Deanna Dorsey v. Northern Light Health

2022 ME 62, 288 A.3d 386

• Court: Supreme Judicial Court of Maine
• Decided: December 20, 2022
• Status: Published

Opinion

MAINE SUPREME JUDICIAL COURT Reporter of Decisions Decision: 2022 ME 62 Docket: BCD-22-4 Argued: October 4, 2022 Decided: December 20, 2022

Panel: STANFILL, C.J., and MEAD, JABAR, HORTON, and LAWRENCE, JJ.

DEANNA DORSEY

v.

NORTHERN LIGHT HEALTH et al.

JABAR, J.

[¶1] Northern Light Health and Northern Light Eastern Maine Medical

Center (together EMMC) appeal from a summary judgment entered in the

Business and Consumer Docket (Duddy, J.) in favor of Deanna Dorsey on the

parties’ cross-motions for summary judgment. The trial court concluded that

EMMC failed to comply with the state’s wage payment and minimum wage laws,

26 M.R.S. §§ 621-A to 629-B, 664(1) (2022), when it permitted Dorsey’s

paycheck to be deposited into a bank account controlled by cybercriminals1

who had stolen Dorsey’s username and password to the online portal where

she designated payroll information. We affirm the judgment.

1 There is no information in the record indicating that criminal charges were brought as a result of this incident, but the parties and the court all refer to the perpetrators by this term, as will this opinion, for consistency. 2

I. BACKGROUND

[¶2] The following facts are drawn from the summary judgment record,

are viewed in the light most favorable to EMMC, the nonprevailing party, and

are undisputed unless otherwise noted. See Brooks v. Lemieux, 2017 ME 55, ¶ 2,

157 A.3d 798.

[¶3] Dorsey is an anesthesiologist employed by EMMC pursuant to an

“Employment Agreement” that sets forth the amount of, but not how she

receives, her compensation.2 Upon hiring Dorsey, EMMC provided her with its

“Information Systems Acceptable Use” policy, which prohibits disclosure of an

employee’s username and password. The policy does not contain a signature

2 The stipulated statement of material facts states that Dorsey “was employed pursuant to a series

of written employment agreements and amendments thereto (collectively the ‘Employment Agreement’) setting forth the amount of Dorsey’s compensation.” The complaint alleges that Dorsey’s “compensation was governed by a Physician Employment Agreement executed in September of 2016, an Amendment to the Physician Employment Agreement executed in July and August of 2017, and a Memo of Understanding concerning compensation for call time executed in July of 2017 (the ‘2017 Memo’)” and that “[t]he Employment Agreement required [EMMC] to pay Dorsey in regular installments ‘consistent with Employer’s regular payroll practices.’” In its answer, EMMC admits those facts as they relate to the agreements executed in September of 2016 and July and August of 2017 but denies them as they relate to the July 2017 agreement. Neither the appendix nor the Odyssey record appears to contain any part of the “Employment Agreement.” EMMC asserts that we “can reasonably infer from the parties’ failure to introduce or rely upon any other provisions of the written Employment Agreement that it is silent regarding the manner and method of wage payment.” 3

line. Dorsey signed an “Employee Code of Conduct and Confidentiality

Statement” (Code of Conduct)3 that states in relevant part:

As part of my job, I may use, see or hear confidential patient information and confidential organizational information. The information may be spoken, written, on diagnostic equipment, on computer or on tape. . . . I will follow the Code of Conduct and the EMH/EMMC policies when I . . . use . . . [confidential organizational] information.

If I am given or select a username and password for use in computers . . . , I will not tell anyone else what they are. My username and password are the same as my signature and when used they mean that I obtained, used or gave out information. I am responsible for all activities if someone else uses my username and password.

The Code of Conduct lacks a line for any person other than an employee to sign

and is not co-signed by a representative of EMMC. Lastly, Dorsey completed a

direct deposit authorization form that enabled EMMC to deposit her wages into

her designated bank account at USAA Federal Savings Bank.

[¶4] At the time, EMMC used a “Human Resources Information System”

called “Lawson” that contained an “employee self-service portal” (ESS portal)

by which employees who opted to be paid via direct deposit, including Dorsey,

could designate the bank account into which their paychecks would be

3 The trial court refers to this document as “the Statement,” while the parties refer to it as, alternatively, the Code of Conduct and Confidentiality Policy or the Code of Conduct. For clarity and brevity, this opinion refers to that document as the Code of Conduct. 4

deposited. Dorsey was required to use Lawson to designate where her direct

deposit should be paid.

[¶5] In June 2018, Dorsey and approximately 600 other EMMC

employees received a “phishing”4 email at their work email addresses that

contained an embedded link. Upon clicking the link, the employee would be

routed to a fraudulent ESS portal and prompted to enter their username and

password. After doing so, the employee would be routed to a blank screen.

Although Dorsey has no specific recollection of receiving or interacting with the

phishing email, the court noted that her lack of recall failed to generate a factual

issue. EMMC does not contend that Dorsey was at fault in entering her

username and password in the ESS portal or in causing change to the

designation of a bank account for the direct deposit of her pay.

