Deanna Dorsey v. Northern Light Health , 2022 ME 62 ( 2022 )

MAINE SUPREME JUDICIAL COURT Reporter of Decisions
Decision: 2022 ME 62Docket: BCD-22-4
Argued: October 4, 2022
Decided: December 20, 2022
Panel: STANFILL, C.J., and MEAD, JABAR, HORTON, and LAWRENCE, JJ.
DEANNA DORSEY
v.
NORTHERN LIGHT HEALTH et al.
JABAR, J.
[¶1] Northern Light Health and Northern Light Eastern Maine Medical
Center (together EMMC) appeal from a summary judgment entered in the
Business and Consumer Docket (Duddy, J.) in favor of Deanna Dorsey on the
parties’ cross-motions for summary judgment. The trial court concluded that
EMMC failed to comply with the state’s wage payment and minimum wage laws,
26 M.R.S. §§ 621-A to 629-B, 664(1) (2022), when it permitted Dorsey’s
paycheck to be deposited into a bank account controlled by cybercriminals1
who had stolen Dorsey’s username and password to the online portal where
she designated payroll information. We affirm the judgment.
1 There is no information in the record indicating that criminal charges were brought as a result
of this incident, but the parties and the court all refer to the perpetrators by this term, as will this
opinion, for consistency.
2
I. BACKGROUND
[¶2] The following facts are drawn from the summary judgment record,
are viewed in the light most favorable to EMMC, the nonprevailing party, and
are undisputed unless otherwise noted. See Brooks v. Lemieux, 2017 ME 55, ¶ 2,
157 A.3d 798.
[¶3] Dorsey is an anesthesiologist employed by EMMC pursuant to an
“Employment Agreement” that sets forth the amount of, but not how she
receives, her compensation.2 Upon hiring Dorsey, EMMC provided her with its
“Information Systems Acceptable Use” policy, which prohibits disclosure of an
employee’s username and password. The policy does not contain a signature
2 The stipulated statement of material facts states that Dorsey “was employed pursuant to a series
of written employment agreements and amendments thereto (collectively the ‘Employment
Agreement’) setting forth the amount of Dorsey’s compensation.” The complaint alleges that
Dorsey’s “compensation was governed by a Physician Employment Agreement executed in
September of 2016, an Amendment to the Physician Employment Agreement executed in July and
August of 2017, and a Memo of Understanding concerning compensation for call time executed in
July of 2017 (the ‘2017 Memo’)” and that “[t]he Employment Agreement required [EMMC] to pay
Dorsey in regular installments ‘consistent with Employer’s regular payroll practices.’” In its answer,
EMMC admits those facts as they relate to the agreements executed in September of 2016 and July
and August of 2017 but denies them as they relate to the July 2017 agreement. Neither the appendix
nor the Odyssey record appears to contain any part of the “Employment Agreement.” EMMC asserts
that we “can reasonably infer from the parties’ failure to introduce or rely upon any other provisions
of the written Employment Agreement that it is silent regarding the manner and method of wage
payment.”
3
line. Dorsey signed an “Employee Code of Conduct and Confidentiality
Statement” (Code of Conduct)3 that states in relevant part:
As part of my job, I may use, see or hear confidential patient
information and confidential organizational information. The
information may be spoken, written, on diagnostic equipment, on
computer or on tape. . . . I will follow the Code of Conduct and the
EMH/EMMC policies when I . . . use . . . [confidential
organizational] information.
If I am given or select a username and password for use in
computers . . . , I will not tell anyone else what they are. My
username and password are the same as my signature and when
used they mean that I obtained, used or gave out information. I am
responsible for all activities if someone else uses my username and
password.
The Code of Conduct lacks a line for any person other than an employee to sign
and is not co-signed by a representative of EMMC. Lastly, Dorsey completed a
direct deposit authorization form that enabled EMMC to deposit her wages into
her designated bank account at USAA Federal Savings Bank.
[¶4] At the time, EMMC used a “Human Resources Information System”
called “Lawson” that contained an “employee self-service portal” (ESS portal)
by which employees who opted to be paid via direct deposit, including Dorsey,
could designate the bank account into which their paychecks would be
3 The trial court refers to this document as “the Statement,” while the parties refer to it as,
alternatively, the Code of Conduct and Confidentiality Policy or the Code of Conduct. For clarity and
brevity, this opinion refers to that document as the Code of Conduct.
4
deposited. Dorsey was required to use Lawson to designate where her direct
deposit should be paid.
[¶5] In June 2018, Dorsey and approximately 600 other EMMC
employees received a “phishing”4 email at their work email addresses that
contained an embedded link. Upon clicking the link, the employee would be
routed to a fraudulent ESS portal and prompted to enter their username and
password. After doing so, the employee would be routed to a blank screen.
Although Dorsey has no specific recollection of receiving or interacting with the
phishing email, the court noted that her lack of recall failed to generate a factual
issue. EMMC does not contend that Dorsey was at fault in entering her
username and password in the ESS portal or in causing change to the
designation of a bank account for the direct deposit of her pay.
