FBI Indicts Doc Who Leaked Trans Kids’ Medical Info to Chris Rufo
Dr. Eithan Haim has portrayed himself as a victim of politically motivated prosecution after he leaked information about trans kids treated at Texas Children’s Hospital to a notorious culture war activist.
by Evan Urquhart
The FBI will bring felony charges against a doctor accused of leaking the private health data of transgender youth to conservative activist Chris Rufo. Dr. Eithan Haim has admitted to leaking partially redacted medical records to Rufo, records he accessed while working as a resident at Texas Children’s Hospital.
Rufo is best known for his efforts to push the Republican party to pursue culture war flashpoints such as critical race theory and the idea that LGBTQ+ acceptance in schools amounts to “grooming” kids.
The records, which included multiple pieces of information relating to individual patients at Texas Children’s, were published on Rufo’s blog on May 16, 2023. At the same time, the write-ups of the leaks were also published in City Journal, the public policy magazine of the Manhattan Institute, a conservative think tank. Stories by Rufo published to City Journal later revealed Haim’s identity and broke the news that he was under investigation by the FBI for misuse of patient data, Most recently, Rufo also broke the news on City Journal that the investigation has resulted in four felony charges for Haim.
An update on Haim’s fundraiser on GiveSendGo, published on June 8, described how Haim was notified of the charges, in his own words.
screenshot from GiveSendGo fundraiser by Eithan Haim
The City Journal story on the indictment further stated that Haim’s first court date for the charges would be today.
Both Haim and Rufo have repeatedly claimed all personally identifying information was fully redacted before the records were made public. Multiple stories in right-wing media have also included quotes to that effect, many of them emphasizing that the leaked records redacted patients’ names. Right-wing media stories have typically repeated this alongside claims by Haim and Rufo that Haim’s indictment was politically motivated.
screenshot from GiveSendGo fundraiser by Eithan Haim
Carmel Shachar, an Assistant Clinical Professor of Law at Harvard Law School, disagrees that the records leaked by Haim have been sufficiently de-identified to ensure compliance with HIPAA, the Health Insurance Portability and Accountability Act. Shachar’s own work focuses on health policy and the law.
“The most commonly used way to ensure compliance is to remove certain identifiers, and there are 18 identifiers listed by the HHS, with the argument that once you remove all of those nobody would be able to re-identify your data,” Shachar explained. “The most prominent one here that I see [referring to the material leaked by Haim] is the date and time of appointment, which is one of the identifiers.”
The HHS website’s section on de-identifying medical records states “All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.”
Haim’s leaked records included the precise date and time of individual patient appointments for youth being treated for gender dysphoria at Texas Children’s. These dates were important because the purpose of the leak was to expose the fact that a few doctors at Texas Children’s had continued to see trans youth patients after Texas Children’s had officially ended their program treating gender dysphoria for youth.
Shachar explained that, typically, penalties for HIPAA violations are levied at large organizations and take the form of fines, often combined with a remediation plan to ensure patient privacy will be better protected by the organization from then on. However, she said, “HIPAA does allow for criminal liability if you willfully leak information. And, I would say in this case, this was obviously an intent to leak information, so I’m not surprised that Eithan got a knock from the Feds.”
Mainstream media coverage of Haim’s alleged breach of patient privacy, and the criminal penalties he may now face as a result, have been all but nonexistent. However, this may change as Haim’s case advances through the courts. Lawyers representing Eithan Haim declined to offer any comment for this story.
Evan Urquhart is the founder of Assigned Media and an incoming member of the 2024-2025 Knight Science Journalism fellowship class at MIT.