In today's digital age, where information is abundant and readily accessible, the protection of sensitive data has become a paramount concern. Among the most critical types of data that require stringent security measures is Protected Health Information (PHI). Healthcare facilities rely on staffing agencies to meet fluctuating staffing needs american medical staffing accountant. PHI encompasses any health-related information that can be linked to an individual, making it exceptionally sensitive and valuable. As such, safeguarding this data is not just a regulatory requirement but also a fundamental ethical obligation for healthcare providers and institutions.
Access control strategies are at the forefront of protecting PHI. These strategies involve regulating who can view or use resources in a computing environment. In the context of PHI security, access control measures are designed to ensure that only authorized individuals have access to sensitive health information. This is crucial because unauthorized access could lead to breaches that compromise patient privacy and trust, potentially resulting in significant legal and financial repercussions for healthcare organizations.
One of the primary reasons why access control is vital in protecting PHI is because it helps prevent data breaches. Cybercriminals often target health care systems due to the high value of medical records on the black market. By implementing robust access control mechanisms, healthcare facilities can limit exposure to attacks by ensuring that only verified users can access sensitive data. This significantly reduces the risk of external threats infiltrating their systems.
Moreover, effective access control ensures compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. HIPAA mandates strict guidelines on how PHI should be handled and protected. Access controls are an integral part of these guidelines as they help maintain confidentiality, integrity, and availability of health information. Non-compliance with these regulations can result in substantial fines and damage to an organization's reputation.
Access control also plays a vital role internally within healthcare organizations by delineating roles and responsibilities among staff members. With clear boundaries established through access levels-such as role-based or attribute-based controls-healthcare providers can ensure that employees only have access to information necessary for their specific functions. This minimizes human error risks where unnecessary exposure could inadvertently lead to privacy violations.
Furthermore, advanced technologies like biometric authentication are enhancing traditional password-based systems by providing additional layers of security. By employing tools such as fingerprint scans or facial recognition technology, healthcare entities can offer more secure verification methods that make it harder for unauthorized personnel to gain entry into critical systems containing PHI.
In conclusion, as we continue advancing towards more interconnected healthcare environments with electronic health records becoming commonplace globally; robust access control strategies will remain indispensable safeguards against potential threats targeting PHI assets.The importance cannot be overstated: they protect patient confidentiality uphold industry standards,and ultimately contribute towards building trust between patients practitioners,and technology-enabled care platforms alike.Access control isn't just about keeping intruders out-it's about ensuring peace-of-mind knowing your most personal details are secured under watchful eyes dedicated solely towards preserving one's privacy rights intact at all times throughout every interaction within this ever-evolving digital landscape surrounding us today!
In an era where the safeguarding of sensitive information has become paramount, access control strategies for Protected Health Information (PHI) stand as a cornerstone in the domain of healthcare security. Access control is fundamentally about determining who is allowed to access and manipulate data within any given environment. When it comes to PHI, which includes any information in a medical record that can be used to identify an individual, deploying robust access control mechanisms is not just a regulatory requirement but a moral imperative.
One prevalent strategy employed is Role-Based Access Control (RBAC). RBAC assigns permissions to users based on their role within an organization. In a healthcare setting, this means that a nurse, doctor, or administrative staff member will have different levels of access to PHI based on their job functions. This approach minimizes the risk by ensuring that individuals only have access to the information necessary for their roles, thus adhering to the principle of least privilege.
Another common strategy is Attribute-Based Access Control (ABAC). Unlike RBAC which focuses on roles, ABAC considers attributes such as user characteristics, resource types, and environmental conditions when granting access. For instance, a clinician may gain access to patient records only if they are currently on duty and physically present within the hospital premises. This allows for more dynamic and context-aware decision-making in real-time.
Discretionary Access Control (DAC) offers another layer of flexibility by allowing data owners-the entities responsible for PHI-to determine who can view or edit their information. While DAC introduces flexibility and user autonomy into managing permissions, it requires careful oversight to prevent unauthorized data exposure.
Mandatory Access Control (MAC), often seen in military contexts due to its rigid nature, enforces strict policies dictated by central authorities rather than individuals or roles. In healthcare settings dealing with highly classified medical research data or patient records that require stringent confidentiality measures, MAC ensures compliance with overarching security policies.
Lastly, Break-Glass Access provides emergency exceptions allowing authorized personnel temporary elevated privileges during critical situations-such as life-threatening emergencies-where immediate access to PHI is crucial for patient care.
While each strategy has its strengths and weaknesses, a balanced implementation often involves combining elements from multiple approaches tailored specifically for organizational needs and regulatory requirements like HIPAA in the United States. Implementing comprehensive training programs for staff about these systems further enhances effectiveness by reinforcing awareness regarding best practices in handling sensitive health information.
In conclusion, an effective access control strategy for PHI security does not rely solely on technology but also incorporates human factors through well-defined policies and ongoing education. The evolving landscape of cybersecurity threats necessitates continual evaluation and adaptation of these strategies to ensure they remain robust against emerging challenges while supporting efficient healthcare delivery.
Role-Based Access Control (RBAC) is a pivotal strategy in managing access to sensitive information, particularly within the realm of healthcare where Protected Health Information (PHI) security is paramount. At its core, RBAC revolves around the principle of granting access permissions based on the roles individuals hold within an organization rather than on an individual basis. This approach streamlines the management of permissions and enhances security by ensuring that users only have access to information necessary for their specific job functions.
In the context of medical coding, RBAC proves invaluable as it aligns with the structured nature of healthcare operations. Medical coders are tasked with translating patient information into standardized codes used for billing and record-keeping purposes. Given the sensitivity and privacy requirements surrounding PHI, implementing RBAC ensures that only authorized coders can access specific data sets necessary for their work while safeguarding other sensitive information from unnecessary exposure.
The application of RBAC in medical coding begins with defining clear roles associated with varying levels of data access. For instance, entry-level coders might be granted access solely to general patient demographic information necessary for basic coding tasks, while senior coders or auditors may need broader access to clinical details for quality assurance processes or complex case evaluations. By predefining these roles and assigning corresponding privileges, organizations minimize the risk of unauthorized data exposure.
