For years, employees have expressed the desire for increased flexibility to work-from-home. But businesses have been slow to adapt and have continued to embrace in-person workspaces. Then, COVID came along, and almost overnight businesses were forced to transition to a remote or partially remote workforce. Even more traditional institutions, such as the court system, were also forced to adapt to remote options.
Conference call fatigue aside, employees — especially millennials and Gen Z — cherished the flexibility provided by remote work options. As a result, employers began offering part-time and full-time work arrangements as an employee benefit and recruiting tool. This has led to the rise of “digital nomads,” who can work from anywhere and who travel frequently. While this can be a wonderful benefit, it can also cause employers to unknowingly walk into a compliance minefield.
Due to remote work arrangements, employees can work in a locality, state, or country other than the brick-and-mortar business location. This is especially true in our tristate area, where it is common to work in downtown Cincinnati but live in Northern Kentucky or Southern Indiana. In some extreme cases, employees can move out of state or even out of the country without the employer ever realizing. Many businesses have reported they tried to recall employees back to the office, only to discover an employee had moved from Ohio to California or Costa Rica.
This is incredibly problematic for companies that do not currently operate in those new jurisdictions. Laws vary significantly across jurisdictions, and employers may become unexpectedly subjected to different or new compliance obligations. Businesses must rely on their legal counsel to provide guidance for navigating this potential minefield.
Businesses with employees working remotely, including attorneys, should immediately take the following steps and determine: (1) Whether employees are engaging in remote work; (2) the frequency of employees engaging in remote work; (3) where employees are working remotely; (4) if their employees’ remote work arrangements trigger new or differing compliance requirements; and (5) whether they will continue to permit remote work — and, if so, identify the steps they need to take to become compliant.
Areas of compliance businesses should review include:
Operating a business in a new country, state, county, or city is not as simple as setting up shop. Most states require businesses who “conduct business” or “transact business” to register with the Secretary of State. Under some states’ tests, employees conducting business remotely may trigger these responsibilities.
Additionally, if employees are operating in a new location, the employer may need to comply with state and local business registration, licensing, and permit requirements. This is especially true for employers who hold professional licenses or whose employees hold specialized licenses or permits. Examples include accounting, architecture, engineering, or law firms; educational institutions; healthcare facilities; construction or home improvement contractors; and financial institutions. Attorney licensure to practice law is state-specific and practicing out-of-state may trigger ethical violations. Employers should conduct a thorough review of registration, licensing, and permit requirements to ensure compliance.
Employers who sponsor employment visas for foreign nationals must be cautious of the jurisdictional limitations of the work authorization. Employees’ visas may prohibit or limit the ability of the employee to work remotely based on the terms of the employment agreement, location of work, and visa category. Generally, employees with H-1B visas are restricted to working only in locations listed in the H-1B sponsorship petition. If employees are working outside those areas, the employer will need to file an amendment notifying the government about any new worksites and/or home offices. This could expose the employer to higher prevailing wages if salaries in the new location(s) are higher than the employer is currently paying. If the employee is working outside the scope of work authorization, it may jeopardize the employee’s visa and may result in non-compliance with immigration laws. Companies should conduct a case-by-case analysis of each worker’s ability to work remotely and where they are permitted to work.
Generally, states require employers to register and obtain workers’ compensation insurance in the state where employees are primarily performing work. In Ohio, even self-insured employers must comply with workers’ compensation registration requirements. Likewise, in most states, employers must register for and pay the unemployment insurance premiums in the states where employees are performing work. In the case of remote workers, this may be a different state altogether. Employers who fail to comply with workers’ compensation insurance and unemployment insurance requirements in those states may be exposed to liability.
Similarly, employee benefit plans and business insurance plans are often state-specific contracts. If employees are working out of state, they may not be entitled to benefits under the plan and the business itself may not have liability coverage for any loss or accidents resulting during out-of-state work. Employers should review contracts to ensure they have coverage for employees who are working remotely out-of-state.
As we all know, taxes are inevitable, and tax obligations vary based on country, state, and locality. Businesses should be cognizant of their own tax liability if “operating” in a new locality, including income taxes, gross receipts, and sales taxes.
Moreover, employers should calculate their employees’ taxes at the correct rate and deduct any required sums. Employees working in a different jurisdiction may be subject to different income tax rates, and mandatory withholdings may need to be adjusted, including wage garnishments. In certain jurisdictions, additional deductions from employees’ paychecks may be required to endow state unemployment, disability, or paid family leave funds. Employers are responsible for notifying employees of deductions and ensuring the appropriate amounts are withheld.
If proper procedures are not followed, remote workers can inadvertently undermine security protocols, leaving the employer’s network vulnerable to security breaches. Common cybersecurity risks include inadvertent disclosures, utilizing unsecure networks or internet connections, and business email compromise. Businesses should develop remote work and security policies to ensure that employees understand and follow necessary security protocols while working remotely. Additionally, businesses should familiarize themselves with state data breach notification laws in case of a potential breach.
Business should also be aware that intrastate and international access to data may implicate foreign and domestic data privacy and security laws, such as European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Various other employment laws may be implicated if any employee begins working in a new jurisdiction, such as laws regarding minimum wage, overtime, meal and rest breaks, reimbursement of expenses, leave requirements, paid sick leave, paid family leave, employee benefits, protected statuses, occupational health and safety requirements, and duties to provide employees with notices of benefits or protection. After an employer identifies an employee working in a new jurisdiction, they should engage in a thorough review of the relevant law to ensure compliance.
Jacob is a Partner in Dinsmore & Shohl’s Immigration group. Jacob advises clients on complex matters of immigration law and compliance. Geiler is an Associate in Dinsmore & Shohl’s Labor & Employment group. In addition to her employment practice, Geiler is a member of Dinsmore’s COVID-19 Task Force.