Vanderbilt University Medical Center Investigated by OCR over Disclosure of Transgender Patients’ Medical Records
Vanderbilt University Medical Center is being investigated by the Department of Health and Human Services’ Office for Civil Rights (OCR) over the disclosure of the medical records of transgender patients to Tennessee Attorney General, Jonathan Skrmetti. VUMC provided the medical records of transgender patients to AG Skrmetti after receiving civil investigative demands for the data as part of an investigation into potential medical billing fraud. VUMC recently sent notifications to the affected patients informing them about the disclosure of their records, which started to be provided to AG Skrmetti in December last year.
The HIPAA Privacy Rule permits, but does not require, healthcare providers to disclose patients’ medical records for law enforcement purposes in certain circumstances, such as in response to an administrative request if the information being sought is relevant and material to a legitimate law enforcement inquiry. VUMC and AG Skrmetti both maintain that the disclosures were legal. AG Skrmetti said the records were requested in response to a run-of-the-mill investigation he was involved with. The investigation was launched in September 2022 after a VUMC doctor publicly described having manipulated medical billing codes to evade coverage limitations on gender-related treatments.
The medical record disclosures have been condemned by many members of the LGBTQ+ community. AG Skrmetti and other authorities in the state have expressed a hostile attitude regarding the rights of transgender individuals and a federal appeals panel recently approved a law in the state that bans hormone therapy and puberty blockers for transgender youth. There are fears that the information disclosed may be used against the patients. Two patients recently lawsuit against VUMC over the disclosures that alleges the records of 106 patients were provided to AG Skrmetti. Given the attitude of state authorities regarding transgender rights, the patients believe VUMC should have provided unidentified data – patient data that has had all personally identifiable information removed.
VUMC’s Chief Communications Officer, John Howser, recently confirmed that VUMC is assisting OCR with a civil rights investigation over the disclosures, although he did not provide any further information as the investigation is ongoing.