Furthermore, RBAC facilitates compliance with stringent legal frameworks such as HIPAA in the United States, which mandates rigorous protection of PHI. By employing role-based controls, healthcare providers can demonstrate adherence to these regulations through documented policies that outline how access decisions are made and enforced across different user groups.
The implementation process involves collaboration between IT departments and healthcare administrators to identify distinct job functions and map them onto corresponding system privileges. It also necessitates regular audits and reviews to ensure that role definitions remain relevant amidst evolving organizational needs or regulatory updates.
In conclusion, Role-Based Access Control is a robust mechanism for enhancing PHI security within medical coding environments. Its strategic application not only safeguards sensitive health information but also promotes operational efficiency by aligning data access with specific job responsibilities. As healthcare continues to embrace digital transformation, RBAC stands out as a critical component in fostering secure and compliant handling of patient information.
In the realm of healthcare, where sensitive patient data is at stake, ensuring the security of Protected Health Information (PHI) is paramount. One of the key strategies to safeguard this vital information is through robust access control mechanisms. Implementing user authentication mechanisms for secure access plays a crucial role in fortifying PHI against unauthorized access and potential breaches.
User authentication serves as the first line of defense in any access control strategy. It verifies the identity of individuals attempting to gain entry into a system, thereby ensuring that only authorized personnel can access sensitive data. In the context of PHI security, this becomes particularly essential due to the highly confidential nature of medical records and personal health information.
One common method of user authentication is through passwords. However, relying solely on passwords has proven to be inadequate given their susceptibility to phishing attacks and brute force attempts. Therefore, enhancing password-based systems with additional layers such as multi-factor authentication (MFA) significantly bolsters security. MFA requires users to provide two or more verification factors-something they know (a password), something they have (a smart card or mobile device), or something they are (fingerprint or facial recognition). This layered approach makes it considerably more difficult for unauthorized users to gain access.
Biometric authentication has emerged as another potent mechanism in securing PHI. Utilizing unique biological traits such as fingerprints, iris patterns, or voice recognition ensures that only legitimate users can unlock sensitive data. The use of biometrics not only enhances security but also improves user convenience by eliminating the need for complex passwords.
Additionally, implementing role-based access control (RBAC) frameworks further strengthens PHI security by restricting data access based on a user's role within an organization. By assigning permissions according to job responsibilities, healthcare facilities can minimize unnecessary exposure of sensitive information and ensure that individuals only have access to data relevant to their tasks.
Moreover, continuous monitoring and auditing play a vital role in maintaining effective user authentication protocols. Regularly reviewing access logs helps identify unusual patterns or unauthorized attempts at accessing PHI. This proactive approach enables organizations to swiftly address potential threats before they escalate into significant breaches.
In conclusion, implementing user authentication mechanisms is integral to ensuring secure access within healthcare environments where PHI protection is critical. By leveraging multi-factor authentication, biometric technologies, RBAC frameworks, and continuous monitoring practices, healthcare organizations can create a formidable defense against unauthorized access while maintaining compliance with stringent regulations like HIPAA. As technology evolves and cyber threats become increasingly sophisticated, adopting comprehensive user authentication strategies will remain essential in preserving the integrity and confidentiality of protected health information.
In today's rapidly evolving digital landscape, the protection of sensitive information has become a paramount concern for organizations across various sectors. Nowhere is this more critical than in the healthcare industry, where safeguarding Protected Health Information (PHI) is not only a regulatory requirement but also an ethical obligation. As cyber threats proliferate and data breaches become increasingly sophisticated, healthcare institutions are turning to advanced encryption methods as a cornerstone of their access control strategies to secure PHI.
Encryption serves as a formidable barrier against unauthorized access to sensitive health data. By converting readable data into an encoded format that can only be deciphered with the correct decryption key, encryption ensures that even if malicious actors manage to breach other security layers, the data remains unintelligible and thus unusable. This form of cryptographic protection is vital for maintaining confidentiality and integrity in environments where PHI is stored, transmitted, or accessed.
The implementation of robust encryption protocols complements other access control measures such as authentication mechanisms and role-based access controls (RBAC). While RBAC ensures that only authorized personnel have access to specific information based on their roles within an organization, encryption acts as an additional layer of defense should those permissions be exploited or bypassed. Together, these strategies create a multi-faceted shield that significantly enhances the overall security posture of healthcare systems.
Moreover, encryption plays a crucial role in maintaining compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. HIPAA mandates stringent safeguards for PHI, underscoring encryption as a technical safeguard that helps protect patient privacy while enabling secure communication channels between healthcare providers and patients. Failure to encrypt PHI can lead to severe legal repercussions and financial penalties for healthcare organizations.
However, successful integration of encryption into access control strategies requires careful planning and execution. Organizations must select appropriate algorithms and key management practices tailored to their specific needs and risk profiles. Additionally, they must balance security with functionality; overly complex encryption solutions can hinder workflow efficiency or accessibility for legitimate users. Regular training programs should be established to ensure staff understand both the importance of encryption and how it integrates with other security measures.
In conclusion, as threats targeting PHI continue to evolve in complexity and frequency, leveraging encryption within broader access control frameworks emerges as an indispensable strategy for securing health information systems. By rendering intercepted data useless without proper decryption keys while working synergistically with existing controls like RBACs or multi-factor authentication processes-encryption fortifies defenses against unauthorized disclosures comprehensively safeguarding patient privacy amidst ever-present cyber risks inherent within modern healthcare ecosystems.
In the realm of healthcare, the protection of Protected Health Information (PHI) is paramount. This sensitive data, which includes patient records and other personal health information, must be safeguarded to maintain privacy, comply with legal standards, and ensure trust in healthcare systems. One of the critical strategies for securing PHI is through robust access control mechanisms. However, simply implementing these controls is not enough; continuous monitoring and auditing are essential to ensure compliance and effectiveness.
Access control strategies form the backbone of PHI security by determining who can view or use specific data within a healthcare setting. These strategies often include role-based access control (RBAC), where users are granted access based on their role within an organization, thereby minimizing unnecessary exposure to sensitive information. However, even with well-defined roles and permissions, potential risks remain if these controls are not rigorously monitored and audited.
