E-FILED

7/24/2023 5:27 PM
CLERK & MASTER
DAVIDSON CO. CHANCERY CT.

IN THE CHANCERY COURT FOR THE TWENTIETH JUDICIAL DISTRICT

DAVIDSON COUNTY, TENNESSEE

PATIENT 1 and PATIENT 2, on behalf of

themselves and all others similarly situated,
Case No.
Plaintiffs,

v.
JURY DEMAND
VANDERBILT UNIVERSITY MEDICAL
CENTER,
Defendant.

CLASS ACTION COMPLAINT

1. The State of Tennessee has been negatively targeting the transgender community

for years. As part of that campaign, in late 2022 and early 2023, the Tennessee Attorney General

suddenly demanded that the Vanderbilt University Medical Center Transgender Health Clinic

(“VUMC”) turn over its patients’ medical records. VUMC knew about the State’s active targeting

of the transgender community. It had a duty to protect their medical information and their

identities. Nevertheless, without its patients’ knowledge, VUMC turned over non-anonymized

medical records for more than 100 current and former patients without redacting their identities.

In turning over this information, VUMC failed its contractual and legal duties, failed its patients,

and has caused them serious harm. Plaintiffs are among the many victims. They bring this Class

Action Complaint against VUMC to vindicate their rights and those of the other innocent victims.

1
 PARTIES

2. PATIENT 1 (“Patient 1”) received the notification that confidential protected

health information (“PHI”) was disclosed to the AG.1 Patient 1’s health coverage is through a state-

sponsored insurance plan. Patient 1 is a citizen of Tennessee and pursues this claim under a

pseudonym to protect their confidential identity and for fear of harassment from members of the

public and the government that have indicated hostility to patients like Patient 1 that receive care

through healthcare providers like VUMC’s transgender clinic.

3. PATIENT 2 (“Patient 2”) received the notification that confidential PHI was

disclosed to the AG. Patient 2’s health coverage was through a state-sponsored insurance plan.

Patient 2 is a citizen of Tennessee and pursues this claim under a pseudonym to protect their

confidential identity and for fear of harassment from members of the public and the government

that have indicated hostility to patients like Patient 2 that receive care through healthcare providers

like VUMC’s transgender clinic.

4. Defendant Vanderbilt University Medical Center is a Tennessee-based non-profit

providing healthcare services in Davidson County and throughout the Middle Tennessee region. It

is a leading provider of health care to transgender individuals in this region. It maintains its

principal place of business at 1161 21st Ave. S Medical Center North D-3300, Nashville, TN

37232. It may be served via its Registered Agent, National Registered Agents, Inc., 300 Montvue

Rd., Knoxville, TN 37919.

1
One of the harms alleged in this Complaint involves VUMC disclosing highly sensitive personal
health information without the knowledge or consent of the individuals who received that care.
For obvious reason, Plaintiffs in this matter are therefore suing pseudonymously.

2
 JURISDICTION AND VENUE

5. This Court has jurisdiction over this proceeding pursuant to T.C.A. § 16-11-101

because a substantial amount of the actions and inactions giving rise to these claims occurred in

Davidson County, Tennessee. Venue is proper pursuant to T.C.A. § 20-4-101(a) in that it is a

transitory action for declaratory relief and all or a substantial portion of the actions and inactions

that gave rise to these claims occurred within this County. Venue is also proper under T.C.A. § 16-

11-115.

FACTUAL ALLEGATIONS

I. Tennessee’s Current Governor and General Assembly Have a Long and Well-
Known Record of Targeting Transgender Individuals.

6. VUMC is aware of the treatment of transgender persons at the hands of the

Tennessee General Assembly and the Governor. Since 2015, Tennessee has enacted more anti-

LGTBQ+ laws than any other state in the country.2

7. The General Assembly and the Governor have enacted a record number of anti-

LGBTQ+ pieces of legislation in recent years – all passed by the General Assembly and quickly

signed by the Tennessee Governor. These include:

a. In 2021, two “bathroom bills,” limiting access to bathrooms for transgender

people.3

b. In 2022, a bill requiring the education commissioner to withhold a portion of

funding from public schools that allowed transgender athletes to participate in
sports.4 This bill was an extension of a ban enacted in 2021 for the sole purpose of
penalizing schools that allowed transgender athletes to participate.

2
ICYMI: Governor Lee Signed Tennessee’s Fourth Anti-Transgender Sports Ban into Law;
Making it the State’s 15th Anti-LGBTQ+ Law Since 2015 - Human Rights Campaign (hrc.org)
(last visited June 29, 2023).
3
Tennessee sued over transgender ‘bathroom bill’ for public schools | PBS NewsHour; Tennessee
to mandate bathroom signs about transgender use | AP News (last visited July 24, 2023).
4
Tennessee General Assembly Legislation (tn.gov) (last visited June 30, 2023).

3
 c. In 2023, bills: (1) against drag (SB 3/HB 9); (2) allowing private schools to prohibit
transgender athletes from participating in school sports (HB 306/SB 1237); (3)
deeming sex at birth an “immutable” characteristic (HB 239/SB 1440); (4) allowing
intentional misgendering of transgender individuals and excluding LGBTQ+
people from protection under Tennessee’s non-discrimination laws (HB 1269 / SB
466).

