The ten-or-more victim enhancement for use rejected where information only sold not used

Corbett and Weaver worked at Florida Hospital near Orlando Florida. When Weaver held the position of release of information specialist he would download patients’ face sheets containing their name, health information, date of birth and social security number without authority to do so and sold them to coconspirators who, the government believed, intended to use the information to open credit card accounts and commit identity fraud.   Corbett took over Weaver’s position as release of information specialist, he solicited her to obtain face sheets without authority and paid her for each assisting him obtain the information. Both were charged with conspiracy to obtain identifiable health information for commercial advantage and pleaded guilty.

The probation officer that calculated the sentencing guidelines recommended a two level enhancement for an offense that involve 10 or more victims under 2B1.1. the probation officer also calculated the Florida Hospital’s loss on costs associated with identifying and notifying patients whose individually identifiable health information was viewed without authorizations. This resulted in a 10 level enhancement. At sentencing the defendant objected to the loss amount on the grounds that the Florida Hospital’s expenses should have been excluded as cost incurred by victims primarily to aid the government in the prosecution and criminal investigation of the offense. She objected to the 10 or more victim enhancement on the grounds that the government only identified a handful at most who suffered any identifiable financial harm as a result of the conspiracy. The district court denied both objections.

The court of appeal reversed the 10 or more victim enhancement on plain error grounds because the district court did not find any victims beside Florida Hospital had suffered any actual loss or that anyone sustained bodily injury due to the offense. Under the definition for a victim under the sentencing guidelines in a case involving means of identification, a victim is any individual whose means of identification was used unlawfully or without authority. Only the Florida Hospital qualified as a victim.

The sentencing court erred when it counted all 1,700 individuals whose face sheets were compromised because the government did not prove that all of their means of identification had been used within the meaning of the relevant definition. The court applied the plain error standard because the federal criminal defense attorney did not preserve the issue for appeal. The court rejected the government’s argument that each patient was a victim because the defendant sold their information. It found that mere sale or transfer of a means of identification does not constitute its use based on the plain meaning of the words of the guidelines.

The appeals court also found there was a reasonable probability that the district court’s error affected Corbett’s sentence. Even though the district court varied downward from its calculated sentencing range, its sentencing decision remained tethered to what it believed was the correct range. As for the loss amount issue, the court found rejected Corbett’s argument that she should be only responsible for her actions. The argument that was not raised at the sentencing and was not properly raised as a distinct argument on appeal was that she should not be responsible for data breaches before she took over the job.