Wright v. University of Cincinnati

58 F. Supp. 3d 854, 316 Educ. L. Rep. 745, 2014 U.S. Dist. LEXIS 138595, 124 Fair Empl. Prac. Cas. (BNA) 1323
CourtDistrict Court, S.D. Ohio
DecidedSeptember 30, 2014
DocketCase No. 1:13-CV-529
StatusPublished
Cited by1 cases

This text of 58 F. Supp. 3d 854 (Wright v. University of Cincinnati) is published on Counsel Stack Legal Research, covering District Court, S.D. Ohio primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Wright v. University of Cincinnati, 58 F. Supp. 3d 854, 316 Educ. L. Rep. 745, 2014 U.S. Dist. LEXIS 138595, 124 Fair Empl. Prac. Cas. (BNA) 1323 (S.D. Ohio 2014).

Opinion

ORDER

SANDRA S. BECKWITH, Senior District Judge.

This matter is before the Court on Defendant University of Cincinnati’s motion for summary judgment (Doc. No. 24). For the reasons that follow, Defendant’s motion for summary judgment is not well-taken and is DENIED.

I. Background

Plaintiff Renee Wright presents a single claim for employment discrimination against her former employer, the University of Cincinnati, pursuant to Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e-2. Plaintiff alleges that the University terminated her from her position as an SAP security analyst in the Office of Information Security because of her gender. In relevant part, and generally speaking, Plaintiffs job duties included granting and removing employee access to information contained within the University’s computer system. The University terminated Plaintiff in September 2011 on the grounds that she caused or allowed three separate security breaches in a five-month period, the last two occurring while she was on a performance improvement plan (“PIP”).

The first alleged security breach was discovered in May 2011. At the time, the University had recently completed installing an employee self-service module (“ESS”) in the computer system. Among other things, the ESS modifications allow employees to access their personnel files and make changes to their financial information, such as the bank where their pay is to be deposited. After the ESS modifications went live, two separate department heads noticed that upwards of 700 University employees had been granted access to view the financial information of all University employees. Doc. No. 20-1, at 80-81, 84-85. An investigation by Plaintiffs department into this alleged security breach found that in February 2011, Plaintiff entered the code changes that allowed this broad access to employees’ financial information pursuant to an email she received from Christine Diersing, the director of Business Core Systems — the department that was apparently responsible for administrating that domain of the system. Vykhovanyuk Dep. (Doc. No. 20) at 35.

Plaintiff was charged with a security breach for this incident because Diersing made the request for a change in system access through an email rather than via the Solutions Manager function of the system. According to the University, the formal procedure required system change requests to be made through the Solutions Manager so that the requested change could be properly vetted and tested before it went live. Plaintiff was put on a PIP for making this system change in violation of the established procedure. Plaintiff, however, has presented evidence that she documented the change she made in the system itself as well as the source authorizing the change. Doc. No. 20-1, at 13. There is also in the record an email Diersing authored at the time that the alleged security breach was discovered indicating the access changes Plaintiff entered had previously been considered and approved and worked the way they were supposed to have worked. See Doc. No. 20-1, at 71.1 [857]*857In other words, according to Plaintiff, the access changes she made were authorized and the results anticipated by the responsible party or parties. See also Doc. No. 20-1, at 19 (internal system note dated April 14, 2011 stating “A check was made into the ESS services for appearance and functionality resulting from the CE switch in production. All services junction as anticipated. ”) (emphasis added).

Plaintiff was charged with a second and similar security breach in June 2011. Plaintiffs co-worker, Larry McCullough, changed the access to a certain database of human resources employee Larry Suttles. Suttles, however, needed continued access to the database to do his job and emailed the OIS to restore it. Plaintiff saw Sut-tles’s email and was aware that he had previously been authorized access to the database. Plaint. Dep. at 192-95. Plaintiff, therefore, restored Suttles’s access to the database. Somehow — it is not clear on the record — Plaintiffs supervisor became aware that she granted Suttles’s request. Pursuant to a directive from Diersing, McCullough removed Suttles’s access to the database again. Later, however, Diersing’s manager, Toni Lucas, directed that Suttles’s access be restored again. See Doc. No. 20-1, at 92-98. Plaintiff, nevertheless, was cited for a security breach for accepting Suttles’s access request without proper authorization.

Plaintiff was charged with a third and final security breach in August 2011. On this occasion, Plaintiff became aware that an HR employee named Valerie Reid transferred to a new department and no longer would need access to two of the system’s databases. Plaintiff reminded HR to send her a request to change Reid’s access to these databases. HR did send a change request to Plaintiff through the appropriate channels. According to Plaintiff, she had two windows open on her computer to enter the access changes but one of them, unbeknownst to her, “timed out” and was not completed. Plaintiff testified that normally when she made security changes, the system would automatically generate a report the next day so she could verify her work. On this occasion, however, there was a power outage in the data center and the system did not generate the report. Plaintiff did not take any other steps to verify that the changes had been completed. Four days went by until it was discovered that Plaintiff failed to change Reid’s access to the one of the databases. Plaint. Dep. at 203-11.

Because Plaintiff committed three security violations in just over five months, her immediate supervisor, Bogdan Vykhovan-yuk, and division assistant vice, president, Kevin McLaughlin, decided there were sufficient grounds to terminate her for neglect of duty. They passed along this request to Melissa Berling, the Director of Business Affairs. On September 8, 2011, Berling, in consultation with the legal and human resources departments, authored a letter to Plaintiff informing her that her termination was under consideration and set out the bases for that decision — namely the three security violations just described. In accordance with University policy, Ber-ling gave Plaintiff twenty-four hours to [858]*858respond to her letter and explain why she should not be fired. Doc. No. 19-1, at 29-30.

In her response, Plaintiff highlighted her “exemplary” performance reviews pri- or to the cited security violations. With regard to the first violation, Plaintiff indicated essentially that she had only done what she had been asked to do and that it was not the responsibility of the security department to test and approve the requested change. With regard to the second violation, Plaintiff indicated that Sub-ties’ security access had been revoked in error, that there was authorization on file for the access he requested, and that Sut-tles’s manager had reminded McCullough not to change the access of any of her employees without her prior approval. Finally, as to the third violation, Plaintiff explained that the power outage in the data center prevented her from being able to double-check her work. Doc. No. 19-1, at 31-32.

The following day, Berling wrote a letter confirming the decision terminating Plaintiffs employment. Doc. No. 18-1, at 51.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
58 F. Supp. 3d 854, 316 Educ. L. Rep. 745, 2014 U.S. Dist. LEXIS 138595, 124 Fair Empl. Prac. Cas. (BNA) 1323, Counsel Stack Legal Research, https://law.counselstack.com/opinion/wright-v-university-of-cincinnati-ohsd-2014.