II. The Attorney General of the State of Tennessee Repeatedly Targets the
Transgender Community.

8. Attorney General Jonathan Skrmetti was sworn in as Tennessee’s Attorney General

(“AG”) and Reporter on September 1, 2022.5 Almost immediately, he joined the Governor and

General Assembly in targeting people who are (or are perceived to be) transgender.

9. On September 12, 2022, one of his first acts upon taking office was to lead other

attorneys general in objecting to efforts of the U.S. Department of Education to include gender

identity in Title IX’s protections against sex-based discrimination.6

10. On October 12, 2022, AG Skrmetti again led other attorneys general in demanding

that federal Attorney General Merrick Garland “stand down” in the face of statements regarding

pediatric gender dysphoria treatments that Skrmetti admitted would “provoke” threats.7

11. On February 15, 2023, AG Skrmetti joined other attorneys general in an amicus

brief defending Florida’s laws prohibiting transgender athletes from participating on women’s and

girls’ teams.8

5
Attorney General Jonathan Skrmetti (tn.gov) (last visited July 24, 2023).
6
AG Skrmetti Leads State AG Response to U.S. Department of Education’s Proposed Regulations;
Redefinition of “Sex” (tn.gov) (last visited June 25, 2023).
7
AG Skrmetti Leads Thirteen State Coalition Demanding U.S. Department of Justice Respect Free
Speech Rights of Critics of Irreversible Pediatric Transgender Procedures (tn.gov) (last visited
June 25, 2023).
8
TN AG Skrmetti Joins Multistate Coalition in Support of Florida Law Preserving Girls’ Sports
Teams for Biological Females (last visited June 25, 2023).

4
 12. On April 11, 2023, AG Skrmetti again joined other states’ attorneys general in an

amicus brief supporting Florida’s ban on Medicaid funds for gender transitioning procedures.9

13. On June 7, 2023, AG Skrmetti praised a bill that would define sex an “immutable”

characteristic, saying that “[t]his is an issue that really matters to us. We're fighting hard. This,

whether we want it to be or not, is a huge legal battle — and it looks like it will be for a while to

come.”10 To help fight the attorney general’s “huge legal battle[s],” Skrmetti added a $2.5 million,

10-attorney “strategic litigation unit” to “focus on ‘proactive litigation’….”11

III. The Attorney General Requested Personally Identifying Records for Transgender
and Perceived as Transgender Patients from VUMC.

14. On September 21, 2022 – while the AG was actively litigating cases seeking to

curtail or diminish the rights of the transgender community – the conservative commentator Matt

Walsh made inflammatory claims about services provided by VUMC.12 Walsh did not mention

Medicaid fraud. Tennessee’s elected leaders, including the Governor, could not point to specific

laws that they thought VUMC had violated.13 In response, VUMC asserted that it hadn’t broken

any laws.14 Nevertheless, in reaction to the tweets, Governor Lee publicly called for an

investigation into VUMC.12

9
TN AG Skrmetti Joins Brief Supporting Florida’s Ban on Medicaid Funds for Gender
Transitioning Procedures (last visited June 25, 2023).
10
Attorney General praises new state law defining sexes to avoid 'corruption of language'
(tennessean.com) (last visited June 25, 2023).
11
Attorney General beefs up office to take on feds, cities – Tennessee Lookout (last visited June
25, 2023).
12
Social media posts spark calls to investigate Tenn.'s VUMC | AP News (last visited July 24,
2023).
13
https://apnews.com/article/health-business-tennessee-nashville-vanderbilt-university-
6deb93f7dea92f1b2082c39f72b59766 (last visited July 24, 2023).
14
Gov. Lee calls for investigation into VUMC clinic (wkrn.com) (last visited July 24, 2023).

5
 15. The AG obliged. On November 2, 2022, the AG issued his first Civil Investigative

Demand (“CID 1”) to VUMC, purportedly to investigate “possible violations of Tennessee’s

Medicaid False Claims Act.”15

16. CID 1 stated:

17. CID 1 then demanded VUMC produce the following medical records:

15
https://apnews.com/article/health-business-tennessee-nashville-vanderbilt-university-
6deb93f7dea92f1b2082c39f72b59766

6
 18. The attachment contained 106 entries of individual patients without explanation as

to the source of the names on the list.

19. The list included individuals who are: (1) on the state employees’ health plan and

their family members, and (2) people who receive their health care through TennCare.

20. Some of the VUMC patients whose records were disclosed were not even patients

of the VUMC Transgender Health Clinic.

21. On March 14, 2023, the AG issued a second CID (“CID 2”). CID 2 requested

additional information and contained a similar exhibit with 106 entries. VUMC knew that it had

not broken any laws, and that the motivation for the investigation was a Tweet thread from a Daily

Wire columnist. VUMC was also aware of the anti-transgender agenda of the Governor, General

7
Assembly, and AG. At a minimum, VUMC should have pushed back on the AG’s request for

personally identifiable information.16

22. Nevertheless, it appears that instead of pushing back, VUMC simply complied with

the AG’s demand and turned over all requested records. Those records included the personally

identifying information of its patients and some of the most intimate details of their private lives.

