Consider this workplace hypothetical.

Bob manages Department A. He can hire, fire, discipline, and promote employees in Department A.

Jane works in Department B. Bob isn't in Jane's chain of command. He doesn't supervise her, evaluate her, control her pay, recommend discipline, or otherwise have any meaningful say over her employment.

Bob sexually harasses Jane.

Is the company automatically on the hook because Bob is a supervisor? No.

Under Title VII, the question isn't whether Bob supervises someone. It's whether Bob is a supervisor over Jane.

That's an important distinction because the answer determines the standard for employer liability.

In Vance v. Ball State University, the Supreme Court drew a relatively bright line. An employee is a "supervisor" for Title VII harassment purposes only when the employer has empowered that person to take a tangible employment action against the victim — hiring, firing, promoting, demoting, significantly reassigning, or otherwise materially changing the victim's employment status.

So, back to Bob and Jane.

Bob may be a supervisor organizationally. He may have direct reports. He may even have "Vice President" printed on his business card.

But if he has no such authority over Jane, Title VII generally treats him as Jane's coworker, not her supervisor.

The 6th Circuit made this point crystal clear in EEOC v. AutoZone, Inc. There, the alleged harasser was a store manager who could direct employees' work, initiate discipline, make recommendations, and even hire some hourly employees. Yet he could not take tangible employment actions against the employees he actually harassed.

That wasn't enough. As the court put it, the fact that the manager could hire other employees didn't matter. He "could not and did not hire the employees he harassed, and that's what matters under Vance."

A brand-new California case reaches essentially the same conclusion under that state's harassment law.

In Doe v. Wells Fargo Bank, N.A., decided just this week, the alleged harasser was a senior employee whom the plaintiff considered influential. She argued that strict employer liability should apply because he supervised other employees. The court rejected that argument: when someone supervises other people but has no supervisory authority over the plaintiff, "as to the plaintiff, the harasser is a coworker." 

The court was explicit that strict liability did not apply where the alleged harasser wasn't the plaintiff's supervisor and merely supervised other employees.  

This distinction matters because it dramatically changes the liability rules.

If Bob were Jane's supervisor, and his harassment resulted in a tangible employment action against her, the employer would be vicariously liable. If there were no tangible employment action, the employer could avoid liability only through the Faragher/Ellerth affirmative defense.

But because Bob isn't Jane's supervisor, the coworker-harassment negligence standard applies instead. Jane must show that the employer knew or should have known about the harassment and failed to take prompt and appropriate corrective action. Vance expressly preserves that negligence framework for harassers who don't qualify as the victim's supervisors.

There is one important caution.

Org charts aren't everything. An employer can't necessarily avoid supervisor liability by reserving the final signature on hiring, firing, or discipline to somebody higher up. In Kramer v. Wasatch County Sheriff's Office, the 10th Circuit recognized that someone may qualify as a supervisor when the employer has effectively delegated significant employment authority to that person - for example, when evaluations or recommendations actually drive promotion, discipline, reassignment, or termination decisions. 

But mere influence isn't enough. AutoZone rejected the idea that the ability to persuade a decisionmaker automatically transforms someone into the victim's supervisor.

In these cases, the right question isn't, "Is the harasser a manager?" It's, "What authority did the harasser have over this employee?"

Who could hire Jane? Who could fire her? Who controlled her promotions, discipline, pay, significant assignments, and benefits? Whose recommendations were effectively rubber-stamped?

Those facts determine whether Title VII treats the harassment as supervisor harassment, triggering vicarious liability rules, or coworker harassment, governed by a negligence standard.

That doesn't mean employers get a pass when a manager harasses someone outside their reporting line. If the employer knew or should have known about the harassment and failed to respond appropriately, liability can still follow.

But when the issue is vicarious liability, titles alone don't decide the case. Bob's business card may say "manager." The more important question is whether, under Title VII, he was Jane's manager.

An employee's FMLA certification says she may need intermittent leave "4x per month for 1 day."

She's never missed more than four days in a month. But sometimes she takes two of those days consecutively.

HR reads the certification as four separate episodes, each lasting one day. The employee reads it as four total days of leave per month.

Who's right? Maybe neither — at least not conclusively.

A certification describing intermittent leave is often giving an estimate, not imposing a hard attendance cap. And when the need for leave is unforeseeable, employers should be especially careful about treating the frequency or duration listed by the doctor as an absolute limit.

