Appeal from the United States District Court for the Central District of California D.C. No. 2:08-cr-01356-AJW-1 Andrew J. Wistrich, Magistrate Judge, Presiding
The opinion of the court was delivered by: M. Smith, Circuit Judge:
April 13, 2012-Pasadena, California
Before: Andrew J. Kleinfeld and Milan D. Smith, Jr., Circuit Judges, and Janis L. Sammartino, District Judge.*fn1
Opinion by Judge Milan D. Smith, Jr.
Defendant-Appellant Huping Zhou, a former research assistant at the University of California at Los Angeles Health System (UHS), accessed patient records without authorization after his employment was terminated. In an information, the government charged him with violating the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which imposes a misdemeanor penalty on "[a] person who knowingly and in violation of this part . . . obtains individually identifiable health information relating to an individual[.]" 42 U.S.C. § 1320d-6(a)(2) (emphasis added). Zhou moved to dismiss the information because it did not allege that Zhou knew that the statute prohibited him from obtaining the health information. The district court denied the motion to dismiss. Zhou entered a conditional guilty plea, reserving the right to appeal the denial of his motion to dismiss.
We have jurisdiction under 28 U.S.C. § 1291, and we affirm the district court because the plain text of Section 1320d-6(a)(2) is not limited to defendants who knew that their actions were illegal. Rather, the misdemeanor applies to defendants who knowingly obtained individually identifiable health information relating to an individual, and obtained that information in violation of HIPAA.
FACTUAL AND PROCEDURAL BACKGROUND
Zhou was hired as a research assistant in rheumatology at UHS on February 2, 2003. On October 29, 2003, UHS issued Zhou a notice of intent to dismiss due to "continued serious job deficiencies and poor judgment." On November 12, 2003, after a formal internal grievance hearing, Zhou received a dismissal letter effective November 14, 2003.
After his termination on November 14, 2003, there were at least four instances, on November 17 and 19, in which Zhou accessed patient records without authorization. The information charged Zhou with crimes only for accessing patients' medical information after he was terminated and no longer treating patients at the hospital.
HIPAA provides that: "[a] person who knowingly and in violation of this part - (1) uses or causes to be used a unique health identifier; (2) obtains individually identifiable health information relating to an individual; or (3) discloses individually identifiable health information to another person, ...