After more than a year of anticipation, the Department of Homeland Security (DHS) has at last issued a Final Rule addressing an employer's obligations in response to receipt of a social security number (SSN) mismatch notice from the Social Security Administration (SSA). The final rules are materially similar to the draft published for comment in June 2006. On Friday, August 10, 2007, DHS published the Final Rule ("Safe-Harbor Procedures for Employers Who Receive a No-Match Letter"), with publication in the federal register expected this week. The Final Rule states that receipt of a Social Security Administration (SSA) no-match letter can be evidence that the employer has constructive knowledge that an employee lacks work authorization; however the Final Rule also creates safe harbor procedures for employers to avoid liability. It is anticipated that the regulations will take effect 30 days after publication in the Federal Register. The full text of the regulations can be found on the Federal Register.

Overview

The new safe harbor rules benefit employers in two ways. First, following the rules may protect an employer from immigration fines and penalties even if the employee subject to the safe harbor procedure is actually an unauthorized alien. Second, the rules provide a limited defense from government claims of discrimination predicated on the employer's conduct in following the safe harbor process.

Contrary to many press reports, the regulations do not require wholesale termination of employees with unresolved mismatch situations. Indeed—and unfortunately—the new regulations leave open many of the most vexing questions facing employers who receive SSA mismatch notices. For this reason, employers revising or implementing policies in recognition of the new rules should proceed cautiously, based on the plain language of the regulations and the interpretations offered by the Immigration and Customs Enforcement bureau of DHS, www.ice.gov "Safe Harbor for Employers".

The Safe Harbor

Existing law prohibits knowing employment of aliens who lack employment authorization. Under current regulations, knowledge can be actual or "constructive." The Final Rule deals only with the constructive knowledge standard. Following the prescribed safe harbor steps will not protect an employer who has actual knowledge that a worker is not authorized to work in the U.S.

Constructive knowledge is defined by the Final Rule as "knowledge which may fairly be inferred through notice of certain facts and circumstances that would lead a person, through the exercise of reasonable care, to know about a certain situation." The Final Rule adds two specific situations to the existing examples where an employer may have constructive knowledge:

1. Written notice from the Social Security Administration (SSA) that the combination of name and SSN submitted for an employee does not match SSA records; or
2. Written notice from DHS that an immigration status document or an Employment Authorization Document (EAD) presented by an employee as proof of work authorization is assigned to another person, or that there is no record of a status document or EAD being issued to that person.

The Final Rule then presents the safe harbor procedure that employers can follow to avoid liability from no-match letters received from either SSA or DHS.

SSA Mismatch: Initial Attempt to Resolve

Within 30 days of receipt of an SSA no-match notice, the safe harbor requires an employer to try to resolve the discrepancy by:

1. Checking its personnel and payroll records to determine whether the discrepancy results from a clerical error on the employer's part. If an error is found, the employer must make the correction, notify SSA of the correction, verify that SSA has made the correction and that the new information matches SSA records, and make a record of the manner, date, and time of such verification. The employer must also verify with the SSA that the employee's name and social security number (SSN), as corrected match the SSA records. (The Final Rules does not anticipate that the SSA will send confirmation of verification, and as a practical matter, it does not have capacity to do so. Verification inquiries can be addressed by telephone at 1-800-772-6270, Monday-Friday from 7:00 a.m. to 7:00 p.m.) The burden is on the employer to document these attempts.¹
2. If there is no simple remedy for the mismatch, the employer must promptly ask the employee whether the information in its personnel records is correct. If the employee claims the information is correct, the no-match letter notwithstanding, the employer should direct the employee to resolve the discrepancy with SSA. On the other hand, if the employee claims that the employer's records are incorrect, the employer should re-check its records, as described above.

