I called the interim manager before I called anybody else, because I wanted to know why her name was attached to an enrollment I had never requested. She said she hadn’t personally enrolled me, but the account had been created from her office login in January, shortly after she took over. I told her I had never given anyone permission to use my name, and she said the education coordinator had told her the enrollment was already approved when she arrived. Then she opened the record while we were on the phone and read me the date the course had supposedly started. It was a Tuesday in March 2023, and I knew exactly where I had been because I’d worked a twelve-hour shift that day and my timecard showed me on the floor until seven that evening. She said the course had been marked as completed three months later, and the person who uploaded the completion certificate had used an email address that wasn’t mine.
I asked her to tell me the name on that email, and she hesitated before saying it belonged to a woman who had worked in the hospital years ago. I didn’t recognize the name, but the interim manager did. She said the woman had been a supervisor in another department and had left after an internal investigation, though she couldn’t discuss the details. Then she said something that made me pull up my own banking records: the education agreement didn’t just say I owed the hospital for the course. It authorized them to deduct the amount from my wages if I left before the required term. I told her I’d never signed that authorization, and she said the electronic signature looked valid because it matched the signature already stored in my employee file. I asked who had accessed that file in 2023. She checked the audit log and went quiet. There were three logins. Two belonged to payroll employees. The third belonged to the same woman whose name was on the enrollment.
I told my lawyer everything that afternoon, and he asked me to send him the agreement, my timecards, and the audit log. He noticed something I hadn’t: the education repayment amount was exactly the difference between what I was paid and what the hospital had deposited. Someone had been changing my payroll classification and then using the fake training agreement to make the deductions look legitimate. We requested the original enrollment record, including the IP information and the documents used to verify my identity. The hospital sent them two days later. The identity document attached to the enrollment was a copy of my driver’s license, but the signature underneath wasn’t mine. And the emergency contact listed on the form wasn’t my sister, my husband, or anyone in my family. It was the name of a woman I had worked with twenty years ago. When I called her, she immediately asked why I was looking into the training agreement. Then she said something that stopped me cold: “Because they told me you were the one who wanted me to take the fall.”
