Several years ago, Employee Stock Ownership Plans (ESOP) were the underused gems of the Employee Retirement Income Security Act of 1974 (ERISA). Today there are more than 6,500 vibrant companies with ESOPs in place, benefiting over 14 million employees and representing $1.3 trillion in assets. Why did these companies do it? 

Many public companies offer their employees the option to own company stock in their 401(k) plans. But what happens when a company is aware of an issue that will cause the company's stock price to drop, like the need to issue an accounting restatement? Can the company face not only a securities lawsuit from public investors, but also breach of fiduciary duty claims by participants in the 401(k) under ERISA against the company and company insiders who also act as ERISA fiduciaries over the 401(k) plan?

This chart summarizes some key IRS employee benefit plan limitations for 2019 and prior years, for easy reference:

COLA

On March 15, 2018, the Fifth Circuit Court of Appeals held that the Department of Labor’s revised definition of a “fiduciary” was invalid, and vacated the DOL’s “Conflict of Interest” regulations, commonly known as the “Fiduciary Rule.”

This month, the IRS quietly updated Frequently Asked Questions (FAQs) 55-58 regarding employer shared responsibility provisions under the Patient Protection and Affordable Care Act (PPACA) to explain how the IRS is going to start imposing employer shared responsibility excise taxes.

The IRS has announced cost of living adjustments to employee benefits limitations for 2018, including increasing the 401(k) elective deferral limit to $18,500 (plus $6,000 catch-up for those age 50 and older, plan permitting).

This chart summarizes some key limits:

COLA

An employee improperly accesses his employer’s computer network and steals the names, birthdates, and social security numbers of his fellow employees to use for illegal financial gain. A criminal hacks into that same network for similar illegal purposes. Because employers regularly obtain, store, and use confidential employee personally identifiable information (“PII”) as part of their business operations, they are targets for this kind of activity. But what legal responsibility do employers have to their employees when PII is misappropriated by an employee, or stolen by hackers in a data breach?

Phase 2 of the U.S. Department of Health and Human Services Office for Civil Rights’ (“OCR”) HIPAA audit program is in process. Unlike OCR’s initial Phase 1 Pilot audits, which addressed only Covered Entities, Phase 2 also focuses on Business Associate compliance with HIPAA’s Privacy, Security, and Breach Notification Rules. 

Well this is unsettling – the person responsible for the massive data breaches at Yahoo was its general counsel? CorporateCounsel speculates about what this means for in-house counsel: are their jobs at risk over cybersecurity? And I wonder – what if a company does not have in-house counsel, or has turnover in IT? Who else will be held accountable for data breaches?

 

Last year, the U.S. Supreme Court gave ERISA’s express preemption provision back its superpower, in Gobeille v. Liberty Mutual Insurance Company.