Employee's application seeking a religious exemption from the COVID-19 vaccination requirement for agency employees denied

The Appellate Division sustained Supreme Court's decision rejecting Plaintiff's petition seeking a court order annulling the determination of the City of New York Reasonable Accommodation Appeals Panel [Citywide Panel] denying Plaintiff's request for a religious exemption from the COVID-19 vaccination requirement for employees of the New York City Department of Education [DOE].

The Citywide Panel denied Plaintiff's administrative appeal challenging the denial of his application for a religious exemption from the vaccination requirement, finding that:

[1] "Plaintiff failed to establish that his objection to receiving any of the COVID-19 vaccines was based on a sincerely held religious belief; and 

[2] "granting the accommodation would impose an undue hardship on DOE."

Citing Matter of Marsteller v City of New York, 217 AD3d 543, the Appellate Division noted that Plaintiff:

[1] "had no demonstrated history of refusing medications or vaccines;

[2] "he admitted to receiving a certain vaccination required for him to attend college;  and 

[3] "he refused to answer a question about whether he had avoided any other vaccines or medications based on the same objection he raised to the COVID-19 vaccines."

The court also rejected Plaintiff's argument that DOE's "Position Statement" was unsigned and undated hearsay, noting "Generally, administrative proceedings need not conform to all of the ... evidentiary rules adhered to in judicial tribunals", citing Matter of Church of Scientology of N.Y. v Tax Commn. of City of N.Y., 120 AD2 376, nor need an agency "state with specificity its detailed analysis," or "point to any contemporaneously created record that demonstrates that it considered all relevant factors" or "or engage in a cooperative dialogue".

Click HERE to access the Appellate Division's decision posted on the Internet.

 

New York State Comptroller Thomas P. DiNapoli released audits of State entities

On October 4, 2023, State Comptroller Thomas P. DiNapoli announced the audits of State Departments, Agencies, Public Authorities and other entities listed below were issued.

Click on the text highlighted in color to access both the summary and the complete audit report

 

Metropolitan Transportation Authority – New York City Transit: Risk Assessment and Implementation of Measures to Address Extreme Weather Conditions (2021-S-27)

Flooding remains a serious issue for the City and the Metropolitan Transportation Agency’s (MTA) transportation system, including New York City Transit (Transit). In September 2007, the Chair of the MTA appointed a commission to make sustainability-related recommendations to the MTA and its agencies. The audit found that, to date, the MTA has not implemented one of the most important recommendations – the development of the climate change adaptation master plan. Further, review of a sample of capital projects intended to correct or prevent damage found that projects were often incomplete in scope of work, not finished on time or within budget, or insufficiently documented.

 

Department of State – Implementation of the Security Guard Act (Follow-Up) (2023-F-20)

Article 7-A of the General Business Law, also known as the Security Guard Act (Act), requires that individuals working as security guards have a valid registration card and entrusts the Department of State (DOS) with issuing registration cards. The Act also requires guards to complete training and renew their registration every 2 years. A prior audit, issued in July 2021, found security guards classified as police/peace officers did not fulfill their training requirements, including armed guards who did not complete the required firearms training. The follow-up found DOS made significant progress in addressing the problems identified in the initial audit report, implementing a new procedure for monitoring and reviewing training records. Of the initial report’s four audit recommendations, three were fully implemented and one was partially implemented.

 

Department of Transportation – Compliance With Freedom of Information Law Requirements (2020-S-12)

The New York Freedom of Information Law (FOIL) provides for public access to government records. Under FOIL, agencies, including the Department of Transportation (DOT), must make all eligible records available for public inspection or copying upon request. The audit found DOT did not always comply with the FOIL requirements, identifying instances of non-compliance, including cases of DOT not providing the requested records available, denying the request, or failing to acknowledge the request within the statutory time frame. Furthermore, DOT obstructed the audit by, among other actions, requiring that all meetings be attended by supervisory staff from DOT’s main office and not providing all requested information.

