Vanderbilt University Medical Center is being investigated for sharing non-anonymized medical records without consent. This has triggered a clash between Tennessee law and HIPAA, resulting in a federal inquiry and a patient lawsuit. The U.S. Health and Human Services Office of Civil Rights is investigating, while transgender patients are pursuing legal action against privacy violations. The investigation stems from concerns over medical coding fraud and unauthorized data sharing. VUMC maintains its compliance with privacy laws and is in dialogue with the Attorney General’s office. The situation highlights tensions between patient privacy and legal obligations.
Vanderbilt University Medical Center (VUMC) is currently under scrutiny for revealing non-anonymized medical records to state authorities without obtaining patient consent. This has sparked a conflict between Tennessee state law and HIPAA regulations, resulting in both a federal investigation and a class-action lawsuit from affected patients.
The U.S. Health and Human Services Office of Civil Rights is conducting a federal investigation into Vanderbilt University Medical Center’s actions. Simultaneously, transgender patients are engaging in a legal battle, contending that the unauthorized sharing of their personal health information with Tennessee Attorney General Jonathan Skrmetti constitutes a breach of their privacy.
The Significance
Jonathan Skrmetti has defended his investigation into VUMC’s transgender clinic, explaining that his office is legitimately looking into potential medical coding fraud issues due to pre-existing “billing concerns.” He stated that his motivation is to safeguard taxpayer funds and that his office routinely investigates cases of medical coding fraud.
VUMC, represented by John Howser, its Chief Communications Officer, clarified that their actions were in line with federal and Tennessee healthcare privacy and security laws, including HIPAA. According to VUMC, they were obligated to provide complete medical records as per legal requirements.
VUMC received Civil Investigative Demands (CIDs) from the Tennessee Attorney General’s office in November 2022 and subsequently in March 2023. These CIDs sought information related to an investigation into VUMC’s billing practices for state-sponsored insurance plans covering gender-affirming healthcare.
The Investigation’s Origins
The investigation into VUMC’s transgender clinic was instigated by remarks made by its founder in a 2019 online video discussing documentation challenges. The investigators needed to match patient identities with claims data to proceed.
Dr. Shayne Sebold Taylor, in the video, explained how she codes for cases where insurance doesn’t cover transgender-related procedures. Skrmetti’s interview on NewsChannel5 featured a clip from this video where Dr. Taylor mentioned using the code “endocrine disorder – not otherwise specified” to order the required lab tests.
An anonymous Reddit post revealed that VUMC communicated through their MyHealth patient portal regarding the Attorney General’s investigation into billing for transgender care services. The portal stated that the Attorney General had the legal right to demand relevant documents, including patient medical records.
The Response and Legal Perspective
VUMC declined to comment on the Reddit post’s content, while the CIDs additionally sought more information about VUMC’s transgender services.
Abby Rubenfeld, representing plaintiffs in a class-action lawsuit against VUMC, argued that the actions of the Tennessee Attorney General’s office exceeded the boundaries set by federal health privacy law. Although exceptions exist for civil investigations, Rubenfeld maintained that some limits and guidelines should not have been disregarded.
The OCR’s Stance
The Office for Civil Rights (OCR) is regularly involved in investigating HIPAA violations related to information blocking and cybersecurity breaches. In a June 2022 HIPAA guidance, HHS noted that covered entities could disclose PHI based on other legal requirements.
VUMC’s Future Steps
VUMC’s legal counsel is currently engaged in ongoing discussions with the Attorney General’s office regarding the relevance of the information requested for the investigation.
A Commitment to Patient Care
VUMC emphasized its commitment to providing inclusive and personalized care to all patients, including the LGBTQIA community. They expressed regret that patients’ records had become part of the investigation and assured patients of their readiness to address questions and continue delivering necessary care.
