A health-care worker convicted of stealing a hospital’s confidential patient information to gain business for his private health care company is entitled to resentencing, a federal appeals court ruled Feb. 21.

The restitution Viju Mathew was ordered to pay was unlawful because it included amounts for Medicare payments that preceded the acts for which he was convicted, the U.S. Court of Appeals for the Fifth Circuit said.

Mathew, a former employee of Parkland Health and Hospital System in Dallas, was convicted of stealing health insurance claim numbers for about 1,300 Parkland patients for use in soliciting prospective clients for his private home health service, Dallas Home Health Care Inc.

He was sentenced after a guilty plea to 30 months in prison and $277,957.89 in restitution payable to Medicare.

Mathew disputed the sums included by prosecutors in the restitution amount, which the Justice Department said included all patients—even those legitimately referred by Parkland to DHHC.

The court rejected all of Mathew’s restitution calculation claims except one—that the order unlawfully included Medicare payments to DHHC “that preceded the temporal scope of his offense of conviction.”

The result was dictated by the Mandatory Victim Restitution Act, which limits restitution orders to actual losses directly caused by a defendant’s criminal acts.

Here, Mathew’s restitution had to temporally flow from his knowing possession of confidential Medicare patient information with the intent to use it unlawfully, the court said.

Judge Jerry E. Smith wrote the opinion, joined by Judges Stuart Kyle Duncan and Kurt D. Engelhardt.

Burleson, Pate & Gibson LLP represented Mathew.

The case is United States v Mathew, 5th Cir., 17-10863, 2/21/19.