AMERICAN ARBITRATION ASSOCIATION IN THE MATTER OF THE ARBITRATION OPINION AND AWARD Between AA +#01-15-0004-0451 STATE OF NEW YORK (OFFICE OF THE betel Ea MEDICAID INSPECTOR GENERAL) Grievant: Harvey Brody, NOD dated 6/12/2015 And PUBLIC EMPLOYEES FEDERATION, een AFL-CIO Grievant Before: Ira B. Lobel, Arbitrator Appearances: For the Respondent: Michael H. Sussman, Esq., Sussman & Watkins Victor Bartorsky, Public Employees Federation member, retired Usher Piller, Council Leader, Division 191, Public Employees Federation For the Office of the Medicaid Inspector General Dionne Wheatley, Associate General Counsel, Office of the Medicaid Inspector General Matthew Chiesa, Human Resource Specialist, Labor Relations (Director ‘of Employee Relations, Office of the Medicaid Inspector General) RODUCTION Pursuant to the 2011-2015 collective bargaining agreement (“CBA”) between the State of New York (Office of the Medicaid Inspector General) (“OMIG”) and the Public Employees Federation, AFL-CIO (“PEF”), a demand for arbitration was timely filed by PEF on behalf of Harvey Brody (“Grievant”) concerning a Notice of Discipline dated June 12, 2015. (Jt. 2) Subsequent to the PEF demand for arbitration, Grievant obtained private counsel and filed apetition in Albany County Supreme Court seeking to dismiss the Notice of Discipline. By decision dated December 1, 2015, the Supreme Court dismissed the petition. (Jt. 5) ‘The undersigned was selected as arbitrator through the procedures of the American Arbitration Association and the parties’ Rotating Panel Agreement. Hearings were conducted ‘on March 28, April 6, and May 18, 2016, in Albany, NY, during which OMIG presented its case. By memorandum dated May 26, 2016, Grievant rested its case without calling any witnesses or introducing any additional documents. Appearing through their representatives, the parties were given full opportunity to call and cross examine witnesses and present documentary evidence in support of their respective positions. Briefs were submitted on or about July 22, 2016, at which time the hearing was considered closed. STIPULATED ISSUES At the beginning of the hearing, parties stipulate to the following issues: 1. Was the Notice of Discipline timely filed, pursuant to Section 33.5(h) of the PEF/State contract? 2. Did the Employer have just cause to issue the Notice of Discipline dated June 12, 2015? 3. Is the Grievant guilty of the charges in the Notice of Discipline? 4, Ifso, is the Employer's proposed termination penalty appropriate? If not, ‘what is the appropriate penalty, if any? 5. Did the Employer have probable cause to suspend the Grievant without pay effective June 15, 2014, pursuant to Article 33.4(a)(1) of the PEF/State contract?BACKGROUND, ‘The Office of Medicaid Inspector General (“OMIG”) is an independent agency within the New York State Department of Health created to improve and preserve the integrity of the Medicaid program by conducting and coordinating fraud, waste, and abuse control activities for all state agencies responsible for Medicaid funded services. (T 228) To carry out its mission, OMIG employees may be involved in performing audits and investigative work as well as analyzing data from Medicaid providers and recipients. (T 229) OMIG has policies in place to address the use and dissemination of the Medicaid program records received by OMIG employees. (S8) OMIG employees regularly receive training relating to the confidentiality and security of Medicaid program records. (S9, $10, $11) Harvey Brody (“Grievant”) has been employed as a Medicaid Investigator I by OMIG since 2008. (I 33) He was initially assigned to the Division of Systems Utilization and Review (formerly called the Division of Technology and Business Analysis) until July, 2012, when he ‘was transferred to the Recipient Restriction Program in the Division of Medicaid Investigations. (T 36, S1, S2, S5) He has been employed by the State since 1991. (S 7, p 12) His performance reviews indicate he is a satisfactory employee. (T 68) On October 19, 2012, OMIG placed Mr, Brody on a paid suspension. The suspension was effective immediately and was to continue until further notice. Mr. Brody was advised not to report to the worksite nor have any contact with anyone associated with OMIG, ($6) At the time of the suspension, Mr. Brody was considered one of the principle employees working on a prison match project.' (T 195) He was assigned to a unit supervised by Kevin Ryan, Deputy Medicaid | This project involved making sure inmates in the prison system were not receiving Medicaid benefit.Inspector General. Mr. Brody was suspected of sending unauthorized emails to his personal email address and to Michael Conners, Comptroller of the County of Albany. (1203, 223, 229, 230) Tom Meyer, First Deputy Medicaid Inspector General, performed a search of emails sent from Mr. Brody’s computer. (T 233, 234) The emails allegedly contained sensitive information with personally identifiable information (including personal health data) sent to Brody’s unencrypted computer and to an outside individual not authorized to receive the data. (Michael Conners) (1.234, $15 - S20) The Medicaid Inspector General was notified about these findings. (TT 