This case raises important issues about employer liability for a hostile work environment created by third parties and about non-employer liability for employment-related discrimination under the Maine Human Rights Act (MHRA). We articulate here the rules which govern these claims.

Tara Roy, the plaintiff, worked as a nurse, employed by Correct Care Solutions, LLC (CCS), at a Maine Department of Corrections (MDOC) prison. After MDOC revoked her prison security clearance and CCS terminated her employment in October 2014, Roy sued three sets of defendants: CCS, the MDOC, and two individuals, the prison's warden and deputy warden. She alleged that discrimination and sexual harassment by the prison's corrections officers made her work environment hostile and that she was retaliated against for complaints about the hostile work environment and for other whistleblowing.

Specifically, Roy alleged that CCS violated Title VII and § 4572 of the MHRA by not responding adequately to her complaints about the hostile work environment and by retaliating against her in terminating her employment for protected complaints. Her claims against MDOC under § 4633 of the MHRA alleged that MDOC interfered with her MHRA-protected right to work free from discrimination and that MDOC's revocation of her security clearance was unlawful retaliation. Finally, against Rodney Bouffard, the warden, and Troy Ross, the deputy warden, Roy brought claims under 42 U.S.C. § 1983 for violations of the Equal Protection Clause and the First Amendment.

The district court granted summary judgment to all defendants on all claims. See Roy v. Correct Care Solutions, LLC , 321 F.Supp.3d 155 , 160 (D. Me. 2018). We reverse as to CCS and MDOC and affirm as to Bouffard and Ross.

After an overview of the facts, we first explain that a jury could find that Roy's work environment was discriminatorily hostile. Having established this, we proceed to examine liability for each defendant. We reverse summary judgment for MDOC, first deciding an unresolved question *57 of Maine law about the scope of § 4633 non-employer liability for workplace harassment and then finding disputes of material fact. Next, in reversing summary judgment for CCS, we explain that an employer can be liable for a hostile work environment created by non-employees as long as the employer knew of the harassment and failed to take reasonable steps to address it. A jury could find CCS liable for failing to protect Roy from the harassment, as well as for retaliation. Finally, we affirm summary judgment for the warden and deputy warden. Ross and Bouffard receive qualified immunity, as reasonable officials could have believed on these facts that no equal protection or First Amendment violations occurred.

I.

We present the facts in the light most favorable to Roy and draw all reasonable inferences in her favor, as we must at summary judgment. Pippin v. Boulevard Motel Corp. , 835 F.3d 180 , 181 (1st Cir. 2016).

Under a contract with MDOC, CCS operates and staffs the medical facility at the Maine State Prison (MSP) in Warren, Maine. In August 2012, CCS hired Roy to work as a licensed practical nurse at the MSP, where the medical facility consists of an infirmary and a clinic. Roy worked in the clinic, and primarily interacted with the prison's corrections officers when they brought inmates in for treatment. As a safety measure, two officers were also specifically assigned to the medical facility, one to the clinic and one to the infirmary.

In late 2012, Davis Snow, the officer assigned to the clinic, made sexual jokes and degrading comments about women to Roy and made physical contact with Roy on two occasions. Snow's remarks were "constant[ ]." He said, for example, "don't worry, it's because you are blonde. You wouldn't understand," and, "I wouldn't expect someone like you to understand how things are done." Snow also once squeezed and twisted Roy's wrist until she dropped to her knees in pain. And he once bent her over a chair and spanked her.

Roy complained to her CCS supervisors and MDOC about Snow in early 2013. After MDOC investigated these complaints, Snow was reassigned, away from the medical facility.

About a year later, in the spring of 2014, Roy began working with Donny Turner, who was often the corrections officer assigned to the medical clinic. Turner, like Snow, "constantly" made derogatory jokes and comments about women. He said, "[W]hy do we have females when ... men do everything," and that a woman's "job is to be at home." Turner continued his remarks even after Roy told him that his comments were not funny.

On June 20, 2014, Roy filed an Incident Report about Turner's degrading comments. The report also complained that Turner's behavior created health and safety risks. Roy explained that Turner sometimes ignored her, left her alone in exam rooms with inmates, and did not respond to her requests to bring sick or injured inmates to the clinic.

CCS employees were instructed to fill out MDOC Incident Reports to provide information about any disruptions in the work of the clinic involving corrections officers. CCS says that reports by its employees about MDOC officers were usually submitted to CCS supervisors Elisabeth Lamson, CCS's administrator at the prison, and Robin Cross-Snell, the prison's head nurse. CCS also says that such reports were then referred to MDOC within a day or two for investigation, but the record suggests that this was not always done.

*58 Outside of this formal Incident Report process, Bouffard, the warden, and Ross, the deputy warden for operations, had frequent contact with Cross-Snell and Lamson. The CCS supervisors attended the prison's daily operations briefings, and Lamson routinely spoke informally with MDOC officials about concerns related to the medical facility.

Roy's report on Turner went to Lamson, and Lamson believes she may have spoken with Turner about the report. But she did not bring the issue to his supervisors, and there is no evidence that it was ever referred to or investigated by MDOC.

Turner's behavior around Roy escalated after Roy filed the Incident Report about him. Turner often left Roy alone with inmates, was frequently absent from his post in the clinic, talked down to Roy, and worked slowly or ignored Roy when she needed something. It is considered a security risk for an officer at the medical facility to leave his post, particularly when inmates are around.

Roy continued to complain about Turner to her supervisors, in person and by email. For example, on July 23, 24, and 31, 2014, Roy emailed Lamson saying that Turner was absent from his post in the clinic for as long as twenty minutes while inmates were there. Lamson forwarded at least one of Roy's emails about Turner to MDOC, but there is no evidence that MDOC investigated or acted on these reports by Roy about Turner, or that CCS ever followed up.

In early August 2014, Roy emailed Lamson about an incident with Officer Ernest Parrow. When Roy reminded Parrow about the proper procedure for bringing sick inmates to the clinic, Parrow told Roy to "stop being a bitch." He added that he now understood why people hated her. Later that month, on August 26, Roy sent an Incident Report to Cross-Snell stating that she had called Parrow to ask him to bring an inmate to the clinic to sign a form and that Parrow had responded by again calling her a "bitch" and then hanging up on her.

