====== 65 ======

2

Employment Issues in the Virtual Workplace (December 29, 2015)

Robert H. Cohen

Omnicom Group, Inc.

Beverly W. Garofalo

Jackson Lewis P.C.

If you find this article helpful, you can learn more about the subject by going to www.pli.edu to view the on demand program or segment for which it was written.

 

====== 67 ======

Dating back to the invention of the computer, technological advancements have continually altered how employees complete their work. The advent of the Internet, e-mails, smart phones, remote access software, and cloud computing have all incrementally contributed to the development of the “Virtual Workplace.”

Whether it involves a formal telecommuting arrangement or employees extending their workday by checking email on an iPhone or remotely downloading a document from a “cloud” or via software that connects their home computer to their employer’s network – an increasing number of 21st-century employees conduct a portion of their duties in this virtual environment. Expanding the workplace in this manner can create win-win opportunities for both the employer and employee. However, permitting employees to work outside of the four walls of an employer’s worksite can also create risks for unprepared employers in a number of areas. Employers can avoid exposure by proactively anticipating and addressing these issues in policies and agreements with employees.

According to a 2015 Gallup poll, 37% of U.S. workers state that they have telecommuted. This is four times greater than the 9% reported in 1996. While telecommuting is certainly on the rise, it is still not commonplace across the workforce. For those who do telecommute, it is rarely a full-time endeavor. Rather, on average, these workers telecommuted just two days per month. Only about 10% of those who telecommute do so more than 10 workdays per month. Perhaps not surprisingly in our increasingly 24/7 work environment, much of the reported tele-working activity actually occurs at home after regular working hours or over the weekend. Moreover, because by its nature telecommuting relies upon technology to perform tasks, only certain jobs are suited for telecommuting. A majority of telecommuters are college educated, with annual household income of $75,000 or more and hold a “white-collar” job.

Overall, productivity does not appear to be an issue for telecommuters. Almost 60% of those polled by Gallup believe that workers are equally productive working remotely as they are in the office. Twenty-five percent of telecommuters believe they are more productive than their at work counterparts. It is generally believed that employees who telecommute have better attendance – they are more likely to work when they are ill, when a child is ill or when they have to attend to personal matters. This results in cost savings to employers as well as greater productivity. Employers with formal telecommuting programs report decreases in their real estate and overhead. Employees who telecommute may be more engaged in their jobs and have greater job satisfaction, which, in turn, can translate into greater loyalty and less turnover.

====== 68 ======

Employers can reduce costs by, for example, hiring telecommuters from locations with lower costs of living. Also, the pool of qualified candidates is much greater when not limited to a particular locale.

Another important benefit of telecommuting is that it limits the type of negative workplace interactions that may result in discrimination, harassment, and retaliation lawsuits. Gossip and interpersonal tension are unavoidable when employees are forced to spend long hours together, in close quarters, at times under intense pressure. By allowing employees to spend more time physically apart from their co-workers, companies can diffuse interpersonal tension and minimize destructive gossip.

Of course, there are downsides and risks to telecommuting as well. As for the telecommuters, some report feeling isolated. Others report being passed over for promotion due to being “out of sight and out of mind”. In 2013, Yahoo CEO Marissa Meyer famously ordered all company employees back to the workplace. According to Meyer, this move was done in an effort to foster greater collaboration and communication amongst employees. But there are other, more tangible risks for employers. Through thoughtful and creative management, companies can greatly mitigate the risks telecommuting poses.

Recommendations for Mitigating the Risks Posed by the Virtual Workplace

Before rushing to reap the benefits that telecommuting models afford, companies must be careful to identify and develop plans for managing the array of associated risks.

1. Privacy & Data Security

A paramount concern of employers that permit telecommuting must be securing its customer and employee data. This is particularly so for companies operating in industries in which employees frequently work with confidential data – such as healthcare, financial and retail industries. Indeed, according to recent report by the Wall Street Journal about a survey by the Association for Corporate Counsel, “employee error” turns out to be the most common reason for data breaches. An example of the kind of employee error mentioned in the survey – “accidently sending an email with sensitive information to someone outside the company” – is something just about all of us have heard about or experienced in our own organizations.

