The Trump administration is quietly pushing for unprecedented access to medical records of millions of federal workers, retirees, and their families.
A new proposal by the Office of Personnel Management (OPM) could grant the agency detailed access to personal medical data, raising concerns about privacy and the potential misuse of sensitive health information.
What is the Proposal?
A notice from OPM outlines a plan requiring 65 insurance companies, covering over 8 million Americans (including federal employees, retired members of Congress, postal workers, and their families), to provide monthly reports containing personally identifiable health data.
The data would include medical claims, pharmacy details, treatment encounters, and provider information.
Concerns About Privacy and Legal Issues
This proposal has sparked alarm among insurers, health policy experts, and legal professionals who are concerned about the legality and security of sharing such sensitive information.
Experts fear that having access to detailed health data could allow OPM to target or discipline individuals based on their political views or healthcare choices, particularly regarding sensitive issues like abortion or transgender treatment.
What Data Will OPM Access?
The proposed regulation does not require insurers to redact identifying information, making it clear that OPM would have access to highly detailed medical records.
This could include doctor’s notes, diagnoses, treatments, and provider interactions. Some experts worry that such access could lead to misuse or violation of privacy, especially given OPM’s history with data security issues.
Concerns Over the Agency’s Capabilities
While OPM has been increasing its analysis of health data to improve federal health plans, critics argue that the proposed access to identifiable data goes too far. Experts, including Jonathan Foley (former OPM advisor), worry about the agency’s ability to securely handle such detailed and personal information.
HIPAA and Privacy Laws
Under the Health Insurance Portability and Accountability Act (HIPAA), health data must be protected from unauthorized disclosure. OPM’s argument for needing the data “for oversight activities” raises questions about whether such a broad request is justified.
Legal experts, including Jodi Daniel, a former HIPAA privacy rule developer, have expressed concerns about the vagueness and overreach of the proposal.
Response from Insurers
Major insurers, such as Blue Cross Blue Shield, Kaiser Permanente, and UnitedHealthcare, have not publicly commented on their compliance plans. However, CVS Health and other groups have raised concerns about the legality of sharing personal health data without clear privacy protections.
CVS Health warned that insurers could face security breaches or legal consequences if sensitive health data is improperly shared.
The Risk of Data Breaches
The proposal also raises fears about data breaches. In 2015, OPM suffered a significant data breach that exposed the personal records of 22 million Americans, allegedly due to a cyberattack by the Chinese government. This history has made experts even more wary of granting OPM access to such sensitive data without proper safeguards.
Opposition from Health Organizations
The Association of Federal Health Organizations (AFHO) and other health advocacy groups have expressed strong opposition to the proposal, arguing that insurers are already bound by HIPAA to protect health data and should not be required to share it with OPM unless necessary.
AFHO chair Kari Parsons highlighted that OPM had previously sought similar data in 2010 but never finalized an agreement.
The Path Forward
OPM has not provided any updates since closing comments in March. For any change to occur, the agency would need to publish a final decision, which has not yet happened. Critics continue to call for greater transparency and stricter regulations to protect Americans’ personal health information.