The 6th Circuit recently made exactly that point in Jackson v. USPS. A medical certification estimating intermittent FMLA leave does not necessarily create a hard ceiling on the amount of protected leave an employee may take. If the actual leave materially differs from the doctor's estimate, the employer's remedy is generally to investigate through the FMLA certification process — not simply declare the excess absence(s) unprotected.

That doesn't mean employees get unlimited leave. It just means that HR has to use the proper tool.

If "4x per month for 1 day" is genuinely unclear, the employer may seek clarification of what the provider meant. Clarification is just that: understanding the meaning of an existing response. HR, a leave administrator, another management official, or a health care provider may contact the employee's provider; the employee's direct supervisor may not. And the employer cannot use clarification as a backdoor demand for medical information beyond what the FMLA permits.

The other tool is recertification.

Here's the basic framework:

1. The general rule is 30 days. An employer ordinarily may request recertification no more often than every 30 days, and only in connection with an absence. If the existing certification states that the condition will last longer than 30 days, the employer generally must wait until that minimum period expires.  


2. Six months is the outside checkpoint. Even when the certification covers a long-term or indefinite condition, the employer may request recertification every six months in connection with an absence.


3. A significant change can justify an earlier recertification. This is where our example gets interesting. The regulation itself says that if a certification predicts one-to-two-day migraine episodes and the employee's last two migraines each cause four-day absences, the increased duration may constitute a significant change permitting recertification before 30 days. Frequency, duration, severity, complications, and even certain absence patterns can matter.


4. Give the provider the actual attendance pattern. As part of a recertification, the employer may provide the health care provider with a record of the employee's absences and ask whether that pattern is consistent with the employee's serious health condition and need for leave. That's a much better question than HR deciding for itself what the certification means.


5. Give the employee enough time. The employer generally must allow at least 15 calendar days to provide the recertification, unless it is not practicable despite the employee's diligent, good-faith efforts.

Here's where HR gets itself into trouble. Suppose HR tells the employee: "Your new certification needs to say you may take up to four consecutive days, but no more than four total days per month." That's not clarification. That's HR writing the doctor's answer. Don't do that.

Instead, just give the provider the facts and ask the medical question: Is this employee's actual leave pattern consistent with the condition and the need for intermittent leave? Then let the provider answer it.

Most importantly, don't automatically discipline an employee merely because an unforeseeable absence exceeds the frequency or duration estimated on an existing certification. At least in the 6th Circuit, those estimates are not necessarily hard caps. If the pattern materially changes, use the recertification process the regulations give you.

An FMLA certification is medical information, not an attendance points chart. When the employee's actual leave stops matching the doctor's estimate, ask questions before you start issuing discipline.

One email. One click. And, nearly a decade later, 114 guilty verdicts.

The Manchester City financial scandal started with something far less sophisticated than disguised sponsorship agreements, hidden payments, or Premier League financial regulations.

It started with phishing.

In January 2017, a senior Manchester City official received an email that appeared to come from someone at UEFA. It contained a link to what looked like a financial compliance report.

The employee clicked "download."

That was all it took.

The email wasn't from UEFA. It was a phishing attack tied to Rui Pinto, the Portuguese hacker behind Football Leaks. The click gave Pinto access to City's computer systems, from which he obtained thousands of internal emails and documents. Those documents eventually made their way to journalists, helped launch investigations by UEFA and the Premier League, and became part of the story that culminated last month with an independent Premier League commission finding City guilty of 114 of 115 charges. City denies wrongdoing and has appealed.
Think about that for a moment. One employee clicked one bad link. And the rest, as they say, is 114 guilty verdicts.

That happened in 2017. Phishing has gotten a lot more sophisticated since then.

Today's phishing email might perfectly mimic Microsoft, DocuSign, your bank, a customer, your CEO, or one of your vendors. Attackers can scrape LinkedIn and company websites to learn reporting relationships and job responsibilities. Generative AI makes it trivial to write polished, personalized emails without the bad grammar and awkward phrasing that used to give scams away.

And phishing isn't limited to email. It can arrive by text, Teams, Slack, social media, or even a phone call.

So what can an employer do?

Here are eight places to start.

1. Train employees to verify, not just recognize.

"Look for typos" is not a cybersecurity strategy anymore.

Employees need a simple rule: if an email unexpectedly asks you to click a link, download a file, enter credentials, move money, change banking information, or disclose sensitive information, verify the request through another channel.

Call the person. Open the website yourself instead of using the link. Start a new email using an address you already know.

The National Institute of Standards and Technology specifically recommends independently verifying suspicious or urgent requests rather than relying on contact information contained in the message itself.

