks.
SUZANNE GLADLE: Well, to that point, more and more people are going to prefer to communicate with their physicians and health care providers through telemedicine tools. Is that going to create an greater attack surface? And are there things that our audience needs to be mindful of both from a business perspective as well as a patient perspective?
MARK: Yeah, for sure. So you guys would be the experts on the business side in terms of the insurance. But I was just talking with some colleagues this morning. I imagine that we're going to see some sort of PHI loss—story in the next who knows how ever many months. And, frankly, if that's what we're talking about in a few months, there would be almost a sigh of relief.
But I'm curious if there will be a pause on kind of the normal way that that creates a financial penalty, because what a PHI loss is because you had to kind of change this protocol for telemedicine, right? You're trying to respond to a crisis. And in doing so, you've set up some sort of patient portal or an exchange of data. Or you're not masking social security numbers in an email. But you're just trying to get patients rescheduled.
And kind of that war time feeling of, do we just suspend all that kind of risk? So from that corporate side but from the personal side that's not comforting, because the loss of your PHI has to come down to, do I really care if someone looks at my medical record? No, not from a knowing what my medical issues are. But I do care from a future fraud perspective and that effect on me.
So I think the increase in telemedicine kind of like the VPN issue, we already knew there was insecure, whether it's IoT or just telemedicine or insecure processes being followed in health care in any industry but in health care for this discussion. And now we're, again, going from maybe you had 10% of people doing telemedicine. And that's going to jump up tremendously here.
So if you just take the same percent as being insecure, in my example, you quintupled the amount of instances where there could be PHI data loss or something else. So for consumers, it doesn't really change what you should be looking for. It just means you should be looking to make sure the websites and apps are communicating a secure fashion.
You should make sure that if you're using a secure connection, you should make sure you're not transmitting over open communications insecure, sensitive information. So it's all the same types of best practices, except there's just a lot more people that are going to are already doing it. And so you increase your chance for error.
SUZANNE GLADLE: All right, well, those were some very insightful observations, Mark. And I think we're, oh, like, going to be a little bit more guarded and hopefully a little bit more thorough with our conformance to all of the cybersecurity protocols that our employers expect us to adhere to.
I think that this series will probably be the first of many to come. So we'll invite folks that are listeners to this Webex that if they have questions, they can direct them to me or to Aarti. And we're more than happy to explore those questions in our next forum. Thanks for joining us. Goodbye.
Obesity: America's COVID-19 Achilles Heel
Helping Employees with Financial Insecurity
Government Announces Relief for Defined Benefit Plans
COVID-19: FAQs for Employee Benefits Groups
Commercial Property - Building Vacancy Advisory
Risk Management Issues in the Trucking Industry
Keeping Truck Drivers Healthy and Safe During the COVID-19 Pandemic
Assessing and Navigating Declines in Pension Assets in the Wake of COVID-19
Preparing for and Handling a Property Loss During COVID-19
Retirement Relief Provisions of the CARES Act
Coronavirus Advisory: Cybersecurity Measures
HR Strategy: Crisis Preparedness Plans
Coronavirus Advisory: Pharmacy
It Benefits You: Your Employee Benefits Newsletter
CARES Act Summary
COVID-19: Bracing for Impacts
Coronavirus Advisory: Communicating During Crisis
Business Email Compromise
COVID-19: Potential Impact to Private Insurers
COVID-19: Families First Coronavirus Response Act (FFCRA)
Beware of Coronavirus (COVID-19) Scams
Benefits Administration Technology
KISHA MOLIERE: Good morning, and welcome to COVID Conversations, brought to you by the Ben Admin and Technology Practice of McGriff Insurance Services. I'm Kisha Moliere, a Ben Admin Technology Consultant with McGriff. And also with me today is Kristin Shirley, the practice leader.
As we are all aware, the novel Coronavirus has really changed the landscape for a lot of employers due to social distancing policies enacted across the country, leading to a sudden shift to a telecommuting workforce. So we wanted to take a couple of minutes to point out a few items employers may not be thinking about yet with respect to the impact of COVID-19 around this year's open enrollment.
So, Kristin, it appears that the days of in-person benefit meetings may be a thing of the past, or at least on pause for a while. What is one of the first things you think employers need to consider due to so many employees now being remote?
KRISTIN SHIRLEY: Thanks, Kisha. Yeah, I think collecting contact information for employees will be imperative right now, since many may be telecommuting and using their personal equipment, like their cell phones, their email, instead of really using company resources. And I also think it's important that employers be asking themselves if they've developed a strategy to gather this employee contact them year round and collect it periodically. That way, they have it in situations like this.
And since all employees have to elect benefits, one way to make sure that you update and have your employees update their contact information is requiring the contact information page in their Ben Admin system or their HRMS system. That way, employees will be forced to enter that contact information before they actually enroll in their benefits.
KISHA MOLIERE: Good deal.