Along with this August 26 Incident Report, Roy provided to CCS several sexually explicit text messages that Parrow had sent her earlier that summer. Parrow, who had previously had a brief romantic relationship with Roy, texted her, "There is still a thing or two I didn't get to do to ya," and "if you want me to bend you over let me know." Roy responded, "U have a [girlfriend]!!!" to the first message and ignored the second. She told Cross-Snell that Parrow was angry with her in part because she had rejected his advances.

Cross-Snell verified that Parrow had called Roy a "bitch" twice and wrote an Incident Report, which she sent to MODC; CCS also gave MDOC the text messages between Parrow and Roy. CCS's regional vice president, John Newby, who supervised Roy's supervisors, learned that Parrow had called Roy a "bitch" twice and, on August 28, spoke with Ross, the deputy warden, about it. Ross says he then investigated Parrow's behavior, in part by reviewing the explicit text messages. Because of the alleged name-calling, Ross talked to Parrow about workplace professionalism.

The text messages from Parrow reviewed by CCS and MDOC also showed an exchange between Parrow and Roy on July 16, 2014, in which Parrow said Roy was "being a shit" after Roy refused to share with him medical information that he wanted about an inmate. Roy said that the information, an inmate's prescribed medications, was confidential by statute and that Parrow was not authorized to receive it.

*59 Parrow was not the only officer asking Roy for confidential medical information. Throughout July and August 2014, Roy complained to her supervisors that she and other medical staff were getting frequent calls from corrections officers requesting confidential information. She said that officers responded to her refusals to share it by calling her names, yelling, hanging up on her, and threatening to file grievances against her. At least four times during the summer of 2014, she emailed her supervisors reporting specific incidents. Roy says nothing was done by CCS or MDOC.

Roy also says that by mid-August multiple corrections officers showed daily hostility toward her. Several of these officers, including Parrow, Snow, Paul Dever, and Paul Garrido, also filed Incident Reports complaining about Roy. For example, Snow filed a report stating that Roy had yelled at him. To Roy, the officers' hostility and the filed Incident Reports constituted retaliation against her for her complaints about Snow, Turner, Parrow, and their requests for confidential medical information. At her deposition, Roy said, "[W]ith the officers, when one is upset with somebody, they all are."

Lamson and Cross-Snell met with Roy on August 14 about the reports filed about her. Roy told her supervisors that the reports were false or exaggerated. Lamson and Cross-Snell warned Roy that she "could be moved to another department" if her behavior did not change. At that point in August, CCS obviously contemplated that it could move Roy to a different job within CCS. Weeks later, CCS's position changed, as we describe below.

On September 12, Garrido told Roy that Officer Curtiss Doyle had said to him that an inmate needed to get sick so that the ensuing emergency medical call would "get Tara off her fat lazy ass." Roy filed another Incident Report that day saying that she viewed this comment as sexual harassment. MDOC investigated the incident in late September, days before Roy's employment was terminated.

Also on September 12, Roy emailed the CCS human resources specialist, copying Cross-Snell, Lamson, and their supervisor Newby, asking for a transfer to a different CCS facility "d[ue] to the fact that I currently feel that my work site is bo[ ]rd[er]ing on a hostile work environment." The record shows no response to Roy's email, and Roy does not remember getting one.

That same week, Officer William DeGuisto messaged Roy on Facebook to say, "You['re] lucky [Officer Paul] Dever is out on admin leave[.] He was trying hard to get you fired." When Roy asked for more information, DeGuisto told her that Dever "fucking complained to everyone you were picking on Turner and trying to get him fired" and that Dever "wrote a few reports on you." When Roy said that Dever "does [not] have ANY reason to write reports on me," DeGuisto offered, "He says you have fucked everyone in the prison."

DeGuisto then asked in a Facebook message if he could call Roy, but she replied she would "rather not" give him her phone number. A few days later, he asked again if he could call her, and added, "Please try to smile at my window and not look at me like I'm the enemy." Four days after that, DeGuisto messaged her: "Another report written against you today!!! And you still act like you mad at my window[.] See you, I UN FRIEND YOU Tired of attitude."

Roy filed an Incident Report about DeGuisto's Facebook messages, attaching the exchange about Dever and the later requests to call her. Lamson passed the report to her supervisor, Newby, and planned to discuss the report with Bouffard, the warden. Although MDOC says that it reviewed the allegations, Bouffard *60 and Ross explained at their depositions that they did not act on the complaint because the interaction occurred on Facebook. Even though Roy and DeGuisto's messages were about what Roy, DeGuisto, and Dever had done, said, and heard in the workplace, in Ross's view, "The Facebook stuff, that's off-duty stuff. We don't do much with that." Similarly, Bouffard called the conversation "something that was going on in their own private lives."

After Roy filed the Incident Report about DeGuisto, Lamson spoke to Roy about all the Incident Reports she had filed. What happened at the meeting is disputed. As Roy remembers it, Lamson told Roy that she should not write any more reports about corrections officers because Ross was upset with Roy's frequent complaints. As Lamson remembers it, she told Roy "that the report[s Roy files] should be of substance."

About two weeks later, on September 26, 2014, Roy and another nurse, Vanessa Reed-Chapman, were working in the clinic when Officer King was the correctional officer assigned to the clinic and Officer Snodgrass was assigned to the infirmary. (Turner was usually the officer assigned to the clinic, rather than King, and Snodgrass's typical assignment was the front desk.) At about 10:00 that morning, a member of the medical staff was called to a medical emergency elsewhere in the prison. Protocol required the officer assigned to the infirmary to accompany the medical staff member, as the infirmary could be locked to secure the inmates there. That day, however, King was asked to respond to the call instead of Snodgrass.

After King left, Roy and Reed-Chapman, who were then alone with three inmates in the medical clinic, called Snodgrass three times to come over from the infirmary. If the medical clinic officer was away, the infirmary officer was supposed to secure the infirmary and come to the clinic. Surveillance footage shows Snodgrass asleep at his desk and unresponsive to the nurses' calls. Eventually, Snodgrass did come over.

