1: Background

This is not the first time Tennessee has attempted to make a list of trans people in its state. Rather, this is part of a wider pattern.

In 2023, Tennessee Attorney General Jonathan Skrmetti forced Vanderbilt Hospital to hand over all records pertaining to trans youth healthcare to the Attorney General’s Office. Vanderbilt Hospital is a major provider of trans healthcare in the state. This was done under the guise of fighting fraud in billing practices. It also assured the public that the records, which contained a list of over 100 trans kids, would be kept in strict confidence. Three years later, there is no public record as to what was done with this list.

The Attorney General responsible for this, Jonathan Skrmetti, is a major player in anti-trans politics. He was responsible for implementing one of the first state bans on youth trans healthcare. The resulting Supreme Court decision legitimizing this bears his name: Skrmetti.

This latest attempt to compile a list of trans patients is part of a wider project by the state to expand its anti-trans discrimination. 

The law to do this, HB 754, was introduced over a year ago. The bill had little movement until March, when it passed the House with a supermajority.

Collecting the medical records of its trans citizens is not entirely new territory for Tennessee; it is simply expanding and systematizing the existing ad-hoc process of record seizure. Whereas once it was limited to minors at a single hospital, now it will be done to everyone within the state, regardless of age. Unlike the prior example with Vanderbilt hospital, the new list isn’t limited to 100 kids. It’s targeting as many trans people as it can, and it’s guaranteed to become public information.

2: Data Collection

Under the new law, all medical records pertaining to transition medicine, and trans people’s broader healthcare situations, will be collected with the express purpose of making that information public. 

It does this by requiring all doctors, clinics, and others involved with trans healthcare to report on their patients– not just the details of their transitions, but their entire medical record. This reporting is to be filed once a month, using forms that do not yet exist (according to the text of the law).

2.1: What is Covered

Doctors and clinics will be forced to report the following information:

Demographic Info: The form will collect the age of the patient, their state of residence, as well as their sex at birth.

Date: All medical procedures, or referrals for such procedures, must be identified with the date that they were offered.

Info on Relevant Drugs: If any drugs are offered in the course of offering trans healthcare, the clinician must report 1) the name of the drug, 2) the dosage of the drug, 3) the frequency and duration that the drug is to be taken, and 4) the method that the drug is taken in.

Info on Relevant Surgeries: If any trans-related surgeries are offered, the details of the surgery must be listed.

Info on Providers and Clinics: Clinics must provide “the name, contact information, and medical specialty of the healthcare professional who prescribed the gender transition procedure or made the referral for the gender transition procedure”. In other words, it must require all relevant information on doctors.

Other Diagnoses: The report must contain “A list of any diagnoses that the person receiving or referred for a gender transition procedure has received of neurological, behavioral, or mental health conditions.” In short, most other medical conditions that the patient has on file.

An earlier version of the bill required the form to collect the patient’s county of residence. This was removed, likely to better comply with medical privacy laws, which prohibit all nonconsensual collecting of medical data about the location of patients which is more specific than what state they live in.

HIPAA privacy requirements are supposed to mandate all such patient data to be removed before it can be published. However, HIPAA also has a statutory exemption for disclosures required by state law. Since the disclosure of this information is required by state law, doctors cannot be sued by their patients if they hand over personal information to the state government. In short, HIPAA will not be a meaningful obstacle to collecting data.

2.2: Failure to Comply

Failure to report any of this comes with severe consequences. If a doctor fails to report this detail (in whole or in part), their medical license will be revoked for at least six months. If a clinic fails to report this detail (in whole or in part), they will be fined up to $150,000.

Due to the steep penalties of noncompliance, I expect that the vast majority of clinicians will comply with these requests.

3: The Annual Report (And the Personal Data Within It)

The stated purpose of collecting this data is to compile a report on trans healthcare in the state, to be released every year. As we will discuss in detail, this is almost certainly false.

3.1: The claim of Anonymous Data

The author of the bill, Representative Jonathan Faison (R), has repeatedly claimed that the collection of the data, and the subsequent report on said data, poses no risk to the privacy of the patients in question. 

He elaborated on this idea in the debate at the house concurrence on April 15. When pressed by Representative Karen Camper (D) about the security of the patient’s medical data, Faison said that "It's going to be collected the same way that all medical data is collected. No matter if you go and have an ingrown toenail at a clinic fixed or if you have surgery or if you have anything done, data is collected and we keep that data and stored and it's available to the public"

While medical claims data is almost certainly gathered, it’s not something subject to becoming a publicly-viewable repository. Faison conflates the existing practices of medical-records keeping with making those records fully public and inspectable– a dangerous obfuscation.

