Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS

To investigate a website

A four-person telehealth clinic published a page saying the effects of puberty blockers are "completely reversible." The Justice Department says that may be misbranding, and subpoenaed the names, dates of birth, addresses and Social Security numbers of every patient the clinic had ever prescribed a puberty blocker or a hormone. On Friday a divided Ninth Circuit panel reversed the judge who had thrown the subpoena out — and published the opinion, which makes it binding on every federal district court in the circuit.

You booked the appointment on a website. Fifteen minutes, free, to talk about whether you might have gender dysphoria. Then you uploaded your records and your consent forms to a patient portal, and then you were on a video call with a doctor, and at the end of it you had a prescription.

The Justice Department would now like your name, your date of birth, your address, your Social Security number, and your parent or guardian's details.

On Friday a divided panel of the Ninth Circuit said it could try. The case is QueerDoc, PLLC v. DOJ, No. 25-7384, decided on 14 August. QueerDoc is the clinic — an online practice prescribing puberty blockers and hormones, minors included, in ten states. Its website names three doctors and an administrator.

The subpoena came in fifteen parts, most of them ordinary: personnel files, billing codes, pharmacy contracts. Requests 11 through 13 are not. They demand the records of every patient ever prescribed a puberty blocker or a hormone, and, in the subpoena's own words, "[d]ocuments sufficient to identify each patient." Judge Richard Paez, dissenting, put a number on it: "thousands of intrusive patient and employee records."

Here is what the government is investigating. Not a pharmacy. Not a manufacturer. A website.

The legal theory runs through the Food, Drug, and Cosmetic Act's ban on misbranding a drug, and misbranding includes publishing false or misleading "labeling." Labeling, the Supreme Court held in Kordel v. United States in 1948, does not have to be attached to anything: "No physical attachment . . . is necessary." And the FDA's own rule extends it to virtually any "printed, audio, or visual matter descriptive of a drug." So QueerDoc's public web pages qualify, and the majority names them: two pages of instructions for self-injecting hormones, and a page saying the effects of puberty blockers are "completely reversible."

That last sentence is the alleged crime. The Social Security numbers are the investigation.

No grand jury, no judge, no warrant

This is an administrative subpoena under a provision of HIPAA, 18 U.S.C. §3486, which lets the attorney general or a designee compel documents in any investigation of a federal health care offence. No grand jury. No judge. No warrant. No showing of probable cause. The only way to fight one is to move to quash, and the burden falls on the recipient.

QueerDoc moved to quash, and on 27 October 2025 a federal judge in Seattle, Jamal Whitehead, threw the subpoena out entirely. He found it issued for an improper purpose: to carry out the President's stated objective of ending gender-affirming care. The paper trail was not subtle, and none of it is in dispute. An executive order signed in January 2025 told the department to prioritise investigations of this kind. In April then-Attorney General Pamela Bondi told every Justice Department employee the goal was, in the majority's own summary, to "bring [gender-affirming care] to an end." On 11 June, his first day running the civil division, Brett Shumate sent the same message to his own staff and served QueerDoc with this subpoena.

The documents are not in dispute: an executive order, two memos, then the subpoena. The panel split 2–1 on whether the sequence is evidence of purpose.
The documents are not in dispute: an executive order, two memos, then the subpoena. The panel split 2–1 on whether the sequence is evidence of purpose.

The Ninth Circuit reversed. Judge Carlos Bea, a George W. Bush appointee, wrote the opinion; Judge Daniel Bress, appointed by Trump, joined it; Paez, appointed by Clinton, dissented. None of the paper trail, the majority held, is evidence of bad faith. "The President may direct DOJ to exercise its statutory authority in a manner that aligns with his broader policy goals."

How the panel got there matters more than that sentence does. It did not disagree with Whitehead about what the department had done. It reclassified what kind of thing his conclusion was. A trial judge's findings of fact survive appeal unless they are illogical or unsupported; legal conclusions get no such protection. Whitehead's finding of improper purpose was, Bea wrote, not a finding at all: "The issue here is not one of fact. The district court conducted no evidentiary hearings and took no testimony." Inferring purpose from the Administration's public statements "did not amount to fact-finding but rather the drawing of legal conclusions from undisputed facts."

Paez called that misguided and pointed to Anderson, a 1985 Supreme Court decision saying the opposite: deference applies even where a judge's findings rest on "documentary evidence or inferences from other facts." The case turned on which of those two sentences you believe.

The majority, he wrote, "manufactures legal errors that will require federal courts to rubber stamp investigations initiated by the DOJ to harass opponents and chill disfavored causes, so long as the investigation serves the President's policy priorities." He ended harder still, with a sentence judges do not often write about their colleagues: "I am doubtful the majority would so contort the governing law and our precedent if this case did not promise to impede access to gender-affirming care."