Lamson learned of this incident from both Roy and Reed-Chapman and called MDOC's Captain Melquist, who came to the clinic to speak with the nurses. Roy and Reed-Chapman each told Melquist that the officer on duty in the clinic, King, had responded to a call, that King had left Roy and Reed-Chapman with prisoners and without a corrections officer, and that the infirmary officer on duty, Snodgrass, did not arrive to cover the clinic for fifteen minutes.

Although Melquist told Roy and Reed-Chapman to file Incident Reports, Roy did not do so because of what Lamson had told her about Ross not wanting Roy to file more reports. Reed-Chapman did file an Incident Report, writing that King left at "Approx 10[:]00" with "3 inmates still present in clinic with NO Supervision By DOC." She continued, "[O]fficer did eventually come to clinic @ 10[:]15. Safety Risk."

Surveillance footage shows a different officer, Therrien, in the clinic thirty seconds after King left. The video does not show Therrien assuming King's duties or his post. Therrien was there letting inmates in and out of the clinic. The video also shows Snodgrass arriving about six minutes after King left. Either Therrien or Snodgrass is on camera in the clinic for all but one minute and forty-nine seconds of the fifteen minutes after King left. (MDOC says that Therrien never left the clinic, and only occasionally left the view of the camera.)

That same afternoon, Lamson and Cross-Snell met with Captain Melquist, Ross, and the MDOC human resources *61 representative. At the meeting, the captain expressed concern about the discrepancies between the surveillance video and Roy and Reed-Chapman's statements about being unattended for approximately fifteen minutes. Ross then said that he was frustrated that Roy was involved in so many investigations, adding that he wanted to "gate-close" Roy -- that is, to revoke Roy's security clearance. Ross later said that he wanted to do this in part because of "any [reports] that she may have been involved in."

The CCS Team Member Manual provides that employees like Roy are expected to maintain prison security clearances. At the MSP, clearances were controlled by MDOC, and Bouffard was the ultimate decisionmaker.

Although CCS was aware after the meeting that Roy's security clearance was in limbo, there is no evidence that CCS had any discussions with MDOC about Roy after September 26. CCS did place Roy on "temporary suspended leave" that day. Newby, the regional vice president, told Roy that he knew she had done nothing wrong and that the leave was merely a cooling off period. The leave was not temporary.

A week later, on October 2, 2014, Bouffard emailed Newby stating, "Effective immediately as a result of misconduct nurse Tara Roy will no longer be allowed entrance to the facility. Specifically, she misrepresented the truth and subsequently failed to follow a directive." Bouffard made this decision without speaking to Roy or Reed-Chapman about the September 26 incident. Indeed, aside from the captain, who spoke to Roy and Reed-Chapman on September 26, no one at MDOC inquired of them about their version of events.

MDOC did not revoke Reed-Chapman's security clearance, although she had made the same representations, or "misrepresent[ations]," as Roy. At deposition, Bouffard explained that he chose not to revoke Reed-Chapman's clearance because she was a new employee who "took direction" from Roy. At the time, CCS did not ask MDOC to explain the discrepancy, nor did CCS discipline Reed-Chapman.

CCS terminated Roy's employment the day MDOC revoked her clearance. Lamson told Roy that she could no longer work at the MSP because of the loss of her clearance and that CCS had no openings at other facilities. CCS's two other sites in Maine -- the Androscoggin County Jail and the Two Bridges Jail -- were not MDOC facilities and had security clearance systems separate from the MSP's. Later, Lamson admitted that she had not looked into and did not actually know on October 2 whether CCS had openings at these facilities.

II.

We start with Roy's allegations that she was subjected to a hostile work environment in violation of Title VII, the MHRA, and the Equal Protection Clause. This allegation is an essential ingredient of Roy's sexual harassment claims against all defendants. We conclude that a reasonable jury could find that Roy's work environment was hostile, and we turn in later sections to the liability of each defendant.

A hostile work environment is one "permeated with discriminatory intimidation, ridicule, and insult, that is sufficiently severe or pervasive to alter the conditions of the victim's employment." Harris v. Forklift Sys. Inc. , 510 U.S. 17 , 21, 114 S.Ct. 367 , 126 L.Ed.2d 295 (1993) (internal quotations and citations omitted). To succeed on a hostile work environment claim under Title VII, a plaintiff must establish six elements:

*62 (1) that she (or he) is a member of a protected class; (2) that she was subjected to unwelcome sexual harassment; (3) that the harassment was based upon sex; (4) that the harassment was sufficiently severe or pervasive so as to alter the conditions of plaintiff's employment and create an abusive work environment; (5) that sexually objectionable conduct was both objectively and subjectively offensive, such that a reasonable person would find it hostile or abusive and the victim in fact did perceive it to be so; and (6) that some basis for employer liability has been established.

O'Rourke v. City of Providence , 235 F.3d 713 , 728 (1st Cir. 2001) (citing Faragher v. City of Boca Raton , 524 U.S. 775 , 787-89, 118 S.Ct. 2275 , 141 L.Ed.2d 662 (1998) ). A hostile work environment claim under the MHRA is "concurrent with Title VII." Watt v. UniFirst Corp. , 969 A.2d 897 , 903 (Me. 2009). At issue now are whether the harassment was based upon sex and whether it was sufficiently severe or pervasive. Later, we discuss the bases for liability. 1

The district court concluded that a hostile work environment did not exist. 2 In ruling that much of the conduct Roy alleged was not based upon her sex and that the harassment she experienced was not sufficiently severe or pervasive, the district court applied an erroneous legal standard and also erroneously resolved material disputes of fact. See Roy , 321 F.Supp.3d at 166-68 .

