Dr. Eithan Haim is the courageous whistleblower who, through Christopher Rufo, revealed that Texas Children’s Hospital (in Rufo’s words) “secretly continued to perform transgender medical interventions, including the use of implantable puberty blockers, on minor children” after it had publicly announced that it would no longer do so. If you need any more evidence that the Biden administration is controlled by fanatical transgender ideologues, the Department of Justice’s prosecution of Dr. Haim provides it.
DOJ’s indictment of Dr. Haim has now been made public. The indictment charges Dr. Haim with four counts of violating the patient-privacy provisions of HIPAA (Health Insurance Portability and Accountability Act), and it exposes Dr. Haim to total penalties of up to 10 years in prison and up to $250,000 in fines. Some observations:
1. If a whistleblower did what Dr. Haim is alleged to have done to expose, say, that a hospital had committed racial discrimination or Medicaid fraud, it is unfathomable that DOJ would threaten the whistleblower with a life-destroying criminal prosecution. The only reason that Dr. Haim is being targeted is that he has run afoul of the transgender ideology that dominates the Biden administration.
2. Without any supporting allegations, the indictment contends that Dr. Haim acted with “malicious intent” and sought “to cause malicious harm” to the hospital’s physician and patients. I am not aware of an iota of evidence that would suggest that Dr. Haim acted with malice. In his own words, “I knew that it was my moral responsibility to expose what was happening to these children.”
Why is DOJ mistreating a good-faith whistleblower as a malicious actor? The obvious answer is that it wants to threaten him with the most severe penalties under HIPAA (42 U.S.C. § 1320d-6(b)(3)), which apply if an “offense is committed with intent to … use individually identifiable health information for … malicious harm.” Three of DOJ’s four charges against Dr. Haim rely on this absurd claim of malice.
3. Contrary to many public reports, DOJ does not allege that Dr. Haim disclosed any patient’s private medical records—what HIPAA calls “individually identifiable health information.” It alleges instead that he unlawfully “obtained” such information.
Section 1320d-6(a) of Title 42, which defines the criminal offense under HIPAA, separately addresses illegally obtaining individually identifiable health information in subsection (a)(2) and illegally disclosing such information in subsection (a)(3). Each of the charges in the indictment cites subsection (a)(2), not subsection (a)(3).
DOJ seems happy, however, to propagate the false, but politically more appealing, notion that Dr. Haim disclosed private patient information. The consolidated Counts Two through Four in the indictment allege that Haim did “obtain and/or wrongfully disclose individually identifiable health information.” But the phrase “and/or wrongfully disclose” is legally meaningless surplusage, as the counts allege only a violation of subsection (a)(2), not subsection (a)(3). And the facts show that Dr. Haim carefully redacted the information in the records that might identify the patients.
DOJ also confusedly contends that “Person1 [evidently Rufo] published HIPAA protected information obtained by Haim” and that although the “HIPAA protected information [published by Rufo] had partially redacted out name of the pediatric patients[, it] kept the dates of service, diagnosis, procedure codes, and physician names visible.” This contention is gibberish.
HIPAA defines the term “individually identifiable health information” to be limited to information that (among other things) “identifies the individual” or “with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” (42 U.S.C. § 1320d(6).) Haim entirely (not “partially”) redacted the names of the patients, and there is no reasonable basis to believe that the remaining information could be used to identify the patients. Indeed, it is DOJ itself that discloses far more revealing information about the patients, as it identifies them by their initials (M.S., K.B., and G.H.). In short, the information that Rufo published was not “HIPAA protected information.”
(At the risk of getting too deep into the weeds: A HIPAA regulation (45 CFR § 164.514(b)(2)) provides a sort of “safe harbor” that allows a health-care provider to determine that health information is not “individually identifiable health information.” The fact that qualification for that safe harbor require dates of service to be removed cannot and does not override the statutory definition of “individually identifiable health information.” Indeed, the very same HIPAA regulation restates the statutory definition: “Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.” In other words, information that does not fall within the regulatory safe harbor does not automatically become “individually identifiable health information.”)
4. In an op-ed in the Washington Post last week, Attorney General Merrick Garland properly condemned “heinous threats of violence” against DOJ officials and “conspiracy theories crafted and spread for the purpose of undermining public trust in the judicial process itself.” But he also claimed that DOJ “makes decisions about criminal investigations based only on the facts and the law.”
DOJ’s prosecution of Dr. Haim powerfully rebuts Garland’s claim. Every day that passes before Garland orders the indictment to be withdrawn is an outrage.