DIANE ALICEA v. DIRECTOR OF THE DEPARTMENT OF UNEMPLOYMENT ASSISTANCE (2026)

MEMORANDUM AND ORDER PURSUANT TO RULE 23.0

On July 14, 2023, after an evidentiary hearing, a Department of Unemployment Assistance review examiner issued a final decision that the plaintiff, Diane Alicea, was not entitled to receive unemployment insurance benefits. On judicial review pursuant to G. L. c. 30A, § 14, a Boston Municipal Court judge affirmed the department's decision. Because we agree with the plaintiff that her conduct was not in willful disregard of her employer's interest, we reverse. See G. L. c. 151A, § 25 (e). See also Jones v. Director of Div. of Employment Sec., 392 Mass. 148, 151 (1984) (reversal warranted where review examiner “affirmatively sets forth a subsidiary finding which compels the opposite conclusion”).

Background. We summarize the facts found by the department's review examiner, supplemented with additional undisputed facts drawn from the appellate record, reserving certain facts for later discussion.

On April 26, 2023, Boston Medical Center (BMC) terminated the plaintiff's employment as a full-time medical assistant after the plaintiff's login credentials were used to access private patient health information. BMC employees can access patient information through computers located on kiosks throughout the BMC. Employees access the computers through their own login credentials, and the BMC requires that they log out when they step away from a computer kiosk. The computers also lock automatically after they are left inactive for five minutes.

On March 28, 2023, the plaintiff minimized a window with patient information such that the patient information was not immediately visible and stepped away from her computer without logging out or locking the computer. Importantly, the review examiner found that the plaintiff “sometimes steps away from the computer kiosk and minimizes the screen rather than locking the computer or logging out of the system. She does so because she has to work quickly and logging in and out takes more time than minimizing the screen.” While the plaintiff was away from the computer, a coworker used the same computer (and thus the plaintiff's credentials) to access the coworker's own medical records.² After a BMC audit showed that the plaintiff's credentials had been used to access a coworker's medical records, BMC began an investigation of the incident. At an April 25, 2023 investigatory meeting, the plaintiff acknowledged that she was aware of BMC's privacy policies ³ and, as a result, BMC terminated her employment the next day.

At the department's review hearing, BMC submitted a letter in evidence that identified which policies the plaintiff was alleged to have violated. The four policies are the following: first, the code of conduct, which states “[a]ccessing or sharing patient information in violation of [the Health Insurance Portability and Accountability Act (HIPAA)], other laws or BMC policy is a serious matter․ Any BMC colleague who violates these laws may be subject to disciplinary action up to and including immediate termination of their employment.” Second, the employee conduct policy prohibiting “[g]aining access to or sharing restricted patient records, business records, or other medical records without proper authorization” and “[f]ailure to perform duties in accordance with BMC Standards.” Third, the confidentiality and use of information policy, which states, “The unauthorized use, copying, reading or transmission of paper or electronic medical records ․ is strictly forbidden.” And fourth, the HIPAA minimum necessary standard policy, which states “[f]or internal uses of data, medical information will be available based on a need-to-know basis. No more than the minimum amount of [patient health information] and/or necessary electronic data will be accessed, in order to carry out payment, and/or health operations.” During the hearing, the plaintiff's supervisor confirmed that these were the entirety of the policies that the plaintiff violated.