Roy must show that a jury could find the harassment she experienced "was based in part on her" sex. Franchina v. City of Providence , 881 F.3d 32 , 54 (1st Cir. 2018). The district court erred when it suggested that Roy's sex must be the but-for cause or even the sole cause of each alleged harassing incident. Roy , 321 F.Supp.3d at 167 . The Supreme Court has squarely rejected these standards for hostile work environment claims. See Univ. of Texas Sw. Med. Ctr. v. Nassar , 570 U.S. 338 , 343, 133 S.Ct. 2517 , 186 L.Ed.2d 503 (2013) ("It suffices ... to show [on a hostile work environment claim] that the motive to discriminate was one of the employer's motives ...."); Price Waterhouse v. Hopkins , 490 U.S. 228 , 240, 109 S.Ct. 1775 , 104 L.Ed.2d 268 (1989) (plurality opinion) ("To construe the words 'because of' as colloquial shorthand for 'but-for causation' ... is to misunderstand them."). 3

*63 Much of the abuse Roy experienced was undoubtedly based on her sex: Turner made constant derogatory comments about women; DeGuisto pestered her for her phone number in Facebook messages and conveyed that Dever was spreading rumors that she had "fucked" everyone in the prison; 4 and Parrow sent her graphically sexual text messages. The district court erred in disregarding three other allegations that it viewed as insufficiently "connected to Roy's sex." Roy , 321 F.Supp.3d at 167 .

First, there is no doubt that a jury could find that Parrow calling Roy a "bitch" was connected to her sex. It does not matter whether Parrow was motivated by "anger resulting from the breakup of their previous romantic relationship," as the district court emphasized. Id. at 168 . To distinguish between harassment motivated by sex and harassment motivated by anger after a break up, as the district court did, "establishes a false dichotomy" between Roy's sex and Parrow's romantic interest in her, which are "inextricably linked." Forrest v. Brinker Int'l. Payroll Co. , 511 F.3d 225 , 229 (1st Cir. 2007). Regardless of Parrow's particular and subjective motives, "the use of sexually degrading, gender-specific epithets, such as ... 'bitch,' ... constitute[s] harassment based upon sex." Id.

Second, a reasonable jury could infer that the comment about Roy's "ass" was made in part because of her sex, given the context. See, e.g. , Tang v. Citizens Bank, N.A. , 821 F.3d 206 , 216 (1st Cir. 2016) (considering context, use of word "ass" was based on sex); McGullam v. Cedar Graphics, Inc. , 609 F.3d 70 , 85 (2d Cir. 2010) (Calabresi, J., concurring) (viewing comment by male co-worker about plaintiff's "big fat ass" to be based on sex). That context includes Turner, Parrow, and Dever sexualizing Roy and officers like Snow emphasizing aspects of her appearance, such as her blonde hair.

Third, it was error for the district court to hold at summary judgment that Roy's allegations of retaliatory conduct were not sex-based. A jury could find on one of several theories that officers put Roy at risk, treated her rudely, ignored her, demeaned her, and filed reports complaining about her not only because of her whistleblowing but also because of her sex.

A jury could see this degrading treatment as a form of sex-based discrimination. Responding disrespectfully or dismissively to women's requests, complaining about women's performance, and ignoring or ostracizing women are paradigmatic ways to communicate to women that they are less worthy than or less welcome than men in a workplace. See O'Rourke , 235 F.3d at 730 . Indeed, several of the remarks showed this sort of stereotyping (e.g., a woman's "job is to be at home"). A jury could also find that the retaliation was motivated in part by sex because it was *64 committed alongside overtly sexual harassment. See Marrero v. Goya of P.R., Inc. , 304 F.3d 7 , 20 (1st Cir. 2002) (considering sex-neutral conduct by a supervisor with his explicitly sexual conduct); Rosario v. Dep't of Army , 607 F.3d 241 , 248 (1st Cir. 2010) (similar); Kaytor v. Elec. Boat Corp. , 609 F.3d 537 , 548 (2d Cir. 2010) (justifying this inference). Roy alleges that Turner, Dever, Snow, and Parrow, retaliated against her after her whistleblowing while also directing at her blatantly sexual comments, rumors, jokes, and epithets. As the Equal Opportunity Employment Commission (EEOC), amicus here, urging reversal, says, "it is impossible to tease out" as a matter of law "how much of the officers' conduct was based solely on Roy's whistleblowing and how much was also infected with sex discrimination." This is an issue for the jury.

Severity and pervasiveness were also issues for the jury, and the district court erred in deciding as a matter of law that the conduct was neither severe nor pervasive. Roy , 321 F.Supp.3d at 168 . A plaintiff need only show that her work environment was severe or that it was pervasive, Burns v. Johnson , 829 F.3d 1 , 18 (1st Cir. 2016), and a jury could find for Roy on either theory, or on both.

On severity, a jury could find Turner's practice of abandoning his post so that Roy was left alone with inmates severe enough, on its own, to alter the terms and conditions of her employment. Turner was assigned to the medical clinic to protect Roy and the other medical staff from inmates who were considered dangerous, and his absences placed Roy at risk of serious physical harm. Conduct that places a plaintiff in this sort of peril is severe for purposes of a hostile work environment claim. See Patton v. Keystone RV Co. , 455 F.3d 812 , 818 (7th Cir. 2006) (holding that conduct that places the plaintiff in reasonable fear of serious physical harm suffices to show constructive discharge under Title VII, a more difficult showing than severity); see also, e.g. , Gerald v. Univ. of P.R. , 707 F.3d 7 , 18 (1st Cir. 2013) (finding physically threatening behavior severe); Harris , 510 U.S. at 23 , 114 S.Ct. 367 (including physically threatening behavior among indicators of a hostile work environment).

On pervasiveness, there is evidence that Roy was subjected to Turner's persistent derision and to several officers' "daily" retaliatory treatment, escalating from July to September of 2014. This environment was punctuated with the potentially humiliating episodes involving Dever and Parrow. A jury could reasonably view this as frequent abuse and as a pattern of hostility, rather than as intermittent, isolated harassment. See, e.g. , Tang , 821 F.3d at 217 (finding four incidents plus the plaintiff's allegation that the harassment occurred "[e]very time" the harasser "had a chance" could be pervasive); Flood v. Bank of Am. Corp. , 780 F.3d 1 , 13 (1st Cir. 2015) (describing treatment by multiple co-workers as a pattern of abuse); Hernandez-Loring v. Universidad Metropolitana , 233 F.3d 49 , 55 (1st Cir. 2000) (reversing entry of summary judgment on hostile work environment claim based on two incidents and allegation that plaintiff was "repeatedly asked [on] dates").

