April 16, 2024

Wyden, Sanders, Jacobs, and 40 Democrats Urge Hospitals to Protect Patients’ Sensitive Medical Records from Partisan Fishing Expeditions

Far-Right AGs Spark Mental Health Crisis Following Demands for Personal Health Information of Transgender Teens and Adults

Washington, D.C. – U.S. Senator Ron Wyden, D-Ore., Rep. Sara Jacobs, D-Calif., with 42 members, urged hospitals and health care providers to take action to protect sensitive medical records from partisan fishing expeditions carried out by extremist state attorneys generals by using the tools already available to them under federal law, in letters sent today.

“These thinly veiled political assaults come at the expense of vulnerable patients. We are concerned that hospitals are feebly complying with AGs’ requests, betraying their obligation to protect patient privacy,” the members wrote, in a letter to the American Hospital Association, the Federation of American Hospitals, America's Essential Hospitals, the National Rural Health Association, and the Children's Hospital Association.

Wyden and other members called on these associations to encourage their members to adopt best practices for patient privacy and support their members in resisting abusive demands for patient medical records. The letter comes in response to a report by the Senate Finance Committee’s majority staff about trans healthcare record requests by attorneys general in Tennessee, Indiana, Missouri, and Texas, and how medical providers responded to those requests. While some providers protected their patients by fighting against overbroad requests for detailed medical records, Vanderbilt University Medical Center handed over tens of thousands of pages of patient information, including intimate information and photographs, to the Tennessee Attorney General (AG). 

The investigation by the Tennessee attorney general into young adults seeking transgender health care triggered a massive increase in individuals seeking emergency mental health care, including support for experiencing suicidal thoughts. Rainbow Youth Project (RYP), an organization that provides emergency behavioral health care, responded to 376 acute mental health crises from LGBTQ+ youth in the area in a single day, more than 100 times the project’s average call volume. 

“The devastating impact of patient medical record disclosures in Tennessee — which led to patients experiencing suicidal ideation — has demonstrated the unimaginable and extensive harms that occur when hospitals fail to protect patient privacy,” the members wrote. 

The letter is cosigned by Senators Bernie Sanders, D-Vt., Tammy Baldwin, D-Wis., Mazie Hirono, D-Hawai’i, Jeff Merkley, D-Ore., Sheldon Whitehouse, D-R.I., Elizabeth Warren, D-Mass., Martin Heinrich, D-N.M., Chris Van Hollen, D-Md., Alex Padilla, D-Calif., Brian Schatz, D-Hawai’i, Ed Markey, D-Mass., and Peter Welch, D-Vt. The letter is also co-signed by Representatives Pramila Jayapal, D-Wash., Mark Pocan, D-Wis., Mark Takano, D-Calif., Becca Balint, D-Vt., Robert Garcia, D-Calif., Rosa DeLauro, D-Conn.,  James McGovern, D-Mass., Alexandria Ocasio-Cortez, D-N.Y., Adam Schiff, D-Calif.,  Max Frost, D-Fla., Zoe Lofgren, D-Calif., Barbara Lee, D-Calif.,  Rashida Tlaib, D-Mich., Anna Eshoo, D-Calif., Summer Lee, D-Pa., Ayanna Pressley, D-Mass., Suzanne Bonamici, D-Ore., Val Hoyle, D-Ore., Eleanor Holmes Norton, D.C., Cori Bush, D-Mo., Sylvia Garcia, D-Texas, Raúl Grijalva, D-Ariz., Andrea Salinas, D-Ore., Jasmine Crockett, D-Texas, Nikema Williams, D-Ga., Jared Huffman D-Calif., Valerie Foushee, D-N.C., Stephen Lynch, D-Mass., and Ted Lieu, D-Calif.  

While transgender teens were the target of this round of abusive records requests, any vulnerable group of patients could be similarly singled out by political investigations, the lawmakers warned. 

“Hospitals must act to protect Americans from the harm caused by partisan state AGs who have weaponized their legal authority against the transgender community,” they wrote. “It is only a matter of time before AGs expand the use of the surveillance tools to target others seeking necessary medical care, like abortion care.”

Although the Health Insurance Portability and Accountability Act (HIPAA) provides some privacy protections for patient medical records, that law allows providers to disclose medical records to law enforcement officials in response to an administrative request if the requested information is relevant and material to the investigation, and specific and limited in scope, and de-identified information could not reasonably be used. However, if requestors fail to satisfy that three-part test, providers can challenge the validity of these requests. Further, providers can always seek to narrow requests by exercising the legal recourse available to them. 

Wyden, Jacobs, and the other members asked the hospital associations to help their members take the following steps to protect the privacy of patients’ medical records: 

  • Hospitals should consider implementing data minimization and destruction policies.
  • Hospital administrators should establish policies and procedures to respond to legal demands.
  • Hospitals should insist on a higher legal standard in response to demands by law enforcement for unredacted patient medical records
  • Hospitals should closely review whether an out-of-state AG has any legal authority to demand medical records beyond its state border.
  • Hospitals should consider referring out-of-state demands to their state AG’s office when their state AG has a demonstrated track record of protecting patient privacy, so that they may work in partnership to evaluate the claim.
  • Hospitals should proactively and promptly notify patients about record disclosures to law enforcement entities and AGs. 
  • Hospitals should require law enforcement to provide specific and detailed supporting information for having satisfied the three-part test for receiving identifiable patient information, prior to sharing any patients’ medical information. 
  • Hospitals should refuse to hand over medical information in response to demands that merely rephrase the three-part test in the affirmative. 

The letter asks the hospital associations to consider these best practices, establish additional best practices, and schedule a roundtable this year, with relevant stakeholders, where a toolkit on best practices will be disseminated.

Read the full letter to hospital associations here. 

###