He also stated that ensuring the privacy of the patients is the reason why a number of amendments were added to the bill. He made sure to highlight the amendment made by the Senate, which removed the requirement to record the patient’s county of residence. He explained that this was done to be “in line with all HIPAA standards for de-identified data.”. He then argued that with this data point removed, there would be no risk of patients being identified by the data contained within the report.

The summary of one the amendments pertaining to patient privacy also details how it supposedly protects the patients in question. The summary of Amendment 1 tells the casual observer that “the annual statistical reports to the speaker of the senate, the speaker of the house of representatives, and the legislative librarian must not identify individual gender clinics but must aggregate such data[,] and the statistical reports published on the department's website must not include aggregated data.” In short, the reports will not have data on the gender clinics where this healthcare is taking place, and the raw data in question will not be released publicly.

All in all, Faison and his co-sponsors argued that this bill is crafted so that the government can study the effects of trans medicine on trans people in Tennessee, while ensuring the privacy of the patients will be protected.

It is a carefully crafted impression that may have served to help the law pass through the legislative process. 

This impression of the law is a lie.

3.2: The Public Will Have Access to Raw Data

The summary of Amendment 1, which supposedly protects the privacy of the patients whose data is being collected, actually lays out how exactly this law goes from a government mandated survey to a potential doxxing threat. 

Let's take another look at the summary: “the statistical reports published on the department's website must not include aggregated data.” To those without experience in data science, the lack of aggregated data available to the public sounds like a guarantee of privacy. Casual readers might interpret the phrase “must not include aggregated data” in this way.

What this phrase notably does not say, and what it avoids addressing, is what happens to the raw, un-aggregated data. This is only ever addressed in the actual text of the bill, and not in how its sponsors are promoting it. 

Amendment 4 lays out what happens to the raw data:

AND FURTHER AMEND by deleting subdivision (g)(2) in SECTION 2 and substituting:

(2) The department shall make the statistical report available to the public on the department's public website in a downloadable format; provided, the data in the report on the department's public website is not aggregated. The data contained in such report must not identify individual providers.

Emphasis added by The Needle

In short, the law mandates that the raw data collected on trans patients be released to the public. This data will be available to download. What having this in the form of un-aggregated means in practice is that there will be a data point corresponding to every patient whose data was collected. 

That data point will have all the info which the government requested, in a format that links each (anonymized) patient to each piece of info about them. That will include records containing age, sex, medications, dosage, specific dates, and complete mental health diagnosis history. We will discuss how dangerous this is shortly.

The only limiting factor is that the public will not be told which individual providers offered such care. This does not however mean that the clinic where the provider works will remain hidden, as that is part of the raw data.

This threat did not go unaddressed. Representative Justin Jones (D) proposed an amendment to prevent the release of raw data. The amendment was defeated in a vote along party lines. Every House Republican voted for the public release of this data.

3.3: How Many People Will Be Affected?

The reason why the release of raw data on trans patients is so dangerous, even when their names are not included, is that it can easily be used to de-anonymize the patients, and as a result, can be used to share all sorts of unrelated medical information about them.

Let’s start with determining how many people will be affected by this data release. This is all back-of-the-napkin math, but in the absence of more detailed statistics, it will have to do. 

The state of Tennessee has a population of 7.4 million, 5.6 million of whom are adults who can legally obtain trans healthcare in the state. According to the Williams Institute, 0.7% of the population of the US South is transgender. When divided against the adult population of the state, you get an approximate trans population of 39,000 people. 

However, the affected population will be smaller than this. The reporting mechanism is triggered by people getting HRT through a doctor, or by getting some trans-related surgery within a given year. As a result, it will not be triggered by those trans people who do not medically transition, those who obtain it through medical codes that do not indicate that they are trans, or who obtain their hormones or surgeries outside of formal medical channels. 

These people will not be counted, and their medical data will not be sent to the state government. We do not even have reasonable guesses on how many trans people fall into one of these categories in the state, so I will not attempt to guess at that. The ultimate number of persons affected is less than 39,000, but we don’t know how much smaller.

There is also the question of how effective the data collection of this process will be. Tennessee is not the first state to assemble lists of trans people (more on that later). However, this method appears to be more effective at compiling such a list.