2. Turn on multifactor authentication everywhere you can.

A stolen password shouldn't equal a stolen account.

Require MFA for email, cloud storage, payroll, HRIS platforms, remote access, financial systems, and especially administrator accounts.

Better still, move toward phishing-resistant MFA such as passkeys or FIDO security keys. Traditional text-message codes and one-time passwords are better than passwords alone, but sophisticated attackers can sometimes steal those, too. CISA and NIST both recommend phishing-resistant authentication for higher-risk accounts.

3. Stop giving everyone access to everything.

If one employee's account gets compromised, the attacker should not inherit the keys to the entire company.

Apply the principle of least privilege. Employees should have access only to the systems and information they actually need to do their jobs. Administrative access should be especially limited.

The smaller the compromised account's footprint, the smaller the potential blast radius.

4. Harden your email system.

Your employees should not be your only line of defense.

Use modern spam and malware filtering, safe-link scanning, attachment screening, and email authentication technologies such as SPF, DKIM, and DMARC.

DMARC, in particular, can make it harder for attackers to impersonate your company's domain in phishing campaigns.

5. Make reporting suspicious messages ridiculously easy.

Give employees a one-click "Report Phishing" button or an obvious place to forward questionable messages.

And don't punish people for raising false alarms.

I'd rather have IT review 50 legitimate emails than have an employee hesitate for 30 seconds over the one malicious email that matters.

Speed also matters after someone clicks. The sooner IT knows, the sooner it can disable accounts, revoke sessions, reset credentials, isolate devices, and determine what the attacker accessed.

6. Phish your own employees.

Run periodic simulated phishing exercises.

Not as a "gotcha." Not so HR can create a list of employees to discipline.

Use them to identify where your training and systems are failing.

Which kinds of messages fool people? Are executives more vulnerable to fake document-sharing notices? Is accounting susceptible to vendor-payment scams? Are employees entering credentials into fake Microsoft login pages?

Train against the attacks your workforce is actually falling for.

7. Protect the people attackers are most likely to target.

Cybercriminals don't choose victims randomly.

Executives, finance employees, HR, IT administrators, and anyone with access to payroll, employee data, banking information, confidential business information, or wire-transfer authority deserve additional safeguards.

Those safeguards might include stronger authentication, transaction verification procedures, tighter access controls, additional training, and alerts for unusual login behavior.

Your CFO should not be able to change a vendor's bank account based solely on an email. Neither should anyone else.

8. Have a plan for the click that gets through anyway.

Because eventually somebody will click something.

Your cybersecurity plan should assume that prevention will sometimes fail.

Know who gets called. Know how accounts get locked. Know who contacts your cyber insurer. Know how you preserve logs and evidence. Know when outside forensic counsel or cybersecurity professionals get involved. Know whether legal or regulatory notification obligations might be triggered.

And practice the plan before you need it.

Cybersecurity isn't just an IT problem. It's an HR problem, a training problem, a risk-management problem, a legal problem, and ultimately a business problem.

Manchester City reportedly spent years and enormous resources fighting over what Rui Pinto found after one employee clicked one link.

Your company probably doesn't have Manchester City's resources.

Train your employees accordingly.

A firefighter with PTSD asks to bring his dog to work as a reasonable accommodation. The dog helps calm him. His psychologist supports the request.

Does the ADA require the employer to say yes?

Not necessarily.

In Fisher v. City of Lansing, a firefighter claimed that the city violated the ADA when it refused to let him bring his dog, Chet, to the fire station. Fisher had PTSD, and his psychologist recommended an emotional support animal to help manage his symptoms at work.

The court sided with the city.

The problem wasn't whether Fisher had a disability. It was whether the dog was necessary as a reasonable accommodation. To prevail on an ADA failure-to-accommodate claim, an employee must show that the requested accommodation is both reasonable and necessary — that it addresses an obstacle preventing the employee from performing an essential job function.

Fisher couldn't make that showing.

He admitted that he could perform his job without the dog. "Not well," as he put it, but he could perform it. His psychologist likewise couldn't identify any particular job duty Fisher could not perform without the animal. Instead, the doctor testified that the dog had a calming effect on him.

That's where the distinction between a service animal and an emotional support animal becomes important.

Under the ADA regulations governing public entities and public accommodations, a service animal is a dog individually trained to perform work or tasks directly related to someone's disability. Emotional support, comfort, companionship, and a calming presence, standing alone, don't qualify.

But employers need to be careful with that distinction.