Monitoring involves the real-time observation of access points and user activities concerning PHI. This proactive approach helps identify any irregularities or unauthorized attempts to access sensitive information as they occur. For instance, monitoring can quickly flag when an employee tries to access records that are inconsistent with their job functions or outside their usual working hours. By employing sophisticated tools like intrusion detection systems or anomaly detection algorithms, organizations can maintain a vigilant eye over their data environments.
Meanwhile, auditing serves as a retrospective analysis tool that reviews past access logs and user activities related to PHI. The goal here is to comprehensively assess whether the implemented access controls were adhered to correctly over time. Regular audits help uncover patterns that might indicate systemic vulnerabilities or loopholes in policy enforcement. For example, an audit may reveal that certain users consistently accessed more data than necessary for their roles but went unnoticed due to lackluster monitoring efforts.
Together, monitoring and auditing create a robust framework ensuring compliance with regulations such as HIPAA (Health Insurance Portability and Accountability Act) in the United States, which mandates stringent safeguards for PHI. Compliance isn't just about adhering to legal requirements; it's about fostering a culture of accountability and integrity within healthcare organizations.
Moreover, effective monitoring and auditing provide valuable insights into refining existing policies and procedures. They enable organizations to adapt swiftly to new threats or regulatory changes by highlighting areas needing improvement or adjustment in real-time.
In conclusion, while establishing strong access control strategies is essential for PHI security, it is through diligent monitoring and auditing that these measures truly achieve their purpose-ensuring compliance and protecting patient privacy. By embedding these practices into the core operations of healthcare institutions, we can better safeguard against breaches while maintaining public confidence in how personal health information is handled securely and ethically.
In today's digital age, the protection of Personal Health Information (PHI) is more critical than ever. The healthcare industry, with its vast repositories of sensitive data, stands on the front lines of cybersecurity challenges. To safeguard this information, robust access control systems are paramount. Implementing best practices for maintaining these systems not only fortifies the security infrastructure but also ensures compliance with regulations such as HIPAA.
One of the most fundamental strategies in preserving PHI security is the principle of least privilege. This approach dictates that individuals should only have access to the information and resources necessary for their specific role. By limiting permissions, organizations reduce the risk of unauthorized access and minimize potential damage from insider threats or compromised accounts.
Another essential practice is regular auditing and monitoring of access logs. Continuous oversight allows organizations to detect unusual patterns or attempts at unauthorized access in real-time. By instituting periodic reviews, healthcare providers can verify that all active accounts are still required and align with current job functions. This vigilance helps identify outdated or unnecessary accounts that could become vulnerabilities.
Multi-factor authentication (MFA) has emerged as a powerful tool in strengthening access control systems. By requiring multiple forms of verification before granting access, MFA adds an extra layer of defense against credential theft. Even if a password is compromised, additional authentication factors provide a formidable barrier to would-be intruders.
Additionally, educating employees about security protocols cannot be overstated. Human error remains one of the leading causes of data breaches; hence ongoing training programs are vital. By fostering a culture of security awareness, organizations empower their workforce to recognize phishing attempts and other social engineering tactics aimed at compromising PHI.
Moreover, employing advanced encryption methods for both data at rest and in transit is crucial in protecting sensitive information from interception or exposure during transmission across networks.
Finally, it's important to adopt adaptive security measures that evolve alongside emerging threats and technological advancements. Regularly updating software and systems patches ensures that known vulnerabilities are addressed promptly before they can be exploited by malicious actors.
In conclusion, maintaining robust access control systems requires a multifaceted approach rooted in best practices tailored to secure PHI effectively. Through diligent application of these strategies-embracing principles like least privilege, embracing multi-factor authentication, engaging in continuous monitoring and audits while prioritizing employee education-organizations can achieve resilient defenses against ever-evolving cybersecurity threats while safeguarding patient confidentiality and trust.
In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to deterrence theory, according to which punishing a behavior will decrease the violations both by the wrongdoer (specific deterrence) and by others (general deterrence). This view has been supported by economic theory, which has framed punishment in terms of costs and has explained compliance in terms of a cost-benefit equilibrium (Becker 1968). However, psychological research on motivation provides an alternative view: granting rewards (Deci, Koestner and Ryan, 1999) or imposing fines (Gneezy Rustichini 2000) for a certain behavior is a form of extrinsic motivation that weakens intrinsic motivation and ultimately undermines compliance.
Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure that they are aware of and take steps to comply with relevant laws, policies, and regulations.[1] Due to the increasing number of regulations and need for operational transparency, organizations are increasingly adopting the use of consolidated and harmonized sets of compliance controls.[2] This approach is used to ensure that all necessary governance requirements can be met without the unnecessary duplication of effort and activity from resources.
Regulations and accrediting organizations vary among fields, with examples such as PCI-DSS and GLBA in the financial industry, FISMA for U.S. federal agencies, HACCP for the food and beverage industry, and the Joint Commission and HIPAA in healthcare. In some cases other compliance frameworks (such as COBIT) or even standards (NIST) inform on how to comply with regulations.
