Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Michael Stefan Nachmanoff, District Judge. ( 1:23-cr-00195-MSN-1 )

Argued: February 25, 2026 Decided: April 14, 2026

Before DIAZ, Chief Judge, and KING and THACKER, Circuit Judges.

Affirmed by published opinion. Chief Judge Diaz wrote the opinion, in which Judge King and Judge Thacker joined.

ARGUED: Charles Burnham, BURNHAM & GOROKHOV, PLLC, Washington, D.C., for Appellant. Lauren Nicole Beebe, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. ON BRIEF: Erik S. Siebert, United States Attorney, Zoe Bedell, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee.

Page 2DIAZ, Chief Judge:

Before Supreme Court Justice Ruth Bader Ginsburg passed away, someone posted a screenshot of her private medical information on the internet. The information related to treatment the Justice received at George Washington University Hospital. An investigation led federal agents to Trent Russell, who worked for a company with access to the hospital’s medical records. After trial, a jury convicted Russell of (1) destroying and altering records with the intent to impede, obstruct, or influence a criminal investigation, and (2) wrongfully obtaining individually identifiable health information.

Russell raises three issues on appeal: first, that the district court improperly denied his motion to suppress statements that he made to federal agents during an investigative interview; second, that the court abused its discretion by limiting his cross-examination of a witness; and finally, that the government didn’t present sufficient evidence to convict him of obtaining individually identifiable health information.

After careful review, we affirm the judgment in full.

Since the government prevailed at trial and at the suppression hearing, we review the facts in the light most favorable to it. United States v. Everett , 91 F.4th 698, 703 n.1 (4th Cir. 2024).

In January 2019, employees at George Washington University Hospital discovered a Twitter post that revealed information about Justice Ginsburg's recent visits to the Page 3hospital. The post contained a screenshot of the hospital’s patient search screen, which highlighted Justice Ginsburg’s name and showed the dates of ten visits, along with medical services she received (which included radiology, oncology, and surgery services). Based on the dates captured in the screenshot, it was taken between December 31, 2018, and January 9, 2019.

Law enforcement later learned that before circulating on Twitter, the screenshot was posted on the anonymous message board 4Chan. It appeared on a thread titled “Politically Incorrect,” where users promoted a conspiracy theory that Justice Ginsburg had died and prominent Democrats were covering up her death.

The hospital’s Chief Information Officer, Nathan Read, investigated the leak. He obtained search logs for anyone who had used the hospital’s system to look for patients with last names starting with “Ginsb” in the relevant time frame.

That search led him to Robert Harlow, a hospital employee who worked in the emergency room. Harlow had searched for “Ginsbur” despite having no legitimate reason to do so.

But after interviewing Harlow, Read concluded it was unlikely that he leaked the information because he is “an older gentleman” who “didn’t seem to have high technical aptitude.” Joint Appendix (J.A.) 255.¹ So Read broadened his search to anyone who had used the hospital’s database to find patients with last names starting with “Gin.”

Page 4That led him to Russell, who worked for a non-profit that facilitates organ donations. Russell’s position gave him both on-site and remote access to patient medical records and other hospital data.

Read’s new search parameters revealed that a non-hospital issued device, operating under Russell's username, searched for 'Gins ' on January 7, 2019. That search was sandwiched between two others. Seconds before, the same device searched for “Barker,” and seconds after, it searched for “Ginston.” Barker was a hospital patient, but the hospital had no record of ever serving someone with the last name Ginston.

After concluding its investigation, the hospital deactivated Russell's account, notified his employer, and gave Harlow’s and Russell’s names to law enforcement.

Federal Agents Mosi Forde and Chris Lalonde interviewed Russell at work.² The CEO of Russell's company, Lori Brigham, sat in on the interview 'because she was concerned about the case and interested in the outcome.” J.A. 39. Neither Forde nor Lalonde had asked her to attend. Brigham remained silent during the interview, except to once “wonder[] aloud what sensitive information could be derived from simply searching someone's name.' J.A. 25.