And he asked the question the majority never answers: if the point is to find out whether a drug has been misbranded, "how are children's names, dates of birth, social security numbers and addresses relevant to this purpose?"

Broad by design

The government's position is stronger than the outrage around it allows. Administrative subpoenas are meant to be broad. The Supreme Court calls what Congress handed agencies "powers of original inquiry" — permission to look before having a case. Relevance is the only real filter and the bar is deliberately low. And Bea makes a point that is hard to answer: "even if the subpoena is overbroad — an issue the district court did not reach and the parties briefed only minimally — the proper remedy would be to narrow it, not to quash it in its entirety."

That is ordinary law, and probably right. Whitehead threw out all fifteen requests, including the personnel files and the pharmacy contracts QueerDoc never objected to.

Which raises what settled law means here. QueerDoc's subpoena is not a one-off. It carries a number, and so do the others: in a footnote Paez lists rulings on subpoenas 25-1431-014, -016, -019, -030 and -032. On 9 July 2025 — the day QueerDoc's own return was due — the department announced the campaign in a press release headed "Department of Justice Subpoenas Doctors and Clinics Involved in Performing Transgender Medical Procedures on Children." At least seven courts, Paez writes, have "quashed, recommended quashal, or modified these subpoenas" — seven rulings, five of them on the subpoenas he numbers.

One of those numbers, -032, is the Rhode Island case, where a court found in May 2026 that the department had already agreed to anonymised data in several jurisdictions. Paez cites it for the obvious question: if anonymised records will do elsewhere, what is the identifying information for?

QueerDoc's is the first of these subpoenas to be decided by a federal court of appeals — a First Circuit appeal was docketed first, in November, and is still pending. The majority was not following settled law when it reversed. It was making it.

Will the patients be told?

Nothing in the opinion says they will. The opinion runs ninety-five pages. The majority gives patient privacy two sentences, both handing the problem to somebody else: the district court "may entertain any objections specific to DOJ's requests for patient medical records," and the court and the parties "should also consider whether protective orders or other devices should be used to ameliorate any concerns about privacy." Should consider. No protective order exists. No screening team is described. Notifying the people whose files are in the pile never comes up at all.

They are not parties, and cannot be. The only party who can object for them is the clinic that treated them — and had the clinic complied by that deadline, as most recipients do, none of this would have a docket number.

The first page of the opinion says FOR PUBLICATION. An unpublished disposition would have bound nobody else. A published one is precedent: every federal district judge from Arizona to Alaska now has to follow it the next time the government issues a subpoena that looks political.

Nobody's Social Security number has changed hands. The panel ordered no production; it sent the case back to Whitehead to decide whether the subpoena is too broad and too burdensome. The clinic can still win.

QueerDoc was founded by Crystal Beal, a board-certified family physician who teaches at the University of Washington. The website the Justice Department is investigating is still up. On the page introducing the people who work there, this notice sits above their biographies:

"We have removed most of our teams images for safety in these current times!!!! We know it is hard not to have a face for a name when you are meeting a new provider. We made this decision to try to help protect our team and continue to provide you care as long as possible."

The clinicians have taken their own faces down. The government wants the patients' names.

References (2 sources)

References

  • Opinion, QueerDoc, PLLC v. DOJ, No. 25-7384 (9th Cir., filed 14 August 2026), FOR PUBLICATION,

95 pages. Panel: Paez, Bea, Bress; opinion by Bea, dissent by Paez; argued 6 March 2026, Seattle. Retrieved directly from the court, HTTP 200, 595,550 bytes, and read in full. https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/14/25-7384.pdf

  • Below: Jamal N. Whitehead, W.D. Wash., quashed the subpoena in its entirety on 27 October 2025.
  • Authority: 18 U.S.C. §3486. Labeling: Kordel v. United States, 335 U.S. 345, 350 (1948);

21 C.F.R. §202.1. Subpoena breadth: United States v. Morton Salt Co., 338 U.S. 632, 642 (1950). Deference: Anderson v. City of Bessemer City, 470 U.S. 564, 574 (1985).

  • The campaign: Bondi Memo, 22 April 2025, implementing §8(c) of EO 14,187; Shumate memorandum,

11 June 2025; DOJ press release, 9 July 2025, quoted in the opinion. The other subpoenas are cited in Paez's dissent at footnote 6, including In re Admin. Subpoena 25-1431-032 to R.I. Hosp., 2026 WL 1392565 (D.R.I., 14 May 2026), the anonymised-data finding.

  • The clinic: https://queerdoc.com/ for the free fifteen-minute session and the patient portal

described at the top of this piece, and https://queerdoc.com/meet-the-team/, HTTP 200, 482,272 bytes, retrieved 17 August 2026. The staffing and the closing notice come from that page, not from the opinion. /about-us/ returns 404.