 

New York Power Authority – Selected Management and Operations Practices: BuildSmart NY/Executive Order 88 (2023-S-27)

BuildSmart NY is a program created to carry out Executive Order 88 (EO 88), which mandated a 20% improvement in the energy efficiency performance of State government buildings by April 2020 and the BuildSmart 2025 program expands upon the original program and sets new objectives equivalent to a 34% reduction in energy usage. The New York Power Authority (NYPA) administers EO 88 and organizations subject to EO 88 (Affected State Entities [ASEs]) work with NYPA to achieve their allotted portion of the overall savings targeted by 2025. NYPA’s Final Report shows the actual reduction reported was 14.4% by April 2020, and when committed projects (incomplete) are added, the reduction is 22.6%. However, the report includes 123 projects of 158 that are not scheduled to be completed until as late as 2024. Additionally, when NYPA annually reported the status of the BuildSmart NY program, officials shied away from identifying the deficiencies in ASE non-compliance and instead asserted that they had no ability to enforce EO 88.

 

State Education Department – Adult Career and Continuing Education Services: Vocational Rehabilitation Supported Employment Program (Follow-Up) (2023-F-15)

The State Education Department’s (SED) Adult Career and Continuing Education Services – Vocational Rehabilitation (ACCES-VR) program provides vocational rehabilitation services for and supports the employment goals of people with a disability. To help program participants achieve and maintain employment, counselors develop an Individualized Plan for Employment (IPE) with each participant, which identifies the employment goal, services that will be provided to help achieve that goal, and how progress will be measured. A prior audit, issued in March 2022, found that SED did not always meet the time frames for eligibility determinations or finalization and annual reviews of IPEs and SED did not provide any documented evaluations to show the ACCES-VR program was being adequately monitored. The follow-up found SED made progress addressing the issues identified in the initial audit report, replacing its case management system to allow for improved oversight and developing step-by-step guidance for counselors completing IPEs. Of the initial report’s three recommendations, two were implemented and one was partially implemented.

 

State Education Department – Oversight of Mental Health Education in Schools (Follow-Up) (2023-F-21)

Under Section 804 of the Education Law (Law), the State Education Department (SED) is responsible for enforcing a requirement for mental health education in schools. An initial audit, issued in April 2022, found that mental health teams at many school districts were understaffed and that SED did not require school districts to submit any documentation indicating compliance with the Law. SED made progress in addressing the problems identified in the initial audit report, developing a mechanism to determine if schools are providing mental health education and taking steps to secure more mental health staffing. Both recommendations from the initial report were implemented.

 

New York City Office of Technology and Innovation – LinkNYC Program Revenues and Monitoring (Follow-Up) (2022-F-25)

New York City’s Office of Technology and Innovation (OTI) procures citywide IT services. In December 2014, NYC entered into a Franchise Agreement (Agreement) with a consortium of technology, media, and connectivity providers (Consortium) to replace aging public pay telephones with state-of-the-art connection points called Links that would offer free Internet access and phone service. A prior audit issued in July 2021 found that OTI did not sufficiently monitor and enforce the Consortium’s compliance with the Agreement terms, including the collection of almost $70 million due to NYC. The follow-up found that OTI made progress in addressing these issues, but it could do more to ensure revenues owed are assessed and collected correctly and Links are properly installed and maintained. Of the initial report’s 18 recommendations, seven were implemented, six were partially implemented, and five were not implemented.

 

Medicaid Program – Recovering Managed Care Payments for Inpatient Services on Behalf of Recipients With Third-Party Health Insurance (2021-S-24)

For Medicaid recipients enrolled in managed care, the Department of Health (DOH) pays managed care organizations (MCOs) a monthly premium for each enrolled recipient, and, in turn, the MCOs arrange for their health care services, including inpatient services. Many recipients have other third-party health insurance (TPHI) in addition to Medicaid. Medicaid is considered the payer of last resort, and, as such, MCOs are required to coordinate benefits with the recipient’s TPHI prior to paying for Medicaid services. The Office of the Medicaid Inspector General uses a contractor to identify and recover payments made for services that should have been paid for by a recipient’s TPHI. During the audit period, the contractor did not bill TPHI carriers or initiate provider reviews for the recovery of $52.2 million in inpatient claims where MCOs paid as the primary insurance despite recipients having TPHI inpatient coverage.