235) Based on this information, Grievant was suspended with pay on October 19, 2012, and escorted from the building. (T 241, $6) Mr. Meyer did not advise him why he was being suspended and was not aware that anyone advised Mr. Brody of the reasons for his suspension. (T 241) His work computer was seized by the New York State Inspector General. (T 242) It is unclear if OMIG undertook any further investigation regarding Mr. Brody from October 19, 2012, until April, 2015. Except for contact with the statewide Office of Inspector General, it appears that no reports were made to any criminal or governmental agencies regarding any allegations concerning whether Mr. Brody had either improperly distributed or tampered with HIPPA classified information. (T 335, 342-347, 385, 455-6) There appears to be little, if any, contact between OMIG and Mr. Brody throughout this entire period. Mr. Brody was provided with no information regarding any possible discipline; he was given no assignments; no one from any law enforcement agency made any contact with Mr. Brody. Effectively, he was placed in a suspension with pay status that lasted two and a half years; he was not allowed toreturn to his job functions with OMIG. (T 82-86, 93; T 335, 343) In Mareh, 2015, in order to obtain information regarding his employment status, Mr. Brody asked his lawyer, Michael Sussman, to make inquire situation. Working through a contact he had with the Attomey General, Mr. Sussman inquired about the employment status of Mr. Brody. Shortly thereafter, Matthew Chiesa, OMIG’s Director of Employees Relations, ordered ‘Mr. Brody to an interrogation on April 24, 2015. (E 7A & 7B) Interestingly, Mr. Chiesa testified that he knew of no specific event triggering this interrogation, held two and a half years after Mr. Brody was placed on paid suspension. (I 103) During the interrogation, Mr. Brody was queried about material protected by HIPAA sent to himself and to Michael Conners, the Albany County Comptroller. All of these communications occurred between January and October 15, 2012. (See also $18, $19, $20, S21 & S22) There was no claim that Mr. Brody sent the data to anyone other than himself and Mr. Conners. (T'72) There was no claim that Mr. Brody had an illegal purpose for these transmissions. (T 111) There was no testimony to dispute Mr. Brody’s claim that he sent the data 10 himself to facilitate his preparations for work the next day. (T 137) However, HIPAA information was improperly sent to unencrypted computers; there appeared to be some breach in the security of the Medicare information that forced OMIG to send out notices to over 15,000 individuals notifying them of the possible breach. (T 98) Two months later, on June 12, 2015, Mr. Brody was issued a Notice of Discipline NOD") alleging various instances of misconduct that OMIG asserts would constitute a crime. (it.2) The misconduct includes transmission of emails containing confidential names, socialsecurity numbers, dates of birth and client identification numbers to his home email server on March 9, July 9, September 27, and October 5 and 16, 2012. It was asserted all of these transmissions could constitute a crime. The NOD also noted improper contact with Michael Conners between March and October, 2012; it was asserted that these contacts would also constitute a crime. On June 12, 2015, Mr. Brody was notified that he was being suspended without pay effective June 15, 2015. (Jt. 4) In accordance with the CBA, it was asserted that Mr. Brody's continued presence on the job would “represent a potential danger to persons or property or would severely interfere with operations.” ‘A demand for arbitration was sent on June 17, 2015. After the adverse Supreme Court decision noted in the introduction of this Opinion and Award, the parties scheduled this arbitration proceeding. WAS THE NOTICE OF DISCIPLINE TIMELY FILED, PURSUANT TO SECTION 33.5(H) OF THE PEF/STATE CONTRAC Before any decision can be made on the merits, including any discussion of whether Brody’s suspension without pay is consistent with the terms of Section 33.4(a)(1) of the CBA, the threshold issue of timeliness must be discussed. The contract specifies the following: An employee shall not be disciplined for acts, except those which would constitute a crime, which occurred more than one year prior to the notice of discipline. The employee’s entire record of employment, however, may be considered with respect to the appropriateness of the penalty to be imposed, if any.Summary Position of the Grievant ‘The Grievant argues that the charges propounded against Mr. Brody are patently untimely, without factual allegations or proof at the hearing that he engaged in behavior constituting a crime in the State of New York. He asserts that none of the disciplinary charges or the evidence alleges or substantiates facts which demonstrate the elements of the cited sections of the Penal Law. Grievant cites prior disciplinary arbitration cases which hold that, in order to extend the timeliness guidelines set forth in the CBA, the disciplinary charges must contain factual allegations which satisfy the elements of the Penal Law offenses claimed to be violated. In the instant matter, Grievant