The agents told Russell that the interview was voluntary, he was free to leave at any time, and he could decline to answer any questions. According to Forde, Russell’s “affect Page 5was pleasant and measured” during the interview, and he “appeared to be under no apparent duress.' J.A. 40.

The agents showed Russell the relevant search logs. He confirmed that the credentials used for the searches belonged to him. Russell also admitted that he’d run the search for “Barker,” who was his patient. But Russell denied searching for “Gins” and 'Ginston.'³

When asked what “Gins” stood for, Russell said that “if he had to take a guess, it was Justice Ginsburg.” J.A. 363. The agents hadn’t yet mentioned the Justice’s name in the interview. Russell also “guessed” that the agents were speaking with him “because someone had taken a screenshot of Justice Ginsburg's medical record.' J.A. 367.

Russell insisted that he didn't know how his credentials had been used to run the “Gins” and “Ginston” searches. But he theorized that “potentially his cat had run across the keyboard and typed in those letters.” J.A. 364. He also suggested that the searches could be typos or that a coworker may have used his login information.

When the agents asked to see Russell’s personal laptop and cellphone, Russell said that both had been stolen. But he agreed to give the agents the hard drive to his desktop computer, which he kept at home and used for remote work. After the interview, Lalonde and another agent met Russell at his house, where he handed over a hard drive.

Page 6The government later discovered that Russell hadn't handed over his desktop's primary hard drive, which would have contained the computer’s operating system. Instead, he’d turned over a secondary drive that was mostly dedicated to gaming.

Russell had also recently “formatted” the hard drive, so much of the data was erased, overwritten, or reorganized in a way that wasn’t easily discernible. Forensics revealed that Russell formatted the drive a little over a week before he gave it to law enforcement—and only about two days after he learned that the hospital revoked his remote access.

Even so, the government recovered some relevant information from the hard drive. Every computer comes with a unique device name. According to the hospital’s search logs, a computer named “DESKTOPE7399QV” had accessed Justice Ginsburg’s record s. Russell’s desktop shared the same identifier. And since the desktop’s usernames were all in Russell’s name, the government determined that he was the device’s only user.

The government also identified text strings and images saved on the hard drive that contained antisemitic comments and promoted conspiracy theories about Justice Ginsburg’s health. The images showed not only that Russell had spent time on 4Chan, but that he’d visited the same “Politically Incorrect” thread where Justice Ginsburg’s medical information was posted.

Still, the government considered other suspects. Agents investigated other hospital employees who conducted similar searches. But they found legitimate reasons to dismiss those employees as suspects.

The government also considered whether someone else used Russell’s credentials to run the search. This alternative, however, didn’t square with the forensic analysis, which Page 7showed that Russell’s home computer performed the search. And Russell admitted that he’d looked for another patient on the database just seconds before “Gins” appeared in his search history. So all signs pointed to Russell as the person who conducted the unlawful search.

C.

A grand jury indicted Russell for three offenses: wrongfully obtaining individually identifiable health information under 42 U.S.C. § 1320d -6(a)(2); wrongfully disclosing individually identifiable health information under 42 U.S.C. § 1320d -6(a)(3) ; and unlawfully destroying and altering records under 18 U.S.C. § 1519 (for formatting the data on his hard drive). He pleaded not guilty.

Before trial, Russell moved to suppress the statements he made during his interview with Forde and Lalonde. He argued that his statements were involuntary because his company’s CEO was present during the interview, so he’d believed he would lose his job if he didn’t fully participate. Russell also asked the district court to exclude his hard drive as fruit of the poisonous tree.

The district court denied the motion. In doing so, the court made several findings of fact. Russell “was [twenty-nine] years old at the time of the interview, [] he is an English speaker, [] he holds an associate’s degree, he’d served in the military for four years, and he'd been employed at [his] company for two years prior to the interview.' J.A. 81. Russell “was questioned at his place of work in a conference room” where at least one door remained unlocked. J.A. 81. The agents didn’t show their weapons or use handcuffs. They also told Russell that the interview was voluntary and that he could leave at any time.