Aleksandra Vaca of Transitics explained that:

I think it’ll be more effective than the attempts we’ve already seen in Indiana, Kansas, and Texas. Kansas, for example, only invalidated ~1,800 driver’s licenses—around 10–20% of the estimated number of trans people in the state—because it had to rely on legal transition data. The same goes for Indiana, where the list of trans people who changed their birth certificates is 1,558 names long despite [there] being ~26,000 trans people in the state. Texas’ list is only <200 names long due to not being retroactively compiled.

Meanwhile, Tennessee won’t be targeting identity documents. Instead, it’ll be going after medical transition data, and that’s a process that a lot more trans people go through. 

In short, this process will likely be more effective than previous attempts to make lists of trans people.

3.4: The Ease of De-anonymizing Data

The primary threat of this is in how easy it will be to match the dataset to the actual people it is taken from. Aleksandra Vaca explains that “the biggest concern is that although it may end up doing so anyways, the state doesn’t even need to compile the data itself; because it’ll be released to the public in a highly detailed report, it all comes down to how well hate groups are able to piece the data together.”

There is a large body of evidence that it will be trivial for hate groups to do this. The small population size of those affected, combined with a large amount of data which is considered quasi-identifiers, creates a system which can easily be used to identify a person.

Quasi-identifiers are pieces of information that are less specific than a person’s name or address, but when added together, can be used to identify a person in the data.

The most notable example is the date of a given medical procedure. HIPAA requires that for any such info to be made public, any info on the date in question which is more specific than the year it was conducted must be removed. This law requires that the day in question be released. This is a quasi-identifier. 

Another example that is specific to trans people is what clinic a person is going to. Trans healthcare is usually treated as a type of specialty care, where patients have to travel to specific clinics to get that care. This is usually an endocrinologist (in the case of HRT) or a plastic surgeon (in the case of surgery). There are a fairly limited number of these in a given area, meaning that if you know where someone lives, you can easily find out where their clinic is, or vice versa. 

These quasi-identifiers have long been understood to pose a grave risk in terms of de-anonymizing the people involved. In a landmark study, Latanya Sweeney detailed the ease of de-anonymizing a person using publicly available data. Quoting from her study on the matter:

It was found that 87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}. About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person.

The exact data points being collected by Tennessee are not exactly the same. It collects age rather than date of birth, and there is no reliable marker of location besides the nearest clinic. Nonetheless, the sheer number of quasi-identifiers connected to any particular person are so vast, and the population contained in the dataset is so small, that matching a given profile onto a given person can be made trivially easy.

Medical privacy standards are written so that the public is protected from this exact kind of exposure. This is why Representative Faison said that the info released is "in line with all HIPAA standards for de-identified data". This is technically true, but it misses a key detail. HIPAA prohibits doctors from releasing patient data without the patient’s consent in most cases. However, doctors are protected from any resulting liability if the release of such data is required by law. As a result, this law will supersede medical privacy legislation.

Tennessee’s new law will release such info, regardless of the risk it poses.

3.5: How Reidentification Works

Using this dataset to identify a person does not require any sophisticated training or tools. All it requires is existing information on a person. As testimony on the bill made clear, “It would not be difficult to identify patients with all of this information... Particularly in smaller communities where there are a limited number of providers.”

There is also the fact of how much data is attached to every profile. If you can identify a person based on the profile, you can also learn every other piece of info gathered about them.

The following are a few examples of how this can be done. For the sake of argument, let's say that the list contains 20,000 people.

Family: Imagine that a family member suspects that another family member is trans. They know the subject’s age and birth sex. This alone might filter out as much as 99% of the list, bringing the number of matches from 20,000 to 200. From this field, they can filter for any medical or mental conditions that the subject has. For the sake of argument, say this narrows the field by 95%, from 200 to 10. They can then take the 10 people left, and look at what clinics the services were offered at. Most people will only travel great distances for medicine if there are no better options. As a result, most such services will be in the same general area that the person lives in. If someone lives in a major metropolitan area, there might be more than one person with the same profile. If someone lives in a rural area, it will probably be a 1-to-1 match.

As an additional quasi-identifier, each profile has the dates of relevant medical services. If the family member is aware of any unexplained absences or unexplained expenses, these can be compared against the dates on the profile.

This wouldn’t exactly be a hard confirmation that the person in question is trans. However, this is enough circumstantial evidence that most people would be convinced that the person they are investigating and the person in the profile are the same. If the subject were confronted with this much circumstantial evidence, many would fold and admit it. After all, people have been convicted in courts for less.