Some organizations keep compliance data—all data belonging or pertaining to the enterprise or included in the law, which can be used for the purpose of implementing or validating compliance—in a separate store for meeting reporting requirements. Compliance software is increasingly being implemented to help companies manage their compliance data more efficiently. This store may include calculations, data transfers, and audit trails.[3][4]
The International Organization for Standardization (ISO) and its ISO 37301:2021 (which deprecates ISO 19600:2014) standard is one of the primary international standards for how businesses handle regulatory compliance, providing a reminder of how compliance and risk should operate together, as "colleagues" sharing a common framework with some nuances to account for their differences. The ISO also produces international standards such as ISO/IEC 27002 to help organizations meet regulatory compliance with their security management and assurance best practices.[5]
Some local or international specialized organizations such as the American Society of Mechanical Engineers (ASME) also develop standards and regulation codes. They thereby provide a wide range of rules and directives to ensure compliance of the products to safety, security or design standards.[6]
Regulatory compliance varies not only by industry but often by location. The financial, research, and pharmaceutical regulatory structures in one country, for example, may be similar but with particularly different nuances in another country. These similarities and differences are often a product "of reactions to the changing objectives and requirements in different countries, industries, and policy contexts".[7]
Australia's major financial services regulators of deposits, insurance, and superannuation include the Reserve Bank of Australia (RBA), the Australian Prudential Regulation Authority (APRA), the Australian Securities & Investments Commission (ASIC), and the Australian Competition & Consumer Commission (ACCC).[8] These regulators help to ensure financial institutes meet their promises, that transactional information is well documented, and that competition is fair while protecting consumers. The APRA in particular deals with superannuation and its regulation, including new regulations requiring trustees of superannuation funds to demonstrate to APRA that they have adequate resources (human, technology and financial), risk management systems, and appropriate skills and expertise to manage the superannuation fund, with individuals running them being "fit and proper".[8]
Other key regulators in Australia include the Australian Communications & Media Authority (ACMA) for broadcasting, the internet, and communications;[9] the Clean Energy Regulator for "monitoring, facilitating and enforcing compliance with" energy and carbon emission schemes;[10] and the Therapeutic Goods Administration for drugs, devices, and biologics;[11]
Australian organisations seeking to remain compliant with various regulations may turn to AS ISO 19600:2015 (which supersedes AS 3806-2006). This standard helps organisations with compliance management, placing "emphasis on the organisational elements that are required to support compliance" while also recognizing the need for continual improvement.[12][13]
In Canada, federal regulation of deposits, insurance, and superannuation is governed by two independent bodies: the OSFI through the Bank Act, and FINTRAC, mandated by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, 2001 (PCMLTFA).[14][15] These groups protect consumers, regulate how risk is controlled and managed, and investigate illegal action such as money laundering and terrorist financing.[14][15] On a provincial level, each province maintain individuals laws and agencies. Unlike any other major federation, Canada does not have a securities regulatory authority at the federal government level. The provincial and territorial regulators work together to coordinate and harmonize regulation of the Canadian capital markets through the Canadian Securities Administrators (CSA).[16]
Other key regulators in Canada include the Canadian Food Inspection Agency (CFIA) for food safety, animal health, and plant health; Health Canada for public health; and Environment and Climate Change Canada for environment and sustainable energy.[17]
Canadian organizations seeking to remain compliant with various regulations may turn to ISO 19600:2014, an international compliance standard that "provides guidance for establishing, developing, implementing, evaluating, maintaining and improving an effective and responsive compliance management system within an organization".[18] For more industry specific guidance, e.g., financial institutions, Canada's E-13 Regulatory Compliance Management provides specific compliance risk management tactics.[19]
The financial sector in the Netherlands is heavily regulated. The Dutch Central Bank (De Nederlandsche Bank N.V.) is the prudential regulator while the Netherlands Authority for Financial Markets (AFM) is the regulator for behavioral supervision of financial institutions and markets. A common definition of compliance is:'Observance of external (international and national) laws and regulations, as well as internal norms and procedures, to protect the integrity of the organization, its management and employees with the aim of preventing and controlling risks and the possible damage resulting from these compliance and integrity risks'.[20]
In India, compliance regulation takes place across three strata: Central, State, and Local regulation. India veers towards central regulation, especially of financial organizations and foreign funds. Compliance regulations vary based on the industry segment in addition to the geographical mix. Most regulation comes in the following broad categories: economic regulation, regulation in the public interest, and environmental regulation.[21] India has also been characterized by poor compliance - reports suggest that only around 65% of companies are fully compliant to norms.[22]
The Monetary Authority of Singapore is Singapore's central bank and financial regulatory authority. It administers the various statutes pertaining to money, banking, insurance, securities and the financial sector in general, as well as currency issuance.[23]
There is considerable regulation in the United Kingdom, some of which is derived from European Union legislation. Various areas are policed by different bodies, such as the Financial Conduct Authority (FCA),[24] Environment Agency,[25] Scottish Environment Protection Agency,[26] Information Commissioner's Office,[27] Care Quality Commission,[28] and others: see List of regulators in the United Kingdom.
Important compliance issues for all organizations large and small include the Data Protection Act 2018[29] and, for the public sector, Freedom of Information Act 2000.[30]
The U.K. Corporate Governance Code (formerly the Combined Code) is issued by the Financial Reporting Council (FRC) and "sets standards of good practice in relation to board leadership and effectiveness, remuneration, accountability, and relations with shareholders".[31] All companies with a Premium Listing of equity shares in the U.K. are required under the Listing Rules to report on how they have applied the Combined Code in their annual report and accounts.[32] (The Codes are therefore most similar to the U.S.' Sarbanes–Oxley Act.)
The U.K.'s regulatory framework requires that all its publicly listed companies should provide specific content in the core financial statements that must appear in a yearly report, including balance sheet, comprehensive income statement, and statement of changes in equity, as well as cash flow statement as required under international accounting standards.[33] It further demonstrates the relationship that subsists among shareholders, management, and the independent audit teams. Financial statements must be prepared using a particular set of rules and regulations hence the rationale behind allowing the companies to apply the provisions of company law, international financial reporting standards (IFRS), as well as the U.K. stock exchange rules as directed by the FCA.[34] It is also possible that shareholders may not understand the figures as presented in the various financial statements, hence it is critical that the board should provide notes on accounting policies as well as other explanatory notes to help them understand the report better.
Data retention is a part of regulatory compliance that is proving to be a challenge in many instances. The security that comes from compliance with industry regulations can seem contrary to maintaining user privacy. Data retention laws and regulations ask data owners and other service providers to retain extensive records of user activity beyond the time necessary for normal business operations. These requirements have been called into question by privacy rights advocates.[35]
Compliance in this area is becoming very difficult. Laws like the CAN-SPAM Act and Fair Credit Reporting Act in the U.S. require that businesses give people the right to be forgotten.[36][37] In other words, they must remove individuals from marketing lists if it is requested, tell them when and why they might share personal information with a third party, or at least ask permission before sharing that data. Now, with new laws coming out that demand longer data retention despite the individual’s desires, it can create some real difficulties.
