Why Conduct Background Checks:

1. Why Conduct Background Checks: Employment Screening STEINER CONSULTING, LLC

2. Food For Thought • Some Statistics For Thought • 43% of Resumes Contain Significant Inaccuracies • statistics show that over 90% of college students say they would lie on a resume to get the job they want. • Cost of One Bad Hiring Decision Can Exceed • Recruiting, Screening, Testing, Interviewing • Hiring • Training • Incomplete Job or Poorly Done Job • Likelihood of Associated Theft, Violence, Injury $1,000,000 STEINER CONSULTING, LLC

3. Business Reasons • To Make the Best Hiring Decision • Gain a Competitive Advantage • Reduce Turnover • Increase Productivity & Morale • Reduce Risk of Business Disruption • Comply with Federal Law Mandates for Certain Industries • Healthcare, Childcare, Hazardous Waste Drivers, Public Companies’ Employees, Commercial Drivers, Airlines, Trucking, Etc. • Fulfill Other Contractual or Legal Obligations STEINER CONSULTING, LLC

4. To Provide a Safe Work Environment • Protect the Assets of the Organization • Foster Peace of Mind • Reduce Risk of Legal Liability • Failure to Perform Due Diligence • Negligent Hiring • Inequitable Treatment of Applicant Pool STEINER CONSULTING, LLC

5. Employers’ Legal Obligations To Screen • Premises Liability • Respondent Superior • Indirectly Liable for Acts of Employee In Course of Employment • Harassment • Negligence • Federal OSHA Laws • “General Duty” to Protect Employees Against “Recognized Hazards” STEINER CONSULTING, LLC

6. Laws Affecting Background Screening • FCRA (The Fair Credit Reporting Act) • As Amended By FACTA December 2006 (15 USC 1681 et seq.) • FACTA - The Fair and Accurate Credit Transactions Act • Enforced by FTC - Federal Trade Commission • $100-$1,000 statutory damages without showing of actual harm • Punitive Damages and Attorney Fees for “willful” violations • State Consumer Reporting Statutes • Oklahoma Security Breach Notification Act (24 OS 161 et seq.) • Oklahoma Consumer Protection Act (15 OS 751 et seq.) • Regulated Industry Requirements • HEALTHCARE AND PHARMACY • Transportation • Securities • Nuclear • Banking • Healthcare • Education STEINER CONSULTING, LLC

7. Laws Continued • State Licensing Requirements • Pharmacy Responsibilities (59 OS 353 et seq.) • State Law Protections • 25 OS 1101 et seq • Handicap • Gender • Retaliation • USA Patriot Act (Financial Industry) • 2001; re-adopted 2005 • US Bankruptcy Code (11 USC § 525(b)) • Sarbanes-Oxley Act of 2002 (Public Companies) • 15 USC 1514A (Whistleblower protection) • Title VII of CRA of 1964 (42 USC 2000 et seq.) • association (marriage), race, color, religion, sex, national origin • Enforced By EEOC STEINER CONSULTING, LLC

8. Laws Continued • Americans with Disabilities Act (ADA) • 42 USC 21111 et seq. • Discrimination in employment application procedures, hiring, advancement and discharge, workers comp, job training, and other terms, conditions, and privileges of employment • Age Discrimination in Employment Act of 1967 (ADEA) • 29 USC 621 et seq. • Discrimination in hiring, promotions, wages, or termination of employment and layoffs • State Employment Laws • Identity/Employee Privacy (21 OS 1533.1 et seq.) • Common Law STEINER CONSULTING, LLC

9. Laws Continued • Driver’s Privacy Protection Act (18 USC 721) • Financial Modernization Act of 1999 (Gramm-Leach-Bliley Act) • Financial Institutions (15 USC 1581) • Health Insurance Portability & Accountability Act (HIPAA) • Privacy Rule • Security Rule • Patient Safety and Quality Improvement Act of 2005 (PSQIA) (42 CFR Part 3) STEINER CONSULTING, LLC

10. Legal Disclaimer: This presentation is designed solely for informational purposes, and should not be inferred or understood as legal advice. Persons in need of legal assistance should seek the advice of competent legal counsel. Check with an employment law attorney in your state before approving and applying any of the suggestions or interview/application questions in this article. An employer should engage in a careful analysis to determine they will not violate a federal law, state law or Title VII of the 1964 Civil Rights Act. STEINER CONSULTING, LLC

11. Pharmacy Law Regulatory Overview • Pharmacy is one of the most highly regulated professions/businesses • Protection of the Public • FDA (now under HHS) • Historical Development • Pure Food and Drugs Act (1906) • Food, Drug and Cosmetic Act of 1938 (FFDCA) • Drug Amendments (1962) • Medical Device Amendments (1976) • Infant Formula Act of 1980 • Dietary Supplement Health and Education Act of 1994

12. Application to Pharmacists • Prescription Drug Marketing Act of 1987 (PDMA) • Samples • Licensing of Wholesalers • FDA Modernization Act of 1997 • Compounding • Controlled Substances Act of 1970 • DEA • Scheduled Drugs • Registration • Ordering, Dispensing, Handling, Transfer, Disposal • Security Requirements • Record Keeping • State Law, Regulation and Licensure • Oklahoma Pharmacy Act (59 OS 353 et seq.) • Responsibility of Pharmacist and Discipline (OAC 535)

13. Employment Law Summary • Employment Relationship • At Will Employment • Implied Contracts • Wrongful Discharge • Employee Duties • Loyalty • Trade Secrets • Restrictive Covenants • Employer Duties • Civil Rights • Title VII • ADA • ADEA • State Statutes and Common Law