VUMC did not inform its affected patients that it had done this.

23. On March 14, 2023 (that same day), the AG issued a third CID (“CID 3”). CID 3

dramatically expanded the scope of the requests from CID 1 and 2. It included a request that

VUMC produce “All communications between Dr. Melissa Ciperski and anyone working at

Centerstone regarding or related to a potential gender dysphoria diagnosis of a person receiving

mental health treatment at Centerstone during the relevant time period.”

24. Centerstone is a well-known mental health treatment facility that provides mental

health treatment for, among other conditions, gender dysphoria.

25. CID 3 contained the following requests:

16
Gov. Lee: Claims against Vanderbilt transgender health clinic ‘warrants a thorough
investigation’ (wsmv.com) (last visited June 26, 2023).

8
 26. As this list indicates, CID 3 included wildly overbroad records requests that

exceeded even the stated nature of the investigation. For example, it requested records for all

patients who were referred to the VUMC Center for transgender health – even if they never had

more than an initial office visit. It further requested all communications to or from a certain VUMC

email address – regardless of whether the communications involved patients who had used

Medicaid services or were covered by the state’s insurance plans.

9
 27. Thus, on its face, CID 3 far exceeded any information the AG would have

reasonably required to investigate claims under Tennessee’s Medicaid False Claims Act or any

other False Claims Act investigation.

28. VUMC turned over its patients’ medical files in response to one or more of these

CIDs. At the time, VUMC was aware of the parade of anti-LGTBQ+ legislation in Tennessee over

the past few years. Against that backdrop, its failure to safeguard the privacy of its patients is

particularly egregious.

29. VUMC therefore knew that the state of Tennessee was targeting transgender people

based on their transgender status. This alone should have given VUMC pause in turning over

personally identifying medical records with confidential PHI to the entity targeting its transgender

patients – but inexplicably it did not. Instead, in response to the AG’s CID, it appears that VUMC

did not even attempt to de-identify the information provided.

IV. Federal Law Required VUMC to Keep Plaintiffs’ Medical Information Private.

30. The Health Insurance Portability and Accountability Act (“HIPAA”) sets out

security provisions and data privacy responsibilities designed to keep patients’ medical

information safe. HIPAA compliance provisions, commonly known as the Administrative

Simplification Rules, establish national standards for electronic transactions and code sets to

maintain the privacy and security of PHI.17

31. HIPAA provides specific privacy rules that require comprehensive administrative,

physical, and technical safeguards to ensure the confidentiality, integrity, and security of PHI is

properly maintained.

17
HIPAA lists 18 types of information that qualify as PHI according to guidance from the
Department of Health and Human Services Office for Civil Rights, and includes, inter alia: names,
addresses, any dates including dates of birth, Social Security numbers, and medical record
numbers.

10
 32. Under federal law, VUMC is only able to produce PHI pursuant to a CID under the

following circumstances:

(1) The information sought is relevant and material to a legitimate law enforcement
inquiry;

(2) The request is specific and limited in scope to the extent reasonably practicable in
light of the purpose for which the information is sought; and

(3) De-identified information could not reasonably be used.

45 C.F.R. § 164.512(f)(1)(ii)(C) (emphasis added). None of these criteria applied here.

33. This regulation required VUMC to, at a minimum conduct a review and/or an

investigation to ensure that:

a. Any PHI produced pursuant to any of the CIDs issued by the AG only contain
relevant and material information;

b. The AG’s attempt to obtain the data was for a “legitimate” law enforcement need;

c. The CID only covered a limited time period;

d. VUMC understood the purpose for why the AG sought the information and that
any response was limited in scope to that purpose; and

e. Anonymous patient data could not be used.

VUMC does not appear to have done the necessary review or investigation.
34. VUMC released the PHI of its increasingly vulnerable patients to the AG’s office

without providing any safeguards of this personally identifying information.

35. The information that VUMC released to the AG included the most sensitive and

confidential medical information that its patients have. This could include the following types of

information:

a. Pictures of genitalia;

b. Gender identity unknown to others;

c. Mental health information;

11
 d. Private communications with clinicians that the patient may not have disclosed to
anyone else in the world;

e. Sexual history;

f. Sexual health history;

g. Mental health history;

h. Medication history;

i. Familial situations and relationships; and

j. Identity of intimate partners.

36. The disclosure of this information threatens (and as described below, actually has

caused) severe mental, psychological, and emotional trauma. Many of these individuals work for

the State of Tennessee itself – or are adult children or spouses of those state employees. They have

now had their private medical information and identities disclosed to the State of Tennessee. The

Tennessee AG office alone has over 350 employees and a budget of over $47 million. That does

not include employees and officials in other departments with whom those 350+ employees

necessarily interact with or encounter every day.

37. In a state that has become increasingly hostile to the LGTBQ+ community, many

of these individuals came to the VUMC transgender health clinic as a safe space. VUMC betrayed

their trust.