contends there is no evidence establishing the basic elements of the crime charged or any allegation of criminal intent. Brody was never arrested for the conduct in question nor convicted of any such crime. Accordingly, the disciplinary charges are all untimely and must be dismissed. The Grievant examines each of the sections of the penal code that were allegedly violated, as noted in all charges in the NOD. Grievant notes intent is a critical element in all of these sections. In this case, there is no evidence Mr. Brody sent emails to himself or Mr. Conners for nefarious purposes. Since Mr. Brody had no intent to create harm, he could not be guilty of violating any section of the News York State Penal Code. The Grievant questions why OMIG did nothing for two and a half years after learning of the alleged breach. No charges were propounded against him. No reports were made to any criminal agencies. No reports were made to any federal agency with regard to any alleged information that Mr. Brody had either improperly distributed or tampered with. Basically, there‘was no contact with Mr. Brody from OMIG or any law enforcement agency. On this basis alone, the matter should be considered untimely. Summary Position of OMIG OMIG asserts that the disciplinary charges allege “conduct which would constitute a crime” and thus fall within the exception to the one year time period for bringing disciplinary action. It notes that all charges contain factual allegations describing misconduct including references to dates and times and specifications tying the alleged misconduct to a crime. It argues that the arbitration cases cited by the Grievant are distinguishable from the disciplinary charges issued against the Grievant. OMIG refers to the Grievant's opening statement in which. “the element of intent” was critical to any violation of the Penal Law. It notes that the key elements in Penal Law §156.05 & 156.10 are “knowingly” and “having no right to do so” and the clement of “intent” is only defined in Penal Law §156.29, 156.30 & 156.35. OMIG submits that the NOD cites the elements of computer related crimes, as required by previous arbitration awards. OMIG asserts that referral for criminal prosecution is not a prerequisite for an employer to commence disciplinary action against an employee, citing numerous cases supporting this proposition. It maintains New York courts have long recognized that the “constitutes a crime” exception to the statute of limitations contained in collective bargaining agreements renders it inapplicable. The lack of criminal charges is not relevant to establishing whether the NOD was timely filed under the provisions of the CBA. OMIG asserts it is not the arbitrator's role to speculate as to what may have causedOMIG’s delay in commencing the disciplinary action after the alleged misconduct was discovered in 2012. The arbitrator's role is to consider the evidence presented by OMIG at the disciplinary hearings. Discussion In this matter, the NOD outlines eight charges with several specifications in each charge. OMIG identified the actions, dates, and approximate times in which Mr. Brody allegedly conducted certain acts that allegedly violated Federal or State law. Each of these specifications contained sufficient information so that the Grievant would know the sections of the law he was accused of violating and the specific conduct for which he was being held accountable. The specificity is sufficient for the Grievant to understand fully the basis for the Notice of Discipline, including both the sections of law and the facts leading to the allegations. The exception to the statute of limitations in the contract does not require an employer to pursue a criminal investigation. It simply requires the employer to articulate actions that would, if proven, constitute a crime. In this case, OMIG cited one section of Federal Law and five sections of the New York Penal Law. The Federal law, 42 USC §13204-6, states: A person who knowingly and in violation of this part — (1) uses or causes to be used a unique health identifier, (2) obtains individually identifiable health information relating to an individual; ot (3) discloses individually identifiable health information to another person; shall be punished as provided in subsection (b) of this section. For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d- 9(b)(3) of this title and the individual obtained or disclosed such informationwithout authorization. Grievant maintains Brody’s actions do not constitute a crime. However while the statute does not use the word crime, such actions could be punished by a fine of not more than $50,000 or imprisonment of not more than one year. While the words misdemeanor and felony are not used, the potential punishment must be considered a crime as referenced in Section 33.5(h) of the CBA. Additionally, the Grievant argues that the employer did not report Brody's conduct to any federal enforcing agency and did not report the “crime” to anyone in law enforcement. While this factor may impact any evaluation concerning how serious the conduct should be considered for the purpose of discipline, it cannot be considered relevant when determining whether the NOD was