Timecard provider outage has St. Charles calling on workers to repay $2 million in overpayments

(Update: Cease-and-desist letter)

Ransomware attack cut off access for 2 months: nurses, others dismayed, may seek legal action

BEND, Ore. (KTVZ) – A ransomware attack on a global timekeeping and scheduling provider cut off St. Charles Health System’s access to timecard data for nearly two months, and the repercussions of that outage are starting to hit workers in the wallet, as the organization calls on them to repay $2 million in overpayments.

The nurses' union has fired back, demanding an end to such efforts and threatening legal action if the payment demands they said are illegal are not withdrawn.

The attack on Ultimate Kronos Group left St. Charles unable to access timecard data from Nov. 28, 2021, to Jan. 22 of this year, St. Charles Public Information and Government Affairs Officer Lisa Goodman told NewsChannel 21 Thursday when we inquired about the issue reported to us by some employees.

Here's how Goodman described what occurred as a result:

"During the outage, we did our best to pay people as accurately as possible for the time they worked, based on the hours they reported. One of the unfortunate impacts of the outage was that some of our employees were underpaid, and some were overpaid.

"Over the last several months, we have focused our efforts on making financially whole those employees who were underpaid. We’re now at the point where we need to recoup the $2 million that was overpaid.

"While we recognize this is an inconvenience for our employees, we’ve communicated from the beginning that this is a step we’d eventually need to take.

"We have made every effort to keep our employees apprised of the situation. Since the outage, we’ve sent 19 emails to all our employees and another seven to our leaders about the UKG outage and the organization’s recovery efforts. We’ve also held several town halls to discuss the situation and to give our employees an opportunity to ask questions."

Goodman said a total of 2,358 caregivers were overpaid; for the whole group, the average amount owed is $780. Most people -- 1,784 in total -- owe $1,000 or less, she added.

St. Charles nurse Megan Bovi told NewsChannel 21 that this week, her manager handed her a sticky note with the amount she owed: $2,900.

Those recent contacts have left her, and others who contacted NewsChannel 21, dismayed and asking questions.

"Where did they up with this calculation?" Bovi said. "Why has evidence not been provided? Why has it not been made available to me, to sit down with an accountant, for every individual employee to sit down and review records and pay stubs and all of that? They gave no evidence as to how they came to this number."

Bovi said she was offered payment plans ranging from two weeks to several pay periods.

"At the time, I was told what I owed they wanted me to sign a paper agreeing to make payments," she said. "I just felt disrespected."

A family member of two St. Charles nurses said they also were given the option of repayment through relinquishing some of their ETO (earned time off).

Oregon Nurses Association spokesman Scott Palmer told NewsChannel 21 Thursday that "ONA is aware of an ongoing issue related to the St. Charles Health System demanding repayment alleged overpayment of funds to nurses and other health care staff."

The nurses union said it sent this message to its members at the three St. Charles facilities where they represent nurses:

“Important Information - Please Read & Share

"We have been made aware St. Charles Health Systems is directly contacting nurses demanding they make payment arrangements for alleged overpayments. We are advising nurses to hold off on signing any agreements with SCHS and to reach out to HR Business Partner Nicole Ponder for an accounting of the alleged overpayment.

"ONA leadership and our legal team will be contacting SCHS Management shortly with a “cease and desist” order to protect the interests of ONA represented nurses. We will keep everyone posted once contact has been made with more information."

In the case and desist letter sent Friday, ONA General Counsel Thomas Doyle says the state Bureau of Labor and Industries "is very clear on this issue -- paycheck deductions going to the employer to pay for an alleged 'overpayment' or loan are not for the employee's benefit and are therefore unlawful."

Doyle claimed St. Charles is violating state wage and hour laws, "which can result in significant civil penalties through BOLI enforcement and/or class action in civil court."

"Again, we will not hesitate to pursue these legal remedies if St. Charles does not rescind its payment demands immediately." He gave the hospital system until 9 a.m. Monday to respond "or we will pursue further legal actions."

After the letter was sent, St. Charles issued this statement:

"We strongly believe that we’ve complied with the law and with our contractual obligations in every respect as we’ve paid our employees and as we now look at how to make payroll corrections that are needed because of the ransomware attack on UKG."