[¶6] Cybercriminals using Dorsey’s illegally obtained credentials
changed Dorsey’s designated bank account to have her pay from EMMC
deposited into a Green Dot bank account controlled by the cybercriminals
rather than into her USAA bank account. An EMMC expert indicated that it was
4 Phishing is defined as “the practice of sending a fraudulent email that appears to be from a
legitimate business, as a bank or credit card company, in an attempt to deceive an individual into
disclosing personal information, as a password or an account number.” Phishing, Webster’s New
World College Dictionary (5th ed. 2016).
5
impossible to show who used Dorsey’s credentials to change the bank account.
As a result of the change, EMMC deposited Dorsey’s earned wages for the
relevant pay period ($8,432.98) into the Green Dot account. After two other
employees notified EMMC that they had not received their expected direct
deposits, EMMC investigated and determined that eleven employees, including
Dorsey, had their paychecks deposited into bank accounts controlled by the
cybercriminals.
[¶7] EMMC reported the wage theft to the FBI and its own bank, but only
a small portion of Dorsey’s wages ($79.65) was recovered and returned to
Dorsey. EMMC refused to issue Dorsey a check for the remaining wages.
[¶8] On June 23, 2020, Dorsey filed a three-count complaint against
EMMC asserting that EMMC failed to (1) pay her in violation of the wage
payment laws, see 26 M.R.S. §§ 621-A to 629-B; (2) pay her minimum wage and
overtime, see 26 M.R.S. §§ 664, 670 (2022); and (3) produce certain documents
deemed part of her personnel file, see 26 M.R.S. § 631 (2022). Both parties filed
motions for summary judgment on July 21, 2021. The court granted Dorsey’s
motion on October 26, 2021, and entered final judgment on Count 1 and
Count 2 December 21, 2021.5 Count 3 was dismissed by stipulation.
5 In granting summary judgment for Dorsey, the court emphasized that EMMC was not arguing
that Dorsey was at fault for the fraudulent redirection of her pay: “To understand EMMC’s defense to
6
[¶9] EMMC timely appealed. 14 M.R.S. § 1851 (2022); M.R. App. P. 2A(a),
2B(a), (c)(1).
II. DISCUSSION
A. Standard of Review
[¶10] “Cross motions for summary judgment neither alter the basic
Rule 56 standard, nor warrant the grant of summary judgment per se.”
F.R. Carroll, Inc. v. TD Bank, N.A., 2010 ME 115 ¶ 8, 8 A.3d 646 (quotation marks
omitted). When reviewing a grant of summary judgment, we consider “only the
portions of the record referred to, and the material facts set forth in [M.R.
Civ. P. 56(h)] statements.” Id. (quotation marks omitted). We consider the
“evidence and any reasonable inferences thereof in the light most favorable to
the non-prevailing party to determine whether there is a genuine issue of
material fact.” Yankee Pride Transp. & Logistics, Inc. v. UIG, Inc., 2021 ME 65,
¶ 10, 264 A.3d 1248. “A fact is material if it has the potential to affect the
outcome of the suit, and a genuine issue of material fact exists when a
fact-finder must choose between competing versions of the truth, even if one
Dr. Dorsey’s wage claims, it is first necessary to understand what EMMC is not arguing. As EMMC
explained at oral argument, EMMC is not arguing that Dr. Dorsey was negligent or otherwise at fault
and is thus disentitled to payment of her Wages. EMMC is also not arguing that Dr. Dorsey breached
her Employment Agreement with EMMC or otherwise violated an EMMC policy and is thus disentitled
to payment of her Wages.”
7
party’s version appears more credible or persuasive.” Id. (quotation marks
omitted). If no genuine issue of material fact exists, we “review de novo the trial
court’s interpretation and application of the relevant statutes and legal
concepts.” Ogden v. Labonville, 2020 ME 133, ¶ 10, 242 A.3d 177 (quotation
marks omitted).
B. The Wage Payment Laws
[¶11] “In interpreting a statute, our single goal is to give effect to the
Legislature’s intent in enacting the statute.” Dickau v. Vt. Mut. Ins. Co., 2014 ME
158, ¶ 19, 107 A.3d 621. To achieve that goal, we first look to a statute’s plain
language, “taking into account the subject matter and purposes of the statute,
and the consequences of a particular interpretation. In determining a statute’s
practical operation and potential consequences, we may reject any
construction that is inimical to the public interest or creates absurd, illogical,
unreasonable, inconsistent, or anomalous results if an alternative
interpretation avoids such results.” Id. ¶¶ 19, 21 (quotation marks omitted).
Maine’s wage payment laws are remedial statutes that we construe liberally for
the benefit of employees. Dir. Bur. of Labor Standards v. Cormier, 527 A.2d 1297,
1300 (Me. 1987).
8
[¶12] Under Maine’s wage payment laws, an “employer is liable to the
employee . . . for the amount of unpaid wages.” 26 M.R.S. § 626-A (authorizing
the affected employee to initiate an action for unpaid wages). “For purposes of
[section 621-A, governing the timely and full payment of wages], ‘direct deposit’
means the transfer of wages through electronic funds transfer directly into an
employee’s account in an accredited financial institution designated by the
employee.”6 Id. § 621-A(7).
