The Story They Don’t Want Told
On January 15, 2025, UnitedHealthcare of Colorado (UHC-CO) crossed a line no insurer should ever cross. They took five recorded calls from a patient — calls about denied coverage for gender-affirming care — and packaged them with sensitive protected health information (PHI): surgical history, psychiatric medications, and identity details.
They sent it to the Grand Junction Police Department.
But what most don’t know: this was UHC’s second attempt. Internal evidence shows UHC first routed the same PHI to the Department of Homeland Security (DHS). When DHS declined to act, UHC pivoted to local police. Two bites at the apple, both without warrant, subpoena, or emergency justification.
And the question that matters most: why did they do this?
Why: Retaliation Disguised as “Safety”
The answer is not buried in statute books. It is political, personal, and strategic.
Silencing Advocacy: The patient — a trans woman — was not passive. She was documenting coverage denials, building a digital archive, and preparing litigation. AdministrativeErasure.org was already exposing UHC’s practices. Escalating her to DHS and police wasn’t about “safety.” It was about silencing speech and making advocacy carry the cost of fear.
Shifting Liability: At the time, UHC faced exposure over coverage denials and potential HIPAA non-compliance. By flipping the script, they reframed the patient not as a whistleblower but as a threat. That reclassification shifted attention from their misconduct to her supposed danger.
Profiling a Vulnerable Target: Trans patients are disproportionately surveilled and stigmatized. UHC exploited that stigma, banking on the idea that law enforcement and media would default to suspicion rather than empathy.
This was not accident. It was administrative erasure: a strategy of weaponizing bureaucratic tools to erase dissent and credibility.
“Deny. Defend. Depose.”
Just days after Luigi Mangione allegedly shot and killed UHG CEO Brian Thompson, the patient used three words to describe what RMHP and UHC were already doing to her:
“Deny. Defend. Depose.”
Deny needed care — estrogen, surgery, coverage.
Defend the denial with corporate compliance maneuvers.
Depose the whistleblower by framing her as a threat and dragging her into court.
Those words were not rhetorical flourish. They predicted exactly what came next: escalation to DHS, then police, then litigation. They captured the entire corporate playbook — deny the claim, defend the denial, and depose the patient into silence.
This phrase, now preserved in the civil complaint, crystallizes UHC’s retaliatory posture. It is the blueprint by which insurers turn patients into defendants, and defendants into erasures.
The 35-Day “Myth” of Imminent Threat
HIPAA contains one narrow exception for such disclosures: 45 C.F.R. §164.512(j) permits release of PHI without consent only when there is a good-faith belief in a serious and imminent threat.
But UHC’s own records destroy any “imminent” claim.
The last call was in December 2024.
UHC waited 35 days before shipping those calls to police.
Police closed the referral within 72 hours, filing no charges.
As detailed in Section XVI. The 35-Day ‘Myth’ of Imminent Threat, no threat is imminent after five weeks of silence. The delay itself proves the defense is hollow.
Exhibit L: The Paper Trail
The referral is memorialized in Exhibit L, a January 15, 2025 cover letter to GJPD. It lists:
Five audio recordings of patient calls.
Identifying PHI, including surgical and medication details.
Language portraying the patient as a potential threat.
What it does not include:
A warrant.
A subpoena.
Any reference to imminent danger.
Exhibit L reads not as a compliance response, but as a calculated attempt to hand-off reputational risk from UHC to law enforcement.
Automation Becomes Accusation
This wasn’t the work of one rogue employee. UHC deploys AI-driven monitoring platforms like Verint, NICE, and nH Predict. These systems flag patient calls for “risk” markers and auto-escalate.
Here, a distressed patient calling about estrogen coverage denials was flagged not as vulnerable, but as dangerous. The escalation pipeline — DHS first, police second — was likely triggered by algorithmic misclassification. Humans signed off, but machines paved the way.
Automation gave UHC cover: “the system flagged it.” But what the system really did was criminalize distress.
Media Echo: How Retaliation Travels
The police dropped the referral in three days. But the damage didn’t end there.
In July 2025, a local news article resurfaced the incident. By sequencing events and omitting context, it presented the patient as “investigated for threats.” The investigation’s closure — the fact that no charges were ever filed — was buried.
This media echo effect amplified stigma while shielding UHC. The insurer didn’t need to speak publicly. The narrative they seeded had already taken on a life of its own.
Why This Matters Beyond One Case
Civil Rights: If insurers can send patients to DHS for coverage complaints, the chilling effect is obvious.
HIPAA Integrity: The 35-day delay and 72-hour dismissal reveal how weak the “imminent threat” safeguard really is.
Trans Profiling: Distress over denied care was repackaged as public danger, reinforcing toxic stereotypes.
Policy Urgency: Current law doesn’t prevent multiple bites — DHS first, local next — until some agency takes action.
This is not just a violation. It is a blueprint.
Administrative Erasure in Action
The Administrative Erasure project defines this pattern: using bureaucratic processes to erase dissenters by reframing them as risks.
Escalation Ladder: UHC tried federal, then local, until someone might act.
Narrative Laundering: They didn’t have to prove a crime; they just had to seed suspicion.
Public Stigma: Once law enforcement was involved, even briefly, media could echo the narrative without liability.
What began as coverage disputes over estrogen and surgery became a manufactured threat investigation. That’s erasure, not error.
The Human Cost
This is not only about statutes and exhibits. It is about a trans woman whose identity and medical history were sent to DHS and local police without justification.
It is about waking up to learn your calls for care were reframed as “threats.” It is about carrying the stigma of an “investigation” even after it was dismissed. It is about knowing your insurer can erase your credibility with one email.
That is the cost of proxy surveillance: the patient pays in fear, reputation, and dignity.
Read the Full Report
The complete 23-page analysis, with exhibits and footnotes, is available here:
👉 Surveillance by Proxy: How UnitedHealthcare Evaded HIPAA Using Local Law Enforcement (PDF)