Finally, there is other evidence supporting Roy's claim of a hostile work environment. That officers complained about Roy and that she requested a transfer in mid-September could permit a jury to find that the harassment was "detract[ing] from [Roy's] job performance" and "discourag[ing] [her] from remaining on the job," both telltale signs of a "discriminatorily abusive" environment. Harris , 510 U.S. at 22 , 114 S.Ct. 367 .

*65 III.

A jury could find that Roy endured a hostile work environment, so we proceed to evaluate the liability of each defendant. We begin with the claims against MDOC, turn next to CCS, and finally to Ross and Bouffard.

A. Claims against MDOC under Maine Law

Roy alleges first that MDOC interfered with her MHRA-protected right to work free from sex discrimination in violation of MHRA § 4633(2). Second, she alleges that MDOC's revocation of her security clearance was an act of retaliation, unlawful under § 4633(1), for her MHRA-protected complaints about sexual harassment, about officers requesting inmate medical information made confidential by statute, about officers ignoring her requests to bring inmates to the clinic, about officers leaving her alone with potentially dangerous inmates, and about retaliation because of her reporting activity. 5

We address first whether § 4633 of the MHRA allows suits against non-employer third parties for discrimination that occurs in a workplace. 6 The district court concluded, relying on the Maine Law Court's decision in Fuhrmann v. Staples Office Superstore East, Inc. , 58 A.3d 1083 (Me. 2012), that the MHRA allows employment discrimination actions against employers only, and never against "non-employer entit[ies]" like MDOC. Roy , 321 F.Supp.3d at 164 . We disagree and hold, based on the text and history of § 4633, that the provision allows Roy's claims. 7

1. Section 4633

The text of § 4633 encompasses both of Roy's claims against MDOC. Section 4633 reads:

(1) Retaliation. A person may not discriminate against any individual because that individual has opposed any act or practice that is unlawful under this Act ....

(2) Interference, coercion, or intimidation. It is unlawful for a person to coerce, intimidate, threaten or interfere with any individual in the exercise or enjoyment of the rights granted or protected by this Act ....

Me. Rev. Stat. Ann. tit. 5, § 4633 (1)-(2). This language prohibits any "person" 8 from hindering -- by "[i]nterference, coercion, or intimidation" or by "[r]etaliation" -- the exercise of any "rights granted or protected" by the MHRA. Me. Rev. Stat. Ann. tit. 5, § 4633 .

*66 The legislative history of § 4633 also supports our reading. The Maine legislature's summary of § 4633 at its enactment states that the provision "makes clear that retaliation, interference, coercion and intimidation ... by any person because that individual engaged in activities related to rights protected by the [MHRA] is a violation of the Act." Me. Pub. L. 1993, ch. 303 § 3, Summary.

Further, Maine's Human Rights Commission (MHRC), the agency that administers the MHRA, has long interpreted § 4633 to allow claims like Roy's against third parties whose actions impair workers' MHRA-protected rights to be free from workplace discrimination. Indeed, in Maine Human Rights Comm'n v. Saddleback, Inc. , No. CV-06-219, 2008 WL 6875449 (Me. Super. Ct. Oct. 31, 2008), the Maine Superior Court agreed with the MHRC that Saddleback, a ski resort, violated § 4633 in demanding that a construction contractor fire one of its employees because the employee had reported safety violations at a Saddleback work site.

As Saddleback makes clear, there is a key distinction between § 4633 and § 4572, the MHRA provision that prohibits unlawful employment discrimination. Section 4572 addresses discriminatory conduct by an employer, or employees or agents of the employer, that occurs within the scope of a traditional employment relationship. Section 4633 targets actions by third parties (not the employer, its employees, or agents) that hinder employees' MHRA-protected rights to work free from discrimination.

MDOC argues and the district court agreed that the Law Court's decision in Fuhrmann precludes this reading of § 4633. Not so. In Fuhrmann , a Staples salesperson had her longstanding work hours changed after she reported possible tax fraud at her store. 58 A.3d at 1088 . She sued Staples and her individual supervisors, alleging retaliation under § 4572 of the MHRA for whistleblower activity defined in § 833(1)(A) of the Maine Whistleblower Protection Act (MWPA). Id. at 1088-89 . The Law Court dismissed the claims against the individual supervisors, holding that "[p]ursuant to either [the MHRA's or the MWPA's] statutory definition of 'employer,' there is no individual supervisor liability for employment discrimination." Id. at 1098 .

Fuhrmann does not control here. The issue before the Law Court there was individual supervisor liability for a claim under § 4572, and neither Fuhrmann 's holding nor its reasoning translate to cases like this one involving third-party liability under § 4633. Fuhrmann never mentioned § 4633, and several significant differences between § 4572 and § 4633 undercut MDOC's argument that Fuhrmann 's holding extends to bar Roy's claims. First, § 4572 prohibits discrimination by an "employer," and what Fuhrmann interpreted was the MHRA's definition of that term. 58 A.3d at 1094 . In contrast, § 4633 prohibits discrimination by any "person." Second, § 4633 appears in the miscellaneous section of the MHRA, while Fuhrmann interpreted provisions in the MHRA's employment discrimination section. Third, the provisions have different histories, and the enactment of § 4633 more than twenty years after § 4572 is a strong indication that the provisions have different intents.

Nevertheless, the district court reasoned that allowing Roy's § 4633 suit "contradicts Fuhrmann 's central rationale -- that the MHRA intends to hold employers liable for employment discrimination." Roy , 321 F.Supp.3d at 163 . But Fuhrmann assessed only whether the legislature intended to allow suits against individual supervisors, not what it intended about suits against non-employer third parties. To the *67 Fuhrmann court, the MHRA's incorporation of vicarious liability indicated a legislative intent to hold employers, but not supervisors as individuals, liable for supervisors' discriminatory conduct. Fuhrmann , 58 A.3d at 1097 ; see also Me. Rev. Stat. Ann. tit. 5, § 4553 (10)(E) (discussing vicarious liability). But vicarious liability is not relevant to claims like Roy's against third parties not alleged to be agents of the employer. Similarly, Fuhrmann concluded that the remedies listed in the remedial provision that applies to both § 4572 and § 4633 violations were difficult to apply "to individual supervisors in practice." 58 A.3d at 1098 . Fuhrmann said nothing about the application of the listed remedies to third-party entities and did not explore the remedial provision's prefatory statement that "remedies may include, but are not limited to" those listed. Me. Rev. Stat. Ann. tit. 5, § 4613 (2)(B). The district court erred in holding that Fuhrmann bars Roy's claims against MDOC.