DHS Immigration Document Mismatch: Initial Attempt to Resolve

Unlike the SSA no-match notification process, there is no system that checks and catches mismatched immigration documents as a matter of course. These mismatches generally arise in connection with an audit, likely by ICE—the Immigration and Customs Enforcement office within DHS, or by the OFCCP, in connection with affirmative action audits. When an employer receives a DHS immigration related no-match notice, the new regulations direct the employer to attempt to resolve the discrepancy by "taking reasonable steps" to resolve the question raised by DHS about the immigration status document or EAD within 30 days of receiving the notice. It is notable that DHS, the agency publishing these regulations, provides no guidance about what those steps would be! In the absence of further guidance, the employer should follow the steps outlined on the notice, if any. If no steps are outlined, the employer should attempt to contact the nearest Citizenship and Immigration Service office, a division of DHS, to inquire about the mismatch and document efforts to do so. If that proves unsuccessful, the employer should confront the employee and follow the same steps suggested in connection with a Social Security Mismatch, as described above.

Process for Unresolved Matches

If a Social Security number or immigration number mismatch is not resolved within 90 days of the employer's receipt of the mismatch notice, the Final Rule requires the employer to re-verify the employee's work eligibility and identity within three additional days after the 90th day following receipt of the no match document. The method for doing this is a new I-9 form, as though the employee were commencing new employment, with some important exceptions:

1. Use a new I-9 form and have the employee complete section 1, just as if the employee were newly hired. For section 2 of the I-9, the rules are similar to those at commencement of employment, except that the employee may not present the document that is the subject of the no-match letter, and any document used to establish identity must include a photograph.
2. The employer must retain the new I-9, in addition to the prior I-9, for the same period and in the same manner as though the employee were newly hired.
3. The information provided in support of the new I-9 is not subject to electronic verification. This is because the Social Security Administration limits employers' direct use of its database solely to payroll related purposes and not for work authorization purposes.

It is not clear whether the safe harbor requires a new I-9 for employees who did not use the mismatched social security number in the initial I-9 process. ICE has published contradicting questions and answers dealing with this issue, and we are seeking to clarify its interpretation.

Can an Employee with an Unresolved Social Security Mismatch Situation Continue Employment by Presenting New Work Authorization?

If the employee cannot resolve the mismatch, the safe harbor rules require execution of a new I-9. Only if the employee cannot meet the new I-9 standards is the employer expected to terminate employment.

The safe harbor regulations, illustrated clearly in ICE questions and answers, contemplate that an employer is eligible for the safe harbor, even if the employee presents wholly new documentation, not including the mismatched social security number. ICE recognizes that there may continue to be a mismatch issue in this circumstance. This underscores that the immigration laws do not hold an employer responsible for accepting employees' inaccurate, false, or purloined work authorization documents, so long as the employer completes the I-9 process and the identity and work authorizations appear to be genuine. To the contrary, the regulations anticipate that it is permissible to accept a new I-9 form with facially valid identity and work authorization documents and continue the employee's employment: "[I]f the employee is verified, then even if the employee is in fact an unauthorized alien, the employer will not be considered to have constructive knowledge of that fact."

Can an Employer Impose Stricter Rules to Deal with Mismatches?

The safe harbor rules address only when evidence of a social security mismatch notice may be used to establish knowing employment of unauthorized alien workers. To the extent that the safe harbor rules do not anticipate adverse employment action, an employer is well-advised to follow the rules and not go beyond them, as the rules define the extent to which an employer is safe in concluding that an employee with an unresolved social security number does not have work authorization. However, these rules do not prohibit employers from adopting stricter rules for management of social security mismatches, where those rules are unrelated to the issue of work authorization. Although ICE does not have authority to mandate that employers adopt such rules, the regulatory history of the Safe Harbor rules strongly suggest that ICE will consider these types of initiatives favorably in the event of worksite audits.

Will the Safe Harbor Provisions Apply to Situations Where the Mismatch Notice or Information Is Received Through Sources Other than the SSA No-Match Letter?

The preamble to the regulations addresses this, and the simple answer is no. Therefore, online verification of SSN's using the SSA website or information received as a result of participation in the USCIS EEV or ICE IMAGE program will not extend the Safe Harbor provisions to those situations. Nor do these regulations govern circumstances where an employer learns about alleged mismatches from state unemployment agencies or insurers. In fact, the Social Security Administration's limitations on the use of its systems strictly for payroll purposes, not for checking on work authorization, remains unchanged, notwithstanding the new Safe Harbor rules. The trick for employers will be in deciding what to do with mismatch circumstances not governed explicitly by the safe harbor rules, which is why work rules unrelated to I-9 processes and work authorization issues are worth consideration. Because of privacy protections for social security information under many state laws, and because of HIPAA limitations on the unauthorized disclosure of health-related information, these situations warrant individualized attention, to make sure that zealous immigration compliance does not lead to inadvertent missteps in other compliance arenas.²

How Do Mismatch Notices Impact Income Tax Withholding?

