Updated Nov. 11 at 3:30 p.m. 

The Psychological & Counseling Center sent an email out to 468 of its clients on Nov. 10 without blocking the recipients from seeing each other’s names. The content of the email was a satisfaction survey regarding the student’s recent visit to the center. Several students responded to all recipients of the email with sarcastic and angry messages regarding the breach of their privacy.

The PCC notified the Vanderbilt University Medical Center Privacy Office upon realizing their error, and the Privacy Office is investigating the matter, according to a follow-up email sent out to the student recipients. As part of an effort to “mitigate the effects” of the incident, copies of the email were deleted from the inboxes of students who received them.

According to the email, only unopened copies of the email were deleted, but several students who did open the email reported having the message deleted from their inboxes as well. Students whose messages did not get deleted were advised to delete the message from their inbox and from their trash folders. The Hustler is awaiting a comment from the Office of News & Communications regarding the removal of the emails.

This incident is a potential violation of the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy of medical information. The HIPAA Privacy Rule, formally called The Standards for Privacy of Individually Identifiable Health Information, “establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain healthcare transactions electronically,” according to the U.S. Department of Health and Human Services website.

“The Medical Center’s Privacy Office is investigating the circumstances that resulted in the email distribution from the Psychological Counseling Center,” John Howser, the Chief Communications Officer for the VUMC, wrote in an email to the Hustler. “The students are being notified of this error and appropriate steps are being taken to the ensure confidentiality of future email distributions.”

Carly Stewart, the president of Active Minds, released a statement on behalf of the organization in an email to the Hustler:

“While we have not been able to make contact with the PCC to confirm, we believe that the release was wholly unintentional. Active Minds understands that accidents do happen, and that this mistake, in particular, has serious privacy and personal implications for those involved. However, we do not believe that this error should overshadow or devalue the important work being done at the PCC.”

The Office of Civil Rights, within the U.S. Department of Health and Human Services, is responsible for reviewing HIPAA violations and determining the penalties inflicted, according to HIPAA.com, an informational website about the intricacies of HIPAA run by experts on the legislation.

There is a tiered fine system for violations which is dependent upon the “nature and extent of harm,” such as whether the action was intentional or neglectful and how many people were impacted by the violation. However, if the violation was unintentional and is corrected within 30 days, no civil penalty (fine) can be imposed. The Department of Justice can prosecute major HIPAA violations, such as deliberately acquiring and disclosing an individual’s health information, but that does not seem to apply in this case.

An individual who is concerned that their HIPAA rights have been violated can file a complaint with the Office of Civil Rights.

This story will be updated as new information is received. 

Read below for more of Carly Stewart’s email from Active Minds:

“If you are struggling, please continue to seek help. And know whole-heartedly that it is okay to be not okay. The PCC and its high-quality services still stand as a ally, and the primary resource, to the students on our campus in their times of need. Please do not let a mistake detract or discourage you from seeking help if that is what you need. If you do not feel comfortable now seeking help at the PCC, please contact another resource such as the Center for Student Wellbeing (615-322-0480), the National Suicide Prevention Lifeline (1-800-273-8255), the National Text Crisis Line (Text “GO” to 741741), or a private counselor in Nashville. The Office of Residential Life, including your RAs and Area Coordinators, are trained to assist you and put you in the direction of services, as well. Active Minds is also an ally for you in this time. Please do not hesitate to reach out to Carly Stewart or Laura Rice if you are struggling with where or how to seek services.”