
The legislation doesn’t even define what’s supposed to be made public. In the worst case scenario (unlikely, but the law doesn’t prevent it!) everything collected could be made public. This includes the doctor’s name, patient age, county of procedure, date of procedure, and their entire mental health history. If you wanted to out someone you suspected to be trans and you knew a handful of details about them, these reports would potentially be able to confirm that for you
This is the case whenever “rare” characteristics end up in a dataset, including sparsely populated geographic regions, rare conditions, conditions that primarily affect a certain group, etc. This is why COVID data would sometimes say “no data” or “data not shown because of small population” for certain counties and age groups