your tailored business solutions

To retain talent and incentivize performance, businesses often grant equity compensation to their employees.  Granting an equity interest to an employee in a partnership has significant tax implications that should be understood by both the company and the employee before equity is granted.  A partnership can be a general partnership, limited partnership, limited liability partnership, or a limited liability corporation classified as a partnership.

In this article, we will look at dual status concerns and alternative approaches to handle these concerns.  The grant of equity to an individual is an incentive award that can be highly tax efficient.  Generally, the grant of equity is an appreciation award (meaning the company’s value must increase for the award to become valuable).  These awards are commonly classified as profits interests.  If properly structured, the individual granted these profit interests will have no income on the grant date and the appreciation has the potential to be taxed at capital gains rates.  Please note, there are different types of partnership interests.  We will discuss the types of partnership interests and equity compensation in a future article.

What Changes When an Employee Becomes a Partner

Unlike with an S corporation or C corporation, a partner of a partnership cannot also be an employee for employment tax purposes.  When an employee is granted an equity interest in a partnership, the individual is no longer considered an employee for employment tax purposes and the individual receives a Schedule K-1 for future pay (rather than a W-2). 

Disregarded Entity Complication

Recently finalized regulations also present a new dilemma when a partner of a partnership is an employee of a disregarded entity wholly owned by that same partnership.  In this situation, although the partner is an employee of the disregarded entity and not of the partnership, the regulations clarify that the disregarded entity is also disregarded for employment tax purposes.  As a result, the partner can no longer be an employee of the disregarded entity and would be subject to the self-employment tax rules as if the disregarded entity did not exist.  Therefore, all payments from the disregarded entity to the partner or on behalf of the partner would be recharacterized as guaranteed payments to the partner.  

Key Risks of Misclassification

Mischaracterizing partners as employees could entail significant risk in a variety of areas. 

1. Payroll Taxes – The partnership may have over-withheld and overstated its payroll tax deduction.  All payroll taxes paid on behalf of partners should be treated as guaranteed payments.
2. Retirement and Health Plans – A partner would not be entitled to take part in certain tax advantaged retirement or health plans that are typically available for employees.
3. Qualified Business Deduction (IRC Sec. 199A) – Wages paid to these partners are not eligible as W-2 wages for purposes of calculating the qualified business deduction.
4. State Apportionment – Wages paid to partners would be characterized as guaranteed payments and are not included in payroll apportionment factors.
5. Profits Interests Relying Upon Rev. Proc. 2001-43 – If partner and employee status are mutually exclusive, the partner has not followed the Rev. Proc.’s requirements, and the partner would not be treated as a partner on the grant date of the equity interest.  This could result in income and tax on the unvested profits interests. 

Common Structuring Approaches

Partnerships have developed a variety of approaches to manage dual status concerns.

1. Management Holding Company (“Tiered Partnership Structure”)

In this scenario, employee-partners would own their profits interests in another partnership sometimes referred to as a “management aggregator” (the upper tier partnership (UTP)) and the UTP would own these same profits interests in the operating partnership or holding partnership (the lower tier partnership (LTP)) owning the operating disregarded entity.  As a result, the employee-partners would be partners of the UTP and can be treated as employees of the disregarded entity wholly owned by the LTP.  Please note, the IRS asked for comments on these types of tiered structures.  For this tiered structure to be acceptable, it is dependent on respecting the management holding company as a partnership separate from the LTP.

2. Services or Payroll Entity

A separate affiliate company of the partnership issues a wage to the employee-partners. The separate affiliate company would receive a management fee from the partnership to supplement the wages paid to these employee-partners. A facts and circumstances analysis should be considered to mitigate the concerns of the employee-partners being viewed as providing services directly to the operating partnership or operating disregarded entity. 

3. Single Shareholder S Corporation

In this structure, the employee-partner owns his or her profit interest through an S Corporation.  Under this scenario, the employee partner would continue to receive wages from the operating partnership or operating disregarded entity, their new S Corporation would hold their interest in the partnership, and the S Corporation would allocate the employee partner’s earnings to them via an S Corporation K-1.  Careful attention to the reasonable compensation rules for S Corporations should be kept here.

We Can Help

The dual status dilemma can be difficult to navigate.  The implications of granting equity interests to employees are complex and the effectiveness of these structures depends upon the facts of your situation.   If you are considering granting equity compensation to employees or have other questions, please reach out to us for assistance.

The information provided in this communication is of a general nature and should not be considered professional advice. You should not act upon the information provided without obtaining specific professional advice. The information above is subject to change.

Healthcare organizations remain a frequent target for cybercriminals because patient data is valuable and clinical operations are highly sensitive to downtime. As healthcare systems become more dependent on connected technologies, even a temporary outage can affect patient access, care delivery, operational performance, and regulatory obligations. Ransomware groups understand these pressures and often exploit them to increase leverage during an attack.