Page 8And while the CEO was in the interview room, the agents hadn’t asked her to join. Neither the CEO nor the agents made any 'explicit threat or statement that could be interpreted as [Russell] potentially losing his job if he didn’t speak with the agents.” J.A. 82. Nor did any authority suggest that the “mere presence” of an employer constitutes an implicit threat to employment. J.A. 82.

The district court also explained that Russell freely admitted “certain inculpatory evidence regarding accessing records and admitted [to] sharing his credentials and taking photographs in other circumstances[,] while denying the activity alleged regarding [Justice Ginsburg] .” J.A. 82. This showed that he was “fully capable of making the decision to speak and answer the questions in the way that he wished to do so.' J.A. 82 – 83.

The case proceeded to trial. When cross-examining Lalonde, defense counsel asked if Russell had offered any explanations for how his credentials were used to run the “Gins” search. The government objected on hearsay grounds.

Defense counsel countered that he wasn’t trying to introduce Russell’s explanations for their truth. Instead, he wanted to highlight Lalonde’s bias. Counsel explained that if Russell had told Lalonde that he shared his passwords with other people, and Lalonde didn't use that information to consider other potential culprits, it showed that the government failed to conduct a robust investigation.

The district court sustained the government’s objection. But it suggested other ways for the defense to explore bias. Russell’s lawyer could ask Lalonde directly about his bias, without introducing Russell’s statements. And given that Russell planned to take the stand, Page 9he was 'certainly welcome to testify about whatever his theory of the defense is and whatever he may have tried to explain at the time that he was questioned.' J.A. 384. After that, defense counsel could then recall Lalonde for more questioning.

But counsel chose not to question Lalonde further, either on cross-examination or in Russell’s case-in-chief.

After the government rested its case, Russell moved under Federal Rule of Criminal Procedure 29 for a judgment of acquittal . Though he sought an acquittal on all charges, his argument focused on the charges related to obtaining and disclosing individually identifiable health information. He argued that the screenshot of Justice Ginsburg’s data didn’t “count” under the relevant statute “because no actual medical records were accessed; it was just entries . . . of what the records would be if you wanted to look at them.” J.A. 523 –24. The district court denied the motion.⁴

The jury found Russell guilty of (1) destroying and altering records, and (2) obtaining individually identifiable health information. It acquitted him of disclosing individually identifiable health information.

The district court sentenced Russell to twenty-four months’ imprisonment. This appeal followed.

Page 10We start with Russell’s motion to suppress. We review the district court’s findings of fact for clear error and its legal conclusions de novo. See Everett , 91 F.4th at 709.

Russell’s statements to law enforcement were properly admitted only if he made them voluntarily. See United States v. Braxton , 112 F.3d 777, 780 (4th Cir. 1997) (en banc). “Coercive police activity is a necessary finding for a confession . . . to be considered involuntary.” United States v. Giddins , 858 F.3d 870, 881 (4th Cir. 2017). So we must consider 'whether the confession was extracted by any sort of threats or violence, or obtained by any direct or implied promises, however slight, or by the exertion of any improper influence.' Hutto v. Ross , 429 U.S. 28, 30 (1976) (citation modified).

At the same time, '[t]he mere existence of threats, violence, implied promises, improper influence, or other coercive police activity . . . does not automatically render a confession involuntary.” Braxton , 112 F.3d at 780. “The proper inquiry is whether the defendant's will has been overborne or his capacity for self-determination critically impaired.' Id. (citation modified). We base this determination on the totality of the circumstances, “including the characteristics of the defendant, the setting of the interview, and the details of the interrogation.' Id. at 781 (citation modified).

Russell claims that the CEO’s presence at the interview created an implicit threat that he had to cooperate with the federal agents “as a condition of continued employment.” Appellant's Br. at 16. And he argues that the district court erred by applying a 'bright-line Page 11rule' that any 'threatened loss of employment must be stated explicitly' to render a defendant's statements involuntary. Id.

