Why trans people can’t trust Tennessee with their data

Patients in Nashville receiving gender-affirming care from the Vanderbilt University Medical Center were told last month that their records had been turned over to the Tennessee Attorney General’s office. The request was made as part of an investigation into insurance fraud claims. 

The investigation comes at a time when the Tennessee state government has been proposing a barrage of legislation to limit access to healthcare for trans people. On July 8, a ban on gender-affirming care for minors went into effect. A block on the ban by a federal district judge was temporarily overturned by the Sixth Circuit Court of Appeals, a higher federal court, in a split decision after an appeal by Tennessee Attorney General Jonathan Skrmetti.

In such a hostile atmosphere, Skrmetti’s demands for records from the Vanderbilt’s Clinic for Transgender Health have alarmed patients.

Chris Sanders, executive director at Tennessee Equality Project, an LGBTQ advocacy organization, told me that the parents of young trans people have expressed fears that their children might be targeted. “When you’re a parent intent on defending your child, this looks like danger coming down the road,” said Sanders. 

States with aggressive anti-trans laws like Texas and Florida have been seeking large swathes of data on trans people. In the wake of the VUMC revelations, people are asking if Tennessee is taking a similar path. 

In September 2022, VUMC battled claims on social media, including by conservative politicians and religious leaders, that their gender-affirming care services were morally and legally objectionable and amounted to “money-making schemes.” Nashville, due in part to the VUMC clinic, has been seen as a haven for people seeking gender-affirming options in Tennessee. In response to allegations of illegal conduct, Attorney General Skrmetti said he would “use the full scope of his authority to ensure compliance with Tennessee law.” 

VUMC was required by law to turn over records to Skrmetti’s office. In response to a request for comment, the Tennessee Attorney General’s office directed me to its statement on June 21: “This investigation is directed solely at VUMC and related providers and not at patients or their families. The records have been and will continue to be held in the strictest confidence, as is our standard practice and required by law. This same process happens in dozens of billing fraud investigations every year.”

But on social media, many feared that Skrmetti’s data sweep was a gross violation of the 1996 Health Insurance Portability and Accountability Act and that VUMC could have done more to protect confidential information. In one tweet, a person who said VUMC had shared their data and that they were “terrified” claimed to have “challenged it with a HIPAA violation report.” In another tweet, containing a news clip from Nashville’s WKRN station in which the mother of a trans teen says she felt betrayed by the VUMC, several of the comments suggested VUMC had committed a HIPAA violation.

Jolynn Dellinger, senior lecturing fellow on privacy law and policy at Duke University School of Law, says that while HIPAA “is a pretty good law it’s widely misunderstood.” It only applies, she told me, “to a very small number of covered entities. The vast majority of health data is not covered by HIPAA.” 

As VUMC is a hospital, HIPAA does in fact protect its patient records, conversations with healthcare providers, and billing information. This means that the information cannot be shared without consent, but exceptions are made for law enforcement requests such as subpoenas and court orders. In this instance, a VUMC spokesman told reporters, the Tennessee Attorney General had the necessary legal authority to obtain the data.   

According to Dellinger, laws that are looking to criminalize access to gender-affirming care and abortion care leave the door open for authorities to seek people’s health data. On June 16, attorneys general from 19 states, including Tennessee, signed a letter addressed to the Secretary of Health and Human Services voicing their objection to a proposed expansion of HIPAA protections that would prevent states from exploiting their authority to fish for data. The dissenting attorneys general insist that the rule change “would unlawfully interfere with States’ authority to enforce their laws, and does not serve any legitimate need.” While focused on access to abortion, the complaints of Republican-governed states apply equally to those seeking gender-affirming care. 

Laws that restrict bodily autonomy, whether it is access to gender-affirming care or abortion, leave people vulnerable to a set of threats from state authorities that very much include demands for digital data.

Dellinger fears that laws that criminalize access to health care disincentivize people from seeking the care they need because they feel they can’t trust their doctor or that their medical records will be seized. Dellinger also said, “Once criminalization comes into play, privacy risks grow.” In their letter, the 19 state attorneys general argue that HIPAA recognizes that “privacy interests must be balanced against the ‘public interest in using identifiable health information for vital public and private purposes.’” 

Despite Tennessee Attorney General Skrmetti’s assertion that the VUMC patients’ records will be held in the “strictest” confidence, it is unclear how long that data will be held by authorities and whether it will continue to hold the data even after its investigation is complete. For now, though, Tennessee has taken another step in the legislative war that it appears to be waging against healthcare for trans people.

The decision this month by the Sixth Circuit Court of Appeals is the first time a federal court has overturned a block on the banning of gender-affirming treatment. Courts have unanimously blocked such bans, points out the American Civil Liberties Union, in Arkansas, Florida, Indiana, Alabama and Kentucky. In a statement, the ACLU’s Tennessee chapter described the court’s decision as a “heartbreaking development for thousands of transgender youth, their doctors, and their families.”

Since 2015, reported the Washington Post, “Tennessee has enacted at least 14 laws that restrict LGBTQ rights — the most in the nation in that time frame.” On June 22, a federal judge dismissed a lawsuit filed by a group of trans women from Tennessee who wanted the right to change the designated sex on their birth certificates. 

“It’s hard to exist as a transgender person in Tennessee at this moment,” said Jaime Combs, one of the plaintiffs. And now the state is asking the trans people whose rights it seeks to restrict to trust it with their data.