Employees of St. Charles Health System are being asked to repay roughly $2 million after a ransomware attack on a global workforce management provider kept health system staff from accessing time card data for months.

In December, an attack on Ultimate Kronos Group, a company that holds timekeeping and scheduling data for workplaces nationwide, prevented St. Charles Health System from accessing employee time card data from Nov. 28 to Jan. 22.

After spending weeks repaying regional healthcare staff who had been underpaid, St. Charles is now asking for money back from 2,358 staffers who were overpaid, St. Charles spokeswoman Lisa Goodman said in an email to The Bulletin on Friday.

That’s an average of about $780 per person, Goodman said.

The health system says 1,784 people will owe $1,000 or less and said it is offering different options for staff, including a “payment plan, a lump sum payment or a reduction of earned time off (vacation time) to offset their balance owed,” Goodman said.

A spokesperson from the Oregon Nurses Association, the union representing St. Charles nurses, said some staff members are being asked to pay back as much as $3,000.

“While we recognize this is an inconvenience for our employees, we’ve communicated from the beginning that this is a step we’d eventually need to take,” Goodman said. “We have made every effort to keep our employees apprised of the situation.”

The move by St. Charles has sparked immediate outrage and pushback from health care staffers who say they are being asked to make thousands of dollars worth of repayments with little clarity as to how the health system decided what they should pay.

“I think there’s a right way of going about getting this fixed, and I don’t know if making our employees responsible for it is the right way to go about it,” said Josh Plank, a hospitalist with St. Charles who is part of the organizing committee for the providers union. He added: “They clearly have enough money to pay a multi-million dollar law firm to fight our union representation, so I don’t think they’re in that bad of a financial situation.”

The Oregon Nurses Association on Thursday told its members not to make the repayments for now. The union’s general counsel wrote a cease and desist order for the health system and planned to send it Friday, urging it to halt the repayment process and claiming that what it was doing was illegal.

The association “will vigorously defend its members rights to be free from this unlawful activity,” according to a copy of the letter obtained by The Bulletin. “The fact that St. Charles believes it made an error does not surprise anyone. St. Charles use of unlawful debt collection demands against its employees to correct its own error is beyond the pale.”

St. Charles argues that it kept employees apprised of the situation in recent months, sending 19 emails and holding town hall meetings to discuss the situation and ask questions.

But Plank and Scott Palmer, the director of communications for the Oregon Nurses Association, said some healthcare workers didn’t know they would need to pay money back until this week. At least one was informed of what they would need to repay with a sticky note, Palmer said.

The latest controversy comes as St. Charles — the only hospital system for eight counties — is repeatedly rocked by financial hardship after the pandemic damaged the hospital system’s bottom line and caused a staffing shortage that left some staff concerned that the institution was falling into disarray.

In recent months, the health system has also laid off two executives and more than 100 employees in a single month.

Goodman said that “many of our caregivers have already acknowledged they’ve been overpaid and have authorized a repayment agreement.”

Palmer said it wasn’t right to ask healthcare workers to now make these payments after enduring the pandemic’s toll.

“Nurses have been working incredibly hard in one of the most challenging hospital environments,” he said, adding: “It’s just adding insult to injury.”

The nurses association is asking that St. Charles withdraw its demands for repayment by 9 a.m. on Aug. 15 “or we will pursue further legal actions.”

— Bryce Dole; 541-617-7854, bdole@bendbulletin.com