Two patients sued Vanderbilt University Medical Center for violating their privacy by turning their records over to Tennessee’s attorney general.