The Vanderbilt University Medical Center is under scrutiny in a federal civil rights investigation over the alleged unauthorized release of transgender patients' medical records to the Tennessee attorney general, the Nashville-based hospital system told CNN in a statement.

"We have been contacted by and are working with the Office of Civil Rights," John Howser, chief communications officer for the medical center, told CNN about the investigation by the US Department of Health and Human Services. "We have no further comment since this is an ongoing investigation."

CNN has reached out to the US Department of Health and Human Services and the Tennessee Attorney General's office for comment.

Last month, the Vanderbilt University Medical Center was sued by two people who claim they were among more than 100 current and former patients whose records were turned over to the Tennessee attorney general earlier this year, according to a lawsuit filed in the Davidson County Chancery Court.

The plaintiffs allege that Vanderbilt turned over non-anonymized medical records to the state without the patients' knowledge, and that the state's request for information was part of an effort "negatively targeting the transgender community," according to the complaint.

In a statement to CNN in response to the lawsuit, Howser said, "Vanderbilt University Medical Center (VUMC) received valid requests from the Office of the Tennessee Attorney General as part of its investigation which sought information about transgender care at VUMC. The Tennessee Attorney General has legal authority in an investigation to require that VUMC provide complete copies of patient medical records that are relevant to that investigation, and VUMC was obligated to do so. VUMC complies with all health care privacy and security requirements established under both Federal and Tennessee law, including but not limited to HIPAA."

Tricia Herzfeld, an attorney for the plaintiffs, told CNN her clients felt encouraged knowing that federal authorities are looking into the incident.

"The more we learn about the breadth of the deeply personal information that VUMC disclosed, the more horrified we are," Herzfeld said in a statement.

The plaintiffs filed their suit under a pseudonym, and CNN has not been able to reach out to them directly.

CNN has reached out to the Tennessee Attorney General's office for comment about the lawsuit.

In October of last year, the hospital suspended gender-affirming surgeries for minors, CNN previously reported. At the time, the Vanderbilt University Medical Center's chief health officer, Dr. C. Wright Pinson, said the suspension was due to an ongoing review of new guidance on treating transgender patients, and noted the review "may take several months."

When asked today about the status of that review, Howser said, "Since July 1, 2023, in Tennessee, through a new law, all gender-affirming care for individuals under age 18 is now illegal."

The move came amid pressure from Tennessee's Republican leaders, who sent a letter to the hospital requesting that Vanderbilt Medical halt all gender transitioning surgeries on minors.