Fourth Circuit Upholds HIPAA Conviction of Hospital Contractor Who Posted Ginsburg's Medical Records to 4Chan

Russell worked for a non-profit organ donation company that had access to George Washington University Hospital's patient database. In January 2019, a screenshot of Justice Ginsburg's patient search screen appeared on 4Chan's "Politically Incorrect" thread, where users were promoting conspiracy theories that the Justice had died. The screenshot revealed that Justice Ginsburg had been receiving treatment at the hospital for cancer-related conditions seemingly since at least 2014.

A jury convicted Russell of unlawfully obtaining individually identifiable health information and destroying records with intent to obstruct an investigation. Chief Judge Diaz, writing for the panel, rejected Russell's challenges to the admission of his statements to federal agents, limits on cross-examination, and the sufficiency of the evidence.

Search logs tied Russell to the breach. When federal agents confronted him with queries for "Gins" and "Ginston" logged under his credentials, Russell suggested that "potentially his cat had run across the keyboard and typed in those letters." The court found this explanation implausible, given that Russell had legitimately searched for another patient just seconds before the suspicious queries.

Russell also attempted to destroy evidence. Days after learning the hospital had revoked his access, he formatted his computer's hard drive. Government forensics experts determined that Russell had turned over a secondary gaming drive rather than his desktop's primary hard drive. Recovered data showed Russell had visited the same 4Chan thread where the medical information was posted, along with antisemitic comments and conspiracy theories about Justice Ginsburg's health.

Russell argued on appeal that the screenshot did not qualify as "individually identifiable health information" because it did not reveal specific health conditions or doctor names. Chief Judge Diaz rejected that argument, holding that information showing Justice Ginsburg's name, treatment dates, and medical services including "radiology and oncology services" fell "well within the heartland of the conduct the statute is aimed at."