Discussion. “We review a judge's consideration of an agency decision de novo.” Doe, Sex Offender Registry Bd. No. 523391 v. Sex Offender Registry Bd., 95 Mass. App. Ct. 85, 89 (2019). A court may set aside or modify an agency's decision if it determines that the decision is, inter alia, “[b]ased upon an error of law” or “[u]nsupported by substantial evidence.” G. L. c. 30A, § 14 (7) (c), (e). “The applicable standard of review is highly deferential to the agency and requires the reviewing court to accord due weight to the experience, technical competence, and specialized knowledge of the agency, as well as to the discretionary authority conferred upon it” (quotation and citation omitted). Lincoln Pharmacy of Milford, Inc. v. Commissioner of the Div. of Unemployment Assistance, 74 Mass. App. Ct. 428, 431 (2009). “In reviewing a decision of the board concerning an individual's entitlement to benefits, we determine whether it ‘contains sufficient findings [and] whether those findings are supported by substantial evidence.’ ” Connolly v. Director of the Div. of Unemployment Assistance, 460 Mass. 24, 26-27 (2011), quoting Guarino v. Director of the Div. of Employment Sec., 393 Mass. 89, 92 (1984). Additionally, reversal of an agency decision is warranted where a review examiner's decision “not only fails to recite subsidiary findings in support of the review examiner's conclusion,” but “also affirmatively sets forth a subsidiary finding which compels the opposite conclusion.” Jones, 392 Mass. at 151.

In the end, the review examiner concluded that the plaintiff was not entitled to receive unemployment insurance benefits pursuant to G. L. c. 151A, § 25 (e) (2), which states that no benefits shall be paid to an individual if they left work “by discharge shown to the satisfaction of the commissioner by substantial and credible evidence to be attributable to deliberate misconduct in wilful disregard of the employing unit's interest.”⁴ This provision “requires a two-part analysis: both ‘deliberate misconduct’ and ‘wilful disregard’ of the employer's interest must be shown in order to disqualify the employee, and the employee's state of mind at the time of the misconduct is an issue for both parts.” Fallon Community Health Plan, Inc. v. Acting Director of the Dep't of Unemployment Assistance, 493 Mass. 591, 596 (2024), citing Still v. Commissioner of Employment & Training, 423 Mass. 805, 810 (1996). “[T]he critical factual issue in considering whether an employee's alleged misconduct is in wilful disregard of [the] employer's interest is the employee's state of mind at the time of the misconduct” (quotation and citation omitted). Commissioner of Dep't of Employment & Training v. Dugan, 428 Mass. 138, 142 (1998). “To determine the employee's state of mind, we require subsidiary findings of fact, which take into account the worker's knowledge of the employer's expectation, the reasonableness of that expectation and the presence of any mitigating factors” (quotation and citation omitted). Id. “When a worker ․ has a good faith lapse in judgment or attention, any resulting conduct contrary to the employer's interest is unintentional; a related discharge is not the worker's intentional fault, and there is no basis under § 25 (e) (2) for denying benefits.” Still, supra, citing Garfield v. Director of Div. of Employment Sec., 377 Mass. 94, 97 (1979).

The defendants argue that “[a]lthough Alicea claimed that her misconduct was driven by a desire to work more efficiently, the Department reasonably concluded that that she had nonetheless acted in wilful disregard of Boston Medical Center's significant interest in protecting patient privacy.” We disagree.

The review examiner concluded that the plaintiff acted in willful disregard of BMC's interests because “[t]he desire to work more efficiently by not logging out of the system or locking the screen does not constitute a state of mind that prevented the claimant from acting with deliberate misconduct in willful disregard of the employing unit's interest.”⁵ While it may be that the plaintiff was not “prevented” from acting in willful disregard of BMC's interest, the review examiner does not explain why the plaintiff's actions were, in fact, in willful disregard of BMC's interest. See Connolly, 460 Mass. at 26-27.

Notably, as the defendants emphasize, BMC's interest at issue is that of protecting patient privacy. When the review examiner asked the plaintiff's supervisor how the plaintiff's inadvertently allowing her coworker to access patient records violated the policy against unauthorized access of patient records, the supervisor explained that employees are treated as responsible for any access of patient records conducted through the particular employee's credentials. The supervisor also stated that employees are trained annually on the BMC policy that every employee is responsible for their own password and credentials. However, while BMC's policy may be to treat an employee's failure to take precautions resulting in unauthorized access of private health information as a willful violation of its privacy policies, we are not required to do the same. See Still, 423 Mass. at 809.