V. VUMC Fails to Adequately Protect Patient Data in Compliance with State Law
and its Own Privacy Policy.

38. Plaintiffs and members of the proposed Class are VUMC’s current and former

patients whose PHI appeared in any documents produced by VUMC in response to CIDs 1, 2, or

3 from the AG’s office.

12
 39. As a condition of receiving treatment, VUMC requires its patients to provide their

PHI to VUMC. VUMC warrants that it will safeguard this information under state and federal law

and its privacy policy.

40. In the ordinary course of business, VUMC maintains records of its patients’

information such as its patients’ full names, Social Security Numbers, financial account

information, credit-card information, dates of birth, prescription information, diagnosis

information, treatment information, treatment providers, health insurance information, medical

information, and Medicare/Medicaid ID numbers.

41. When VUMC collects this sensitive information from patients, it promises those

patients that it will use reasonable measures to safeguard the PHI from misuse.

42. In the Notice of Health Information Privacy Practices in place in 2022 (the “2022

Privacy Policy”), VUMC had informed its patients that it collects and maintains their PHI under

that policy’s terms).18

43. Under the Privacy Policy, VUMC warrants that it will disclose PHI to law

enforcement as follows:

18
A copy the Privacy Policy (obtained through the Wayback Machine) is attached hereto as
Exhibit A.

13
 44. VUMC therefore represented to its patients that, as a matter of contract, it would

safeguard their PHI and only disclose it in limited circumstances. Relevant here, it stated that

would disclose PHI to “law enforcement and other officials” only when “authorized or required

by law” or in “response to a court order, subpoena, warrant, summons, or similar process.” A court

order, a subpoena, a warrant, and a summons all require court process.

45. Accordingly, no patient reasonably would have expected that the catch-all term

“similar process” in the Privacy Policy would include handing over detailed, non-anonymized,

intimate, and personal medical information en masse to an un-elected state official without any

14
court process, review, or notice and an opportunity to be heard beforehand. Nevertheless, in breach

of its own Privacy Policy, VUMC did exactly that.

46. To make matters worse, VUMC did not even tell its patients that it did this.

47. Months went by and none of the patients knew that their medical information had

been comprised. Nor did they know that VUMC had revealed their gender identity to a politically

motivated AG, who was ostensibly pursuing a “billing” investigation.

48. In the meantime, a federal lawsuit had been filed challenging the State’s ban on

gender-affirming health care to transgender youth.

49. On June 1, 2023, a copy of the CIDs was filed on the public docket in that federal

case.

50. On June 2, 2023 (the next day – and months after the damage had already been

done) – VUMC sent the following email to some patients whose private medical information

VUMC had handed over en masse to the AG’s office:

15
 51. VUMC’s email did not mention that the public filing of the CIDs prompted its

belated notification to its patients. Regardless, the email was facially inadequate and incorrect.

52. As of the date of this Complaint, VUMC has failed to explain: (1) why it failed to

protect its patients’ information from the AG; (2) why it put its own interests in cooperating with

the AG above the need to keep sensitive patient information related to out of the hands of an

otherwise hostile governmental actor; and (3) why it violated its own contractual promises to its

patients about safeguard that information.

VI. Plaintiffs Fear for Their Safety After VUMC’s Breach.

53. Plaintiffs are current and former VUMC patients.

54. As a condition of receiving VUMC’s medical services, VUMC required Plaintiffs

to provide their PHI to VUMC.

16
 55. Plaintiffs reasonably believed, as part of the payments to VUMC for medical

treatment and services, that those payments included amounts for data security. If Plaintiffs had

known that VUMC did not conduct an investigation into the AG’s CIDs or that Plaintiffs’ private

PHI would be disclosed to the AG non-anonymized and without notice, then Plaintiffs would have

sought treatment elsewhere.

56. Since learning of VUMC’s actions, the named Plaintiffs have suffered significant

anxiety and distress, along with monetary damages. Collectively, they have been terrified for their

physical safety, have had significant anxiety and distress that has impacted their ability to work,

has caused them to increase home security measures, and drop out of activities in which they

normally would participate.

VII. Plaintiffs and the Proposed Class Face Significant Risk of Harassment as a
Result of the AG Having Continued Access to Their PHI.

57. Plaintiffs and members of the proposed Class have suffered injury from the misuse

of their PHI that can be directly traced to VUMC’s conduct.

58. Plaintiffs and the Proposed Class guard their health information and only wish to

disclose it to trusted individuals that they know will not harass them. In Tennessee, transgender

individuals and those perceived as transgender like the Plaintiffs and the Proposed Class face

significant threats of harassment, harm, and bodily injury from being transgender or perceived as

transgender. As discussed more fully below, a significant percentage of transgender individuals

and those perceived as transgender experience high rates of discrimination, harassment, and

violence. In the climate of hostility in Tennessee, transgender individuals and those perceived as

transgender are leaving the state in order to feel safe and secure. They are justifiably scared.19

19
'I'm definitely feeling scared': Transgender patients want answers after Tennessee's AG obtained
their medical records | WPLN News (last visited June 27, 2023).

