RNU criticizes NL Health Services phishing exercise

ST. JOHN’S – The Registered Nurses’ Union Newfoundland & Labrador is raising concerns after NL Health Services conducted a phishing awareness exercise that used the promise of an additional paid day off as the hook for employees.

The email, sent as part of an internal cybersecurity test, appeared to recognize employees for their work during ongoing system pressures, including the implementation of CorCare. It invited employees to “submit” a request for what was described as a “June Holiday,” an additional paid day off in recognition of their care, commitment, and professionalism.

RNU president Yvette Coffey, RN (pictured), said the exercise was in very poor taste.

“Yes, we have heard concerns from members about this, and frankly, I understand why they are upset,” said Coffey. “Nurses and other health-care professionals have worked through enormous pressure over the last number of years, including ongoing staffing shortages, burnout, organizational restructuring, and the challenges connected to the rollout of CorCare.

“To use the promise of an additional paid day off as the hook for a phishing exercise was in very poor taste.”

Coffey said the issue is not with cybersecurity education, but with the judgment used in designing the exercise.

“Cybersecurity education is important, but it needs to be done with judgment and respect,” said Coffey. “There are many ways to test phishing awareness without exploiting the very real stress, fatigue, and frustration health-care workers are experiencing.”

The union says the message was especially insensitive at a time when many nurses and healthcare professionals are exhausted, struggling to access leave, and managing significant change across the health system.

“I am not sure who thought this would be a good idea,” said Coffey. “At a time when staff are exhausted, when many are struggling to access leave, and when employees are being asked to manage significant change across the system, this message was bound to feel insulting to many people who received it.”

RNU says employees deserve genuine recognition for their work, not a fake promise of appreciation used as a test.

“Members and other healthcare professionals have every right to be perplexed and more than a little miffed,” said Coffey. “They deserve genuine recognition for the work they are doing, not a fake promise of appreciation used as a test.”

The Newfoundland and Labrador Association of Public and Private Employees (NAPE) also expressed dismay and outrage over the phishing exercise.

“I am absolutely disgusted that NLHS would do this to our hardworking healthcare staff,” said NAPE President Jerry Earle. “Our members deserve better than to be taunted with the promise of a day off after the incredible amount of work and sacrifice they made to get CorCare up and running. Many members were denied vacation, worked countless extra hours, and spent time away from their families and loved ones during the CorCare launch. To use those sacrifices as the basis for a phishing test is nothing short of cruel.”

NAPE is calling on NLHS to immediately apologize to all employees who received the email. This has caused such unnecessary stress and upset amongst staff that the people responsible for this should be immediately removed from their positions.

“If one of our members did something as cruel as this, they would be out of a job today. Our healthcare workers have given so much to support patients and the healthcare system through one of the most challenging transitions in recent memory,” said Earle.

“They deserve appreciation and respect, not to be used as a tool for a cybersecurity exercise. The NLHS should be focused on rebuilding trust and improving morale, this exercise accomplished the exact opposite, and we will do whatever we need to do to ensure this is dealt with.”