Surgeon Who Exposed Transgender Care to Minors Charged with Criminal HIPAA Violations

The Department of Justice has revealed the indictment against surgeon Eithan Haim, MD. Haim was the whistleblower who provided the press with documents regarding minors at Texas Children’s Hospital who got gender-affirming care. Haim faces charges of four criminal violations of the Health Insurance Portability and Accountability Act (HIPAA), namely illegally accessing, obtaining, and disclosing Texas Children’s pediatric patients’ protected health information (PHI).

Haim anonymously provided records he got from Texas Children’s to Christopher F. Rufo, a senior fellow working at the Manhattan Institute, who publicized an article in the City Journal disclosing the gender-affirming care that Texas Children’s Hospital provides to minors. Back then, there was no specific Texas legislation that bans those treatments. In February 2022, Texas Attorney General Ken Paxton released a non-binding legal opinion including transgender treatments like hormone therapy, puberty blockers, and surgeries as forms of child abuse. State Governor Greg Abbot then directed the Texas Department of Family and Protective Services to inspect providers of gender-affirming care within the state.

In March 2022, Texas Children’s Hospital announced that its gender-affirming services for minors will be stopped because of the Texas bill that banned these treatments for transgender minors. Texas Children’s Hospital paused the care to protect its personnel from legal issues. Haim claimed that after Texas Children’s released that statement, the hospital still secretly provided gender-affirming care to minors (from 11 years old) for a year.

Immediately after the news in May 2023, Attorney General Paxton started investigating the hospital’s gender-affirming care. The investigation was started after media reports that suggested Texas Children’s illegal services. Texas Children’s Hospital CEO Mark Wallace later stated that the hospital would stop all gender-affirming care services to follow Senate Bill 14, which became effective in September 2023.

Government prosecutors started investigating possible criminal violations of HIPAA with the help of the Federal Bureau of Investigation (FBI). Haim was recognized as the potential whistleblower but later faced charges of four counts of criminal HIPAA violations. The exact charges against Haim were unknown until now.

Haim recently said in a Fox News interview that the charges were politically driven and were because of the government’s transgender ideology. Attorney Marcella Burke said that Haim reported the child abuse he saw in the hospital as a whistleblower to the State of Texas. But the government went out of its way and prosecuted the whistleblower.

The government indictment was not disclosed to Haim and his attorneys. Haim said he only provided Rulo with documents without identifying patient data, so there was no impermissible disclosure of PHI. He also said that HIPAA allows disclosures of PHI when the disclosures are for the prevention of a serious and impending threat to health or security. Rulo affirmed that all personally identifiable information was removed from the documents provided to him.

The indictment was unsealed during the first appearance of Haim before Magistrate Yvonne Y. Ho in Houston. The charges against Haim pertained to the disclosure of patient data to Rulo and how Haim acquired that data. During Haim’s residency, he was assigned rotations at Texas Children’s Hospital. Haim could access medical records, but it was revoked because of inactivity. In April 2023, Haim allegedly requested login access to Texas Children’s records of pediatric patients, which were not under his care. As per the indictment, Haim followed up his request stating its urgency in preparation for adult care services under his care.

After Haim got access again, the prosecutors assert that on or around April 24, 2023, Haim’s login activity indicated that he accessed the data of pediatric patients not associated with his care. Based on the indictment, Haim wanted remote access to discreetly access pediatric patient records not under his care from Baylor and from Texas Children’s Hospital.

Allegedly, Haim did not discuss concerns with Baylor or Texas Children’s regarding the gender-affirming care being given to minors. He did not call the anonymous hotline of Baylor as stipulated in his HIPAA training, instead, he opted to contact the media and shared the documents with patient records as evidence. This action resulted in financial harm to Texas Children’s Hospital, medical slowdowns to scheduled patients, and threats to patients and doctors.

From September 2022 to February 2024, Haim is purported to have committed HIPAA violations. Count 1 is knowingly obtaining individually identifiable health information of patients under false pretenses. Counts 2-4 is obtaining and/or wrongfully sharing individually identifiable health information with an intention to cause malicious harm to doctors and patients of Texas Children’s Hospital.
Three counts for three patients. In case found guilty, Haim will serve up to 10 years in federal jail and pay a minimum of $250,000 fine.

Author: Daniel Lopez

Daniel Lopez is the HIPAA trainer behind HIPAA Coach and the HIPAA subject matter expert for NetSec.news. Daniel has over 10 years experience as a HIPAA coach. Daniel provides his HIPAA expertise on several publications including Healthcare IT Journal and The HIPAA Guide. Daniel has studied Health Information Management before focusing his career on HIPAA compliance and protecting patient privacy. You can follow Daniel on Twitter / X https://twitter.com/DanielLHIPAA