NAMA Industry Regulations & Compliance 5 — Questions and Answers
Question 1: Which law requires vending operators who employ 50 or more full-time equivalent employees to offer affordable health insurance coverage or face potential penalties?
- ERISA
- COBRA
- The Affordable Care Act (ACA) Employer Shared Responsibility provision (Correct answer)
- HIPAA
Correct answer: The Affordable Care Act (ACA) Employer Shared Responsibility provision
The ACA's Employer Shared Responsibility provision (the 'employer mandate') requires applicable large employers with 50+ FTEs to offer minimum essential coverage or pay a penalty.
Question 2: A vending machine located in a school that participates in the National School Lunch Program must comply with USDA 'Smart Snacks in School' standards. These standards set limits on:
- Machine operating hours only
- Calories, saturated fat, sodium, and sugar content of competitive foods sold (Correct answer)
- The number of machines permitted per campus
- The types of payment accepted by school vending machines
Correct answer: Calories, saturated fat, sodium, and sugar content of competitive foods sold
USDA Smart Snacks standards cap calories, saturated fat, sodium, and total sugars for foods and beverages sold in schools outside of the meal program.
Question 3: The Sherman Antitrust Act could apply to vending operators if two competing operators agree to:
- Use the same third-party payment processor
- Divide geographic territories and not compete in each other's areas (Correct answer)
- Join the same trade association
- Purchase products from the same distributor
Correct answer: Divide geographic territories and not compete in each other's areas
Market allocation agreements between competitors — such as dividing territories — are per se violations of Section 1 of the Sherman Antitrust Act.
Question 4: A vending operator's new machine software update stores biometric data (fingerprint scans) for employee authentication. In Illinois, this triggers compliance with:
- Illinois Personal Information Protection Act (PIPA)
- Illinois Biometric Information Privacy Act (BIPA) (Correct answer)
- Illinois Electronic Commerce Security Act
- Illinois Consumer Fraud Act
Correct answer: Illinois Biometric Information Privacy Act (BIPA)
Illinois BIPA regulates the collection, use, storage, and destruction of biometric identifiers including fingerprints, requiring written consent and a retention policy.
Question 5: When a vending operator imports snack products from abroad and repackages them for sale in U.S. machines, they assume the regulatory role of:
- Foreign supplier
- FDA-registered food facility and importer of record (Correct answer)
- Broker exempt from FDA oversight
- Contract manufacturer only
Correct answer: FDA-registered food facility and importer of record
An entity that imports food products and repackages them for sale is considered a food facility under FSMA and must register with the FDA, and is the importer of record for Customs purposes.
Question 6: Under the Telephone Consumer Protection Act (TCPA), a vending operator using automated text messages to promote loyalty program offers must:
- Send messages only between 8 a.m. and 9 p.m. local time and obtain prior express written consent (Correct answer)
- Obtain oral consent captured on a recorded line
- Register the marketing campaign with the FCC before launching
- Limit message frequency to no more than one per week
Correct answer: Send messages only between 8 a.m. and 9 p.m. local time and obtain prior express written consent
TCPA requires prior express written consent for autodialed or pre-recorded marketing texts and restricts calling hours to 8 a.m.–9 p.m. in the recipient's local time zone.
Question 7: A vending operator who is also a 'covered entity' storing customer health data (e.g., through a wellness vending program tied to employer health plans) must comply with:
- FTC Health Breach Notification Rule only
- HIPAA Privacy and Security Rules (Correct answer)
- State insurance regulations exclusively
- OSHA medical records standard 29 CFR 1910.1020
Correct answer: HIPAA Privacy and Security Rules
If a vending operator handles protected health information as part of an employer-sponsored health plan, HIPAA Privacy and Security Rules govern how that data must be protected and disclosed.
NAMA Industry Regulations & Compliance 5
Which law requires vending operators who employ 50 or more full-time equivalent employees to offer affordable health insurance coverage or face potential penalties?