 

Department of Health: Medicaid Program – Improper Medicaid Payments for Claims Not in Compliance With Ordering, Prescribing, Referring, and Attending Requirements (Follow-Up) (2023-F-4)  

As of January 1, 2014, New York’s Medicaid program required health care professionals who order, prescribe, refer, or attend (OPRA) Medicaid services be appropriately screened and enrolled in Medicaid and their National Provider Identifier (NPI) – a unique identification number – to be included on Medicaid claims. A prior audit issued in August 2021 found Medicaid made over $1.5 billion in improper and questionable payments for claims that did not contain an enrolled or affiliated OPRA NPI as required or where the NPI was not properly validated by the Department of Health (DOH) at the time of payment, and $19.4 million in payments for claims that contained an OPRA NPI that should not be included on Medicaid claims or that should be further reviewed by DOH due to past misconduct. The follow-up found that none of the improper and questionable payments have been reviewed. Furthermore, DOH has not improved system controls to prevent improper use of an override option for pharmacy claims that were denied because they did not contain the NPI of an enrolled provider in the prescribing field, and, as a result, auditors identified another $11.3 million in improper pharmacy payments since the initial audit. Of the initial report’s 12 audit recommendations, one was implemented, three were partially implemented, and eight were not implemented.

 

New York State Health Insurance Program – UnitedHealthcare Insurance Company of New York: Overpayments for Physician-Administered Drugs (2021-S-32)

The Department of Civil Service contracts with UnitedHealthcare Insurance Company of New York (United) to administer the Medical/Surgical Program of the Empire Plan, which covers a range of services, including physician-administered drugs, which are also covered under the Empire Plan’s separate Prescription Drug Program. A physician-administered drug is an outpatient drug (other than a vaccine) that is usually administered by a health care provider in a physician’s office or other outpatient clinical setting. The audit identified $5,536,537 in actual and potential overpayments for the cost of physician-administered drugs during the audit period. As of March 29, 2023, United recovered $254,188 of the improper payments.

 

New York State Health Insurance Program – Empire BlueCross: Overpayments for Physician- Administered Drugs (2021-S-33)

The Department of Civil Service contracts with Empire BlueCross (Empire) to administer the Hospital Program of the Empire Plan, which covers services including physician-administered drugs. A physician-administered drug is a drug, other than a vaccine, that is typically administered by a health care professional in a hospital or facility setting. In certain circumstances, physician-administered drugs are paid under the Empire Plan’s separate Prescription Drug Program, but both programs should not pay for the same physician-administered drug for the same patient on the same date of service. The audit identified $2,776,510 in actual and potential overpayments for the cost of physician-administered drugs during the audit period. As of June 21, 2023, Empire had started recoveries for $116,287 of the improper payments.

 

Department of Civil Service – New York State Health Insurance Program: Incorrect Payments by CVS Caremark for Medicare Rx Drug Claims That Were Improperly Paid Under the Commercial Plan (2022-S-24)

The Department of Civil Service (Civil Service) contracts with CaremarkPCS Health, L.L.C. (CVS Caremark) to administer the prescription drug program for the Empire Plan, which includes the Empire Plan Medicare Rx drug plan (Medicare Rx Plan) for retired members and their dependents who have Medicare, and a Commercial Plan for members and their dependents who do not have Medicare. Claims paid under the Medicare Rx Plan are eligible for enhanced drug manufacturer discounts and federal subsidies that are not available for claims paid under the Commercial. For the audit period, auditors identified claims totaling $12,358,531 that were incorrectly paid under the Commercial Plan instead of the Medicare Rx Plan.

