Case Title: Dorsey v. Northern Light Health

Citation: 

Docket Number: 2022 ME 62

State: maine

Court: Maine Supreme Court

Date: 2022-12-20T00:00:00Z

Document:
MAINE SUPREME JUDICIAL COURT 
Reporter of Decisions 
Decision: 
2022 ME 62 
Docket: 
BCD-22-4 
Argued: 
October 4, 2022 
Decided: 
December 20, 2022 
 
Panel: 
STANFILL, C.J., and MEAD, JABAR, HORTON, and LAWRENCE, JJ. 
 
 
DEANNA DORSEY 
 
v. 
 
NORTHERN LIGHT HEALTH et al. 
 
 
JABAR, J. 
[¶1]  Northern Light Health and Northern Light Eastern Maine Medical 
Center (together EMMC) appeal from a summary judgment entered in the 
Business and Consumer Docket (Duddy, J.) in favor of Deanna Dorsey on the 
parties’ cross-motions for summary judgment.  The trial court concluded that 
EMMC failed to comply with the state’s wage payment and minimum wage laws, 
26 M.R.S. §§ 621-A to 629-B, 664(1) (2022), when it permitted Dorsey’s 
paycheck to be deposited into a bank account controlled by cybercriminals1 
who had stolen Dorsey’s username and password to the online portal where 
she designated payroll information.  We affirm the judgment. 
 
1  There is no information in the record indicating that criminal charges were brought as a result 
of this incident, but the parties and the court all refer to the perpetrators by this term, as will this 
opinion, for consistency. 
 
 
2 
I.  BACKGROUND 
[¶2]  The following facts are drawn from the summary judgment record, 
are viewed in the light most favorable to EMMC, the nonprevailing party, and 
are undisputed unless otherwise noted.  See Brooks v. Lemieux, 2017 ME 55, ¶ 2, 
157 A.3d 798. 
[¶3]  Dorsey is an anesthesiologist employed by EMMC pursuant to an 
“Employment Agreement” that sets forth the amount of, but not how she 
receives, her compensation.2  Upon hiring Dorsey, EMMC provided her with its 
“Information Systems Acceptable Use” policy, which prohibits disclosure of an 
employee’s username and password.  The policy does not contain a signature 
 
2  The stipulated statement of material facts states that Dorsey “was employed pursuant to a series 
of written employment agreements and amendments thereto (collectively the ‘Employment 
Agreement’) setting forth the amount of Dorsey’s compensation.”  The complaint alleges that 
Dorsey’s “compensation was governed by a Physician Employment Agreement executed in 
September of 2016, an Amendment to the Physician Employment Agreement executed in July and 
August of 2017, and a Memo of Understanding concerning compensation for call time executed in 
July of 2017 (the ‘2017 Memo’)” and that “[t]he Employment Agreement required [EMMC] to pay 
Dorsey in regular installments ‘consistent with Employer’s regular payroll practices.’”  In its answer, 
EMMC admits those facts as they relate to the agreements executed in September of 2016 and July 
and August of 2017 but denies them as they relate to the July 2017 agreement.  Neither the appendix 
nor the Odyssey record appears to contain any part of the “Employment Agreement.”  EMMC asserts 
that we “can reasonably infer from the parties’ failure to introduce or rely upon any other provisions 
of the written Employment Agreement that it is silent regarding the manner and method of wage 
payment.”   
 
 
3 
line.  Dorsey signed an “Employee Code of Conduct and Confidentiality 
Statement” (Code of Conduct)3 that states in relevant part: 
As part of my job, I may use, see or hear confidential patient 
information and confidential organizational information.  The 
information may be spoken, written, on diagnostic equipment, on 
computer or on tape. . . .  I will follow the Code of Conduct and the 
EMH/EMMC 
policies 
when 
I . . . use . . . 
[confidential 
organizational] information. 
 
If I am given or select a username and password for use in 
computers . . . , I will not tell anyone else what they are.  My 
username and password are the same as my signature and when 
used they mean that I obtained, used or gave out information.  I am 
responsible for all activities if someone else uses my username and 
password. 
 