 

====== 69 ======

a. Virtual Private Networks

The risk for a data breach grows for employees working remotely. Instead of working in the controlled environment of an office, where equipment and networks can be closely monitored and maintained, telecommuters may access and transfer confidential and proprietary data from shoddily-secured devices and/or over networks that lack adequate security protections. To guard against these risks, companies should strongly consider providing telecommuters virtual private network (VPN) access to the companies’ private networks. VPNs can allow employees to securely access the corporate intranet while travelling outside the office. Employers should mandate that telecommuters utilize the VPN whenever sending or receiving data from the company’s network.

b. “Bring Your Own Device” Policies

The use of mobile devices by telecommuters is another source of potential liability. Bring Your Own Device (“BYOD”) policies have become increasingly popular among employers, both because they shift the cost of purchasing devices onto employees and because they satisfy the desire of employees to select their favorite devices. Before implementing BYOD policies, however, companies should take steps to manage the accompanying risks.

One such risk is that employees will not equip their devices with adequate anti-virus protections. Without realizing that his device has been attacked by malware, a telecommuter may transfer infected data to his company’s network, thereby triggering a security breach. Of particular concern are the apps that reside on a telecommuter’s device. Many mobile app developers do not place a high priority on data security, as illustrated by a recent IBM/ Ponemon study:

Fifty percent of mobile app developers have no budget for security.

Forty percent of companies don’t scan mobile app codes for vulnerabilities.

The average company tests less than half of the apps it builds for security issues.

Thirty-three percent of companies never test any apps for security.

====== 70 ======

Such vulnerabilities have contributed to over one billion personal data records being compromised last year alone. In addition, studies show that 11.6 million mobile devices being affected by malware at any given time.

Whether an employer does or does not have a “BYOD” program, it may not realize how much of its data is stored on its employees’ personal devices. In either case, the company’s data is at risk. According to the same IBM/Ponemon study, a majority of employees (over fifty-five percent) define themselves as heavy app users yet indicate that their employer does not have a policy that defines the acceptable use of mobile apps in the workplace. An even larger majority of employers (67%) do not review or vet the downloading of mobile apps in the workplace. Most employers allow employees to use and download business apps on their personal devices without monitoring for potential security issues.

Developing and implementing a comprehensive BYOD program can help to mitigate those risks, including those that apps present. Many employers are probably not even aware of this potential “app” risk to electronic company information. Employers are advised to move quickly to address potential security risks to company confidential information, including those created by the use of mobile apps.

Companies should oversee the installation and maintenance, on all telecommuter work devices, of company-approved anti-virus software. Companies should also ensure that all telecommuter devices are equipped with locator and remote wiping applications. In the event that a telecommuter’s device is lost or stolen, these applications will allow the company to recover the device or, if recovery is impossible, to erase its data.

c. Cloud Computing

In a USA Today guest essay, Rajiv Gupta, a former General Manager at Hewlett Packard and a Professor of Computer Science and Engineering at the University of California, Riverside, predicted that “by 2020 nearly 40% of the information in the digital universe will be touched by cloud computing providers.” Cloud computing refers to the storage, management and processing of data on a network of remote servers located on the internet rather than locally on a computer or on a company’s physical server. There are now hundreds of cloud service providers. Many businesses recognize this trend and may already have business data

====== 71 ======

and applications in the cloud. However, some may not realize that some of their data is in the cloud without their knowledge or authorization, and without having had an opportunity to vet the provider(s). For example, it has been found that as many as 1 in 5 employees use commercial cloud providers to store company information. Many of those employees are undoubtedly telecommuters, who informally utilize cloud providers to facilitate ready access to company data while they are working remotely. The company’s IT department likely has no knowledge that employees are utilizing these apps, creating what has been referred to as “shadow IT”. The employees, in turn, likely do not realize the risk that storing corporate data on unsecured apps can present, including loss or theft of intellectual properly, violation of regulatory requirements governing the security of data such as HIPAA, breach of customer contracts mandating the security of its data, loss of control over the data, lack of awareness if a breach were to occur and a failure to comply with breach notification laws or contractual provisions.

Employers are well-advised to take steps to understand what company data is being uploaded to a cloud service, what cloud services are being informally utilized by telecommuters and then to try to reign it in through adoption of clear policies and training of employees.

d. Employer “To Do’s” To Minimize Risk of Security Breaches

Addressing data security in an organization often means focusing on its IT infrastructure, with less attention to how employees do their jobs, on what information they have access to and why, and whether employees are sufficiently aware of best practices for safeguarding information, among other things. Firewalls, software updates and encryption all are important to a comprehensive information security program for telecommuters, but organizations first must understand the roles employees play and the functions they carry out that involve personal information. It is not uncommon for employee mistakes to bypass the IT safeguards, resulting in a data breach.

In many organizations, data breach prevention is thought of solely as an IT function. In most cases, this is simply the wrong approach. Data security is an enterprise-wide concern, requiring other stakeholders to have a seat at the table when trying to

====== 72 ======

understand and minimize these risks. The IT department is a necessary component for developing a data security plan, but its participation alone is not sufficient.