[¶6] Cybercriminals using Dorsey’s illegally obtained credentials

changed Dorsey’s designated bank account to have her pay from EMMC

deposited into a Green Dot bank account controlled by the cybercriminals

rather than into her USAA bank account. An EMMC expert indicated that it was

4 Phishing is defined as “the practice of sending a fraudulent email that appears to be from a legitimate business, as a bank or credit card company, in an attempt to deceive an individual into disclosing personal information, as a password or an account number.” Phishing, Webster’s New World College Dictionary (5th ed. 2016). 5

impossible to show who used Dorsey’s credentials to change the bank account.

As a result of the change, EMMC deposited Dorsey’s earned wages for the

relevant pay period ($8,432.98) into the Green Dot account. After two other

employees notified EMMC that they had not received their expected direct

deposits, EMMC investigated and determined that eleven employees, including

Dorsey, had their paychecks deposited into bank accounts controlled by the

cybercriminals.

[¶7] EMMC reported the wage theft to the FBI and its own bank, but only

a small portion of Dorsey’s wages ($79.65) was recovered and returned to

Dorsey. EMMC refused to issue Dorsey a check for the remaining wages.

[¶8] On June 23, 2020, Dorsey filed a three-count complaint against

EMMC asserting that EMMC failed to (1) pay her in violation of the wage

payment laws, see 26 M.R.S. §§ 621-A to 629-B; (2) pay her minimum wage and

overtime, see 26 M.R.S. §§ 664, 670 (2022); and (3) produce certain documents

deemed part of her personnel file, see 26 M.R.S. § 631 (2022). Both parties filed

motions for summary judgment on July 21, 2021. The court granted Dorsey’s

motion on October 26, 2021, and entered final judgment on Count 1 and

Count 2 December 21, 2021.5 Count 3 was dismissed by stipulation.

5 In granting summary judgment for Dorsey, the court emphasized that EMMC was not arguing that Dorsey was at fault for the fraudulent redirection of her pay: “To understand EMMC’s defense to 6

[¶9] EMMC timely appealed. 14 M.R.S. § 1851 (2022); M.R. App. P. 2A(a),

2B(a), (c)(1).

II. DISCUSSION

A. Standard of Review

[¶10] “Cross motions for summary judgment neither alter the basic

Rule 56 standard, nor warrant the grant of summary judgment per se.”

F.R. Carroll, Inc. v. TD Bank, N.A., 2010 ME 115 ¶ 8, 8 A.3d 646 (quotation marks

omitted). When reviewing a grant of summary judgment, we consider “only the

portions of the record referred to, and the material facts set forth in [M.R.

Civ. P. 56(h)] statements.” Id. (quotation marks omitted). We consider the

“evidence and any reasonable inferences thereof in the light most favorable to

the non-prevailing party to determine whether there is a genuine issue of

material fact.” Yankee Pride Transp. & Logistics, Inc. v. UIG, Inc., 2021 ME 65,

¶ 10, 264 A.3d 1248. “A fact is material if it has the potential to affect the

outcome of the suit, and a genuine issue of material fact exists when a

fact-finder must choose between competing versions of the truth, even if one

Dr. Dorsey’s wage claims, it is first necessary to understand what EMMC is not arguing. As EMMC explained at oral argument, EMMC is not arguing that Dr. Dorsey was negligent or otherwise at fault and is thus disentitled to payment of her Wages. EMMC is also not arguing that Dr. Dorsey breached her Employment Agreement with EMMC or otherwise violated an EMMC policy and is thus disentitled to payment of her Wages.” 7

party’s version appears more credible or persuasive.” Id. (quotation marks

omitted). If no genuine issue of material fact exists, we “review de novo the trial

court’s interpretation and application of the relevant statutes and legal

concepts.” Ogden v. Labonville, 2020 ME 133, ¶ 10, 242 A.3d 177 (quotation

marks omitted).

B. The Wage Payment Laws

[¶11] “In interpreting a statute, our single goal is to give effect to the

Legislature’s intent in enacting the statute.” Dickau v. Vt. Mut. Ins. Co., 2014 ME

158, ¶ 19, 107 A.3d 621. To achieve that goal, we first look to a statute’s plain

language, “taking into account the subject matter and purposes of the statute,

and the consequences of a particular interpretation. In determining a statute’s

practical operation and potential consequences, we may reject any

construction that is inimical to the public interest or creates absurd, illogical,

unreasonable, inconsistent, or anomalous results if an alternative

interpretation avoids such results.” Id. ¶¶ 19, 21 (quotation marks omitted).

Maine’s wage payment laws are remedial statutes that we construe liberally for

the benefit of employees. Dir. Bur. of Labor Standards v. Cormier, 527 A.2d 1297,

1300 (Me. 1987). 8

[¶12] Under Maine’s wage payment laws, an “employer is liable to the

employee . . . for the amount of unpaid wages.” 26 M.R.S. § 626-A (authorizing

the affected employee to initiate an action for unpaid wages). “For purposes of

[section 621-A, governing the timely and full payment of wages], ‘direct deposit’

means the transfer of wages through electronic funds transfer directly into an

employee’s account in an accredited financial institution designated by the

employee.”6 Id. § 621-A(7).