The Code of Conduct lacks a line for any person other than an employee to sign 
and is not co-signed by a representative of EMMC.  Lastly, Dorsey completed a 
direct deposit authorization form that enabled EMMC to deposit her wages into 
her designated bank account at USAA Federal Savings Bank.   
[¶4]  At the time, EMMC used a “Human Resources Information System” 
called “Lawson” that contained an “employee self-service portal” (ESS portal) 
by which employees who opted to be paid via direct deposit, including Dorsey, 
could designate the bank account into which their paychecks would be 
 
3  The trial court refers to this document as “the Statement,” while the parties refer to it as, 
alternatively, the Code of Conduct and Confidentiality Policy or the Code of Conduct.  For clarity and 
brevity, this opinion refers to that document as the Code of Conduct. 
 
 
4 
deposited.  Dorsey was required to use Lawson to designate where her direct 
deposit should be paid.   
[¶5]  In June 2018, Dorsey and approximately 600 other EMMC 
employees received a “phishing”4 email at their work email addresses that 
contained an embedded link.  Upon clicking the link, the employee would be 
routed to a fraudulent ESS portal and prompted to enter their username and 
password.  After doing so, the employee would be routed to a blank screen.  
Although Dorsey has no specific recollection of receiving or interacting with the 
phishing email, the court noted that her lack of recall failed to generate a factual 
issue.  EMMC does not contend that Dorsey was at fault in entering her 
username and password in the ESS portal or in causing change to the 
designation of a bank account for the direct deposit of her pay.    
[¶6]  Cybercriminals using Dorsey’s illegally obtained credentials 
changed Dorsey’s designated bank account to have her pay from EMMC 
deposited into a Green Dot bank account controlled by the cybercriminals 
rather than into her USAA bank account.  An EMMC expert indicated that it was 
 
4  Phishing is defined as “the practice of sending a fraudulent email that appears to be from a 
legitimate business, as a bank or credit card company, in an attempt to deceive an individual into 
disclosing personal information, as a password or an account number.”  Phishing, Webster’s New 
World College Dictionary (5th ed. 2016). 
 
 
5 
impossible to show who used Dorsey’s credentials to change the bank account.  
As a result of the change, EMMC deposited Dorsey’s earned wages for the 
relevant pay period ($8,432.98) into the Green Dot account.  After two other 
employees notified EMMC that they had not received their expected direct 
deposits, EMMC investigated and determined that eleven employees, including 
Dorsey, had their paychecks deposited into bank accounts controlled by the 
cybercriminals.   
[¶7]  EMMC reported the wage theft to the FBI and its own bank, but only 
a small portion of Dorsey’s wages ($79.65) was recovered and returned to 
Dorsey.  EMMC refused to issue Dorsey a check for the remaining wages.   
[¶8]  On June 23, 2020, Dorsey filed a three-count complaint against 
EMMC asserting that EMMC failed to (1) pay her in violation of the wage 
payment laws, see 26 M.R.S. §§ 621-A to 629-B; (2) pay her minimum wage and 
overtime, see 26 M.R.S. §§ 664, 670 (2022); and (3) produce certain documents 
deemed part of her personnel file, see 26 M.R.S. § 631 (2022).  Both parties filed 
motions for summary judgment on July 21, 2021.  The court granted Dorsey’s 
motion on October 26, 2021, and entered final judgment on Count 1 and 
Count 2 December 21, 2021.5  Count 3 was dismissed by stipulation.   
 
5  In granting summary judgment for Dorsey, the court emphasized that EMMC was not arguing 
that Dorsey was at fault for the fraudulent redirection of her pay: “To understand EMMC’s defense to 
 
