In a case of first impression, the Eleventh Circuit was asked to determine who is considered an identity theft victim. Those whose information was used, not merely sold, are victims, the three-judge panel held.

Given the novelty of the case, the court’s decision could have ripple effects across the country on how courts sentence identity thieves.

Erica Hall, an office assistant at a Coral Springs gynecological and obstetric practice, used her position to lift information protected by the Health Insurance Portability and Accountability Act, more often referred to as HIPPA, in exchange for money.

In the course of her employment, Hall had access to patient names, dates of birth, Social Security numbers and medical information. All told, Hall sold 141 patients’ sensitive information, which was clearly meant to be shrouded by HIPPA.

The scheme was simple.

Hall texted patient information to Rufus Bethea or Bianca Cook, who would forward it to Courtney Gissendanner. For her part, Hall was supposed to be paid $200 for each patient profile. Hall’s cut jumped to $1,000 for each patient profile that could be used to open a fraudulent credit card account.

That was the extent of Hall’s role in the conspiracy. Others down the line would then use the credit cards to obtain cash advances and to make fraudulent purchases. Of the 141 patients whose identities were compromised, 12 fake accounts were created.

Hall was charged and soon after pled guilty to conspiracy to commit bank fraud, conspiracy to commit identity theft and access device fraud, and wrongfully obtaining and transferring individually identifiable health information for personal gain.

Her case got more complicated at sentencing.

The federal sentencing guidelines put Hall’s base offense level at seven. After accounting for factors increasing or decreasing her base, Hall’s level was adjusted to 18. In other words, she was staring down 27 to 33 months of incarceration. The district court varied downward and gave her 14 months instead based on her background.

But one of the enhancements the district court applied was based on the number of victims. Instead of a two-level enhancement for more than 10 but less than 50 victims, she was subjected to a four-level enhancement for more than 50 but less than 250 victims. Hall appealed.

The Eleventh Circuit had to decide how many patients were Hall’s victims — 12 or 141.

One definition of a victim is a person who sustained any part of the actual loss or who sustained bodily injury. The other definition of a victim is any person whose means of identification was used unlawfully or without authority.

There was no question 12 of the patients were victims by virtue of having their identification used to open the accounts. On the other hand, it wasn’t clear whether the remaining patients were.

The court distinguished the plain meaning of the term "used" from that of "transfer." The former connotes action and implementation, whereas the latter involves a change in possession or control.

Writing for the three-judge panel, Chief Judge Joel F. Dubina reasoned, "Hall’s sale of the unauthorized identifying information to her co-conspirators did not implement the purpose of the conspiracy. Hall’s mere transfer of the personal identifying information, without more action, did not employ that information for the purpose for which the conspiracy was intended — the procurement of fraudulent credit cards and cash advances."

Also persuasive to the court was the federal Sentencing Commission’s note addressing characteristics of the specific offense, which referenced "transfer or use."

"It is telling that the Commission used the two terms ‘use’ and ‘transfer’ in this sentencing guideline. We assume that the Commission used two terms because it intended each term to have a particular, nonsuperfluous meaning," Dubina observed.

Obtaining another form of identification, such as a credit card, with a stolen identity — something Hall did not do — was the sort of use contemplated by the commission.

Therefore, the panel found Hall’s sentence was unreasonable because the district court misinterpreted the guideline. There is the possibility that the district court’s error had no practical impact on Hall’s sentence, however.

But even if Hall’s sentence goes unchanged on remand, the Eleventh Circuit’s ruling may prove to shape the sentences imposed in other identity theft cases.