Supreme Court: What Is Improper Access to a Computer?
While Hospitals Lose Money, the Supreme Court Discusses Whether Medical Device Reprocessing is Computer Fraud
A Georgia police officer (Nathan Van Buren) used his computer to look up a license plate on the Georgia Crime Information Center (GCIC), a resource he had authorized access to, in order to see if its registered owner, a stripper, was an undercover officer. This was a complex part in an FBI “sting” operation, and the FBI ended up charging him for violating the law.
On November 30th, the Supreme Court had its first discussion in the Van Buren v. United States case. Here is the connection: Van Buren was convicted of violating the “Computer Fraud and Abuse Act” (CFAA). He was sentenced to 18 months of prison in the U.S. District Court for the Northern District of Georgia for obtaining unauthorized access to information on a computer for improper purposes. The court determined that this violates Section 1030(a)(2) of the Computer Fraud and Abuse Act.
This act, federal law passed in 1986, is a federal statute that imposes civil and criminal liability for unauthorized access of computers. It is said that legislators were partially inspired by the 1983 movie “WarGames”… It essentially limits access to a computer. In 1986, computers were computers. In 2020, everything has a “computer” in it, from remote controlled light switches over electrical toothbrushes to cars – and medical devices.
Van Buren appealed the conviction to the United States Court of Appeals for the Eleventh Circuit. It is with the Supreme Court now because of a “circuit split”, meaning the US Circuit Courts have been divided in terms of how broadly they want to interpret the statute: The Statute’s notion of "exceeding authorized access" can be interpreted broadly to mean that accessing a computer with authorization but for an improper purpose is a violation of the CFAA, or it can be interpreted more narrowly to mean that a violation only occurs if the authorized user accesses information they were prohibited from accessing.
It is with the Supreme Court now because of a “circuit split”, meaning the US Circuit Courts have been divided in terms of how broadly they want to interpret the statute...
Now, what does that have to do with hospital economics and single-use device reprocessing? Well, with a broad interpretation of the "exceeds authorized access" clause of the CFAA, single-use device reprocessors would essentially be breaking the law when they “access” computers in medical devices (many of them do) to make the device ready for a – FDA sanctioned – second use. The “authorized access” in this situation is based on the hospital’s ownership of the device and them making the device available to reprocessors. However, the original device manufacturer has not “intended” this access and it can be interpreted as an “improper purpose” – even if the hospital has granted the reprocessor access. A more narrow interpretation would have the statute focus on actual violation of access prohibition (such as hacking a computer - or a medical device) to somehow alter the device, which would not impact reprocessing.
Officer Van Buren probably shouldn’t have looked up the license plate. But a lot more is at stake at the Supreme Court: Hospitals’ access to savings of hundreds of millions of dollars through reprocessing. If the Supreme Court upholds the broader interpretation, most high-dollar devices (those with computers in them) approved by the FDA for reprocessing could no longer be reprocessed. Beyond healthcare, other re-use initiatives and enterprises that celebrate American innovation and an interest in getting the most value for a product would suffer as well – including automobile repairs, computers, smart phones, watches, etc. Re-use is simply a cornerstone of a smart economy and responsible enterprise.
Re-use is simply a cornerstone of a smart economy and responsible enterprise.
Meanwhile, Fierce Healthcare reported on November 30th that hospital operating margins declined by 70% since the start of 2020 (not considering CARES Act relief) to 1.6% NEGATIVE; they are losing money. Decrease in demand is the direct reason, but an unhealthy cost structure is the fundamental problem. Being able to use reprocessed medical devices is often a critical part in the equation that normally allows hospitals to remain financially sound. So the Supreme Court’s deliberations have enormous significance for healthcare.
Now, the risk is slim that the court will opt for a broad interpretation of the statute. After all, the interpretation of a “WarGames”-inspired law based on 1986 technology should probably be updated to take into consideration the evolution of computer technology and modern-day re-use practices. But keep your eyes on this discussion.