2. MDOC's Alternative Argument for Summary Judgment

MDOC also argues that Roy has not offered evidence sufficient to push her § 4633 interference and retaliation claims past summary judgment. MDOC is plainly wrong.

First, on the § 4633(2) interference claim, MDOC contends only that we may affirm the grant of summary judgment because there was no hostile work environment. But, as explained, a reasonable jury could conclude that Roy was subjected to a hostile work environment because of her sex in violation of the MHRA's protections against "unlawful employment discrimination." See Me. Rev. Stat. Ann. tit. 5, § 4572 (1)(A).

Second, because we reject MDOC's arguments that Roy's conduct was not protected activity under the MHRA and the MWPA and that it had non-pretextual reasons for revoking her security clearance, Roy's retaliation claim may go to the jury. MDOC says that the facts show that Roy did not engage in protected activity. But, with respect to Roy's complaints about the hostile work environment, MDOC appears to contend only that the reports are not protected because the evidence did not suffice to show that the work environment was hostile on the basis of sex. That contention is mistaken. Similarly, as we will explain with respect to CCS's liability under the MWPA, the arguments advanced by CCS and, by reference, MDOC, do not preclude Roy's other complaints from being found to be protected whistleblower activity because they relate to potential violations of medical privacy laws, as well as to health and safety risks at the prison. See id. § 4572(1) (making unlawful discrimination based on whistleblower activity); Me. Rev. Stat. Ann. tit. 26, § 833 (1)(A)-(B) (defining protected whistleblower activity as reporting "a violation of a [state or federal] law or rule" or "a condition or practice that would put at risk the health or safety of ... [an] individual.").

MDOC next argues that Roy cannot show that MDOC's stated reasons for revoking the security clearance -- Roy's statements about and her failure to file a report on the September 26 incident -- were pretext for retaliation. But, based on numerous facts, of which we mention only a few, a jury could conclude that those reasons were pretext. A jury could credit Ross's statements that he was frustrated about Roy's involvement in so many investigations and that he wanted to "gate-close" Roy. And, even if the jury were to credit MDOC's stated reasons over Ross's statements, a jury could find that Roy's actions did not jeopardize the security of *68 the prison and could not justify, on their own, the revocation of her clearance.

Further, there is the glaringly differential treatment of Roy and Reed-Chapman. Although Reed-Chapman, who had never complained before, also told the captain that she and Roy were unattended for approximately fifteen minutes, and then put that impression in writing, in an Incident Report, MDOC did not revoke Reed-Chapman's security clearance. Reed-Chapman did file a report, as the captain had requested. But a jury could believe Roy's assertion that she had been told that Ross did not want her to file more reports. Or, a jury could decide that MDOC did not actually need a report from Roy once it had Reed-Chapman's.

In sum, Roy's § 4633 interference and retaliation claims can proceed to trial.

B. Claims against CCS under Title VII and Maine Law

Roy has also produced sufficient evidence for her sexual harassment and retaliation claims against CCS to reach a jury.

1. Hostile Work Environment Claims against CCS

An employer like CCS can be liable for a hostile work environment created by third parties like MDOC's employees. See Medina-Rivera v. MVM, Inc. , 713 F.3d 132 , 137 (1st Cir. 2013) ; Rodriguez-Hernandez v. Miranda-Velez , 132 F.3d 848 , 854-55 (1st Cir. 1998) (using ratification theory); see also, e.g. , Gardner v. CLC of Pascagoula, LLC , 894 F.3d 654 , 657 (5th Cir. 2018) ("Because the ultimate focus of Title VII liability is on the employer's conduct[,] ... nonemployees can be the source of the harassment."); Beckford v. Dep't of Corr. , 605 F.3d 951 , 957 (11th Cir. 2010) ("It is well established that employers may be liable for failing to remedy the harassment of employees by third parties who create a hostile work environment."). 9 In these situations, a finding that the harassment was so severe or pervasive as to alter the terms and conditions of the plaintiff's employment is not by itself enough to make the employer liable. Liability for a discriminatory environment created by a non-employee "depends on whether the employer knew or should have known of the hostile work environment and took reasonable measures to try to abate it." Gardner , 894 F.3d at 663 ; see also, e.g. , Freeman v. Dal-Tile Corp. , 750 F.3d 413 , 423 (4th Cir. 2014) (holding that employer liability depends on employer knowledge and whether the employer response was "reasonably calculated to end the harassment" (internal quotation marks omitted) ). Circuit courts addressing the issue of employer liability for third-party harassment have uniformly applied this rule. 10

*69 The district court never discussed whether there was a basis for CCS's liability under Title VII and the MHRA, and CCS does not argue on appeal that there is no legal basis. 11 We consider the issue, however, because of the unique nature of Roy's workplace, where workers employed by multiple entities shared a worksite that did not belong to Roy's employer and where the organizational relationships afforded non-employers influence over employment conditions and decisions. See Dallan F. Flake, Employer Liability for Non-Employee Discrimination , 58 B.C. L. Rev. 1170 , 1178-81 (2017) (stating that such organizational complexity is increasingly common and analyzing the implications for third-party harassment claims).

Many third-party harassment cases involve less complex arrangements: common are cases involving retail customers or healthcare facility patients who harass employees at a store or healthcare facility operated by the employer. See, e.g. , Lockard v. Pizza Hut, Inc. , 162 F.3d 1062 , 1067 (10th Cir. 1998) (customers); Gardner , 894 F.3d at 657 (patient). But those cases do not purport to limit an employer's duty to those situations. In our view, the duty to try to protect employees from sexual harassment exists in other environments, even in environments that are, like MDOC's prison, "inherently dangerous" and difficult to control. Freitag v. Ayers , 468 F.3d 528 , 539 (9th Cir. 2006) ("[E]ven in an inherently dangerous working environment, the focus remains on whether the employer took reasonable measures to make the workplace as safe as possible." (quotation marks omitted) ); see also Beckford , 605 F.3d at 958-59 ; Gardner , 894 F.3d at 663-64 (applying this to nursing homes with diminished-behavioral-capacity patients). CCS had an obligation to try to protect Roy from a hostile work environment, and the reasonableness rule consistently applied in third-party harassment claims is adequate to account for the complexities of her workplace. 12 Cf. Beckford , 605 F.3d at 959 (holding this test adequate to account for the complexities of a work environment in a prison).