timely filed. Ifthe filing of charges was a prerequisite to the exception in Section 33,5 (h), the contract would have so stated. Without a specific requirement articulating the need for the filing of a criminal case, all that must be shown is that the conduct, if proven, could constitute a crime the authorities could pursue, if so desired. ‘The specifications in the charges also references various sections of the New York State Penal Law, including §156.05 (Unauthorized Use of a Computer); §156.10 (Computer Trespass); §156.29 (Unlawful Duplication of Related Material in the Second Degree); §156.30 (Unlawful Duplication of Computer Related Material in the First Degree; and §156.35 (Criminal Possession of Computer Related Material) ‘The key elements of §156.05 and 156.10 are a requirement that “a person knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without 10authorization...” There is no requirement of intent in either of these sections. While Mr. Brody contends that he transmitted the material for business and not personal reasons, there is nothing in the wording in this section of the statute indicating such a reason may be an exception to the statute, While such a justification may impact on whether an employee should be disciplined for alleged actions and/or the extent of such discipline, it does not affect the issue of timeliness as defined in the CBA. The other sections of the Penal Law in which Mr. Brody was accused, §156.29, §156.30, & §156.35, all specifically require “intent”. The requirement of intent may have an impact on whether OMIG can prove a necessary element of the section of the law. This relates to proving the charges as opposed to the timeliness of the charges. Even though one may be skeptical if OMIG can prove intent on the charges relating to these three sections of the Penal Law, this has no bearing on whether the charges were filed in a timely manner. Based on the above, the Grievant has had proper notice of the specific statutes and acts, that may have constituted a crime. For this reason, the allegations would normally fall within the “crime” exception of the CBA, However, in this particular case, there are other legitimate concems to question whether the NOD was filed within the time requirements set forth in the CBA. These were raised in both Grievant’s opening statement and during the cross-examination of Mr. Meyer when questions were raised about the extent to which OMIG pursued and/or investigated the alleged crimes. The purpose of any “statute of limitations” in a collective bargaining agreement is to make sure a NOD is issued in a timely manner. This gives all parties an opportunity to make or udefend a case when the facts and circumstances are all relatively fresh. ‘Timely filing also encourages both sides to address issues within a reasonable period from the date and/or knowledge of the events leading to the NOD. The exception to the contract’s one year statute of limitations is when “the conduct would constitute a crime.” The reasons for such an exception are obvious: the alleged conduct may involve a matter in which no one had any knowledge for a period beyond the one year period specified in the contract and/or gathering necessary information may take longer than a one year period. It can be assumed that, unlike the typical discipline, certain acts that may constitute a crime may take time to investigate. These elements are not present in the instant matter. OMIG knew about the alleged misconduct when Mr. Brody was suspended in October, 2012. OMIG did not refer the matter to any criminal authorities; OMIG did not continue its investigation. OMIG did nothing to investigate or obtain more information. For all intents and purposes, it simply let the matter sit for two and a half years without any communications to Mr. Brody (or anyone else) regarding his status or future. When OMIG finally filed a Notice of Discipline in June, 2015, it was not because new information was uncovered or the investigation was completed. An interrogation was conducted in April, 2015; itis unclear what prompted the interrogation at that time. It is even more unclear why it took two and a half years to initiate such interrogation. It appears OMIG decided it had to do something and putting Brody back to work was not a reasonable course of action. In most situations, an employer should be given the benefit of the doubt in this type of 12situation, However, this “benefit” has limitations. Even when the conduct constitutes a crime, ‘an employer has an obligation to act in a reasonably expeditious and responsible manner. For example, an employer should not be able to file a NOD under the crime exception for an act committed years before when all of the facts were known and considered. In this case, there is a legitimate concern about the lengthy time lag between Brody’s suspension and the filing of the NOD, particularly since OMIG had all of the necessary information to make a reasoned judgement regarding the appropriate course of action. The contract has a one year statute of limitation for the filing of any grievance, except those which constitute a crime. However, even grievances that involve conduct which constitute a crime must stil