He used another worker’s credential after being given internal transfer documentation.

Keller claimed:

He believed the transfer was authorized.

Then phone records complicated that.

Messages with a hospital procurement employee.

Deletion attempts.

Payment from an account connected to Hartwell.

The prosecution would later argue he knew far more.