With the Biden Administration’s fast rolling COVID vaccination compliance taking hold, the entire federal contracting sector have been scrambling to find resources which past muster. Hundreds of billions of dollars are at stake. On 09 September 2021 the Administration issued an Executive Order and the Department of Labor’s Occupational Safety and Health Administration (OSHA) is issuing an Emergency Temporary Standard (ETS). Both of these will build the basis of the COVID compliance regulatory environment. The former was President Biden’s Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors, has been covered extensively by Foreclosurepedia with respect to the US Department of Housing and Urban Development (HUD). And the latter will require COVID testing or vaccination for companies whom have over 100 employees. And it is the ETS that truly has the costly part of enforcement.
Currently, 29 C.F.R. § 1903.15(d) controls the penalty phase of violating OSHA’s ETS. There are six types of penalty types: Posting requirement violation, Failure to correct violation, Other-than-serious violation, Serious violation, Repeated violation, and Willful violation. If a company violates the Posting requirement, commits an Other-than-serious violation, or a Serious violation, the fine is up to $13,653. The commission of a Willful violation the fine shall not be less than $9,753 and shall not exceed $136,532. Where the teeth really begin to sink in is in the addressing a Repeated violation which the fine shall not exceed $136,532 and the Failure to correct violation which shall not exceed $13,653 PER DAY.
Regardless of the opinions upon COVID vaccination, the reality is that it is already the law of the land when it comes to federal contracting and with respect to the private sector, the US government has already stated there will be zero deviation. Ann Rosenthal, Senior Advisor to HUD laid the ETS framework out including the fact that OSHA will not provide an opportunity to comment on the ETS prior to its publication as a rule, but the ETS preamble will solicit comments.
It should be noted that the complete vaccination process in both the EO and ETS guidance — other than the Johnson and Johnson vaccine — takes roughly 6 weeks as there is a two week period after the cycle before its efficacy is effective in both the Pfizer and Moderna vaccine.
The penalties for non compliance are substantial — both financial and from the loss of federal contract awards. And the need to legitimately verify compliance cannot be overstated. Simply ticking a box will not do. The Mortgage Field Services Industry may be tempted to simply add a self reporting box in the Aspen Grove Solutions (AGS) system; however, as has been well documented, the AGS number is easily spoofed and so unreliable that even Prime Vendors such as ServiceLink have discontinued its use. At the end of the day, Compliance is the name of the game. One of the biggest questions on everyone’s mind has been whether or not requesting a copy of the CDC COVID-19 Vaccination Record Card triggers Health Insurance Portability and Accountability Act (HIPAA) requirements. The answer is no. In fact, this is what the Department of Health and Human Services (HHS) has to say,
If an employer asks an employee to provide proof that they have been vaccinated, that is not a HIPAA violation, and employees may decide whether to provide that information to their employer.
The protection of Personally Identifiable Information (PII) is of paramount concern even though HIPAA may not be triggered. The Industry has, on multiple occasions, suffered from PII breaches such as the massive Assurant breach Foreclosurepedia exclusively reported on or the National Field Network breach. The larger issue with the Industry’s problem deals with technology itself. For years, many of the systems used by Prime Vendors are coded in CoBOL and other archaic computer languages — they do not even teach CoBOL in universities anymore! Moreover, though, the data that the Industry collects jumps through multiple hands. Part of this is due to the remarketing of the data and part of it is simply do to virtually no regulatory oversight.
Walgreens found out, the hard way the dangers of attempting to allow data to commingle with multiple providers,
If you got a Covid-19 test at Walgreens, your personal data — including your name, date of birth, gender identity, phone number, address, and email — was left on the open web for potentially anyone to see and for the multiple ad trackers on Walgreens’ site to collect. In some cases, even the results of these tests could be gleaned from that data.
While multiple Prime Vendors in the Industry have had catastrophic data failures including Mortgage Contracting Services (MCS), the reality is that even the most basic precautions such as securing a website are still ongoing with Government Sponsored Enterprises (GSE) such as Freddie Mac whose website is still insecure. To that point, there is a reason why compliance is generally offloaded to third party service providers.
The US government has been clear in how they are going to implement compliance. Here is what HUD had to say,
[T]he likely scenario for M&M will be that subcontractors or employees of the prime that are required to visit HUD properties will be required to provide the proof to the prime contractors, and HUD will conduct periodic surveillance using the sign-in logs matched against records obtained by the primes.
More on point and we will cover this over the weekend, the Safer Federal Workforce Task Force has issued guidance that ALL federal contractors and subcontractors must be vaccinated regardless of whether they work remotely or if the jobsite is considered outdoors. Additionally, they must all mask up. Currently, the Industry’s regulatory compliance is a hodgepodge of antiquated technology and extremely limited verification. For example, there is no way to verify that the person entering an AGS number into their mobile app is actually the person issued the number. In fact, multiple instances of using AGS numbers — purportedly for background check purposes — from multiple IP addresses across the United States on the same day is common. That means that one person is capable of deploying their AGS number for multiple subcontractors. There is no meaningful verification of insurance policies. There are no requirements for an educational component. And there ultimately is no way to attest to the veracity of anything on a per work order basis. Much of this is because the National Association of Mortgage Field Services (NAMFS) and its membership have refused to allow access to API’s deployed and when access is granted, it is only to NAMFS members.
For an Industry to thrive it needs to be agile. Relying upon antiquated technology and isolating power and control only in the hands of the few invites decay. Continuity is key and competition must be encouraged in order to thrive within the Industry ecosystem. To that point, Foreclosurepedia will be dedicating this weekend’s Industry Insider podcast to the tech firm whom have already developed software which addresses real time verification of background checks, insurance, licensing, master services agreements, and yes COVID testing and vaccination. To say that Compliance is in their DNA is an understatement! Even more impressive is their pricing at less than $35 a year without any start up or ongoing fees.