In order to claim exemptions under IRS Form W-4, the form must have a valid social security number. Absent such a number, IRS regulations (states typically follow) provide for withholding as if employee is single with zero exemptions. This generally results in higher income tax withholding than an employee would normally claim. While the DHS rules purportedly involved consultation with IRS, it is unclear whether no-match letters or follow-up procedures provided under the Safe Harbor require an employer to disregard any W-4 with mismatched SSNs. Arguably when the Safe Harbor review process has concluded and it is determined that a SSN is invalid, the W-4 should also be deemed invalid, and absent an employee providing a new SSN, withholding should be single, zero exemptions.

Will Participation in the "Basic Pilot" Program Cure Social Security Mismatch Issues?

"Basic Pilot," rechristened last week as "E-Verify" is a process distinct from the social security mismatch process outlined in the Safe Harbor rules. E-Verify is limited to new employees and is tied directly to the I-9 process. E-Verify checks not only Social Security Administration records, but also DHS documents. Plans are actively underway to allow E-Verify to authenticate photographs in immigration related documents, and DHS has asked that states begin to share drivers' license photographs for the same purposes, in hopes that these measures will reduce fraud. This system is not available to use in connection with social security mismatch notices.

Are There Other Worksite Enforcement Initiatives on the Horizon?

The White House confirmed that it soon plans to commence rule-making that will require federal contractors governed by the OFCCP to participate in E-Verify. Several pieces of pending legislation in Congress would impose similar requirements. DHS has promised to issue new guidance limiting the number of acceptable identity and work authorization documents in the I-9 process and is reportedly also working on an updated I-9 form. In addition, many states have adopted--or are considering adopting--their own statewide requirements for immigration compliance. Littler will continue to monitor and update the employer community as significant new developments unfold.

¹ As of the date of publication of this article we have been advised that SSA is preparing an online inquiry confirmation system.

² Group health plan administrators report that they sometimes receive SSN mismatch notices from group health insurers with respect to employees who are applying for group health coverage. In this case, the insurers refuse to enroll the individual and request that the plan administrator obtain corrected data. Here, the information from the insurer provided to the plan administrator is protected under the HIPAA medical privacy regulations, and may not be used for employment purposes without the consent of the employee or an exception provided in the HIPAA privacy regulations. For their part, the DHS final regulations do not address this scenario in their safe harbor procedures. Therefore, where the employer receives such a notice in its capacity as plan administrator, there is an issue of whether the employer, in its capacity as such, is constructively on notice of a SSN discrepancy. Certainly, this is a conflict, both as to the HIPAA and DHS regulations that should be addressed by the respective agencies. In the meantime, we believe that the plan administrator may be justified in releasing the no-match information to the employer in that capacity, under either the "fraud and abuse detection" or "crime on the premises" exceptions provided within the HIPAA regulations. These exceptions could be supported on the theory that providing fraudulent SSN data for the purpose of obtaining unauthorized U.S. employment is a criminal act, or that a person commits a crime by attempting to obtain ERISA benefits by making a false statement to the plan administrator. However, the plan administrator and privacy officer should consult HIPAA counsel to assure proper application of the exceptions before making such a disclosure without a written HIPAA consent from the employee.

Bonnie K. Gibson was a Shareholder working in Littler Mendelson Global's Phoenix office. Jorge Lopez is a Shareholder for Littler Mendelson Global in Littler's Miami office. GJ Stillson MacDonnell is a shareholder and chair of Littler Mendelson's Employment Taxes Practice Group in Littler's San Francisco office. If you would like further information, please contact your Littler attorney at 1.888.Littler, info@littler.com, Mr. Lopez at jlopez@littlerglobal.com, or Ms. MacDonnell at gjmacdonnell@littler.com.