[¶13] However, contract law, not the wage payment laws, governs the

amount and manner of an employee’s payment. See Richardson v. Winthrop Sch.

Dep’t, 2009 ME 109, ¶ 7, 983 A.2d 400 (“Although section 626 creates a

statutory right for former employees to seek payment, entitlement to payment

is governed solely by the terms of the employment agreement.”); OfficeMax Inc.

v. Sousa, 773 F. Supp. 2d 190, 234 (D. Me. 2011).

[¶14] The undisputed facts demonstrate that Dorsey’s earned wages for

the period in question were $8,432.98. Section 621-A establishes that she is

entitled to those wages in full for that two-week pay period and that those

wages must be paid at the rate previously established by EMMC. See 26 M.R.S.

6Title 26 M.R.S. § 621-A(7) (2022) defines “direct deposit” within a subsection prohibiting employees from charging fees for the payment of wages by means of direct deposit. 9

§ 621-A(1), (5). While “pay” is undefined by statute, the term “direct deposit”

in section 621-A(7) means a payment that is transferred directly into the

employee’s designated account, and construing the statute in favor of the

employee, we hold that the wage payment laws, by requiring that a direct

deposit be into an employee’s account, require actual possession of the funds

by the employee. See id. § 621-A(7); Cormier, 527 A.2d at 1300. Because an

employer does not “pay” an employee as required by section 621-A unless an

employee actually received her wages, EMMC failed to pay Dorsey at the time

required by the wage payment statutes because Dorsey never received

possession of her wages.

[¶15] Here, it is undisputed that Dorsey did not authorize EMMC to pay

her salary to the Green Dot account. Cybercriminals, not Dorsey, designated

the Green Dot account, an account that Dorsey did not have access to, as the

receiving account for Dorsey’s wages. It does not make any difference how the

cybercriminals obtained Dorsey’s credentials because it is undisputed in the

record that Dorsey did not designate the fraudulent bank account as the

depository for her paycheck, the cybercriminals did, and she did not receive her

pay in the account that she had designated. 10

[¶16] EMMC argues that it should be entitled to rely on the

cybercriminals’ use of Dorsey’s login credentials,7 citing cases where wages

were diverted to other recipients. Here, however, Dorsey did not actually make

the change to her direct deposit information, in direct contrast to EMMC’s cited

cases where the employees themselves actually requested the paycheck

diversion. See Schlear v. James Newspapers, Inc., 1998 ME 215, ¶ 4, 717 A.2d

917 (payment was diverted from employee to third party at employee’s

request); Brennan v. Veterans Cleaning Serv., Inc., 482 F.2d 1362, 1368-70

(5th Cir. 1973) (wages withheld pursuant to an assignment made by the

employee to repay certain amounts to employer); Vazquez v. Tri-State Mgmt.

Co., 2002 U.S. Dist. LEXIS 385, at *4, *13 (employee requested paycheck

deductions to repay employer for purchasing a car for employee’s use).

[¶17] The fact that Dorsey signed the Code of Conduct is also unavailing

because the document is not a component of Dorsey’s Employment Agreement,

7EMMC’s brief argues that “[u]nder the Business Court’s construction of Section 629, . . . there is literally no circumstance in which an employer can rely upon an employee’s objective manifestation of intent. Under the rule formulated by the Business Court, as long as the employee disavows subjective intent and does not personally receive the wages, the employer must pay them again.” The flaw in this argument is that the objective manifestation of intent that resulted in the change of bank accounts was not Dorsey’s but the cybercriminals’. Given EMMC’s acknowledgments that Dorsey was not at fault and that it was EMMC, not Dorsey, that implemented the online method for changing direct deposit information that allowed the fraud to occur, it is consistent with the goals of the statute for the burden of the loss to fall on EMMC rather than Dorsey. 11

it is not supported by consideration, and the Code of Conduct, by its terms,

applies only to “confidential patient information and confidential

organizational information.”

[¶18] Finally, as the trial court emphasized in its ruling, EMMC does not

contend that “Dorsey was negligent or otherwise at fault” or in breach of her

employment agreement, so neither the court nor we have been called on to

decide the effect of an employee’s negligence, breach, or other fault in these

circumstances.

III. CONCLUSION

[¶19] There is no genuine dispute of material fact that EMMC did not

deposit Dorsey’s wages into her bank account. By not transferring the money

to Dorsey’s account, EMMC failed to “pay” her and thereby violated Maine’s

wage payment laws. Dorsey was entitled to summary judgment.

The entry is:

Judgment affirmed. 12

Daniel R. Strader, Esq., and Katharine I. Rand, Esq. (orally), Pierce Atwood LLP, Portland, for appellants Northern Light Health and Northern Light Eastern Maine Medical Center

Peter Mancuso, Esq. (orally), Borealis Law PLLC, Portland, for appellee Deanna Dorsey

Business and Consumer Docket docket number BCD-2020-37 FOR CLERKS REFERENCE ONLY