Money laundering and terrorist financing pose significant threats to the integrity of the financial system and national security. To combat these threats, the EU has adopted a risk-based approach to Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) that relies on cooperation and coordination between EU and national authorities. In this context, risk-based regulation refers to the approach of identifying and assessing potential risks of money laundering and terrorist financing and implementing regulatory measures proportional to those risks. However, the shared enforcement powers between EU and national authorities in the implementation and enforcement of AML/CFT regulations can create legal implications and challenges. The potential for inconsistent application of AML regulations across different jurisdictions can create regulatory arbitrage and undermine the effectiveness of AML efforts. Additionally, a lack of clear and consistent legal frameworks defining the roles and responsibilities of EU and national authorities in AML enforcement can lead to situations where accountability is difficult to establish.
Corporate scandals and breakdowns such as the Enron case of reputational risk in 2001 have increased calls for stronger compliance and regulations, particularly for publicly listed companies.[1] The most significant recent statutory changes in this context have been the Sarbanes–Oxley Act developed by two U.S. congressmen, Senator Paul Sarbanes and Representative Michael Oxley in 2002 which defined significantly tighter personal responsibility of corporate top management for the accuracy of reported financial statements; and the Dodd-Frank Wall Street Reform and Consumer Protection Act.
The Office of Foreign Assets Control (OFAC) is an agency of the United States Department of the Treasury under the auspices of the Under Secretary of the Treasury for Terrorism and Financial Intelligence. OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign states, organizations, and individuals.
Compliance in the U.S. generally means compliance with laws and regulations. These laws and regulations can have criminal or civil penalties. The definition of what constitutes an effective compliance plan has been elusive. Most authors, however, continue to cite the guidance provided by the United States Sentencing Commission in Chapter 8 of the Federal Sentencing Guidelines.[38][39]
On October 12, 2006, the U.S. Small Business Administration re-launched Business.gov (later Business.USA.gov and finally SBA.Gov)[40] which provides a single point of access to government services and information that help businesses comply with government regulations.
The U.S. Department of Labor, Occupational Health and Safety Administration (OSHA) was created by Congress to assure safe and healthful working conditions for working men and women by setting and enforcing standards and by providing training, outreach, education, and assistance. OSHA implements laws and regulations regularly in the following areas, construction, maritime, agriculture, and recordkeeping.[41]
The United States Department of Transportation also has various laws and regulations requiring that prime contractors when bidding on federally funded projects engage in good faith effort compliance, meaning they must document their outreach to certified disadvantaged business enterprises.[42]
cite book
: CS1 maint: multiple names: authors list (link)
Part of the behavioral sciences |
Economics |
---|
![]() |
|
|
Part of a series on |
Organized labor |
---|
![]() |
Employment is a relationship between two parties regulating the provision of paid labour services. Usually based on a contract, one party, the employer, which might be a corporation, a not-for-profit organization, a co-operative, or any other entity, pays the other, the employee, in return for carrying out assigned work.[1] Employees work in return for wages, which can be paid on the basis of an hourly rate, by piecework or an annual salary, depending on the type of work an employee does, the prevailing conditions of the sector and the bargaining power between the parties. Employees in some sectors may receive gratuities, bonus payments or stock options. In some types of employment, employees may receive benefits in addition to payment. Benefits may include health insurance, housing, and disability insurance. Employment is typically governed by employment laws, organization or legal contracts.
An employee contributes labour and expertise to an endeavor of an employer or of a person conducting a business or undertaking (PCB)[2] and is usually hired to perform specific duties which are packaged into a job. In a corporate context, an employee is a person who is hired to provide services to a company on a regular basis in exchange for compensation and who does not provide these services as part of an independent business.[3]
An issue that arises in most companies, especially the ones that are in the gig economy, is the classification of workers. A lot of workers that fulfill gigs are often hired as independent contractors.
To categorize a worker as an independent contractor rather than an employee, an independent contractor must agree with the client on what the finished work product will be and then the contractor controls the means and manner of achieving the desired outcome. Secondly, an independent contractor offers services to the public at large, not just to one business, and is responsible for disbursing payments from the client, paying unreimbursed expenses, and providing his or her own tools to complete the job. Third, the relationship of the parties is often evidenced by a written agreement that specifies that the worker is an independent contractor and is not entitled to employee benefits; the services provided by the worker are not key to the business; and the relationship is not permanent.[4]
As a general principle of employment law, in the United States, there is a difference between an agent and an independent contractor. The default status of a worker is an employee unless specific guidelines are met, which can be determined by the ABC test.[5][6] Thus, clarifying whether someone who performs work is an independent contractor or an employee from the beginning, and treating them accordingly, can save a company from trouble later on.
Provided key circumstances, including ones such as that the worker is paid regularly, follows set hours of work, is supplied with tools from the employer, is closely monitored by the employer, acting on behalf of the employer, only works for one employer at a time, they are considered an employee,[7] and the employer will generally be liable for their actions and be obliged to give them benefits.[8] Similarly, the employer is the owner of any invention created by an employee "hired to invent", even in the absence of an assignment of inventions. In contrast, a company commissioning a work by an independent contractor will not own the copyright unless the company secures either a written contract stating that it is a "work made for hire" or a written assignment of the copyright. In order to stay protected and avoid lawsuits, an employer has to be aware of that distinction.[4]
Employer and managerial control within an organization rests at many levels and has important implications for staff and productivity alike, with control forming the fundamental link between desired outcomes and actual processes. Employers must balance interests such as decreasing wage constraints with a maximization of labor productivity in order to achieve a profitable and productive employment relationship.
The main ways for employers to find workers and for people to find employers are via jobs listings in newspapers (via classified advertising) and online, also called job boards. Employers and job seekers also often find each other via professional recruitment consultants which receive a commission from the employer to find, screen and select suitable candidates. However, a study has shown that such consultants may not be reliable when they fail to use established principles in selecting employees.[1] A more traditional approach is with a "Help Wanted" sign in the establishment (usually hung on a window or door[9] or placed on a store counter).[3] Evaluating different employees can be quite laborious but setting up different techniques to analyze their skills to measure their talents within the field can be best through assessments. Employer and potential employee commonly take the additional step of getting to know each other through the process of a job interview.