17
 59. The Rainbow Youth Project, a non-profit that advocates for LGBTQ+ young

people, received hundreds of phone calls from families in varying degrees of mental health crisis,

including suicidal ideation, caused by VUMC’s actions in turning over records.20 Their fears are

justified. According to the FBI, anti-trans crimes rose by 41% between 2019 and 2020 alone.21

60. Because of their status, transgender individuals face increased discrimination in the

workplace (including losing their jobs and being harassed), face higher risk of assault (verbal,

physical, sexual, and lethal), increased risk of suicide, mental health issues, and increased risk of

suicide.22 They also face increased difficulties locating and receiving appropriate health care –

sometimes even discrimination by providers and insurers.23

VIII. Plaintiffs and the Class Members Have Suffered Damages and Have Otherwise
Been (and Continue to Be) Injured by VUMC’s Misconduct.

61. As a result of VUMC unlawfully disclosing Plaintiffs and the Proposed Class’ PHI

to the AG, Plaintiffs and the proposed Class have suffered (and will continue to suffer) damages,

including monetary losses, lost time, anxiety, and significant and serious emotional distress. They

also continue to face injuries going forward. They have suffered or are at an increased risk of

suffering:

a. The loss of the opportunity to control how their PHI is used;

b. The diminution in value of their PHI;

c. Out-of-pocket costs associated with obtaining additional mental health services to

deal with the stress, mental anguish, and grief associated with VUMC’s conduct;

20
Vanderbilt Medical Center Turned Over Trans Patient Records | Time (last visited June 27,
2023).
21
2020 FBI Hate Crimes Statistics (justice.gov) (last visited July 3, 2023).
22
USTSTNStateReport(1017).pdf (transequality.org) (last visited July 3, 2023).
23
USTSTNStateReport(1017).pdf (transequality.org) (last visited July 3, 2023).

18
 d. Lost opportunity costs and lost wages associated with the time and effort expended
addressing and attempting to mitigate the actual and future consequences of the
unlawful disclosure; and

e. The continued risk to their PHI, which remains in the possession of VUMC and is
subject to further breaches so long as VUMC fails to undertake the appropriate
measures to protect the PHI in their possession.

CLASS ACTION ALLEGATIONS

62. Plaintiffs bring this action on behalf of themselves, and all members of the proposed

Class (the “Class”) as defined as:

All individuals whose PHI VUMC disclosed to the AG in response to CIDs 1, 2, and 3.

The following people are excluded from the Class: (1) any judge or magistrate presiding over this

action and members of their families; (2) Defendant, Defendant’s subsidiaries, parents, successors,

predecessors, affiliated entities, and any entity in which Defendant or its parent has a controlling

interest, and their current or former officers and directors; (3) persons who properly execute and

file a timely request for exclusion from the Class; (4) persons whose claims in this matter have

been finally adjudicated on the merits or otherwise released; (5) Plaintiffs’ counsel and Defendant’s

counsel; and (6) the legal representatives, successors, and assigns of any such excluded persons.

63. The Class defined above is identifiable and ascertainable through objective criteria

using VUMC’s business records.

64. Plaintiffs reserve the right to amend the class definition.

65. This action is properly maintainable as a class action under Tennessee Rules of

Civil Procedure 23.01 and 23.02.

66. Numerosity. Plaintiffs are representative of the proposed Class, consisting of over

one hundred members, far too many to join in a single action.

19
 67. Commonality. There are many questions of law and fact common to the claims of

Plaintiffs and the Class, and those questions predominate over any questions that may affect

individual members of the Class. Common questions for the Class include, but are not necessarily

limited to the following:

a. Whether Defendant breached its contractual promises to safeguard Plaintiffs and

members of the Class’s PHI;

b. Whether Defendant conducted any investigation into the propriety of CIDs 1,2, and
3;

c. Whether, in compliance with state law or its contractual promises, Defendant took
reasonable measures to ensure that anonymous patient data could be sufficient to
respond to CIDs 1, 2, and 3;

d. Whether Defendant’s delay in informing Plaintiffs and members of the Class of the
unlawful disclosures was unreasonable;

e. Whether Defendant’s method of informing Plaintiffs and other members of the

Class of the unlawful disclosure was unreasonable;

f. Whether Defendant’s conduct in disclosing Class Members’ PHI violated

Tennessee law;

g. Whether Plaintiffs and members of the Class were injured as a proximate cause or
result of the unlawful disclosure;

h. Whether Plaintiffs and members of the Class were damaged as a proximate cause
or result of VUMC’s breach of its contract with Plaintiffs and members of the Class;

i. What the proper measure of damages is; and

j. Whether Plaintiffs and members of the Class are entitled to restitutionary,

injunctive, declaratory, or other relief.

68. Typicality. Plaintiffs’ claims are typical of the claims of other members of the

Class. Plaintiffs and Class Members sustained damages from VUMC’s unlawful disclosure of PHI

to the AG under the CIDs, false statements, concealment, and unlawful release of information.

20
Plaintiffs and members of the Class sustained similar injuries and damages as a result of VUMC’s

uniform illegal conduct.