A recent high-profile cybersecurity incident offers a clear example of how a cyber event can affect day-to-day healthcare operations. According to public reporting, the malware-related disruption affected systems supporting healthcare delivery, resulting in impacts to communications, patient-facing services, physician offices, imaging locations, and elective procedures while recovery efforts were underway.

For healthcare leaders, cybersecurity is closely tied to business continuity, operational resilience, reputation, and patient safety. The challenge is not simply preventing attacks, but maintaining critical services and supporting patients when key technology systems become unavailable.

When a Cyberattack Disrupts Patient Care and Healthcare Operations

Modern healthcare delivery relies heavily on technology. When critical systems are disrupted, the effects can quickly spread across the organization.

Disruptions can affect:

• Patient care delivery
• Clinical operations
• Staff workflows and communications
• Revenue cycle performance
• Compliance and regulatory response

What begins as a cybersecurity event can quickly become an operational resilience challenge with implications for patients, caregivers, and community trust.

Takeaways for Healthcare Leaders

• Understand organizational risk – Identify and evaluate risks that could affect care delivery, operations, compliance, and reputation.
• Strengthen incident response preparedness – Develop and regularly test incident response, business continuity, and disaster recovery plans.
• Improve detection and monitoring – Enhance vulnerability management, security monitoring, and threat detection capabilities to identify and contain threats sooner.
• Address regulatory expectations – Document risk assessments, remediation activities, and governance oversight to support HIPAA compliance.

We Can Help

Healthcare organizations face growing pressure to protect patient data, support uninterrupted care delivery, and meet regulatory expectations. As cyber threats become more sophisticated and technology environments more complex, many organizations struggle to maintain visibility into risk, validate security controls, and prepare for operational disruptions.

Effective cybersecurity programs are built on a combination of risk management, governance, technical controls, and incident preparedness. Elliott Davis works with healthcare organizations to:

• Assess cyber risk – Evaluate cybersecurity, compliance, and operational risks that could affect patient care and healthcare operations.
• Strengthen HIPAA compliance – Identify compliance gaps, enhance governance, and support ongoing risk management efforts.
• Validate security controls – Test vulnerabilities, assess external exposure, and evaluate the effectiveness of existing safeguards.
• Improve incident readiness – Prepare teams, processes, and recovery capabilities to maintain operations during a cyber event.
• Access virtual CISO leadership – Gain strategic cybersecurity guidance, governance oversight, and executive-level reporting without hiring a full-time CISO.

Contact us today to strengthen your cybersecurity posture and safeguard the care your patients depend on.

EDIT: Originally published July 14, 2026, this article has been updated with the latest announcements from the DoD.

The Department of Defense has announced the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026. The Department is conducting a 60-day review of the program through a newly established CMMC Reform Task Force.

As part of that review, the Department is actively seeking feedback from organizations across the Defense Industrial Base (DIB) regarding cybersecurity compliance challenges, implementation costs, and opportunities to streamline requirements. Industry comments are being accepted through August 14, 2026.

While the Phase II rollout is paused, Phase I self-assessment requirements remain in effect, and contractors and subcontractors remain responsible for safeguarding covered defense information under existing contractual requirements, including DFARS 252.204-7012.

What This Means for Defense Contractors

The suspension affects the planned transition to Phase II certification requirements and associated implementation milestones. However, cybersecurity obligations have not been suspended.

The Department has stated that compliance will continue to be enforced through self-assessments and select government-led assessments during the review period. Organizations that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) should continue maintaining cybersecurity controls, documentation, and evidence aligned with NIST SP 800-171.

The announcement should be viewed as a pause in certification rollout activities, not a pause in cybersecurity requirements.

In addition to maintaining compliance efforts, contractors may wish to participate in the Department's public feedback process. Feedback submitted during the review period may help inform future CMMC requirements and implementation approaches.

‍Why Preparation Matters Now

Although the future structure of the CMMC program may change, contractors remain responsible for protecting covered defense information and demonstrating cybersecurity readiness.

Organizations that continue remediation efforts, maintain current documentation, and preserve evidence of control implementation will be better positioned to respond to future guidance and avoid disruptions if certification requirements resume in a revised form.

Steps Contractors Can Take Now

1. Continue remediation activities for identified NIST SP 800-171 control gaps.
2. Update System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), policies, and supporting evidence to reflect current implementation status.
3. Confirm whether existing contracts include DFARS 252.204-7012 or other cybersecurity-related requirements.
4. Maintain readiness for self-assessments and potential government-led assessments.
5. Consider providing feedback to the DoD CMMC Reform Task Force.
6. Monitor Department guidance and updates resulting from the Task Force review.
7. Prioritize cybersecurity improvements that reduce operational risk and strengthen overall security posture.

We Can Help

The Elliott Davis Cybersecurity Advisory team can help organizations evaluate current compliance efforts, assess NIST SP 800-171 readiness, strengthen documentation and evidence programs, and prepare for future CMMC requirements as additional guidance becomes available.