Training and development refers to the employer's effort to equip a newly hired employee with the necessary skills to perform at the job, and to help the employee grow within the organization. An appropriate level of training and development helps to improve employee's job satisfaction.[10]
There are many ways that employees are paid, including by hourly wages, by piecework, by yearly salary, or by gratuities (with the latter often being combined with another form of payment). In sales jobs and real estate positions, the employee may be paid a commission, a percentage of the value of the goods or services that they have sold. In some fields and professions (e.g., executive jobs), employees may be eligible for a bonus if they meet certain targets. Some executives and employees may be paid in shares or stock options, a compensation approach that has the added benefit, from the company's point of view, of helping to align the interests of the compensated individual with the performance of the company.
Under the faithless servant doctrine, a doctrine under the laws of a number of states in the United States, and most notably New York State law, an employee who acts unfaithfully towards his employer must forfeit all of the compensation he received during the period of his disloyalty.[11][12][13][14][15]
Employee benefits are various non-wage compensation provided to employees in addition to their wages or salaries. The benefits can include: housing (employer-provided or employer-paid), group insurance (health, dental, life etc.), disability income protection, retirement benefits, daycare, tuition reimbursement, sick leave, vacation (paid and non-paid), social security, profit sharing, funding of education, and other specialized benefits. In some cases, such as with workers employed in remote or isolated regions, the benefits may include meals. Employee benefits can improve the relationship between employee and employer and lowers staff turnover.[16]
Organizational justice is an employee's perception and judgement of employer's treatment in the context of fairness or justice. The resulting actions to influence the employee-employer relationship is also a part of organizational justice.[16]
Employees can organize into trade or labor unions, which represent the workforce to collectively bargain with the management of organizations about working, and contractual conditions and services.[17]
Usually, either an employee or employer may end the relationship at any time, often subject to a certain notice period. This is referred to as at-will employment. The contract between the two parties specifies the responsibilities of each when ending the relationship and may include requirements such as notice periods, severance pay, and security measures.[17] A contract forbidding an employee from leaving their employment, under penalty of a surety bond, is referred to as an employment bond. In some professions, notably teaching, civil servants, university professors, and some orchestra jobs, some employees may have tenure, which means that they cannot be dismissed at will. Another type of termination is a layoff.
Wage labor is the socioeconomic relationship between a worker and an employer, where the worker sells their labor under a formal or informal employment contract. These transactions usually occur in a labor market where wages are market-determined.[10][16] In exchange for the wages paid, the work product generally becomes the undifferentiated property of the employer, except for special cases such as the vesting of intellectual property patents in the United States where patent rights are usually vested in the original personal inventor. A wage laborer is a person whose primary means of income is from the selling of his or her labor in this way.[17]
In modern mixed economies such as that of the OECD countries, it is currently the dominant form of work arrangement. Although most work occurs following this structure, the wage work arrangements of CEOs, professional employees, and professional contract workers are sometimes conflated with class assignments, so that "wage labor" is considered to apply only to unskilled, semi-skilled or manual labor.[18]
Wage labor, as institutionalized under today's market economic systems, has been criticized,[17] especially by socialists,[18][19][20][21] using the pejorative term wage slavery.[22][23] Socialists draw parallels between the trade of labor as a commodity and slavery. Cicero is also known to have suggested such parallels.[24]
The American philosopher John Dewey posited that until "industrial feudalism" is replaced by "industrial democracy", politics will be "the shadow cast on society by big business".[25] Thomas Ferguson has postulated in his investment theory of party competition that the undemocratic nature of economic institutions under capitalism causes elections to become occasions when blocs of investors coalesce and compete to control the state plus cities.[26]
American business theorist Jeffrey Pfeffer posits that contemporary employment practices and employer commonalities in the United States, including toxic working environments, job insecurity, long hours and increased performance pressure from management, are responsible for 120,000 excess deaths annually, making the workplace the fifth leading cause of death in the United States.[27][28]
Australian employment has been governed by the Fair Work Act since 2009.[29]
Bangladesh Association of International Recruiting Agencies (BAIRA) is an association of national level with its international reputation of co-operation and welfare of the migrant workforce as well as its approximately 1200 members agencies in collaboration with and support from the Government of Bangladesh.[18]
In the Canadian province of Ontario, formal complaints can be brought to the Ministry of Labour. In the province of Quebec, grievances can be filed with the Commission des normes du travail.[21]
Two of the prominent examples of work and employment contracts in Germany are the Werksvertrag[30][31] or the Arbeitsvertrag,[32][33][34][35] which is a form of Dienstleistungsvertrag (service-oriented contract). An Arbeitsvertrag can also be temporary,[36] whereas a temporary worker is working under Zeitarbeit[37] or Leiharbeit.[38] Another employment setting is Arbeitnehmerüberlassung (ANÜ).[39][40][41]
India has options for a fixed term contract or a permanent contract. Both contracts are entitled to minimum wages, fixed working hours and social security contributions.[21]
Pakistan has no contract Labor, Minimum Wage and Provident Funds Acts. Contract labor in Pakistan must be paid minimum wage and certain facilities are to be provided to labor. However, the Acts are not yet fully implemented.[18]
In the Philippines, employment is regulated by the Department of Labor and Employment.[42]
According to Swedish law,[43] there are three types of employment.
There are no laws about minimum salary in Sweden. Instead, there are agreements between employer organizations and trade unions about minimum salaries, and other employment conditions.
