From U.S. v. Russell, decided Tuesday by Fourth Circuit Chief Judge Albert Diaz, joined by Judges Robert King and Stephanie Thacker:
Before Supreme Court Justice Ruth Bader Ginsburg passed away, … [i]n January 2019, employees at George Washington University Hospital discovered a Twitter post that revealed information about Justice Ginsburg’s recent visits to the hospital. The post contained a screenshot of the hospital’s patient search screen, which highlighted Justice Ginsburg’s name and showed the dates of ten visits, along with medical services she received (which included radiology, oncology, and surgery services)….
Law enforcement later learned that before circulating on Twitter, the screenshot was posted on the anonymous message board 4Chan. It appeared on a thread titled “Politically Incorrect,” where users promoted a conspiracy theory that Justice Ginsburg had died and prominent Democrats were covering up her death.
The hospital’s Chief Information Officer, Nathan Read, investigated the leak. He obtained search logs for anyone who had used the hospital’s system to look for patients with last names starting with “Ginsb” in the relevant time frame….
Read’s … search parameters revealed that a non-hospital issued device, operating under Russell’s username, searched for “Gins” on January 7, 2019. That search was sandwiched between two others. Seconds before, the same device searched for “Barker,” and seconds after, it searched for “Ginston.” Barker was a hospital patient, but the hospital had no record of ever serving someone with the last name Ginston.
After concluding its investigation, the hospital deactivated Russell’s account, notified his employer, and gave Harlow’s and Russell’s names to law enforcement….
Federal Agents Mosi Forde and Chris Lalonde interviewed Russell at work. The CEO of Russell’s company, Lori Brigham, sat in on the interview “because she was concerned about the case and interested in the outcome.” Neither Forde nor Lalonde had asked her to attend. Brigham remained silent during the interview, except to once “wonder[ ] aloud what sensitive information could be derived from simply searching someone’s name.”
The agents told Russell that the interview was voluntary, he was free to leave at any time, and he could decline to answer any questions. According to Forde, Russell’s “affect was pleasant and measured” during the interview, and he “appeared to be under no apparent duress.”
The agents showed Russell the relevant search logs. He confirmed that the credentials used for the searches belonged to him. Russell also admitted that he’d run the search for “Barker,” who was his patient. But Russell denied searching for “Gins” and “Ginston.” {At trial, the government argued that Russell searched for “Ginston” to conceal that he was looking for Justice Ginsburg’s health records.}
When asked what “Gins” stood for, Russell said that “if he had to take a guess, it was Justice Ginsburg.” The agents hadn’t yet mentioned the Justice’s name in the interview. Russell also “guessed” that the agents were speaking with him “because someone had taken a screenshot of Justice Ginsburg’s medical record.”
Russell insisted that he didn’t know how his credentials had been used to run the “Gins” and “Ginston” searches. But he theorized that “potentially his cat had run across the keyboard and typed in those letters.” He also suggested that the searches could be typos or that a coworker may have used his login information….
Russell was prosecuted, and convicted of “destroying and altering records, and … obtaining individually identifiable health information,” and acquitted “of disclosing individually identifiable health information.” He was sentenced to 2 years in prison.
The court concluded there was enough evidence to sustain the conviction:
The jury convicted Russell under 42 U.S.C. § 1320d-6(a)(2), which prohibits “obtain[ing] individually identifiable health information relating to an individual.” This includes any information that
(A) is created or received by a health care provider … and
(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—
(i) identifies the individual; or
(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
A person violates the statute “if the information is maintained by a covered entity … and the individual obtained … such information without authorization.” Healthcare providers like George Washington University Hospital are covered entities….
Russell argues that the information about Justice Ginsburg in the screenshot doesn’t qualify as “individually identifiable health information.” Although he admits the screenshot showed that the Justice received medical care from the hospital, Russell asks us to limit the statute’s application to individuals who obtain “information about [a patient’s] specific health conditions,” such as “details about the [patient’s] particular physician and type of treatment.” In Russell’s view, because the screenshot didn’t disclose the precise nature of Justice Ginsburg’s illness or the names of her doctors, it can’t serve as the basis for his conviction.
We reject this crabbed view of the statute. The screenshot identified the Justice by name and disclosed where she was being treated, her arrival and discharge dates, and the medical services provided, which included radiology and oncology services. As a witness testified, this information revealed that Justice Ginsburg “had been receiving treatment from [the hospital] for various things related to cancer seemingly since at least 2014.”
This information falls well within the heartland of the conduct the statute is aimed at because it “relates to the past … health or condition of an individual, [and] the provision of health care to an individual.” To hold otherwise would flout the spirit of the law. At the very least, a reasonable juror could accept that the screenshot contained personal health information sufficient to support a conviction under § 1320d-6(a)(2).
And the court held that the CEO’s presence during the interview didn’t make Russell’s statements to law enforcement “involuntary” for legal purposes and thus inadmissible:
[T]he district court didn’t say that implied threats to employment can never be coercive. It simply found that there was no such threat here. Russell didn’t identify a case where “the mere presence of the employer or the CEO [in a conversation with law enforcement] could be construed as a threat, implicit or explicit.” …
The district court concluded that “there’s nothing in the record that suggests that the interaction between the agents and [Russell] involved coercive police activity, either in the words that were spoken or in their actions[,]” [because] … (1) Russell was an English-speaking adult with higher education; (2) law enforcement questioned him in a conference room with windows and at least one unlocked door; (3) the agents told Russell that he “was free to leave at any time, [and] that the interview was voluntary”; (4) the agents didn’t brandish weapons or any other indicia of force or coercion; (5) Russell “felt free to admit certain inculpatory evidence”; and (6) the agents hadn’t asked the CEO to attend the interview.
Given these findings, the CEO’s presence (without more) doesn’t rise to the level of coercive police activity. So the district court correctly denied the motion to suppress.
Lauren Nicole Beebe and Zoe Bedell represent the government.