be filed in a timely manner. While the one year standard need not be adhered to, the exception for a crime in this provision of the contract does not give an employer the unfettered right to file such NODs whenever it chooses. The contract must be interpreted to mean that an NOD must be filed within a reasonable period after knowledge of the crime is obtained id, and/or an investigation is launched and completed. While these time periods need not be rij an employer has an obligation to commence discipline within a reasonable time, even when the conduct may constitute a crime. The “crime” exception in the CBA is applicable in most cases in which there is new information or an ongoing investigation that takes longer than a year. It is not appropriate in a situation in which an employer has all the necessary information and has no valid purpose for a lengthy delay. In this case, the fact that the employer had all the necessary information in October, 2012, and did nothing for two and a half years distinguishes the instant case from the 1Bcases submitted by OMIG. Those cases dealt with disciplinary proceedings arising out of a statute, as opposed to a collective bargaining agreement, In addition, itis not clear how long the employer delayed in filing charges after the “alleged” crime or how much information the employer had when the disciplinary charges were filed. [See Matter of Aronsky v. Board of Education, 75 NY 2d 997 (1990) and Matter of Suker v. NY City Department of Education, 2013 NY Mise.Lexis 3298, Sup. Ct. NY City, 2015)] In this case, OMIG knew about the alleged misconduct in October, 2012, when it placed Mr. Brody on his paid leave. It did nothing to further investigate; its referral to the appropriate State or Federal agencies was minimal at best. Based on the testimony, it appears OMIG simply placed Brody on leave and forgot about him. When it filed the NOD, it was over two and a half years after the initial suspension. This is simply too long a period to keep any employee in an uncertain situation, with no knowledge of the charges against him. Even though Brody was on a paid suspension, he had legitimate concerns regarding his status that an employer should be obligated to address. For this reason, the Notice of Discipline filed in June, 2015, must be considered untimely. There is no reason to discuss each charge, since the same logic and rationale is applicable to all of the charges. Charge 8 does not refer to a specific statute and is therefore untimely on its face. For the reasons set forth above, Charges | through 7 cannot be considered timely and must be dismissed. The exception to the one year statute of limitations does not allow an employer to file a NOD whenever it choses; the employer has an obligation to file the NOD in a reasonably timely manner after it either learns about the alleged criminal conduct and/or completes an 4investigation regarding the possible commission of a crime. Once it obtains the necessary information regarding the possible commission of a crime, the employer has an obligation to act, within a reasonable time period. DISCUSSION OF OTHER ISSUES Based on the above discussion, there is no reason to explore in depth the other stipulated issues, including whether his suspension was consistent with Section 33.4(a)(|) of the CBA. Since the grievance is untimely, Mr. Brody must be reinstated with full back pay. OMIG went into great depth concerning all the issues regarding Brody's conduct and whether termination is appropriate. It made compelling arguments regarding Mr. Brody's guilt on the charges in the NOD. Alll government agencies are increasingly concerned about any alleged violations of HIPAA rules. By sending information to himself and to Michael Conners through an unencrypted server, Mr. Brody technically violated HIPAA rules, Whether Mr. Body's actions would have resulted in discipline (including the possibility of termination) is not an issue that needs to be considered in this decision, based on my determination regarding timeliness. Nevertheless, his actions do appear problematic. Mr. Brody should now be aware that any HIPAA violation will be treated seriously. Any deviation from the rules should be approved by a supervisor in writing in advance, This would include such actions as emails records to oneself or sending material to someone outside the typical government hierarchy. Failure to obey these protocols may result in discipline, up to and including termination. 1sDECISION AND AWARD 1. Charges 1 through 7 in the Notice of Discipline dated June 12, 2015, involving Harvey Brody was not filed in a timely manner. Charge 8 did not reference a crime and cannot be considered to be filed in a timely manner. Accordingly, the Notice of Discipline must be dismissed in its entirety. Harvey Brody shall be reinstated with full back pay. of 60 days in case there are ‘The Arbitrator shall retain jurisdiction for a peri ys Award. any questions regarding implemenfiog pf Ifa BY Lobel, Arbitrator AFFIRMATION STATE OF NEW YORK ) COUNTY OF ALBANY) I, Ira B. Lobel, do hereby affirm upon my oath as Arbitrator that I am the individual described in and who executed this instrument, which is my ay Date: August //, 2015 i; 16