###

 

Cybercrime in New York Rises

Cyberattacks in New York state increased 53% between 2016 and 2022, jumping from 16,426 incidents in 2016 to 25,112 in 2022. The number of attacks targeting critical infrastructure in New York state nearly doubled to 83 in the first half of 2023 compared to 48 during the entirety of last year, according to a report released on October 5, 2023, by State Comptroller Thomas P. DiNapoli.

Estimated losses in New York from cyberattacks in 2022 totaled over $775 million, while losses nationwide totaled $10.3 billion.

“Cyberattacks are a serious threat to New York’s critical infrastructure, economy and our everyday lives,” said DiNapoli. “Data breaches at companies and institutions that collect large amounts of personal information expose New Yorkers to potential invasions of privacy, identity theft and fraud. Also troubling is the rise in ransomware attacks that can shut down systems we rely on for water, power, health care and other necessities. Safeguarding our state from cyberattacks requires sustained investment, coordination, and vigilance.”

Relative to other states, New York had the third highest number of ransomware attacks (135) and corporate data breaches (238) in 2022, trailing only California and Texas for ransomware attacks and California and Florida for corporate data breaches. New York also had the fourth-highest number of cybercrime victims in the nation in 2022 with losses skyrocketing 632% since 2016.

The two most attacked critical infrastructure sectors through ransomware and data breaches in New York were Healthcare and Public Health (9) and Financial Services (8). Commercial Facilities and Government Facilities (7) tied for third.

Combatting the Threat

Securing critical infrastructure from cyberattacks will require sustained investment, coordination and vigilance. In 2022, the Governor appointed a state chief cyber officer to lead cross-agency efforts to combat cyber threats and improve the state's critical infrastructure assets’ cybersecurity. The cyber chief leads a newly created Joint Security Operations Center, a multi-agency cybersecurity coordination hub linking New York state, New York City, local and regional governments and critical infrastructure stakeholders and federal partners for information sharing, cyber threat detection and incident response. In August, the Governor released the first statewide cybersecurity strategy, which will allow the state to access new federal funding.

The federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, for which rules and regulations are being developed, will require cybersecurity reporting for critical infrastructure sectors. The creation of a centralized repository of data breach reports from across the critical infrastructure sectors would also aid in identifying new attack-vectors or exploits before they become widespread, and for coordinated responses to emerging cyberthreats. Encompassing local governments in this database would be important.

DiNapoli’s cybersecurity audits of state agencies and public authorities have found several common technical weaknesses and risks across its audits, such as entities’ misunderstanding of security risks, unsupported applications, unknown data on systems, poor access controls and a lack of monitoring of changes to systems, among others. Recommendations are provided to each agency to enable them to begin corrective actions immediately to strengthen their networks.

Cybersecurity Challenges Facing Local Governments and Schools

DiNapoli also released a report on the cybersecurity challenges facing New York’s local governments and school districts. In New York, cyberattacks have impacted local governments and schools both large and small, including reported attacks at counties including Albany, Chenango, Erie, Nassau, Schenectady, Suffolk, and Schuyler; cities including New York, Albany, Buffalo, Yonkers, Long Beach, and Olean; and towns including Brookhaven, Ulster, Canandaigua, and Moreau.

In 2019, a ransomware attack on the Syracuse City School District froze the district out of its own systems, crippling the website, email system, phones, and back-end functions like payroll and student management. Other attacks on local governments have had far reaching impacts. The September 2022 ransomware attack on Suffolk County, the ramifications of which the county is still dealing with, required the county to disable important computer systems and move many of the county’s functions back to pen and paper for months. It was a cautionary example of the potential impacts of a cyberattack, and highlighted the risk to state systems that linked local government systems could pose.

These and other recent events have demonstrated the serious risks that illegal access to these systems can pose to critical local government and school operations that rely heavily on technology. DiNapoli’s report provides guidance and resources for local governments and schools to help them manage the risks associated with cybersecurity.

