The 9th Circuit Court of Appeals has affirmed the conviction of the first person in the United States to be given a prison term for violating the privacy policy of the Health Insurance Portability and Accountability Act (HIPAA) without using the information for personal gain.

Huping Zhou, a former researcher for the UCLA Healthcare System, argued on appeal that he could not be convicted of a health information privacy violation because he had no knowledge of HIPAA when he accessed some 323 patient records, including those of Arnold Schwarzenegger and Tom Hanks.

The court disagreed and upheld Zhou's conviction and prison term. The court ruled that the word "knowingly" in HIPAA pertains only to the act of obtaining private individuals' health records without their consent. In essence, if a person knows he or she is looking at someone else's personal health information without the consent of that person, then he or she is "knowingly" violating the law.

Zhou in 2010 had pled guilty to violating HIPAA and was sentenced to four months in prison and assessed both a $2,000 fine and a $100 special assessment.

Zhou in 2003 had gone on a "snooping" spree during a three-week period after being informed that he was being dismissed for performance reasons. There is no evidence that he used the patient records for personal gain.