69. Adequacy of Representation. Plaintiffs will fairly and adequately represent and

protect the interests of the Class and have retained counsel competent and experienced in complex

class actions to vigorously prosecute this action on behalf of the Class. Plaintiffs have no interests

that conflict with, or are antagonistic to those of, the Class, and Defendant has no defenses unique

to Plaintiffs.

70. Superiority of Class Action. A class action is also a fair and efficient method of

adjudicating the controversy because class proceedings are superior to all other available methods

for the fair and efficient adjudication of this controversy as joinder of all parties is impracticable.

The damages suffered by the individual members of the Class will likely be relatively small,

especially given the burden and expense of individual prosecution of the complex litigation

necessitated by VUMC’s actions. Thus, individual litigation to address VUMC’s misconduct

would be impracticable and ineffective. Even if members of the Class could sustain such individual

litigation, it would still not be preferable to a class action, because individual litigation would

increase the delay and expense to all parties due to the complex legal and factual controversies

presented in this Complaint. By contrast, a class action presents far fewer management difficulties

and provides the benefits of single adjudication, economy of scale, and comprehensive supervision

by a single court. Economies of time, effort, and expense will be fostered, and uniformity of

decisions ensured.

71. A class action is therefore superior to individual litigation because:

a. The amount of damages available to an individual plaintiff is insufficient to make

litigation addressing Defendant’s conduct economically feasible in the absence of
the class action procedural device;

21
 b. Individualized litigation would present a potential for inconsistent or contradictory
judgments, and increases the delay and expense to all parties and the court system;
and

c. The class action device presents far fewer management difficulties and provides the
benefits of a single adjudication, economy of scale, and comprehensive supervision
by a single court.

72. The litigation of the claims brought herein is manageable. VUMC’s uniform

conduct, the consistent provisions of the relevant laws, and the ascertainable identities of Class

members demonstrates that there would be no significant manageability problems with prosecuting

this lawsuit as a class action.

73. Adequate notice can be given to Class members directly using information

maintained in VUMC’s records.

74. Predominance. Pursuant to Rule 23.02(3), the issues in this action are appropriate

for certification because such claims present only particular, common issues, the resolution of

which would advance the disposition of this matter and the parties’ interests therein. Such

particular issues include but are not limited to the questions identified above.

75. This proposed class action does not present any unique management difficulties.

76. Rule 23.02(2) Equitable Relief Class. Also, with respect to equitable relief, the

requirements of Rule 23.02(2) are also satisfied. VUMC has acted or refused to act on grounds

generally applicable to the Class thereby making appropriate final injunctive relief or

corresponding declaratory relief with respect to the Class as a whole.

FIRST CAUSE OF ACTION

Breach of a Contract
(On Behalf of Plaintiffs and the Class)

77. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

22
 78. VUMC offered to provide goods and services to Plaintiffs and members of the Class

in exchange for payment.

79. VUMC also required Plaintiffs and the members of the Class to provide VUMC

with their PHI in order to receive goods and services.

80. In turn, and through the Privacy Policy, Defendant agreed it would not disclose the

PHI it collects from patients to unauthorized persons.

81. Plaintiffs and the members of the Class accepted VUMC’s offer by providing PHI

to VUMC in exchange for receiving Defendant’s goods and services and then by paying for and

receiving the same.

82. Implicit in the parties’ agreement was that Defendant would provide Plaintiffs and

members of the Class with prompt and adequate notice of any and all unauthorized access and/or

theft of their PHI.

83. As described above, VUMC’s privacy policies did not clearly or adequately notify

patients that VUMC would ever turn over their medical information and PHI without a court

process. The Policy indicated that records would only be turned over with Court involvement.

84. Plaintiffs and the members of the Class would not have entrusted their PHI to

VUMC in the absence of such agreement with VUMC.

85. Defendant materially breached the contract(s) it entered with Plaintiffs and

members of the Class by failing to safeguard such information and failing to notify them promptly

of the unlawful disclosure of their PHI. VUMC further breached the contracts with Plaintiffs and

members of the Class by:

a. Failing to properly safeguard and protect Plaintiffs and members of the Class’s PHI;

23
 b. Failing to investigate whether the AG sought Plaintiffs and the Class’s PHI for a
legitimate law enforcement need and whether de-identified information could
reasonably be used;

c. Failing to investigate whether the AG’s request for PHI was relevant and material
and failing to limit the scope of any PHI delivered to the AG; and

d. Failing to timely inform Plaintiffs and members of the Class that the AG sought
their PHI.

86. The damages sustained by Plaintiffs and members of the Class as described above

were the direct and proximate result of VUMC’s material breaches of its agreement(s).

87. Plaintiffs and members of the Class have performed as required under the relevant

agreements, or such performance was waived by the conduct of VUMC.

88. The covenant of good faith and fair dealing is an element of every contract. All such

contracts impose upon each party a duty of good faith and fair dealing. The parties must act with

honesty in fact in the conduct or transactions concerned. Good faith and fair dealing, in connection

with executing contracts and discharging performance and other duties according to their terms,

means preserving the spirit—not merely the letter—of the bargain. Put differently, the parties to a

contract are mutually obligated to comply with the substance of their contract in addition to its

form.

