Chief Judge Diaz, writing for a unanimous panel, held that the leaked screenshot fell within the heartland of the statute's prohibitions on disclosing individually identifiable health information. The image showed Ginsburg's name, ten visit dates, and services including radiology, oncology and surgery.
The leak surfaced in January 2019, when hospital employees spotted a Twitter post carrying the screenshot. Before it reached Twitter, the image had been posted on 4Chan's "Politically Incorrect" thread, where users circulated conspiracy theories that the Justice had died.
George Washington University Hospital's Chief Information Officer, Nathan Read, traced the access logs to patients whose last names began with "Ginsb," initially flagging an emergency room employee, Robert Harlow. Read dismissed Harlow as the source because, according to the opinion, he was an older gentleman who lacked technical aptitude. A broader search for "Gin" led investigators to Russell.
Russell worked for a non-profit organ donation company with access to the hospital's patient database. Logs showed that on January 7, 2019, a non-hospital device signed in under Russell's username ran a search for "Gins" seconds after a legitimate query for a patient named Barker, and seconds before a search for "Ginston," a name with no hospital record.
When federal agents interviewed Russell at work, he admitted searching for Barker but denied searching for Gins or Ginston. He suggested his cat might have typed on the keyboard or that a coworker had used his login.
Days after the hospital revoked his access, Russell formatted his desktop's hard drive and turned over a secondary gaming drive rather than the primary drive holding the operating system. Forensic experts later recovered data showing he had visited the same 4Chan thread where the medical information was posted, along with antisemitic comments and conspiracy theories.
Russell argued the screenshot did not qualify as "individually identifiable health information" because it omitted specific diagnoses and doctor names. The panel rejected that reading, concluding that a record tying the Justice's name to treatment dates and medical services satisfied the statute.
The court also affirmed the denial of Russell's motion to suppress, finding no coercive police activity. Russell was told the interview was voluntary and could leave at any time, and the silent presence of his company's CEO did not amount to an implicit threat to his employment, the panel said.
On the cross-examination challenge, the court found no abuse of discretion, noting defense counsel declined to pursue further questioning after the trial court offered alternative avenues to probe the investigating agent's bias.
Russell was convicted of unlawfully obtaining individually identifiable health information and destroying records with intent to obstruct an investigation. The Fourth Circuit affirmed the judgment in full.