But the district court didn’t say that implied threats to employment can never be coercive. It simply found that there was no such threat here. Russell didn’t identify a case where 'the mere presence of the employer or the CEO [in a conversation with law enforcement] could be construed as a threat, implicit or explicit.' J.A. 82. And after weighing the totality of the circumstances, the court concluded that “there’s nothing in the record that suggests that the interaction between the agents and [Russell] involved coercive police activity, either in the words that were spoken or in their actions.' J.A. 82.

The district court made several uncontested factual findings to support this conclusion: (1) Russell was an English-speaking adult with higher education; (2) law enforcement questioned him in a conference room with windows and at least one unlocked door; (3) the agents told Russell that he 'was free to leave at any time, [and] that the interview was voluntary”; (4) the agents didn’t brandish weapons or any other indicia of force or coercion; ( 5 ) Russell “felt free to admit certain inculpatory evidence”; and ( 6 ) the agents hadn't asked the CEO to attend the interview. J.A. 81 – 83.

Given these findings, the CEO’s presence (without more) doesn’t rise to the level of coercive police activity. So the district court correctly denied the motion to suppress.

We turn next to the district court’s evidentiary ruling, which we review for abuse of discretion and harmless error. See United States v. Zayyad , 741 F.3d 452, 458 (4th Cir.

Page 122014); United States v. Johnson , 617 F.3d 286, 292 (4th Cir. 2010) (citing Fed. R. Crim. P. 52) .

The Constitution guarantees a criminal defendant’s right “to be confronted with the witnesses against him.” U.S. Const. amend. VI. Accordingly, criminal defendants have a right 'to reasonable cross-examination, when otherwise appropriate, for the purpose of impeaching the credibility of key witnesses.” Quinn v. Haynes , 234 F.3d 837, 847 (4th Cir. 2000).

But district courts “retain wide latitude . . . to impose reasonable limits on [defense counsel’s] cross-examination based on concerns about, among other things, harassment, prejudice, confusion of the issues, the witness’ safety, or interrogation that is repetitive or only marginally relevant.” Delaware v. Van Arsdall , 475 U.S. 673, 679 (1986). In this way, 'the Confrontation Clause guarantees an opportunity for effective cross-examination, not cross-examination that is effective in whatever way, and to whatever extent, the defense might wish.' Id. (citation modified).

The Confrontation Clause also doesn't 'trump established rules of evidence,' including the rule against hearsay. Quinn , 234 F.3d at 847. Hearsay is “an out -of-court statement offered for the truth of the matter asserted.” United States v. Ferguson , 140 F.4th 538, 543 (4th Cir. 2025) (citation modified) ; Fed. R. Evid. 801(c) .

During his interview, Russell offered the agents potential explanations about how his credentials may have been used to search for Justice Ginsburg’s information: in addition Page 13to blaming his cat, he mused that the searches were typos, or that one of his coworkers accessed his login information. But the district court prevented defense counsel from cross-examining Lalonde about Russell's statements because they were inadmissible hearsay.

As he did at trial, Russell argues on appeal that he wasn’t trying to introduce the statements for their truth. Instead, he only wanted 'to show that [Lalonde] received information from Russell that should have led him to take a critical look at [the hospital’s] self-serving conclusions[,] but that the agent failed to do so due to bias.” Appellant’s Br. at 24.

We can't say that the district court abused its discretion by limiting the crossexamination. True, the court could have allowed the questions and given the jury a limiting instruction. See, e.g. , United States v. Jordan , 952 F.3d 160, 167 (4th Cir. 2020). But the court chose not to do so, while spelling out ways for Russell to “attack the [g]overnment’s witnesses on other grounds and . . . raise his preferred argument in his own case.' Zayyad , 741 F.3d at 461.

The court permitted defense counsel to inquire into Lalonde's bias without mentioning Russell’s out-of-court statements. It also said that Russell could testify directly about his interview statements during his own case, and then his counsel could recall Lalonde.