There is a type of employment contract which is common but not regulated in law, and that is Hour employment (Swedish: Timanställning), which can be Normal employment (unlimited), but the work time is unregulated and decided per immediate need basis. The employee is expected to be answering the phone and come to work when needed, e.g. when someone is ill and absent from work. They will receive salary only for actual work time and can in reality be fired for no reason by not being called anymore. This type of contract is common in the public sector.[44]
In the United Kingdom, employment contracts are categorized by the government into the following types:[45]
For purposes of U.S. federal income tax withholding, 26 U.S.C. § 3401(c) provides a definition for the term "employee" specific to chapter 24 of the Internal Revenue Code:
"For purposes of this chapter, the term "employee" includes an officer, employee, or elected official of the United States, a State, or any political subdivision thereof, or the District of Columbia, or any agency or instrumentality of any one or more of the foregoing. The term "employee" also includes an officer of a corporation."[46] This definition does not exclude all those who are commonly known as 'employees'. "Similarly, Latham's instruction which indicated that under 26 U.S.C. § 3401(c) the category of 'employee' does not include privately employed wage earners is a preposterous reading of the statute. It is obvious that within the context of both statutes the word 'includes' is a term of enlargement not of limitation, and the reference to certain entities or categories is not intended to exclude all others."[47]
Employees are often contrasted with independent contractors, especially when there is dispute as to the worker's entitlement to have matching taxes paid, workers compensation, and unemployment insurance benefits. However, in September 2009, the court case of Brown v. J. Kaz, Inc. ruled that independent contractors are regarded as employees for the purpose of discrimination laws if they work for the employer on a regular basis, and said employer directs the time, place, and manner of employment.[42]
In non-union work environments, in the United States, unjust termination complaints can be brought to the United States Department of Labor.[48]
Labor unions are legally recognized as representatives of workers in many industries in the United States. Their activity today centers on collective bargaining over wages, benefits, and working conditions for their membership, and on representing their members in disputes with management over violations of contract provisions. Larger unions also typically engage in lobbying activities and electioneering at the state and federal level.[42]
Most unions in America are aligned with one of two larger umbrella organizations: the AFL–CIO created in 1955, and the Change to Win Federation which split from the AFL–CIO in 2005. Both advocate policies and legislation on behalf of workers in the United States and Canada, and take an active role in politics. The AFL–CIO is especially concerned with global trade issues.[26]
Young workers are at higher risk for occupational injury and face certain occupational hazards at a higher rate; this is generally due to their employment in high-risk industries. For example, in the United States, young people are injured at work at twice the rate of their older counterparts.[50] These workers are also at higher risk for motor vehicle accidents at work, due to less work experience, a lower use of seat belts, and higher rates of distracted driving.[51][52] To mitigate this risk, those under the age of 17 are restricted from certain types of driving, including transporting people and goods under certain circumstances.[51]
High-risk industries for young workers include agriculture, restaurants, waste management, and mining.[50][51] In the United States, those under the age of 18 are restricted from certain jobs that are deemed dangerous under the Fair Labor Standards Act.[51]
Youth employment programs are most effective when they include both theoretical classroom training and hands-on training with work placements.[53]
In the conversation of employment among younger aged workers, youth unemployment has also been monitored. Youth unemployment rates tend to be higher than the adult rates in every country in the world.[54]
Those older than the statutory defined retirement age may continue to work, either out of enjoyment or necessity. However, depending on the nature of the job, older workers may need to transition into less-physical forms of work to avoid injury. Working past retirement age also has positive effects, because it gives a sense of purpose and allows people to maintain social networks and activity levels.[55] Older workers are often found to be discriminated against by employers.[56]
Employment is no guarantee of escaping poverty, the International Labour Organization (ILO) estimates that as many as 40% of workers are poor, not earning enough to keep their families above the $2 a day poverty line.[44] For instance, in India most of the chronically poor are wage earners in formal employment, because their jobs are insecure and low paid and offer no chance to accumulate wealth to avoid risks.[44] According to the UNRISD, increasing labor productivity appears to have a negative impact on job creation: in the 1960s, a 1% increase in output per worker was associated with a reduction in employment growth of 0.07%, by the first decade of this century the same productivity increase implies reduced employment growth by 0.54%.[44] Both increased employment opportunities and increased labor productivity (as long as it also translates into higher wages) are needed to tackle poverty. Increases in employment without increases in productivity leads to a rise in the number of "working poor", which is why some experts are now promoting the creation of "quality" and not "quantity" in labor market policies.[44] This approach does highlight how higher productivity has helped reduce poverty in East Asia, but the negative impact is beginning to show.[44] In Vietnam, for example, employment growth has slowed while productivity growth has continued.[44] Furthermore, productivity increases do not always lead to increased wages, as can be seen in the United States, where the gap between productivity and wages has been rising since the 1980s.[44] Oxfam and social scientist Mark Robert Rank have argued that the economy of the United States is failing to provide jobs that can adequately support families.[57][58] According to sociologist Matthew Desmond, the US "offers some of the lowest wages in the industrialized world," which has "swelled the ranks of the working poor, most of whom are thirty-five or older."[59]
Researchers at the Overseas Development Institute argue that there are differences across economic sectors in creating employment that reduces poverty.[44] 24 instances of growth were examined, in which 18 reduced poverty. This study showed that other sectors were just as important in reducing unemployment, such as manufacturing.[44] The services sector is most effective at translating productivity growth into employment growth. Agriculture provides a safety net for jobs and economic buffer when other sectors are struggling.[44]
Growth, employment and poverty[44] | ||||
---|---|---|---|---|
Number of episodes |
Rising agricultural employment |
Rising industrial employment |
Rising services employment |
|
Growth episodes associated with falling poverty rates |
18
|
6
|
10
|
15
|
Growth episodes associated with no fall in poverty rates |
6
|
2
|
3
|
1
|
Scholars conceptualize the employment relationship in various ways.[60] A key assumption is the extent to which the employment relationship necessarily includes conflicts of interests between employers and employees, and the form of such conflicts.[61] In economic theorizing, the labor market mediates all such conflicts such that employers and employees who enter into an employment relationship are assumed to find this arrangement in their own self-interest. In human resource management theorizing, employers and employees are assumed to have shared interests (or a unity of interests, hence the label “unitarism”). Any conflicts that exist are seen as a manifestation of poor human resource management policies or interpersonal clashes such as personality conflicts, both of which can and should be managed away. From the perspective of pluralist industrial relations, the employment relationship is characterized by a plurality of stakeholders with legitimate interests (hence the label “pluralism), and some conflicts of interests are seen as inherent in the employment relationship (e.g., wages v. profits). Lastly, the critical paradigm emphasizes antagonistic conflicts of interests between various groups (e.g., the competing capitalist and working classes in a Marxist framework) that are part of a deeper social conflict of unequal power relations. As a result, there are four common models of employment:[62]