We acknowledge the defendants’ assertion that the plaintiff opted not to lock her computer despite acknowledging “[t]o some extent” that leaving her computer unlocked was a violation of BMC's policy. While this may support a finding that the plaintiff's misconduct was deliberate,⁶ that is not enough. See Fallon Community Health Plan, Inc., 493 Mass. at 596 (deliberate misconduct and willful disregard of employer's interest are distinct elements of § 25 [e] [2] analysis). An employee may knowingly ignore an employer's express expectation without doing so in willful disregard of the employer's interest. See Jones, 392 Mass. at 150 (employee who refused direct order did not do so in willful disregard of employer's interest where review examiner found that employee deemed other work to be of paramount importance).

Critically, the review examiner found that the plaintiff minimized her screen rather than locking it “because she has to work quickly,” which reasonably supports a finding that her actions were not done in willful disregard of the employer's interest in protecting patient privacy. See Fallon Community Health Plan, Inc., 493 Mass. at 596. This decision to prioritize working quickly over following the policy and logging out of her computer may have been a lapse in judgment warranting termination. See Still, 423 Mass. at 809 (“the issue is not whether the employee had been discharged for good cause, but whether the Legislature intended to deny benefits in the circumstances presented by the case”). But we cannot conclude that the plaintiff's decision to prioritize working more quickly was in willful disregard of her employer's interest, particularly where it is uncontested that the plaintiff testified that she took (albeit inadequate) precautions to protect that interest by minimizing her screen. See Jones, 392 Mass. at 151.

Accordingly, the judgment of the Boston Municipal Court is reversed. A new judgment shall enter in the Boston Municipal Court vacating the decision of the Department of Unemployment Assistance and remanding this case for entry of an order awarding the plaintiff her unemployment compensation benefits in accordance with this decision.

So ordered.

FOOTNOTES

2.   The plaintiff submitted a statement prior to the hearing claiming that her coworker had confessed to accessing her own medical records. At the hearing, the plaintiff's supervisor stated that she had no knowledge of this confession. However, the supervisor also stated that she found the plaintiff's explanation that she had walked away while leaving the record open and her credentials logged in to be credible.

3.   The plaintiff also received annual training on BMC's privacy policies, the last of which occurred February 28, 2023.

4.   A person is also not entitled to benefits if they left work due to “a knowing violation of a reasonable and uniformly enforced rule or policy of the employer, provided that such violation is not shown to be as a result of the employee's incompetence.” G. L. c. 151A, § 25 (e) (2). However, the review examiner concluded, and we agree, that this provision did not apply because a violation of BMC's code of conduct relating to patient privacy results in discipline “up to and including [immediate] termination” rather than uniformly resulting in termination.

5.   The defendants underscore that our standard of review is highly deferential. See Lincoln Pharmacy of Milford, Inc., 74 Mass. App. Ct. at 431. However, “judicial deference to agency action is most appropriate when the agency acts on the basis of its technical or policy expertise, and least appropriate when the agency ventures into the courts’ own ‘traditional area of expertise,’ ” such as a party's state of mind. Alves's Case, 451 Mass. 171, 182 (2008) (Botsford, J., dissenting). And here, the review examiner's decision “affirmatively sets forth a subsidiary finding which compels the opposite conclusion.” Jones, 392 Mass. at 151.

6.   Indeed, rather than “deliberate misconduct,” the plaintiff's conduct may be more appropriately characterized as a “knowing violation” of BMC's policy to lock computers while away. See G. L. c. 151A, § 25 (e) (2). However, as noted supra, we agree with the review examiner that the employee's conduct was not “a knowing violation of a reasonable and uniformly enforced rule or policy of the employer” because BMC did not assert that it “uniformly enforced” a policy of terminating employees for failing to lock their computers. See id.