Those definitions come from Titles II and III of the ADA. Title I (the part of the ADA governing employment) doesn't contain the same service-animal definition or automatically exclude emotional-support animals from consideration. The Job Accommodation Network therefore recommends that employers treat requests for both service animals and ESAs like other reasonable-accommodation requests: engage in the interactive process and determine whether the animal is needed because of the employee's disability.

In other words: "It's an ESA, not a service dog" should not end the conversation.

For employers, the better approach is:

1. Start the interactive process. Don't get hung up on labels.

2. Ask what limitation the animal addresses and how it helps the employee perform the job or access an equal workplace benefit.

3. Request appropriate medical documentation when the disability or need isn't obvious.

4. Focus on necessity, not preference. "This helps me" isn't necessarily the same as "I need this because of my disability."

5. Consider the actual workplace. Safety, sanitation, allergies, disruption, animal control, and essential job duties all matter.

6. Document the analysis. A categorical "no animals" rule is much harder to defend than an individualized ADA assessment.

The ADA doesn't require employers to turn every workplace into a dog- or peacock-friendly office.

But it does require them to treat "Can I bring my dog to work?" as an accommodation question, not merely a pet-policy question. 

Nineteen years in, I repainted the walls. Your handbook needs the same.

Your brain is built to notice what's new. That's not a flaw. It's a feature.

Novelty grabs attention and makes people curious. Wharton researchers Hengchen Dai, Katherine Milkman, and Jason Riis describe a "fresh start effect": people are more motivated to act after a clean break, like a new year, a birthday, or a Monday.

The Ohio Employer Law Blog is 19 years old. I built this website in 2007, and it looked like it.

This week, it got a new look. Same content and same opinions, just easier to navigate with better mobile responsiveness. 

Your handbook has the same problem. It hasn't been refreshed in years. Nobody notices it anymore. It's faded paint. Your employees walk past it every day without seeing it. And that faded paint has a cost.

1. Employees stop reading it. A policy no one reads is a policy no one follows.

2. Managers stop enforcing it. The handbook says one thing. The practice says another. A policy you don't follow can become evidence of pretext. Plaintiffs' lawyers love that gap. It's their Exhibit A.

3. The law moves on without it. Remote work. The Pregnant Workers Fairness Act. AI. If your handbook still reads like 2015, it's missing today's rules and today's risks.

4. Patching piles up contradictions. Add-on memos and one-off updates collide with each other. A clean rewrite lets you cut what you don't follow and clarify what you do.

Pick a policy at random.

Can your managers explain it without opening the handbook?
Does your team follow it exactly as written?
Is it current with the law?

If you hesitated on any of them, you have your answer.

A rewrite is a fresh start. Use it. Retrain your workforce. Coach your managers on enforcement. Get new acknowledgments signed. Apply a fresh coat of paint.

If you're ready to repaint your handbook, email me, or contact the Employment & Labor team at Wickens Herzer Panza.

---

Here's what I read this week that you should read, too.

Wouldn't It Be Nice — via The Norah and Dad Show Podcast

Why Your Employees Override AI — via Harvard Business Review 

When Employees Fear AI Losing Control, HR Needs a Better Answer  — via EntertainHR

Meta employees ordered 'attorney/client privilege' hats while fighting child safety disclosures — via The Verge

Off the Clock, Beyond the Test: Cannabis Use and Workplace Impairment in New York — via The L•E•Jer

AI, And Experts, And Hallucinations, Oh My! — via Above the Law

The Most Dangerous Thing a New Manager Can Say Is 'I'll Fix This' — via Improve Your HR by Suzanne Lucas, the Evil HR Lady

Ways to remove barriers to hiring people with disabilities — via TLNT

The cup meltdown, the "Lost" finale, and other tantrums you've witnessed at work — via Ask a Manager

NLRB Restores Employer-Friendly Standard for Workplace Outbursts During Protected Activity — via Employment Law Letter

'I felt shame': former BA worker locked in legal battle after losing job of 30 years — via The Guardian

"Not Crazy About White People" Allegedly Appeared in an HR Report. What Could Possibly Go Wrong? — via Eric Meyer's Employer Handbook Blog

A New Era of Health Care Noncompetes: Emerging Models and the Future of Labor Mobility — via Trading Secrets

The doctor's note is vague. What should the employer do next? — via HR Dive

Peter Gabriel Reveals Full Details, Release Date for New Album o/i — via Consequence

Some things should be left unseen Bostock does not come with an asterisk Man City's 35 counts, and why the cover-up is always worse than the crime Harassment prevention can't stop at the boardroom WIRTW #811 (the 'uni' edition)