Ninth Circuit Holds that Knowledge of HIPAA Is Not Necessary for Criminal Conviction


[author: Adam H. Greene]

On May 10, 2012, the United States Court of Appeals for the Ninth Circuit held that an individual may be criminally convicted of knowingly obtaining health information in violation of HIPAA, even if the individual did not know that the access was illegal. The decision serves as a reminder to health care providers, health plans, and their business associates that ignorance of the law is not an excuse to criminal prosecution with respect to HIPAA, and that significant repercussions may result from accessing patient information without a valid reason.

Davis Wright Tremaine did not handle this case and the following account was drawn from public records. The case involves Huping Zhou, a former research assistant at University of California at Los Angeles Health System (UCLA). UCLA terminated Zhou, effective Nov. 14, 2003. After his termination, Zhou looked up patient records of celebrities and co-workers on at least four separate occasions. The U.S. Attorney’s Office for the Central District of California brought criminal charges for a misdemeanor violation of HIPAA’s prohibition of “knowingly” obtaining individually identifiable health information in violation of HIPAA. Zhou filed a motion to dismiss on the grounds that he did not know it was illegal to obtain the health information and, therefore, did not act “knowingly.” The magistrate judge dismissed Zhou’s motion, and Zhou then submitted a conditional guilty plea, reserving the right to appeal the dismissal. The trial court sentenced Zhou to four months in prison, a $2,000 fine, and a $100 special assessment.

The Ninth Circuit affirmed the denial of Zhou’s motion to dismiss, finding that, with respect to the criminal HIPAA statute, “knowingly” applies only to the act of obtaining health information (knowledge of the law is irrelevant). This case has significant relevance to covered entities and business associates in that it sets a relatively low bar on what conduct may be deemed a criminal violation of HIPAA.

One potential benefit of this case to covered entities and business associates is that it can be used as a teaching moment, to remind employees that fates even worse than termination (such as criminal prosecution) can result from viewing medical records to satisfy curiosity or for other impermissible reasons.


Written by:


Davis Wright Tremaine LLP on:

Popular Topics
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.