A Stalker: Imagine that a subject is being harassed, either by an individual stalker or as part of a wider harassment campaign. In this case, the relevant information about a person is already known to the harassers. In this case, the info about a person can be used to filter through the dataset. From there, all collected data on them becomes available. Since the database contains the details on medication and surgery, that would all be freely available to the harassers. Any embarrassing info about the subject would be fully available.

Bulk Identification: The greatest risk does not come from targeted attacks on specific people, but from the risk of large numbers of people being identified at once. This is not as complicated as it sounds, and could be done fairly easily.

In Tennessee, legal name changes are made by petitioning the court of the county in which you live. All relevant proceedings are a matter of public record. This includes a person’s old and new names, the county they lived in at the time, and the date at which the order was granted.

This is all important, since trans people tend to change their legal names shortly after they begin medical and/or social transition. This would not be a hard link between a court record and a data profile, however, it would be a notable correlation between the two. Given the small dataset, this could be enough to match people to the anonymous profiles released in the report.

One dataset of court issued name changes contains old and new legal name changes, legal sex, county of residence, and date of court order. The dataset of medical records contains age, legal sex, treatment dates, state residence, and information on treatments. 

To identify a large number of people at once, one would only need to match name changes to data profiles. Given the small population size, it would be relatively easy to get exact matches between both sets. This becomes all the more relevant when you realize that many trans people state in their court filings that they are changing their name because they are trans. In such cases, they are almost certainly somewhere in the dataset. 

When you get a match, you are matching evidence that a person is trans with their name, county, any existing court records, and a rough estimate on when they started transitioning.

Let's set up an example. Someone looks through every name change where a first name is associated with one gender to another within a given county. They then cross-reference this with all people in the database who went to a clinic in that county. Since the population in most counties are very small, you could identify most trans people in the dataset within a given rural county. And that’s before you add on other evidence.

What makes bulk identification the most dangerous method is how easy it is to pull off, and how many people can be affected. It could be easily done by an algorithm built for that purpose.

Ease of Identification: None of the methods I have been describing are anything new. Every technique listed has been a common doxxing technique for decades. What makes this situation unique is how the government is actively providing a list of people to be targeted.

3.6: A Government-Sponsored Doxxing Campaign

The result of all this is nothing less than a government-sponsored doxxing list. The government is assembling data on a section of its citizens, littering that data with quasi-identifiers, and releasing that dataset to the public. Sections of the public can match that dataset with existing public information, so as to create a database of trans people containing all manner of personal information about them. The result will be that most trans people in Tennessee can expect to be publicly identified and outed by their own government.

3.7: Social Effects

It is difficult to say what the social effects of this will be before it actually happens in December. However, absolutely nothing good can come of this.

Under such a system, any attempt to hide being trans would be impossible for most trans people who medically transition. The record of their doctor visits, as well as the medicine they use to transition, would be in the public eye. 

The most obvious detriment of this is when someone is doing background checks. If a trans person is the subject of a background check, and one of the first things to come up about a person is that they are part of a hated minority, and the evidence for that comes from data vetted by a state government, that is going to severely affect how that trans person is treated. 

This becomes a massive issue in any formal context. Trans people are already disproportionately likely to face employment discrimination. The more obvious it is that a person is trans, the more likely that discrimination is to manifest. Having a public registry of trans people will throw any ambiguity about this question out the window. Anyone on the list will face the full brunt of anti-trans discrimination.

Trans people in Tennessee will know that any attempt to transition through formal channels will be used against them, and that that information will end up in the hands of the public. They will be living under a surveillance and public shaming system built specifically for people like them.

4: Double Standard for Detransitioners

At the same time that the government will be gathering data on trans people, it will also be gathering data on detransitioners. This is done to make a report on their healthcare, similar to that being proposed for trans people.

However, the breadth of the information gathered on this form, and what the info will be used for, are very different.

4.1: Data Collection

The form for detransitioners requires much less information about the patients than the form for trans people. It only requires the following information:

(1) The number of insurance claims made for detransition procedures;

(2) The age and sex of an individual receiving a detransition procedure;

(3) If known, the date that the individual initially began a gender transition procedure; and

(4) The state… of residence of the person receiving the gender transition procedure.

As with the first dataset, the requirement to list a person’s county of residence has also been removed for detransitioners.