89. Subterfuge and evasion violate the obligation of good faith in performance even

when an actor believes their conduct to be justified. Bad faith may be overt or may consist of

inaction, and fair dealing may require more than honesty.

90. Additionally, for the reasons stated above, Defendant violated its 2022 Privacy

Policy by disclosing non-anonymized PHI to the AG in response to the CIDs. VUMC also violated

that policy any subsequent policy by failing to notify affected patients until months after it had

disclosed their records and PHI to the State.

24
 91. Plaintiffs and Class members fully performed their obligations under their contract

with VUMC. VUMC did not. Absent their contracts with VUMC, Plaintiffs and Class members

would not have provided their confidential PHI to VUMC. Instead, they would have retained the

opportunity to control their PHI for uses other than medical treatment, billing, and benefits from

VUMC.

92. VUMC failed to advise Plaintiffs and members of the Class of the unlawful

disclosure promptly and sufficiently. VUMC also failed to give Plaintiffs and Class Members

notice and a meaningful opportunity to object to the disclosure of their non-anonymized PHI

before VUMC handed it to the AG.

93. In these and other ways, VUMC violated its duty of good faith and fair dealing.

94. As a matter of contract, Plaintiffs and members of the Class have sustained damages

as a result of Defendant’s breaches of its agreement, including breaches thereof through violations

of the covenant of good faith and fair dealing.

SECOND CAUSE OF ACTION

Negligence
(On Behalf of Plaintiffs and the Class)

95. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

96. VUMC had a duty to protect the PHI of its current and former patients.

97. VUMC breached that duty by providing PHI to the AG in response to the CIDs.

98. As a result of Defendant’s conduct, Plaintiffs and members of the Class suffered

actual damages including increase in emotional distress, anguish, and higher costs of medical care

going forward. Plaintiffs and Class Members will also require additional mental health treatment

that they would not otherwise require but for VUMC’s conduct.

25
 99. Plaintiffs and Class Members also require a declaration and other forms of forward-

looking relief. This includes these forms of relief and the other requested in the Prayer for Relief:

a. A declaration that VUMC violated its Privacy Policy;

b. A declaration that that VUMC’s current Privacy Policy fails adequately to inform
patients of their rights and the terms under which PHI can be disclosed; and

c. An injunction against VUMC from disclosing similar PHI in the future without (a)
adequate due diligence; (b) a determination that the nature of the scope of the
document request is both lawful and actually tailored to the stated purpose of
investigation; and (c) anonymizing the data consistent with the law and patients’
privacy rights.

THIRD CAUSE OF ACTION

Claim for Declaratory and Injunctive Relief Under T.C.A § 1-3-121
(On Behalf of Plaintiffs and the Class)

100. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

101. Under T.C.A. § 1-3-121, “Notwithstanding any law to the contrary, a cause of

action shall exist under this chapter for any affected person who seeks declaratory or injunctive

relief in any action brought regarding the legality or constitutionality of a governmental action. A

cause of action shall not exist under this chapter to seek damages.”

102. With respect to this claim, Plaintiffs and the Class seek declaratory and injunctive

relief against VUMC.

103. This is an action regarding the legality of governmental actions taken by the AG as

to CIDs 1, 2, and 3 issued to VUMC.

104. Plaintiffs and Class Members are people who were affected by those actions.

Accordingly, they are “affected persons” under § 1-3-121.

105. For these reasons, Plaintiffs and the Class respectfully seek all remedies available

under § 1-3-121, including declaratory and injunctive relief.

26
 FOURTH CAUSE OF ACTION
Claim Under Patient’s Privacy Protection Act, T.C.A. § 68-11-1501
(On Behalf of Plaintiffs and the Class)

106. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

107. T.C.A. § 68-11-1501 et seq. is the Tennessee Patient’s Privacy Protection Act (the

“TPPPA”).

108. Under the TPPPA, “[e]very patient entering or receiving care at a health care facility

licensed by the board for licensing health care facilities has the expectation of and right to privacy

for care received at such facility.” T.C.A. § 68-11-1502.

109. For the reasons stated elsewhere in this pleading, VUMC violated that statutory

right by divulging the names, addresses, and other identifying information of the individuals

subject to CIDs 1, 2, and 3, without meeting any statutory exceptions. VUMC therefore violated

the TPPPA. (T.C.A. § 68-11-1503(c).)

110. Plaintiffs and the Class therefore seek all available remedies.

FIFTH CAUSE OF ACTION

Claim Under the Tennessee Consumer Protection Act, T.C.A. § 47-18-101 et seq.
(On Behalf of Plaintiffs Only)

111. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

112. T.C.A. § 47-18-101 et seq. is the Tennessee Consumer Protection Act (“TCPA”).

The act prohibits unfair and deceptive practices affecting the conduct of any trade or commerce.

