Two patients sued Vanderbilt University Medical Center for violating their privacy by turning their records over to Tennessee’s attorney general.
Two patients sued Vanderbilt University Medical Center for violating their privacy by turning their records over to Tennessee’s attorney general.
I didn’t see anything about a court order, just state investigations.
Pardon, it was a civil investigative demand. As long as the AG provided a written statement that the information requested is relevant and material, specific and limited in scope, and de-identified information cannot be used, then judicial involvement is not required.
45 CFR § 164.512 (f) (1) (ii)