The Missouri Attorney General’s Office is allowed to access patient health information as part of its investigation into the Washington University Transgender Center, an appeals court ruled Tuesday.
But Tuesday’s ruling does not end the fight for these otherwise confidential records nor will it open the floodgates for the attorney general to have untethered access to records. Instead, the circuit court must step in to tailor the requests and minimize the amount of protected health information that is ultimately shared.
Among the records requested in a February 2023 civil investigative demand was a desire for “all electronic health records of (the center’s) clients” and a list of all the Transgender Center’s patients.
“This court is very mindful of the breadth and depth of the attorney general’s requests to examine 1,165 minor patients’ most personal medical information,” Hess wrote. “Thus, the circuit court is empowered to modify the (civil investigative demands) as it deems appropriate under state and federal law.”
The decision touches on a notion that private information may already be in the attorney general’s hands. When the center received the initial requests for information, it provided “remote, read-only access to its electronic medical records system” alongside lists of patient information, prescriptions and billing data.
“The center abruptly changed its position, which prompted the attorney general to insist on receiving unredacted medical records with their metadata included,” Hess wrote.
The case is one of a handful of legal fights stemming from former Attorney General Andrew Bailey’s use of the state’s consumer protection law to probe into adolescent gender-affirming care through the state’s consumer protection law. Bailey began looking into the prescription of cross-sex hormones and puberty blockers to minors in early 2023, after a former case worker for the Transgender Center claimed in an affidavit that children were rushed into care.
The attorney general’s office did not immediately respond to a request for comment.
A mainstay of gender-affirming-care providers’ arguments against the civil investigative demands is that the attorney general is attempting to look into medical malpractice, which is outside the office’s jurisdiction. This point is left unanswered in Tuesday’s ruling, with Hess writing that it could be adjudicated in future legal battles if the attorney general files a claim against the center.
The court’s decision, Hess wrote, only applies to pre-claim investigative authority. And although the ruling did not shut down the probe for patient records, some of the attorney general’s claims asserting broad authority were rejected.
The office claimed in its appeal, written by former Solicitor General Josh Divine, that the attorney general’s office counts as a “health oversight agency,” in which HIPAA allows providers to share protected health information.
But because the investigation is looking into consumer fraud through the Missouri Merchandising Practices Act, it is not a matter of health oversight, the court determined.
Divine also wrote that civil investigative demands should be considered “orders” from an “administrative tribunal,” which is another occasion in which HIPAA allows disclosure. But these demands are not “independently enforceable orders,” Hess wrote.
The battle will return to St. Louis Circuit Court, where a judge must sort out whether de-identified records will suffice for the investigation.