KRISTIN SHIRLEY: And Kisha, just kind of based upon your experience, what are some key benefits communication tips that you can provide to set employers up for success during this open enrollment?
KISHA MOLIERE: So yeah, if an employer was accustomed to printing and handing out benefit booklets in the break room during group benefit meetings and then collecting paper enrollment forms after one-on-one enrollment sessions, this year is probably going to be a little different. They'll need to consider some of the following alternatives. First, printing and mailing, which is always an option, but may be cost prohibitive for some, especially during this economic tilt. So I'd recommend uploading their benefit booklets to their company internet or their website.
And if they have a Ben Admin enrollment site, actually uploading the benefit booklet there would be a less costly alternative, as well. Which brings us to the following questions—does your benefit administration software allow for posting of these types of documents? And if it does, does it allow for different versions to be posted for different employee populations, since benefits, costs, and/or eligibility may be different for employees at various locations, classes, et cetera?
Then, the next question you may want to ask is, does your Ben Admin system allow for embedded videos in the enrollment platform? And if so, consider yourself or your broker recording open enrollment meetings and posting them within the actual enrollment site. Another option, of course, would be email. If you've been diligent with collecting emails from your employees, this is a very inexpensive way to send out benefits communications.
And another question you want to ask, again, is, does your Ben Admin or HRMS platform allow you to send targeted communications to subsets of employees? And then, very important in this time, with all of the social distancing, would be video conferencing, such as WebEx, Skype, and GoToMeeting. And some vendors in that space are even offering discounted or no-cost access to their platforms right now, so it's definitely something employers need to look into.
And then, lastly, I would say decision support. If you're going to be making major changes in health insurance benefits this year, consider utilizing a decision support tool during your enrollment process to assist employees in making their benefit decisions. So, Kristen, once employees have received their benefit information, what are some challenges and solutions around actually processing employee elections?
KRISTIN SHIRLEY: Well, since we all can pretty much accept the fact that paper and face-to-face open enrollment is very much a thing of the past, here's a couple of alternatives that you can consider. First up, employers should consider, or they could, do online enrollment fee via Ben Admin platforms with an employee self-service feature, meaning the employee goes in and actually makes their elections using that system's device.
The other thing they could do is that they may want to consider employee enrollments via Ben Admins mobile device. Again, not all Ben Admins platforms are going to have a mobile device. So it's important that they start asking these questions now to find out if theirs does have one that would make that option available.
And then I think the third thing that employers should start asking is that their broker or Ben Admin or HRMS vendors, they should start asking about call centers. This could be a great way to educate employees, especially if a group has plans to change plan offerings this year, and, at the same time, provide that human interaction and that personal touch that we're all so much craving right now.
They should also be asking the brokers about what technology they can provide to assist with those open enrollments. And most importantly, they should start asking these questions, again, now. Any of these proposed alternatives will take time, so if they start planning and start asking and start lining things up now, it will make for a much smoother open enrollment.
KISHA MOLIERE: Agreed.
KRISTIN SHIRLEY: So that about wraps up this edition of the COVID Conversations. So thank you for your time. Be on the lookout for our next installment, and until then, stay healthy.
KISHA MOLIERE: Bye, everyone.
KRISTIN SHIRLEY: Bye.
Return to work resources
COVID-19 Return to Work Checklist
Getting the Workforce Back to Work
HR Strategy: Planning for the Return to Normal
© 2020, McGriff Insurance Services, Inc. All rights reserved.
All McGriff Insurance Services, Inc., Risk Solutions are advisory in nature and are designed to assist the client in the establishment and maintenance of a safe workplace. The responsibility to provide safe and healthful work conditions and operations free from known risk and harm to employees, third parties, and the environment is, and shall remain, that of the client. This document, and any subsequent updates, is not a warranty that reliance upon them will prevent accidents and losses or satisfy local, state or federal regulations.
The information, analyses, opinions and/or recommendations contained herein relating to the impact or potential impact of coronavirus/COVID-19 on insurance coverage or any insurance policy is not a legal opinion, warranty or guarantee, and should not be relied upon as such. This communication is intended for informational use only. As insurance agents or brokers, we do not have the authority to render legal advice or to make coverage decisions, and you should submit all claims to your insurance carrier for evaluation. Given the ongoing and constantly changing situation with respect to the coronavirus/COVID-19 pandemic, this communication does not necessarily reflect the latest information regarding recently enacted, pending or proposed legislation or guidance that could override, alter or otherwise affect existing insurance coverage. At your discretion, please consult with an attorney at your own expense for specific advice in this regard.
Insurance products and services offered through McGriff Insurance Services, Inc., a subsidiary of Truist Insurance Holdings, Inc., are not a deposit, not FDIC insured, not guaranteed by a bank, not insured by any federal government agency and may go down in value.
McGriff Insurance Services, Inc. CA License #0C64544.