Ultimately, a jury must decide Roy's hostile work environment claims against CCS. CCS plainly knew of the harassment. 13 The reasonableness of CCS's response is an issue for the jury. Although CCS did not employ the corrections officers or manage the prison, CCS was not helpless to influence the officers, their supervisors, or the operation of the prison's medical facility. CCS had formal and informal mechanisms for raising Roy's complaints and for pressing for remedies. This influence over the environment and the officers is evident in instances when MDOC responded to CCS's efforts by investigating and acting, as with Parrow. But CCS did not always use the available mechanisms. It forwarded some but not all of Roy's complaints. And when MDOC's responses were dismissive or inadequate, *70 CCS often did nothing. Even when Roy's physical safety was threatened by Turner's and King's absences from the clinic when inmates were present, CCS either did not refer Roy's complaints or accepted MDOC's inaction or arguably inappropriate responses, without question. See Lockard , 162 F.3d at 1075 (finding basis for liability in part on employer's failure to address a "potentially dangerous situation" created by nonemployees). To give just one example, there is no evidence that CCS suggested steps like reassigning Turner, disciplining him, or adding additional layers of security. See Beckford , 605 F.3d at 959-60 (identifying possible measures for mitigating harassment of corrections officers by inmates); Gardner , 894 F.3d at 663 (giving examples of mitigation sufficient to avoid liability in a case of harassment by a nursing home patient).

Apart from what CCS did or could have done to influence MDOC is the issue of what CCS could have done on its own. A jury could see as unreasonable CCS's changing story about and seeming failure to consider an obvious mitigating measure, and one requested by Roy -- a transfer.

Entry of summary judgment was error. Roy's hostile work environment claims against CCS should go to a jury.

2. Retaliation Claims against CCS

In granting summary judgment for CCS on Roy's retaliation claims under Title VII and Maine law, the district court ruled that Roy's complaints were not protected activity because, in its view, CCS lacked "the ability and authority to correct" the complained-of violations. Roy , 321 F.Supp.3d at 169 . We reverse, for errors of law and fact, addressing first the claims under Title VII and the MHRA that CCS retaliated against Roy for complaints about the hostile work environment and second the whistleblower retaliation claim under the MHRA and the MWPA.

a. Title VII and MHRA Retaliation

The Maine case relied on by the district court for its definition of protected activity, Hickson v. Vescom Corp. , 87 A.3d 704 (Me. 2014), interpreted § 833(2) of the MWPA, and does not define protected activity for Roy's Title VII or MHRA claims. See 87 A.3d at 710 (citing Me. Rev. Stat. Ann. tit. 26, § 833 (2) ). Under both Title VII and the MHRA, a jury could find that Roy's complaints were protected because they reported activity that she had a reasonable, good faith belief violated those statutes. See Fantini v. Salem State Coll. , 557 F.3d 22 , 32 (1st Cir. 2009) (citing 42 U.S.C. § 2000e-3 ).

CCS does not defend the district court's rationale. It urges us to affirm the entry of summary judgment on the grounds that Roy cannot show that her complaints were what caused her termination and cannot show that CCS's neutral reason for firing her -- MDOC's revocation of the security clearance -- was pretext. Factual disputes here require a jury to decide causation and pretext. 14

The causation element of a Title VII retaliation claim is not satisfied by evidence that retaliation was one motivating factor in the adverse action. See Nassar , 570 U.S. at 362-63 , 133 S.Ct. 2517 . Instead, Roy must show "but-for" causation -- that is, that she "would not have [been terminated] in the absence of the" protected complaints.

*71 Id. at 360 , 133 S.Ct. 2517 . Emphasizing this standard, CCS argues that the revocation of the clearance was the sole but-for cause of Roy's termination.

Factual disputes preclude summary judgment on this theory of causation. To start, CCS and Roy dispute whether the revocation of the security clearance meant that CCS could no longer employ Roy. If CCS could have transferred Roy to one of its other facilities in Maine, as Roy says, then a jury could find that retaliatory animus was a but-for cause of CCS's decision to fire her rather than transfer her. Significantly, CCS has not produced evidence that a transfer was impossible. CCS does not even deny that a transfer was possible, emphasizing instead that the burden was on Roy to ask about other positions. But Roy did so, in mid-September.

Alternatively, a jury could conclude that MDOC's retaliatory animus caused the revocation of the security clearance and, in turn, caused Roy's termination. A third party's retaliatory or discriminatory animus can cause an employer's adverse action where, as a jury might find here, the employer knew that animus motivated the third-party's actions or demands and simply accepted those actions or demands. Cf. Rodriguez-Hernandez , 132 F.3d at 854-55 (holding that customers' discriminatory preferences, where ratified by the employer, can cause Title VII discrimination); Tamosaitis v. URS Inc. , 781 F.3d 468 , 482-83 (9th Cir. 2015) (holding that client's demand to remove a whistleblowing employee from a project caused employer's adverse action under an analogous statute).

Similar facts would permit a jury to find that CCS's stated reason was pretext for a retaliatory motive. See Billings v. Town of Grafton , 515 F.3d 39 , 55 (1st Cir. 2008) (quoting Hodgens v. Gen. Dynamics Corp. , 144 F.3d 151 , 168 (1st Cir. 1998) ) (explaining that pretext can be shown through facts that expose "weaknesses, implausibilities, inconsistencies, incoherencies, or contradictions in the employer's proffered legitimate reasons"). We mention just a few. The facts about the possibility of transfer weaken CCS's insistence that the security clearance was the sole and actual reason for the firing. That CCS put Roy on leave (telling her it was temporary) immediately after the September 26 meeting, a week before the clearance was revoked and her employment was terminated, could undermine CCS's claim that it harbored no desire to retaliate. Or a jury could infer from CCS's failure to discipline Reed-Chapman that CCS did not find discipline-worthy the conduct that MDOC says led to the revocation of Roy's clearance. Yet CCS did not try to stop MDOC from using that conduct to "gate-close" Roy. To the contrary, CCS immediately, and apparently without question, fired Roy once she lost her clearance. A jury should evaluate the issue of pretext.

b. Whistleblower Retaliation

A jury should also decide Roy's whistleblower retaliation claim. As just discussed, whether Roy's complaints caused her termination and whether CCS's stated reason is pretext are triable issues. The jury, if it sees a need to, can tease apart the effects of the two sets of complaints -- those about sexual harassment and those about officers leaving Roy alone with inmates, asking for confidential inmate medical information, and refusing to bring inmates to the clinic.