Organizations and their employees are increasingly challenged by an expanding regulatory and compliance environment – data security is a part of that environment. The absence of adequate training can not only cause the organization to fall short of certain compliance mandates, but it is a missed opportunity to reduce data breach risk. Training ought to reach beyond how to set a good password and the policy on using flash drives. These are important, but training also should remind employees about basic steps they take in the course of their particular job which could trigger a significant breach if they are not careful – e.g., be careful when forwarding email with sensitive attachments, avoid clicking on links in emails, don’t leave boxes with sensitive data laying around, etc.

2. Wage & Hour

Telecommuting also has implications for wage and hour compliance. While surveys reveal that the majority of telecommuters are classified as exempt from federal and state wage and hour laws, many are (or should properly be) classified as non-exempt, meaning that they are eligible for overtime for all hours worked beyond 40 in a workweek. Studies also show that remote employees may actually work more hours per week on average than their counterparts working in the office. A failure to ensure that telecommuters are paid for all hours worked, including time and one half for overtime hours, can lead to class action claims and very steep damages.

Ensuring that a remote employee accurately reports her start time, end time, and breaks is, of course, considerably more difficult when she is working remotely. For that reason, employers should establish policies for non-exempt telecommuters, which require them to (a) use company-provided software to accurately track their time, and (b) sign acknowledgements, on a regular basis, attesting to their compliance with the company’s time-tracking policies. Employers should also develop policies that clearly explain to all employees – including managers – that telecommuters are, like employees in the employer’s home office, subject to state and federal wage and hour laws and that they are strictly prohibited from working “off the clock”. Put another way, employers must ensure that their employees are not under the misimpression that telecommuters are “on-call” at all times. Ideally, non-exempt telecommuters should be permitted to

====== 73 ======

work overtime only with prior written approval from a manager. Although employees must be paid for all time worked regardless of whether it was recorded or authorized, the employee can, and should, be subject to disciplinary action for engaging in “off the clock” work.

Managers and supervisors of telecommuters must also be trained to understand and enforce applicable wage and hour laws. Even if a telecommuter fails properly to record his hours worked, the employer can still be held liable if a manager knew, or should have known, that the employee worked the additional hours. If a manager is receiving emails, texts or instant messages from a telecommuter outside of regular working hours, that manager must ensure that the time is being recorded. In sum, an employer cannot knowingly permit work to occur without compensating for it and/or putting an end to it.

Many states mandate meal and rest breaks. This time must be uninterrupted with no work. The penalties for non-compliance with meal and rest break laws can be steep and, once again, can give rise to costly class action lawsuits. It is difficult enough to ensure that employees working in the same worksite as their manager are taking their mandatory breaks – the concern is compounded for remote workers. While imperfect, amongst other steps, employers must train telecommuters and their managers on the requirements of the meal and rest break laws and have remote workers sign periodic acknowledgements that they are taking the required breaks. If a supervisor suspects that an employee is not taking his mandated breaks, the supervisor must proactively take steps to address it.

Pay for travel time is another issue for employers with telecommuting workforces to consider. As a general matter, employers are not required to pay employees for time spent commuting to or from their regular place of work. However, when a telecommuter’s regular place of work is her home, time the employee spends traveling to or from the workplace (before or during the workday) to attend meetings or to retrieve physical files may be compensable.

Employers must also bear in mind that, with limited exception, exempt employees must be paid for any work week in which they perform any work at all. To save costs, some employers have instituted mandatory unpaid week-long furloughs. If an exempt employee remotely performs any work that work week, including checking e-mails on a smart phone, she is entitled to her pay for the entire week.

 

====== 74 ======

3. OSHA & Workers’ Compensation

Another area of concern for employers who permit telecommuting is OSHA-compliance. For example, how do employers ensure that their employees’ new work environments – their homes – are OSHA-compliant? Significantly, OSHA does not hold employers liable for, and does not obligate them to inspect, their employees’ home offices. The one exception to this general policy is situations where the employer provides the employee, or requires the employee to use, materials, equipment, or work processes (collectively “materials”) that cause the hazard at issue. Employers should therefore carefully consider what materials they will provide to or require employees to use and clearly distinguish, in their telecommuting policies, those materials from other unrelated materials their employees may have in their homes. Employers should also train employees on how to safely use any materials the company provides or requires.