Counsel instead chose not to ask Lalonde more questions on cross-examination. And while Russell testified in his own defense, his counsel didn’t recall Lalonde. The decision to “forego” these alternative strategies “rests squarely on [Russell’s] shoulders.”Page 14 Id. (citation modified); see also United States v. Smith , 44 F.3d 1259, 1269 (4th Cir. 1995) (district court “acted well within its discretion” when it limited cross-examination because the defendant could “pursue fully the line of inquiry” in her own case).

In any event, any error was harmless. We can affirm on that basis if we conclude “after pondering all that happened without stripping the erroneous action from the whole, that the judgment was not substantially swayed by the error.” Johnson , 617 F.3d at 292 (citation modified).

Here, Russell’s lawyer developed his bias argument through other witnesses, and his closing argument emphasized the shortcomings of both the hospital’s internal review and law enforcement’s investigation. Since the jury heard other evidence of bias, any additional testimony that defense counsel might have elicited from Lalonde would have been cumulative. And given the weight of other evidence against Russell, the testimony wouldn’t “have significantly changed the jury’s impression” of his guilt. United States v. Turner , 198 F.3d 425, 431 (4th Cir. 1999).

Finally, we review the denial of Russell’s motion for judgment of acquittal de novo. United States v. Alerre , 430 F.3d 681, 693 (4th Cir. 2005). 'We are obliged to sustain a guilty verdict if, viewing the evidence in the light most favorable to the government, it is supported by substantial evidence.' Id. (citation modified). Put differently, we must affirm if Russell's conviction is supported by 'evidence that a reasonable finder of fact could Page 15accept as adequate and sufficient to support a conclusion of [his] guilt beyond a reasonable doubt.” United States v. Burgos , 94 F.3d 849, 862 (4th Cir. 1996) (en banc).

The jury convicted Russell under 42 U.S.C. § 1320d -6(a)(2), which prohibits “obtain[ing] individually identifiable health information relating to an individual.” This includes any information that

(A) is created or received by a health care provider . . . and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—

• (i) identifies the individual; or
• (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

42 U.S.C. § 1320d(6) .

A person violates the statute 'if the information is maintained by a covered entity . . . and the individual obtained . . . such information without authorization.' Id. § 1320d -6(a). Healthcare providers like George Washington University Hospital are covered entities. See id. § 1320d -9(b)(3); Exec. Order No. 13181, 65 Fed. Reg. 81321 (Dec. 20, 2000) .

B.

Russell argues that the information about Justice Ginsburg in the screenshot doesn’t qualify as “individually identifiable health information.” Although he admits the screenshot showed that the Justice received medical care from the hospital, Russell asks us to limit the statute’s application to individuals who obtain “information about [a patient’s]Page 16 specific health conditions,” such as “details about the [patient’s] particular physician and type of treatment.” Appellant's Br. at 19 –21. In Russell’s view, because the screenshot didn’t disclose the precise nature of Justice Ginsburg’s illness or the names of her doctors, it can’t serve as the basis for his conviction.⁵

We reject this crabbed view of the statute. The screenshot identified the Justice by name and disclosed where she was being treated, her arrival and discharge dates, and the medical services provided, which included radiology and oncology services. As a witness testified, this information revealed that Justice Ginsburg 'had been receiving treatment from [the hospital] for various things related to cancer seemingly since at least 2014.” J.A. 273 – 74.

This information falls well within the heartland of the conduct the statute is aimed at because it “relates to the past . . . health or condition of an individual, [and] the provision of health care to an individual.” 42 U.S.C. § 1320d(6) ; see also United States v. Spence , 661 F.3d 194, 200 (4th Cir. 2011) ( “[T]he phrase ‘relat[es] to’ . . . carries a broad ordinary meaning, namely, ‘to stand in some relation; to have bearing or concern; to pertain; refer; to bring into association with or connection with.'' (quoting Morales v. Trans World Page 17Airlines, Inc. , 504 U.S. 374, 383 (1992) )). To hold otherwise would flout the spirit of the law. At the very least, a reasonable juror could accept that the screenshot contained personal health information sufficient to support a conviction under § 1320d -6(a)(2).

AFFIRMED