 
6 
[¶9]  EMMC timely appealed.  14 M.R.S. § 1851 (2022); M.R. App. P. 2A(a), 
2B(a), (c)(1). 
II.  DISCUSSION 
A. 
Standard of Review 
[¶10]  “Cross motions for summary judgment neither alter the basic 
Rule 56 standard, nor warrant the grant of summary judgment per se.”  
F.R. Carroll, Inc. v. TD Bank, N.A., 2010 ME 115 ¶ 8, 8 A.3d 646 (quotation marks 
omitted).  When reviewing a grant of summary judgment, we consider “only the 
portions of the record referred to, and the material facts set forth in [M.R. 
Civ. P. 56(h)] statements.”  Id. (quotation marks omitted).  We consider the 
“evidence and any reasonable inferences thereof in the light most favorable to 
the non-prevailing party to determine whether there is a genuine issue of 
material fact.”  Yankee Pride Transp. & Logistics, Inc. v. UIG, Inc., 2021 ME 65, 
¶ 10, 264 A.3d 1248.  “A fact is material if it has the potential to affect the 
outcome of the suit, and a genuine issue of material fact exists when a 
fact-finder must choose between competing versions of the truth, even if one 
 
Dr. Dorsey’s wage claims, it is first necessary to understand what EMMC is not arguing.  As EMMC 
explained at oral argument, EMMC is not arguing that Dr. Dorsey was negligent or otherwise at fault 
and is thus disentitled to payment of her Wages.  EMMC is also not arguing that Dr. Dorsey breached 
her Employment Agreement with EMMC or otherwise violated an EMMC policy and is thus disentitled 
to payment of her Wages.”   
 
 
7 
party’s version appears more credible or persuasive.”  Id. (quotation marks 
omitted).  If no genuine issue of material fact exists, we “review de novo the trial 
court’s interpretation and application of the relevant statutes and legal 
concepts.”  Ogden v. Labonville, 2020 ME 133, ¶ 10, 242 A.3d 177 (quotation 
marks omitted).   
B. 
The Wage Payment Laws 
[¶11]  “In interpreting a statute, our single goal is to give effect to the 
Legislature’s intent in enacting the statute.”  Dickau v. Vt. Mut. Ins. Co., 2014 ME 
158, ¶ 19, 107 A.3d 621.  To achieve that goal, we first look to a statute’s plain 
language, “taking into account the subject matter and purposes of the statute, 
and the consequences of a particular interpretation.  In determining a statute’s 
practical operation and potential consequences, we may reject any 
construction that is inimical to the public interest or creates absurd, illogical, 
unreasonable, 
inconsistent, 
or 
anomalous 
results 
if 
an 
alternative 
interpretation avoids such results.”  Id. ¶¶ 19, 21 (quotation marks omitted).  
Maine’s wage payment laws are remedial statutes that we construe liberally for 
the benefit of employees.  Dir. Bur. of Labor Standards v. Cormier, 527 A.2d 1297, 
1300 (Me. 1987).   
 
 
8 
[¶12]  Under Maine’s wage payment laws, an “employer is liable to the 
employee . . . for the amount of unpaid wages.”  26 M.R.S. § 626-A (authorizing 
the affected employee to initiate an action for unpaid wages).  “For purposes of 
[section 621-A, governing the timely and full payment of wages], ‘direct deposit’ 
means the transfer of wages through electronic funds transfer directly into an 
employee’s account in an accredited financial institution designated by the 
employee.”6  Id. § 621-A(7).   
[¶13]  However, contract law, not the wage payment laws, governs the 
amount and manner of an employee’s payment.  See Richardson v. Winthrop Sch. 
Dep’t, 2009 ME 109, ¶ 7, 983 A.2d 400 (“Although section 626 creates a 
statutory right for former employees to seek payment, entitlement to payment 
is governed solely by the terms of the employment agreement.”); OfficeMax Inc. 
v. Sousa, 773 F. Supp. 2d 190, 234 (D. Me. 2011). 
 
[¶14]  The undisputed facts demonstrate that Dorsey’s earned wages for 
the period in question were $8,432.98.  Section 621-A establishes that she is 
entitled to those wages in full for that two-week pay period and that those 
wages must be paid at the rate previously established by EMMC.  See 26 M.R.S. 
 
6  Title 26 M.R.S. § 621-A(7) (2022) defines “direct deposit” within a subsection prohibiting 
employees from charging fees for the payment of wages by means of direct deposit. 
 