[¶13] However, contract law, not the wage payment laws, governs the
amount and manner of an employee’s payment. See Richardson v. Winthrop Sch.
Dep’t, 2009 ME 109, ¶ 7, 983 A.2d 400 (“Although section 626 creates a
statutory right for former employees to seek payment, entitlement to payment
is governed solely by the terms of the employment agreement.”); OfficeMax Inc.
v. Sousa, 773 F. Supp. 2d 190, 234 (D. Me. 2011).
[¶14] The undisputed facts demonstrate that Dorsey’s earned wages for
the period in question were $8,432.98. Section 621-A establishes that she is
entitled to those wages in full for that two-week pay period and that those
wages must be paid at the rate previously established by EMMC. See 26 M.R.S.
6Title 26 M.R.S. § 621-A(7) (2022) defines “direct deposit” within a subsection prohibiting
employees from charging fees for the payment of wages by means of direct deposit.
9
§ 621-A(1), (5). While “pay” is undefined by statute, the term “direct deposit”
in section 621-A(7) means a payment that is transferred directly into the
employee’s designated account, and construing the statute in favor of the
employee, we hold that the wage payment laws, by requiring that a direct
deposit be into an employee’s account, require actual possession of the funds
by the employee. See id. § 621-A(7); Cormier, 527 A.2d at 1300. Because an
employer does not “pay” an employee as required by section 621-A unless an
employee actually received her wages, EMMC failed to pay Dorsey at the time
required by the wage payment statutes because Dorsey never received
possession of her wages.
[¶15] Here, it is undisputed that Dorsey did not authorize EMMC to pay
her salary to the Green Dot account. Cybercriminals, not Dorsey, designated
the Green Dot account, an account that Dorsey did not have access to, as the
receiving account for Dorsey’s wages. It does not make any difference how the
cybercriminals obtained Dorsey’s credentials because it is undisputed in the
record that Dorsey did not designate the fraudulent bank account as the
depository for her paycheck, the cybercriminals did, and she did not receive her
pay in the account that she had designated.
10
[¶16] EMMC argues that it should be entitled to rely on the
cybercriminals’ use of Dorsey’s login credentials,7 citing cases where wages
were diverted to other recipients. Here, however, Dorsey did not actually make
the change to her direct deposit information, in direct contrast to EMMC’s cited
cases where the employees themselves actually requested the paycheck
diversion. See Schlear v. James Newspapers, Inc., 1998 ME 215, ¶ 4, 717 A.2d
917 (payment was diverted from employee to third party at employee’s
request); Brennan v. Veterans Cleaning Serv., Inc., 482 F.2d 1362, 1368-70
(5th Cir. 1973) (wages withheld pursuant to an assignment made by the
employee to repay certain amounts to employer); Vazquez v. Tri-State Mgmt.
Co., 2002 U.S. Dist. LEXIS 385, at *4, *13 (employee requested paycheck
deductions to repay employer for purchasing a car for employee’s use).
[¶17] The fact that Dorsey signed the Code of Conduct is also unavailing
because the document is not a component of Dorsey’s Employment Agreement,
7EMMC’s brief argues that “[u]nder the Business Court’s construction of Section 629, . . . there is
literally no circumstance in which an employer can rely upon an employee’s objective manifestation
of intent. Under the rule formulated by the Business Court, as long as the employee disavows
subjective intent and does not personally receive the wages, the employer must pay them again.” The
flaw in this argument is that the objective manifestation of intent that resulted in the change of bank
accounts was not Dorsey’s but the cybercriminals’. Given EMMC’s acknowledgments that Dorsey was
not at fault and that it was EMMC, not Dorsey, that implemented the online method for changing
direct deposit information that allowed the fraud to occur, it is consistent with the goals of the statute
for the burden of the loss to fall on EMMC rather than Dorsey.
11
it is not supported by consideration, and the Code of Conduct, by its terms,
applies only to “confidential patient information and confidential
organizational information.”
[¶18] Finally, as the trial court emphasized in its ruling, EMMC does not
contend that “Dorsey was negligent or otherwise at fault” or in breach of her
employment agreement, so neither the court nor we have been called on to
decide the effect of an employee’s negligence, breach, or other fault in these
circumstances.
III. CONCLUSION
[¶19] There is no genuine dispute of material fact that EMMC did not
deposit Dorsey’s wages into her bank account. By not transferring the money
to Dorsey’s account, EMMC failed to “pay” her and thereby violated Maine’s
wage payment laws. Dorsey was entitled to summary judgment.
The entry is:
Judgment affirmed.
12
Daniel R. Strader, Esq., and Katharine I. Rand, Esq. (orally), Pierce Atwood LLP,
Portland, for appellants Northern Light Health and Northern Light Eastern
Maine Medical Center
Peter Mancuso, Esq. (orally), Borealis Law PLLC, Portland, for appellee Deanna
Dorsey
Business and Consumer Docket docket number BCD-2020-37
FOR CLERKS REFERENCE ONLY