14. Employment Law Summary (cont’d) • Employer Duties (cont’d) • Hiring Process • Interviews • Medical Examinations (40 OS 551) • Credit and Background Checks (recent limitations) • Immigration Status • Federal Law • State Law (HB 1804) • Wage and Hour Laws Fair Labor Standards Act (FLSA) • Minimum Wage • Overtime • Breaks • Oklahoma Employment Security Act of 1980 (40 OS 1-101 et seq.) • Protection of Labor (40 OS 161 et seq) • Unions/Oklahoma Right to Work (Okla. Const. art. 23, § 1A)

15. Employment Law Summary (cont’d) • Employer Duties (cont’d) • Leaves of Absence • Family and Medical Leave Act (FMLA) • Uniformed Services Employment and Reemployment Rights Act (Military Leave) • Workers Compensation • 85 OS 1 et seq. • Patient Protection and Affordable Care Act • New Health Care Laws • Phase-in 2010 to 2014 • Health and Safety • Occupational Safety and Health Act of 1970 (OSHA) • Oklahoma Occupational Health And Safety Standards Act of 1970 (40 OS 401 et seq.) Fair Labor Standards Act (FLSA) • Minimum Wage • Overtime • Breaks • Oklahoma Employment Security Act of 1980 (40 OS 1-101 et seq.) • Protection of Labor (40 OS 161 et seq)

16. Employment Law Summary (cont’d) • Termination of Employment • Unemployment Compensation • COBRA • Plant Closing Laws • Exit Interviews • Severance Pay and Releases • No legal requirement to pay severance (except as may be required by contract) • Severance for Full Release of Potential Claims

17. Privacy and the Pharmacy –HIPAA and Beyond • Health Insurance Portability and Accountability Act of 1996 • Balance between important uses of Protected Health Information (PHI) vs. protection of privacy of individuals • HIPAA Privacy Rule (45 CFR Parts 160 and 164) • HIPAA Security Rule (45 CFR 164.308 et seq.) • Health Information Technology for Economic and Clinical Health Act (HITECH) (Updated Privacy and Security Rules) • Payment Card Industry Data Security Standards (PCI-DSS) • Electronic Prescribing / VIPPS

18. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Privacy Rule (45 CFR Parts 160 and 164) • Covered Entities • Health Plans • Health Care Providers (Pharmacies) • Business Associates • Protected Health Information (PHI) • Individually identifiable health information • Past, present, future physical or mental health or condition • Providing of health care • Past, present or future payment for health care provided • De-Identified Health Information • Permitted Uses and Disclosures • CONSENT OR AUTHORIZATION • To the individual (including personal representatives) • Health care treatment, payment and operations • Opportunity to agree or object • Incident to permitted use • Public Interest

19. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Privacy Rule (cont’d) • Limiting Permitted Uses • Minimum Necessary • Internal Access and Use (Policies and Procedures) • Business Associates • Notices and Individual Rights; Administrative Requirements • Privacy Notice • Privacy Policies and Procedures • Workforce Training and Management • Mitigation • Data Safeguards • Complaints • Documentation and Record Retention • Notices, Complaints, Policies and Procedures - 6 years • Retaliation and Waiver (Cannot withhold Health Care) • State Law Exceptions (Freedom of Conscience Act) (63 OS 1-728a et seq.)

20. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Privacy Rule (cont’d) • Enforcement • HHS • $100 per failure (up to $25,000 per year) • Criminal Penalties for knowingly obtaining or disclosing PHI

21. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Security Rule (2006) • Ensure confidentiality, integrity and availability of electronic PHI (ePHI) • Administrative Safeguards • Physical Safeguards • Technical Safeguards • Organizational Requirements • Policies, Procedures and Documentation Requirements • Protect against threats, hazards, impermissible use and disclosure • Ensure Workforce compliance • Generally Preempts State Law

22. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Security Rule (cont’d) • Schedule of Required and Addressable Actions • Administrative Safeguards • Security Management (Security Officer) • Workforce Security, information access management • Workforce Training, Security and Incident Procedures • Physical Safeguards • Facility Access Controls • Workstation Use • Workstation Security

23. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • HIPAA Security Rule (cont’d) • Schedule of Required and Addressable Actions (cont’d) • Technical Safeguards • Access Control • Audit Control • Integrity • Person or Entity Authentication • Organizational Requirements • Standard contracts and arrangements • Business Associates; termination of relationships for material violation • Policies, Procedures and Documentation • “Reasonable and Appropriate” Standards

24. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • PCI-DSS • Protection of Credit Card Data • V2.0 (10/26/2010) • Build and Maintain Secure Network • Firewalls; Penetration Tests/Assessment • Protect Cardholder Data • Maintain Vulnerability Management Program • Implement Strong Access Controls • Regularly Monitor and Test Networks • Maintain Information Security Policy • Bank/Provider Audits and Fines

25. Privacy and the Pharmacy –HIPAA and Beyond (cont’d) • Electronic Prescribing • Electronic Signatures in Global and National Commerce Act (E-Sign) and Uniform Electronic Transactions Act (UETA) • Replaced/updated by HIPAA & HITECH • Delivery of Prescriptions • Written; E-Fax; Electronic • Telephone • Oklahoma “other means of communication” (59 OS 353.13A) • Verified Internet Pharmacy Practice Sites (VIPPSS) • National Association of Boards of Pharmacy (NABR) • Online Pharmacy • Certification • Compliance with Applicable Federal and State Laws • Storage and Shipment Standards • Traceable Means • Appropriate temperature, light and humidity standards • Quality Assurance/Quality Improvement Program

26. THANK YOU Christopher S. Heroux 6450 S. Lewis Ave, Ste 115 Tulsa, OK 74136 918.582.3822 918.582.3813  Direct 918.582.3825  Fax chris@herouxhelton.com