Telecommuting also broadens the workers’ compensation landscape. Courts have, for example, granted workers’ compensation benefits to the family of an employee who died of a blood clot after sitting at her home office computer for long periods of time and to a saleswoman who tripped over her dog while carrying fabric samples from her home to her car. Employers can mitigate their liability exposure in such scenarios by entering into written agreements with telecommuters that clearly and narrowly define which areas of the telecommuters’ home constitute his or her “home office.” Employers can also retain the services of remote workplace consultants who, for a one-time fee, will help telecommuters set up their home offices and examine and document the initial condition of those offices. Doing so may enable employers to preemptively identify areas of risk and can serve as proof, should the employee later file a workers’ compensation claim, that the employer did its part to provide a safe workspace.

4. Discrimination Claims and Telecommuting

Any time an employer offers a benefit to some, but not all, employees, there are risks for discrimination claims. An employee denied the opportunity to telecommute may believe that it was based upon her membership in a protected class under applicable state or federal discrimination laws. Protected classes can include gender, age, disability, nationality, religion, race, color, sexual orientation, etc. To decrease the likelihood of discrimination claims arising from a denial of a request to telecommute, employers should analyze what

====== 75 ======

work within its organization can be performed remotely and should create criteria to be applied by managers in making these determinations. Employers will also want to consider the traits of employees who are well-suited for telecommuting, such as reliability, ability to work independently, good communication skills, and high performance. It should be clear in written policies that the decision whether to permit a remote working arrangement is left to the sole discretion of management and, just as with the employment relationship, a telecommuting arrangement may be terminated by the company at any time. While there is discretion, managers should nonetheless strive to apply the telecommuting criteria uniformly and document their decisions.

5. Telecommuting as a Reasonable Accommodation

Increasingly, with advances in technology, a telecommuting arrangement may be a reasonable accommodation under the Americans with Disabilities Act. This is so even if the company does not have a telecommuting program or if the employee or his job does not precisely meet the criteria for telecommuting developed by the employer. A company must not reject a request for telecommuting out of hand, but, rather, should view the request as triggering the good faith interactive process required by the ADA. However, it is well-settled that a reasonable accommodation does not include the elimination of essential job duties. Thus, a critical issue in evaluating telecommuting as a reasonable accommodation is whether the essential duties of the position can be performed remotely. In arriving at that determination, an employer should consider the primary purpose of the job and the written job description, as well as the actual day-today duties performed by the employee.

It was feared by many employers that a 2014 decision by the Sixth Circuit in EEOC v. Ford Motor Co., 752 F.3d 634 (6th Cir. 2014), which offered a very broad interpretation of telecommuting as a reasonable accommodation, would open the floodgates for telecommuting requests and lead to more claims under the ADA. However, in EEOC v. Ford Motor Co., 782 F.3d 753 (6th Cir. 2015), an en banc panel of the Sixth Circuit reversed the prior decision of the three-judge panel. The plaintiff in that case, a buyer for Ford Motor Company suffering from irritable bowel syndrome, argued that she should be entitled to telecommute a few days per week because in-person attendance was, in her view, not an essential function of her job. Among other arguments, she pointed out that her employer had

====== 76 ======

allowed similar employees to telecommute on occasion, that she could perform nearly all of her duties remotely, and that the job description stated that workers might be allowed to telecommute when appropriate. The en banc panel rejected those arguments— relying primarily on the employer’s judgment and the consequences of not requiring the plaintiff to attend work in the office. It held as a matter of law that in-person attendance was an essential function of the plaintiff’s job. While this decision is highly favorable to employers, it is still necessary for employers to assess any and all requests for reasonable accommodation on a case-by-case basis considering all factors.

6. Telecommuting and the Family And Medical Leave Act

Employers may believe that because an employee works remotely out of state, the employee is not eligible for the protections of the Family and Medical Leave Act (FMLA) because there are not 50 or more employees within a 75-mile radius. However, pursuant to FMLA regulations, a remote employee may be deemed to “work” in the physical location to which she reports, even if it is hundreds of miles away. (The same is true when counting where employees work when analyzing whether the Worker Adjustment Retraining and Notification Act is triggered by a plant closing or layoff.)

Moreover, an employer cannot force an employee who is otherwise eligible for leave under FMLA to telecommute instead. However, for liability reasons, employers should not permit even well-meaning employees on FMLA to casually work from home without first obtaining a fitness for duty certificate from a doctor. The leave should then be treated and tracked as intermittent, rather than continuous, FMLA leave.

Conclusion

The virtual workplace is here to stay. To decrease the risk of data breaches and legal exposure, employers should adopt formal telecommuting and IT policies covering the above topics and others. Managers should receive ongoing training on the company’s policies and on the laws impacting the workplace and how they may apply to the remote workforce.