Vanderbilt University Medical Center, based out of Nashville, is currently under investigation by the Office for Civil Rights (OCR) for releasing transgender patients’ medical records to the Attorney General’s Office.
What happened
As reported in a June article, Vanderbilt University Medical Center (VUMC) agreed to release records of trans patients to the Attorney Genera’s Office. While VUMC released the records in late 2022, they only informed patients in June 2023.
The records were allegedly part of an investigation into medical billing, but with legislation related to transgender rights on the rise, the move sparked a significant backlash among privacy experts.
VUMC did not say how many patients were affected but said they released records of patients enrolled in TennCare insurance plans from as far back as 2018. Later, it was announced that they had also released information related to state workers and their families, as well as patients receiving gender-affirming care.
At the time, VUMC claimed they were complying with the law, and the Office of the Attorney General said the investigation was related to VUMC and providers, not patients. Still, trans crisis lines in Nashville received a significant uptick in calls as many trans patients expressed fear of potentially having their identity disclosed or losing access to care.
What’s new
Now, VUMC is facing a federal investigation coinciding with two patients suing the hospital. According to a news report by NBC, the patients suing over the information’s release argue that identifying information should have been removed before turning over the records.
Despite attorney general Jonathan Skrmetti claiming the records are part of a general investigation, many are alarmed by his past stance defending the proposed ban of gender-affirming care for transgender youth.
The OCR has not yet commented on the investigation.
What they are saying
In June, VUMC’s chief communications officer, John Howser, said, “The Tennessee Attorney General has legal authority in an investigation to require that VUMC provide complete copies of patient medical records that are relevant to its investigation.” Howser said VUMC had no choice but to comply.
Under HIPAA regulations, medical records may be released for a civil investigation, but they must be released in the least intrusive way possible.
Tricia Herzfeld, the attorney representing the patients who are suing, said, “The more we learn about the breadth of the deeply personal information that VUMC disclosed, the more horrified we are.” Herzfeld added that her clients were “encouraged that the federal government is looking into what happened here.”
Howser also said, “We have been contacted by and are working with the Office of Civil Rights.” He said VUMC had no further comment as the investigation is ongoing.
Read more: Lawmakers urge HHS to expand HIPAA privacy regulations.
The big picture
Those fearful of the investigation believe that their records could be used to further prosecute trans individuals or prevent gender-affirming care, which has become a significant source of contention in Tenessee.
In their release to patients, VUMC stated that the attorney general is not permitted to disclose medical records except in legal proceedings.
As the HHS investigates the situation, it could set a precedent as more states seek to ban or modify gender-affirming care.
Similar issues have arisen based on anti-abortion legislation, which has created renewed calls for better privacy protections for reproductive healthcare.
Related: HIPAA Compliant Email: The Definitive Guide.
Abby Grifno