These models are important because they help reveal why individuals hold differing perspectives on human resource management policies, labor unions, and employment regulation.[63] For example, human resource management policies are seen as dictated by the market in the first view, as essential mechanisms for aligning the interests of employees and employers and thereby creating profitable companies in the second view, as insufficient for looking out for workers’ interests in the third view, and as manipulative managerial tools for shaping the ideology and structure of the workplace in the fourth view.[64]
Literature on the employment impact of economic growth and on how growth is associated with employment at a macro, sector and industry level was aggregated in 2013.[65]
Researchers found evidence to suggest growth in manufacturing and services have good impact on employment. They found GDP growth on employment in agriculture to be limited, but that value-added growth had a relatively larger impact.[44] The impact on job creation by industries/economic activities as well as the extent of the body of evidence and the key studies. For extractives, they again found extensive evidence suggesting growth in the sector has limited impact on employment. In textiles, however, although evidence was low, studies suggest growth there positively contributed to job creation. In agri-business and food processing, they found impact growth to be positive.[65]
They found that most available literature focuses on OECD and middle-income countries somewhat, where economic growth impact has been shown to be positive on employment. The researchers didn't find sufficient evidence to conclude any impact of growth on employment in LDCs despite some pointing to the positive impact, others point to limitations. They recommended that complementary policies are necessary to ensure economic growth's positive impact on LDC employment. With trade, industry and investment, they only found limited evidence of positive impact on employment from industrial and investment policies and for others, while large bodies of evidence does exist, the exact impact remains contested.[65]
Researchers have also explored the relationship between employment and illicit activities. Using evidence from Africa, a research team found that a program for Liberian ex-fighters reduced work hours on illicit activities. The employment program also reduced interest in mercenary work in nearby wars. The study concludes that while the use of capital inputs or cash payments for peaceful work created a reduction in illicit activities, the impact of training alone is rather low.[66]
The balance of economic efficiency and social equity is the ultimate debate in the field of employment relations.[67] By meeting the needs of the employer; generating profits to establish and maintain economic efficiency; whilst maintaining a balance with the employee and creating social equity that benefits the worker so that he/she can fund and enjoy healthy living; proves to be a continuous revolving issue in westernized societies.[67]
Globalization has affected these issues by creating certain economic factors that disallow or allow various employment issues. Economist Edward Lee (1996) studies the effects of globalization and summarizes the four major points of concern that affect employment relations:
What also results from Lee's (1996) findings is that in industrialized countries an average of almost 70 per cent of workers are employed in the service sector, most of which consists of non-tradable activities. As a result, workers are forced to become more skilled and develop sought after trades, or find other means of survival. Ultimately this is a result of changes and trends of employment, an evolving workforce, and globalization that is represented by a more skilled and increasing highly diverse labor force, that are growing in non standard forms of employment (Markey, R. et al. 2006).[67]
Various youth subcultures have been associated with not working, such as the hippie subculture in the 1960s and 1970s (which endorsed the idea of "dropping out" of society) and the punk subculture.
One of the alternatives to work is engaging in post-secondary education at a college, university or professional school. One of the major costs of obtaining a post-secondary education is the opportunity cost of forgone wages due to not working. At times when jobs are hard to find, such as during recessions, unemployed individuals may decide to get post-secondary education, because there is less of an opportunity cost.
In some countries, individuals who are not working can receive social assistance support (e.g., welfare or food stamps) to enable them to rent housing, buy food, repair or replace household goods, maintenance of children and observe social customs that require financial expenditure.
Workers who are not paid wages, such as volunteers who perform tasks for charities, hospitals or not-for-profit organizations, are generally not considered employed. One exception to this is an internship, an employment situation in which the worker receives training or experience (and possibly college credit) as the chief form of compensation.[68]
Those who work under obligation for the purpose of fulfilling a debt, such as indentured servants, or as property of the person or entity they work for, such as slaves, do not receive pay for their services and are not considered employed. Some historians[which?] suggest that slavery is older than employment, but both arrangements have existed for all recorded history.[citation needed] Indentured servitude and slavery are not considered compatible with human rights or with democracy.[68]
![]() |
The examples and perspective in this article may not represent a worldwide view of the subject.(September 2023)
|
Self-employment is the state of working for oneself rather than an employer. Tax authorities will generally view a person as self-employed if the person chooses to be recognised as such or if the person is generating income for which a tax return needs to be filed. In the real world, the critical issue for tax authorities is not whether a person is engaged in business activity (called trading even when referring to the provision of a service) but whether the activity is profitable and therefore potentially taxable. In other words, the trading is likely to be ignored if there is no profit, so occasional and hobby- or enthusiast-based economic activity is generally ignored by tax authorities. Self-employed people are usually classified as a sole proprietor (or sole trader), independent contractor, or as a member of a partnership.
Self-employed people generally find their own work rather than being provided with work by an employer and instead earn income from a profession, a trade, or a business that they operate. In some countries, such as the United States and the United Kingdom, the authorities are placing more emphasis on clarifying whether an individual is self-employed or engaged in disguised employment, in other words pretending to be in a contractual intra-business relationship to hide what is in fact an employer-employee relationship.Local employment initiatives aim to ensure that residents of the area adjacent to an employers' premises are offered employment there. Local jobs initiatives are common in a construction context.[69] In retail, the Westfield Centre in west London, which opened in 2008, has been noted as an example offering employment to local residents: during the period when the centre was under construction, up to 3000 local people received pre-employment training through a partnership scheme aiming to ensure that a significant proportion of the centre's jobs were taken up by local people. 40% of the centre's management staff had been locally recruited at the time when the centre opened.[70]
The most significant definitions are 'person conducting a business or undertaking' (PCBU). 'worker' and 'workplace'. [...] 'PCBU' is a wider ranging term than 'employer', though this will be what most people understand by it.
The US is falling drastically behind similar countries in mandating adequate wages, protections, and rights for millions of workers and their families. The wealthiest country in the world is near the bottom of every dimension of this index.
The tendency of our free market economy has been to produce a growing number of jobs that will no longer support a family. In addition, the basic nature of capitalism ensures that unemployment exists at modest levels. Both of these directly result in a shortage of economic opportunities in American society. In addition, the absence of social supports stems from failings at the political and policy levels. The United States has traditionally lacked the political desire to put in place effective policies and programs that would support the economically vulnerable. Structural failing at the economic and political levels have therefore produced a lack of opportunities and supports, resulting in high rates of American poverty.