Further, a jury could deem Roy's whistleblowing complaints protected activity, as they relate to potential violations of medical privacy laws and to health and safety risks at the prison. See id. § 4572(1) (making unlawful discrimination based on protected whistleblower activity);

*72 Me. Rev. Stat. Ann. tit. 26, § 833 (1)(A)-(B) (defining protected whistleblower activity as reporting "a violation of a [state or federal] law or rule" or "a condition or practice that would put at risk the health or safety of ... [an] individual."). The district court erred in ruling that Roy's complaints were unprotected because CCS lacked, under Hickson , "the ability and authority to correct" the complained-of violations. Roy , 321 F.Supp.3d at 169 (quoting Hickson , 87 A.3d at 711 ).

CCS argues, following the district court's reading, that Hickson , and the MWPA provision it interpreted, require evidence of direct authority to correct the violations, as the employee in Hickson , who complained about safety at a mill, was employed by the company directly responsible for mill safety. 87 A.3d at 711 . Yet Hickson nowhere limited its interpretation of § 833(2) to those facts. Nor does the language of the provision suggest that the employer's corrective authority must be direct. It states that whistleblower protection applies to an employee who "has first brought the alleged violation, condition or practice to the attention of a person having supervisory authority with the employer and has allowed the employer a reasonable opportunity to correct that violation, condition or practice." Me. Rev. Stat. Ann. tit. 26, § 833 (2). We see no reason why a jury could not find "ability and authority to correct," Hickson , 87 A.3d at 711 , even if that control is indirect. We have already established that CCS had both formal and informal mechanisms for influencing MDOC, its officers, and the operation of the prison. Roy's whistleblower retaliation claim should go to the jury.

C. Claims against Ross and Bouffard under § 1983

Roy alleges that Bouffard and Ross, the top prison officials, failed to stop prison staff from sexually harassing her in violation of the Equal Protection Clause 15 and that Bouffard and Ross revoked her security clearance because of her complaints, in violation of the First Amendment. Qualified immunity protects Ross and Bouffard from suit because reasonable officials could have believed "on the[se] facts" that no equal protection or First Amendment violation occurred. 16 Dirrane v. Brookline Police Dep't , 315 F.3d 65 , 69 (1st Cir. 2002).

Supervisors like Ross and Bouffard are liable under the Equal Protection Clause for a hostile work environment created by their subordinates in state government only if their "link" to the unlawful harassment was one of " 'supervisory encouragement, condonation, or acquiescence,' or 'gross negligence amounting to deliberate indifference.' " Lipsett v. University of Puerto Rico , 864 F.2d 881 , 902 (1st Cir. 1988) (quoting Bohen v. City of East Chicago , 799 F.2d 1180 , 1189 (7th Cir. 1986) ). Two First Circuit cases apply this principle. In the single case finding supervisory liability under § 1983 for sexual harassment, the defendants knew of severe abuse but failed even to investigate. See id. at 890-93, 907. In the other case, which found no supervisor liability, the *73 defendant, the harasser's supervisor, at first discouraged the plaintiff from filing a formal complaint but then actively encouraged her to do so. See Sanchez v. Alvarado , 101 F.3d 223 , 225, 228-29 (1st Cir. 1996). Ross and Bouffard's conduct falls somewhere between these guideposts. Complaints against Snow and Parrow were investigated and addressed while complaints about Turner, DeGuisto, and officers' retaliatory behavior were not. "[A]s is common where there is a lack of precedent, this is not a case in which a reasonable officer must have known that he was acting unconstitutionally." Dirrane , 315 F.3d at 71 (footnote omitted).

Ross and Bouffard also receive qualified immunity from the First Amendment retaliation claim because reasonable officials could have believed that revoking Roy's security clearance would not violate the Constitution. To show a First Amendment violation, one thing Roy must demonstrate is that she was speaking as a private citizen on a matter of public concern. 17 Complaints like Roy's made to supervisors and public officials about sexual harassment and safety at public agencies can be protected citizen speech on matters of public concern. See, e.g. , Baron v. Suffolk Cty. Sheriff's Dep't , 402 F.3d 225 , 233 (1st Cir. 2005) (upholding a jury verdict on a First Amendment claim by a corrections officer who had complained internally about discrimination and operation of a prison); Campbell v. Galloway , 483 F.3d 258 , 270 (4th Cir. 2007) (holding that police officer's letter to police chief about sexual harassment was protected by the First Amendment). But we cannot say that a reasonable official must have known that Roy's complaints were constitutionally protected. Significantly, Roy only complained internally. And, although the Supreme Court has established that form is never "dispositive" of the public concern question, Garcetti v. Ceballos , 547 U.S. 410 , 420, 126 S.Ct. 1951 , 164 L.Ed.2d 689 (2006), it has sometimes seen a plaintiff's failure "to inform the public" about her concerns as cutting against First Amendment protection, Connick v. Myers , 461 U.S. 138 , 148, 103 S.Ct. 1684 , 75 L.Ed.2d 708 (1983) ; see also, e.g. , City of San Diego v. Roe , 543 U.S. 77 , 84, 125 S.Ct. 521 , 160 L.Ed.2d 410 (2004) (per curiam). Reasonable officials in Ross and Bouffard's positions, then, could have deemed Roy's complaints unprotected. As a result, even if Roy could ultimately make out a First Amendment violation, the defendants receive qualified immunity.

IV.

We reverse summary judgment for MDOC and CCS and affirm summary judgment for Ross and Bouffard. Costs are awarded to Roy.