Eto v. Mayo Clinic: Who Reviewed the De-Identification?

On July 6, 2026, Traci Tamiko Eto filed suit against Mayo Clinic in the District of Minnesota (Case No. 0:26-cv-03189, jury demanded). Eto served as Director of Research Operations from December 2023 to December 1, 2025, overseeing thirty-six employees and three managers in support of Mayo's Human Research Protection Program and IRB, and was designated to lead alignment with the October 2023 U.S. Executive Order on AI. ("AI compliance officer," a label used in some coverage, was not her formal title.)

The allegations — untested throughout

The complaint alleges that de-identification processes within the Mayo Clinic Platform, specifically those supporting data-sharing with global providers, were not properly reviewed by the IRB, and that data was shared without IRB review for use in a foreign country. It then alleges a retaliation arc: an internal legal report in February 2025, followed by exclusion from leadership meetings; a raise to roughly $166,000 in March 2025 followed by a performance-improvement plan; demotion in July 2025; FMLA leave; a September 2, 2025 RIF notice eliminating her role alone; and termination on December 1, 2025. The complaint pleads three federal counts — False Claims Act anti-retaliation (31 U.S.C. §3730(h)(1)), the ADA (42 U.S.C. §12112), and FMLA anti-retaliation (cited in the complaint with a §26 U.S.C. drafting slip; the FMLA is codified at 29 U.S.C. §2615). No state-law claim is pleaded. Mayo has responded that it is committed to responsible use of AI. Every allegation above is an untested plaintiff claim.

The records at issue

Whatever the merits, the evidentiary core of a case like this is a set of oversight questions: which review body considered which de-identification process, when, under which policy version, and with what authority. Those are exactly the record types the Medical AI Profile (MAP, v0.1.2 Working Draft) is being drafted to cover for AI-mediated clinical and research data flows. Two acknowledged VAP v1.2 gaps sit squarely on this case: current anchoring binds a policy identifier, not the policy document's text, so "which version of the review policy governed" is not yet cryptographically fixed; and the missing decision-authority vocabulary means "the IRB reviewed and approved" versus "a designee determined review was not required" have no standard, verifiable record form.

One more discipline point, because this is where drafts most often go wrong: this is a U.S. federal case. GDPR and the EU AI Act are not operative here and do not belong in its analysis — jurisdictional lanes stay separate.

What VAP would not have done

VAP takes no position on the retaliation claims and would not have made any de-identification process adequate or any review correct. Oversight decisions that produced no contemporaneous record are Tier 1: permanently unrecoverable, by design.

Per the normative non-guarantee clause, conformance “…does not warrant the correctness, fairness, or safety of the underlying AI decisions — only the integrity, completeness (at anchor granularity), and attributability of their records. VAP generates evidence; competent authorities and courts evaluate it.”
VAP v1.2 §1.6 (English text is normative)

Verified against: the filed complaint in Eto v. Mayo Clinic (D. Minn., 2026-07-06) and its docket; corroborating reporting by Becker's and Valley News Live; Mayo Clinic's public statement. All allegations remain untested.