## Facts

- Huping Zhou worked as a research assistant at the UCLA Health System (UHS).
- UHS terminated Zhou effective November 14, 2003, after documenting job deficiencies.
- After termination, Zhou accessed UHS patient records multiple times without authorization, including at least four instances on November 17 and 19.
- The government charged Zhou by information with misdemeanor violations of HIPAA, 42 U.S.C. § 1320d-6(a)(2), for knowingly obtaining individually identifiable health information.
- Zhou did not dispute that he accessed the records or that they contained individually identifiable health information; he contested the statute’s required mental state.

## Issues

1. Whether 42 U.S.C. § 1320d-6(a)(2) requires proof that the defendant knew his obtaining of health information was illegal (i.e., knew it was “in violation of” HIPAA), or only that he knowingly obtained the information and that the obtaining in fact violated HIPAA.

## Decision

- The Ninth Circuit affirmed the denial of Zhou’s motion to dismiss the information and affirmed the judgment of conviction.
- The court held that § 1320d-6(a)(2) does not require the government to prove the defendant knew his conduct violated HIPAA.
- The statute requires (1) a knowing acquisition of individually identifiable health information and (2) that the acquisition was, as a matter of law, in violation of HIPAA.
- Because Zhou’s challenge went only to the indictment’s failure to allege knowledge of illegality, the information was not defective.

## Legal Principles

- Under 42 U.S.C. § 1320d-6(a), “knowingly” modifies the prohibited acts (use, obtain, disclose) rather than the phrase “in violation of this part.”
- The conjunction “knowingly and in violation of this part” sets out two distinct requirements: a knowing act and an actual violation of HIPAA.
- Congress’s use of “knowingly,” rather than “willfully,” indicates no requirement that the defendant knew the legal status of the conduct.
- When statutory text is unambiguous, the rule of lenity does not apply to add a higher mens rea requirement.

## Conclusion

The Ninth Circuit held that HIPAA’s misdemeanor provision for obtaining individually identifiable health information punishes intentional acquisition that, in fact, violates HIPAA, without requiring proof that the defendant knew the conduct was unlawful.


United States v. Zhou, 678 F.3d 1110 (9th Cir. 2012)