 
9 
§ 621-A(1), (5).  While “pay” is undefined by statute, the term “direct deposit” 
in section 621-A(7) means a payment that is transferred directly into the 
employee’s designated account, and construing the statute in favor of the 
employee, we hold that the wage payment laws, by requiring that a direct 
deposit be into an employee’s account, require actual possession of the funds 
by the employee.  See id. § 621-A(7); Cormier, 527 A.2d at 1300.  Because an 
employer does not “pay” an employee as required by section 621-A unless an 
employee actually received her wages, EMMC failed to pay Dorsey at the time 
required by the wage payment statutes because Dorsey never received 
possession of her wages.   
[¶15]  Here, it is undisputed that Dorsey did not authorize EMMC to pay 
her salary to the Green Dot account.  Cybercriminals, not Dorsey, designated 
the Green Dot account, an account that Dorsey did not have access to, as the 
receiving account for Dorsey’s wages.  It does not make any difference how the 
cybercriminals obtained Dorsey’s credentials because it is undisputed in the 
record that Dorsey did not designate the fraudulent bank account as the 
depository for her paycheck, the cybercriminals did, and she did not receive her 
pay in the account that she had designated. 
 
 
10 
[¶16]  EMMC argues that it should be entitled to rely on the 
cybercriminals’ use of Dorsey’s login credentials,7 citing cases where wages 
were diverted to other recipients.  Here, however, Dorsey did not actually make 
the change to her direct deposit information, in direct contrast to EMMC’s cited 
cases where the employees themselves actually requested the paycheck 
diversion.  See Schlear v. James Newspapers, Inc., 1998 ME 215, ¶ 4, 717 A.2d 
917 (payment was diverted from employee to third party at employee’s 
request); Brennan v. Veterans Cleaning Serv., Inc., 482 F.2d 1362, 1368-70 
(5th Cir. 1973) (wages withheld pursuant to an assignment made by the 
employee to repay certain amounts to employer); Vazquez v. Tri-State Mgmt. 
Co., 2002 U.S. Dist. LEXIS 385, at *4, *13 (employee requested paycheck 
deductions to repay employer for purchasing a car for employee’s use).   
[¶17]  The fact that Dorsey signed the Code of Conduct is also unavailing 
because the document is not a component of Dorsey’s Employment Agreement, 
 
7  EMMC’s brief argues that “[u]nder the Business Court’s construction of Section 629, . . . there is 
literally no circumstance in which an employer can rely upon an employee’s objective manifestation 
of intent.  Under the rule formulated by the Business Court, as long as the employee disavows 
subjective intent and does not personally receive the wages, the employer must pay them again.”  The 
flaw in this argument is that the objective manifestation of intent that resulted in the change of bank 
accounts was not Dorsey’s but the cybercriminals’.  Given EMMC’s acknowledgments that Dorsey was 
not at fault and that it was EMMC, not Dorsey, that implemented the online method for changing 
direct deposit information that allowed the fraud to occur, it is consistent with the goals of the statute 
for the burden of the loss to fall on EMMC rather than Dorsey. 
 
 
11 
it is not supported by consideration, and the Code of Conduct, by its terms, 
applies 
only 
to 
“confidential 
patient 
information 
and 
confidential 
organizational information.”   
[¶18]  Finally, as the trial court emphasized in its ruling, EMMC does not 
contend that “Dorsey was negligent or otherwise at fault” or in breach of her 
employment agreement, so neither the court nor we have been called on to 
decide the effect of an employee’s negligence, breach, or other fault in these 
circumstances. 
III.  CONCLUSION 
[¶19]  There is no genuine dispute of material fact that EMMC did not 
deposit Dorsey’s wages into her bank account.  By not transferring the money 
to Dorsey’s account, EMMC failed to “pay” her and thereby violated Maine’s 
wage payment laws.  Dorsey was entitled to summary judgment.   
The entry is: 
Judgment affirmed. 
 
 
 
 
 
 
 
 
 
 
12 
Daniel R. Strader, Esq., and Katharine I. Rand, Esq. (orally), Pierce Atwood LLP, 
Portland, for appellants Northern Light Health and Northern Light Eastern 
Maine Medical Center 
 
Peter Mancuso, Esq. (orally), Borealis Law PLLC, Portland, for appellee Deanna 
Dorsey 
 
 
Business and Consumer Docket docket number BCD-2020-37 
FOR CLERKS REFERENCE ONLY