Not established, and not asserted. Whether any patient has been notified, or ever will be. What the district court will do on remand. Whether QueerDoc has sought rehearing en banc — review by a larger panel of the court — the docket showed no such petition when this piece was filed, which is a statement about one retrieval and not about the future. How many patient records are in scope: Paez says "thousands"; the desk has seen no count. And nothing here is a view about the medicine — the question in the case is who gets the names, not whether the prescriptions were right.

Further Discussion

The Alleged Crime Is A Sentence On A Web Page

QueerDoc is a telehealth clinic whose website names three doctors and an administrator, prescribing puberty blockers and hormones to patients in ten states. It published a page saying the effects of puberty blockers are "completely reversible." That sentence is what the Justice Department is investigating. Under the Food, Drug, and Cosmetic Act, misbranding a drug includes false or misleading "labeling" — and labeling, since *Kordel v. United States* in 1948, does not have to be attached to anything. A web page counts. To investigate that page, the department subpoenaed the names, dates of birth, addresses, Social Security numbers and parent or guardian details of every patient the clinic had ever prescribed a puberty blocker or a hormone. On Friday a divided Ninth Circuit panel reversed the judge who had thrown that subpoena out. Three facts to hold onto: 1. **No judge approved this.** It is an administrative subpoena under 18 U.S.C. §3486, a HIPAA provision letting the attorney general or a designee compel documents without a grand jury, a warrant, or any showing of probable cause. The only defence is to move to quash, and the burden falls on whoever received it. 2. **The paper trail was not in dispute.** In April 2025 the then-attorney general circulated a memo stating a goal, in the majority's own summary, to "bring [gender-affirming care] to an end." The majority did not say the trail was absent. It said it was not evidence of bad faith: "The President may direct DOJ to exercise its statutory authority in a manner that aligns with his broader policy goals." 3. **The reversal turned on a reclassification, not a fact.** Findings of fact survive appeal unless illogical; legal conclusions do not. Judge Bea held that the district judge's finding of improper purpose was never a finding at all, because he "conducted no evidentiary hearings and took no testimony." Judge Paez, dissenting, asked what nobody answered: if the question is whether a drug was misbranded, "how are children's names, dates of birth, social security numbers and addresses relevant to this purpose?" A Rhode Island court found in May 2026 that the department had already agreed to anonymised data elsewhere. And the opinion says FOR PUBLICATION. It is now binding on every federal district judge in the circuit. Nobody's Social Security number has changed hands yet — the panel ordered no production and sent the case back. But the clinic has already taken most of its clinicians' photographs off its own website, "to try to help protect our team and continue to provide you care as long as possible."

An Ordinary Subpoena Fight, Decided On Ordinary Grounds

Strip the politics out and this is administrative-subpoena law working the way it has worked since 1950, and the government wins that argument more easily than the outrage suggests. Administrative subpoenas are supposed to be broad. The Supreme Court calls what Congress handed agencies "powers of original inquiry" — permission to look before you have a case. Relevance is the only real filter and the bar is deliberately low. That is not a Trump-era invention; it is *Morton Salt*, decided in 1950. Three facts to hold onto: 1. **Twelve of the fifteen requests are unremarkable.** Personnel files, billing codes, contracts with pharmacies. Requests 11 through 13 are the ones anyone objects to — and the district judge threw out all fifteen, including the ones QueerDoc never objected to. 2. **The remedy for an overbroad subpoena is normally to narrow it.** Judge Bea's sentence is hard to answer: "even if the subpoena is overbroad — an issue the district court did not reach and the parties briefed only minimally — the proper remedy would be to narrow it, not to quash it in its entirety." 3. **Nothing has been produced.** The panel ordered no production. It remanded for the district judge to decide breadth and burden — the two questions he never reached. On that ground the clinic can still win everything it lost. None of that makes the department right. At least seven courts have quashed, recommended quashal, or modified subpoenas in this same campaign, and this is the first appellate ruling on any of them — a First Circuit appeal was docketed earlier and is still pending. Being first to rule is not the same as being followed, and a 2–1 published opinion is a thinner thing than it sounds. **The limb this desk cannot answer.** Whether an investigation can be lawful in every step and improper as a whole. The majority took the steps one at a time and found each defensible. Paez looked at the sequence — an executive order, a memo from the attorney general, a memo from the division head on his first day, then the subpoena — and saw a purpose. Nothing in administrative-subpoena doctrine tells a court which way to look, and this panel split 2–1 on exactly that.

Comics

#1The Alleged Crime Is A Sentence On A Web Page
#2An Ordinary Subpoena Fight, Decided On Ordinary Grounds