113. The conduct described above resulted in VUMC violating the TCPA, and

specifically T.C.A. § 47-18-104, because VUMC:

(5) Represent[ed] that goods or services have sponsorship, approval, characteristics,

ingredients, uses, benefits or quantities that they do not have or that a person has a

27
 sponsorship approval, status, affiliation or connection that such person does not
have;

(12) Represent[ed] that a consumer transaction confers or involves rights, remedies or

obligations that it does not have or involve or which are prohibited by law.

(T.C.A. § 47-18-104 (b)(5) and (12)).

114. Plaintiffs and the Class therefore seek all remedies available under the TCPA.

SIXTH CAUSE OF ACTION

Intrusion Upon Seclusion
(On Behalf of Plaintiffs and the Class)

115. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

116. Through the actions described in this pleading, VUMC has intentionally intruded

upon the solicitude, seclusion, or private affairs or concerns of Plaintiffs and members of the Class,

under circumstances that would be highly offensive to a reasonable person.

117. Plaintiffs and the Class Members manifested an expectation of privacy in their

confidential medical records and associate PHI.

118. As set forth herein, Plaintiffs and Class Members have suffered injuries from

VUMC’s misconduct, including but limited to VUMC’s release of their information to the AG.

119. Plaintiffs and Class Members therefore seek all available remedies under this cause

of action.

SEVENTH CAUSE OF ACTION

Negligent Infliction of Emotional Distress
(On behalf of Plaintiffs and the Class)

120. Plaintiffs and members of the Class incorporate the preceding and following

allegations as if fully set forth herein.

28
 121. For the reasons stated herein, VUMC had a state or contractual duty to Plaintiffs

and Class Members to safeguard their medical records and PHI, breached that duty by disclosing

it and declining to be forthcoming about it, and was the cause in fact and proximate cause of

emotional injuries to Plaintiffs and Class Members. These injuries were foreseeable.

122. Plaintiffs and Class Members therefore seek all available remedies under this cause

of action.

GOOD FAITH CLAIMS

123. The claims advanced by Plaintiffs and in good faith, are not frivolous, and are filed

for the express purposes of extending, modifying, or reversing existing precedent, law, or

regulation, and for the express purpose of the establishing the meaning, lawfulness, or

constitutionality of a law, regulation, or U.S. or Tennessee Constitutional right on a matter of first

impression as defined in T.C.A. § 20-12-119. First, to the best of Plaintiffs’ knowledge, VUMC’s

actions and the AG’s CIDs are unprecedented under Tennessee law. They represent an incursion

of patient privacy for which Plaintiffs have not identified any Tennessee precedent. The case

therefore presents issues of first impression concerning the validity of Plaintiffs’ claims. Second,

to the extent that VUMC asserts immunity from suit under the Tennessee Patient Privacy Act or

HIPAA to defend its conduct, Plaintiffs bring this lawsuit to reverse, modify, or extend any

applicable statute, regulation, or precedent in that regard.

PRAYER FOR RELIEF

WHEREFORE, Plaintiffs, on behalf of themselves and all others similarly situated, request

the following relief:

A. An Order certifying this action as a class action and appointing Plaintiffs as Class
representative and the undersigned as Class counsel;

29
 B. A mandatory injunction directing VUMC to adequately safeguard the PHI of
Plaintiffs and the Class by implementing improved security procedures and
measures;

C. An injunction preventing VUMC from disclosing PHI without providing notice to

each member of the Class relating the full nature and extent of the proposed
disclosure and disclosing in the future PHI to unauthorized persons;

D. Enjoining Defendant from further deceptive practices;

E. An award of damages, in an amount to be determined;

F. For the individual TCPA claim, treble damages and punitive damages as allowed
by law;

G. An award of attorneys’ fees and costs;

H. An award of pre- and post-judgment interest, costs, attorneys’ fees, expenses, and
interest as permitted by law;

I. Granting the Plaintiffs and the Class leave to amend this complaint to conform to
the evidence produced at trial; and

J. Such other and further relief as this court may deem just and proper.

DEMAND FOR JURY TRIAL

Plaintiffs hereby demand a trial by jury on all issues so triable except for the issues of

attorneys’ fees and costs.

30
Dated: July 24, 2023 Respectfully submitted,

/s/ Tricia R. Herzfeld

Tricia R. Herzfeld (BPR #26014)
Benjamin A. Gastel (BPR #28699)
Anthony A. Orlandi (BPR #33988)
Herzfeld, Suetholz, Gastel, Leniski
& Wall, PLLC
223 Rosa L. Parks Ave., Ste 300
Nashville, TN 37203
Ph: 615-800-6225
Fax: 615-994-8625
tricia@hsglawgroup.com
ben@hsglawgroup.com
tony@hsglawgroup.com

Alyson S. Beridon (BPR #40040)

Herzfeld, Suetholz, Gastel, Leniski
& Wall, PLLC
600 Vine St. Suite 2720
Cincinnati, OH 45202
Ph: 513-381-2224
Fax: 615-994-8625
alyson@hsglawgroup.com

Abby Rubenfeld
Rubenfeld Law Office, PC
202 South Eleventh Street
Nashville, TN 37206
Ph: 615-386-9077
arubenfeld@rubenfeldlaw.com

31