Having learned more (see the additions to my reply to his reply), I wasn't even vaguely harsh enough. He should have done some jail time (a few weeks, a misdemeanor is enough), and if he reapplies to get back into MIT I hope the Dean he has to talk to doesn't go softhearted absent a major attitude adjustment that has yet to occur a solid half year later.

Of course, I'm also one of those members of the MIT community who believe Aaron Swartz should have done some serious time in Club Fed (> a year, i.e. felony), am not in the least swayed by his exit from a mess entirely of his own making ("If you aren't willing to do the time, don't do the crime.", incalculably stupid for someone who suffered from depression), and am rather perturbed by all those taking the side of a criminal again MIT to the point of committing even more crimes against the community, like this one.

To answer the rest of your points, it comes down to character, and his actions and most especially his responses afterwords conclusively demonstrate he isn't worthy of the trust which is required for this sort of access to people's health information.

I don't "dismiss his work" so much as "don't trust him or anyone of such poor judgement to work with him" with a service handling sensitive stuff.