photo by: Kansas State Board of Healing Arts screenshot

A screenshot depicts a portion of the order revoking Jeremy Goates' athletic trainer license.

Updated at 6:21 p.m. Tuesday, March 3

The Kansas State Board of Healing Arts has revoked the license of an athletic trainer after he admitted accessing confidential medical records of women who had undergone breast augmentations.

Jeremy A. Goates admitted accessing hundreds of files, many of which had sensitive images in them, according to a consent order revoking his license, including before and after pictures of women who had undergone breast augmentations.

Goates admitted to the board that he accessed the images from home and for his “personal use” over the course of several months, a violation of the Kansas Athletic Trainers Licensure Act. His license, which he acquired in 2005, had been inactive for about two years, and through the consent order he surrendered it “effective as a revocation.”

Goates’ conduct is at the heart of a class action lawsuit filed by numerous women against LMH Health and the KU Health System claiming that their personal information, including nude medical photos, was improperly accessed by Goates at the University of Kansas Health System.

Goates has heretofore gone unnamed in court records, and he apparently has not been charged with a crime.

In a recently unsealed court exhibit in the lawsuit, however — a memo titled “Jeremy Goates interview” conducted March 3, 2023, by KU Health System employees — Goates initially denied accessing medical files, then said he did it to help a doctor remember and to do “cross referencing in my job.” When asked about accessing LMH Health clinic files and confronted with the fact that a “common theme” in hundreds of files was breast procedures, Goates said, “I may or may not have done this. I am not proud of this. It’s a problem I’m dealing with. I am losing my wife over this. Do I need an attorney criminally?”

The two interviewers — Terri Thompson, KU Health’s system director of privacy and privacy officer; and Cherie Smith, employee relations manager — said they could not advise him on whether he needed an attorney, and the conversation continued.

Goates indicated that he looked only at case files that involved plastic surgery, and he said, “I know I’m immoral, but I didn’t want to view oncology patients out of respect.” He said the picture viewing began at the end of 2022 when he stumbled across an available image and realized it was possible to see them. The interviewers told him that the access appeared to have started earlier, in June of 2022, and he didn’t dispute that.

They asked him if he had printed, downloaded or shared any images, and he seemed to deny that, saying, “This was for my personal use.”

When he asked the interviewers how his conduct would be reported, they told him that most likely a letter would be sent to patients telling them the files had been accessed without a job-related reason but that his name would not be in the letter.

“I thought I might be led out in handcuffs today,” Goates then reportedly told the interviewers.

The memo noted that the interview lasted about an hour and 40 minutes, and at its conclusion Goates was told that he would remain on administrative leave. No mention was made in the memo of the incidents being reported to law enforcement.

As the Journal-World reported in April, two women initiated a putative class action against KU and LMH Health demanding more than $5 million on behalf of at least 425 patients who had undergone various surgeries and procedures at Plastic Surgery Specialists of Lawrence, an affiliate of LMH. Patients say they suffered “grave invasions of privacy” when their most intimate medical files were accessed. Several more named plaintiffs have joined the lawsuit since its inception.

Their complaint alleges numerous legal violations, including computer fraud and abuse, negligence, breach of contract, invasion of privacy, intentional infliction of emotional distress and other claims.

Goates used his KU Health credentials for two years, the complaint alleges, to access the patient records, including nude photos, body measurements and other sensitive details, through an electronic records portal.

KU Health eventually terminated Goates but failed to notify law enforcement, the complaint alleges; instead, KU Health notified patients of patient-file breaches by an employee but without disclosing the exact nature and scope of what had occurred. LMH, the complaint says, did not provide any notice at all about the breach. However, LMH Health has said the hospital properly notified all patients impacted by a breach of health records.

Goates’ LinkedIn page identifies him as a certified athletic trainer who worked at the University of Kansas Health System for nearly eight years — from August 2015 until March 2023. It says his Bachelor of Science degree in athletic training came from KU, which he attended from 1997 to 2002.

Previous reporting by the Journal-World listed a Jeremy Goates as the athletic trainer for Lawrence High school in 2012. The Journal-World has asked a spokesman for Lawrence Public Schools about Goates’ past employment at Lawrence High. Spokesman Jake Potter said the district did not have a record of Goates as an employee. When asked for clarification on whether Goates had worked as an independent contractor or as something else, Potter said, “The district does contract for athletic training services,” but declined to confirm Goates’ past role at LHS, instead providing a link to an LMH website listing current athletic trainers.