This is far less personal data than what is asked of trans people receiving similar medical care. Whereas doctors of trans patients are expected to hand over a comprehensive medical history of said patients, doctors of detransitioners only have to list some demographic data about said patients.

4.2: Different Risk Profiles

The reason for this double standard is obvious when we examine the nature of the two reports which the government seeks to publish on the two groups. As of the Senate’s amendments to the bill, both reports must be made “available to the public on the department's public website in a downloadable format; provided, the data in the report on the department's public website is not aggregated.”

Even though both datasets will be publicly available, the different quantities of data contained within them, and the lack of public interest in de-anonymizing the data on transitioners, means that the breach of privacy and accompanying risk of harm will be far greater for trans people than for detransitioners.

Let’s start with the data for detransitioners. The only datapoint being collected which might be considered a quasi-identifier is the date at which they initially began transitioning. However, this data only has to be recorded if the doctor actually knows the date, and there is no requirement to ask after that date to put it on the form. As a result, a large portion of detransitioners will have no information in the dataset which could be used to identify them. Therefore, that portion of them will not have to fear being identified through the use of this dataset.

Compare that to the vast number of quasi-identifiers in the data for trans people. I will not go over the same details twice. However, it is especially notable that doctors are required to give an extensive medical history for trans people, the group which the Tennessee government despises, and are expected to give anywhere near as much info on detransitioners, whom the state views as sympathetic.

Detransitioners also do not have to fear this information about them being used for discriminatory purposes in the same way that trans people do. Whereas the political party pushing this and similar anti-trans laws has been clear on its desire to “remove transgenderism from public life”, it uses detransitioners as a sympathetic foil to trans people and the broader ability to medically transition. This is reflected in the public sympathy given to detransitioners. They are seen as having been misled by trans people, and are therefore seen as worthy of public support. This is why the author of the law is so insistent that this law is being passed for the benefit of detransitioners.

By contrast, trans people are among the most vilified and distrusted people in the United States. This is especially true in a state whose right–wing politics are as extreme as that of Tennessee. Given a chance to learn who in their communities is part of a hated minority group, many will use the data to do just that. From there, all sorts of horrible outcomes become possible.

In short, Tennessee has the same requirement to make a public report for both groups. However, the data within the reports, and the potential risk profiles of the patients, are vastly different.

5: The Wider Campaign to Make Lists of Trans People

Tennessee is not alone in its goal of assembling a list of trans people. It is only the latest state to try making such a list, a goal which Republican politicians have been pursuing at the state level for years.

The most famous example of such a list is that created by Kansas. This was done by flagging when people changed the gender marker on their driver’s license, an administration action which almost universally marks a person out as trans. This list was then used to revoke their ID’s.

Indiana has been laying the groundwork for similar administrative moves. A report by Transitics revealed that the state is using changes on driver’s licenses to mark who is trans, and to similarly revoke their driver’s licenses.

Texas has also used changes to driver’s licenses to make a list of trans people in the state. It has not clarified the purpose of this list.

At the federal level, several anti-trans organizations have been lobbying the FDA for even more aggressive campaigns to assemble lists of trans people. In December, a coalition of over a dozen such groups wrote a petition to the FDA calling for a registry of all trans women, to be assembled from compiling all estrogen prescriptions given to people born as men. This method of making a trans list would be narrower in scope than what Tennessee plans to do, but given that it would be targeted at the federal level, it would affect far more people in total.

While the Government of Tennessee is hardly the first government to assemble a list of trans people, they would be the first to release information from that list to the public.

6: What to Do Going Forward

If you are getting HRT through a doctor in Tennessee, expect to end up on a government registry by December. I wish I could end on something less depressing, but that is the reality of the situation.

If you want to avoid this while still medically transitioning, you have a few options. 

The easiest option is to get your healthcare outside of the state. This might be annoying, but you won’t be on the list. 

The next best option is to leave the state. This is difficult and stressful, but people manage to do it every day. If you are out of the state, and not getting your medication in the state, then they have no means of tracking you through your medicine. In the long term, this is the safest option available to you.

Lastly, you can get your HRT through someone other than your doctor. Trans people do this all the time, for any number of reasons. If you don't know how to do this, you should ask trans people in your local area how they do it. The method is different depending on where you live. However, there are a number of people who can help you get started.

Whatever you do in response to this, I beg you not to stop your hormones. I understand the urge to do so, but the consequences of this to your health would be disastrous.

The signatories of this law want to scare you out of living out as a trans person. Do not give them the satisfaction of complying.