Risks in Local Governments and School Districts

From 2019 through July 31, 2023, DiNapoli’s Local Government and School Accountability division released more than 190 information technology (IT) audits, finding more than 2,400 cybersecurity-related issues. The audits focused on breakdowns or gaps in fundamental cybersecurity components. The most common areas where improvement and corrective action were needed included cybersecurity governance aspects such as training in IT security awareness, policies and procedures, and the need for contingency plans. Because these cybersecurity audits are sensitive in nature, many findings and recommendations for corrective action are communicated confidentially to local government and school officials. Often the audit recommendations can be implemented at no or low cost to local governments or school districts.

Reports

Cyberattacks on New York’s Critical Infrastructure: Staying Ahead of the Threat

 
New York Local Government and School Cybersecurity: A Cyber Profile

 

Increase in the maximum sick leave days that may be accumulated by employees of the State as the employer designated Managerial or Confidential within the meaning of CSL Article 14 [the Taylor Law] proposed

The Department of Civil Service has proposed an amendment to §28 of the Attendance Rules for Employees in New York State Departments and Institutions to read as follows:

"28-1.3(b) Increase Sick Leave Accruals (b) Employees shall earn sick leave credits at the rate of one-half day per biweekly pay period and may accumulate such credits up to a total of 200 225 days."

No change has been proposed with respect to the use of up to 200 days of such credits to pay for health insurance in retirement in accordance with §167(4) of the Civil Service Law nor that an employee shall not earn sick leave credit for any biweekly pay period unless such employee is in full pay status for at least seven workdays during such biweekly pay period.

A part-time employee who is required to work a fixed number of hours on a fixed schedule five days per week, or who is required to work at least half-time each biweekly pay period for a fixed number of hours on a fixed schedule, shall also earn sick leave credit as provided herein, but total pay when absent on such leave shall be the amount which would have been due had such employee worked regularly at his/her usual hours for such period.

The text of proposed rule and any required statements and analyses may be obtained from Jennifer Paul, NYS Department of Civil Service, Empire State Plaza, Agency Building 1, Albany, NY 12239, (518) 473-6598, email: commops@cs.ny.gov.

Data, views or arguments may be submitted to Eugene Sarfoh, Counsel, NYS Department of Civil Service, Empire State Plaza, Agency Building 1, Albany, NY 12239, (518) 473-2624, email: public.comments@cs.ny.gov.

Public comment will be received until 60 days after publication of this notice, published in the State Register on October 4, 2023 [Vol. XLV, Issue 40].

 

Municipal and School Audits released by New York State Comptroller Thomas P. DiNapoli

On October 3, 2023, New York State Comptroller Thomas P. DiNapoli announced the following local government and school audits were issued.

Click on the text highlighted in color to access both the summary and the complete audit report.

 

Cattaraugus County – Sexual Harassment Prevention (SHP) Training

SHP training was provided to employees and elected officials. However, of the 150 total individuals auditors tested (125 selected employees and all 25 elected officials), 36 employees and 18 elected officials did not complete the annual training.

 

Town of Orangeville – Town Clerk/Tax Collector (Wyoming County)

The clerk did not properly record, deposit, remit or report collections. The clerk did not maintain complete and accurate accounting records, provide accurate monthly reports to the supervisor or provide an annual accounting to the board as required. The clerk also did not: accurately record, remit and report detailed clerk fees for 21 of the 24 months reviewed; deposit clerk fees and real property tax collections within required timeframes or in a timely manner; remit real property tax collections totaling $2 million to the supervisor or the county treasurer within the required timeframes; or accurately record and report real property tax collections.

 

Wallkill Central School District – Claims Auditing (Ulster County)

The claims auditor did not ensure claims were adequately supported, properly authorized, approved before payment, for valid purposes or properly reported to the board. Auditors reviewed 100 claims totaling $1.7 million and determined: none were reviewed for sufficient budget appropriations, which could result in budget lines being overspent; 58 totaling $1.6 million did not have sufficient supporting documentation, which could result in paying a claim that is not valid and legal; and 11 lists of claims totaling $464,801 were not included in the claims auditor reports to the board. As a result, the board was not aware of all claims paid.

###