The Office of Personnel Management posted last month that it will begin routinely collecting identifiable, personal health information on more than 8 million people — despite concerns from privacy advocates and Democrats, who have demanded the agency drop the plan. The notice will go into effect July 24, allowing OPM to begin its collection at any point afterward.

In reaction to privacy concerns raised by insurers and others, OPM now says the identities of enrollees will be “pseudonymized” — meaning names, addresses, and Social Security numbers will be removed — before the agency’s analysts review the massive new health datasets it will soon begin receiving.

Birth years of enrollees will be retained, and the agency’s “technical staff” will receive member IDs that it will scramble into different, unique numbers before releasing them to other staffers, according to the notice.

But the notice also specifies that OPM retains the right to reidentify the records.

Sixty-five insurance companies will be required to routinely send OPM detailed data — including names, addresses, doctor information, diagnoses, prescriptions filled, and payment details — on health care services paid through the Federal Employees Health Benefits and Postal Service Health Benefits programs.

In a change to its original proposal, first reported by Ñî¹óåú´«Ã½Ò•îl Health News, the agency says it also wants to peek at records kept by Medicare, the federally funded health insurance for older and disabled Americans, to examine claims from federal employees and retirees, and their families, who depend on both programs.

In its latest notice, OPM argues that the vast trove of data is necessary to ferret out fraud and overpayments in the FEHB and PSHB programs. Those programs cost roughly , with about $50 billion covered by the federal government and $30 billion funded by enrollees. The Trump administration has ramped up efforts, led by Vice President JD Vance, to curtail what it says is rampant fraud and misuse of publicly funded health benefits.

The effort still faces criticism that it doesn’t go far enough to protect the privacy of federal workers and their families.

“Clearly, this administration has not earned our trust with Americans’ sensitive data,” Sen. Mark Warner (D-Va.) said in an emailed statement to Ñî¹óåú´«Ã½Ò•îl Health News. “If OPM wants to work in good faith to reduce fraud, they should come to Congress, including to folks like me who are engaged on this issue and represent many federal workers and retirees and their families, and work to build consensus and trust before implementing these sweeping changes.”

The , posted in December, sparked concerns in part because it did not specify what the Trump administration planned to do with the sensitive health information it receives — and did not instruct insurers to redact identifying information.

OPM General Counsel Kurt Dykstra said the detailed records are critical to the administration’s mission of rooting out fraud and could help identify fraud perpetrated not only by medical providers but also by enrollees.

But when pressed for instances of workers, retirees, or their relatives committing such fraud, Dykstra only noted generally that healthcare fraud does occur.

The information could demonstrate “potential anomalies in usage patterns that could be related to the individual, but really also could be related to the provider, the treater, the clinic — whoever it is that’s actually providing the care,” Dykstra told Ñî¹óåú´«Ã½Ò•îl Health News in an interview.

Records deemed suspicious by OPM’s data analysts could then be referred to the agency’s Office of the Inspector General for further investigation, which could include “determining who’s involved and what the potential issues are, what the ramifications look like,” Dykstra said.

OPM’s plan to collect and analyze medical records has prompted unease among unions and federal workers, to mass firings and layoffs — in some cases, they say, driven by political retribution — since President Donald Trump took office.

Health privacy lawyers say, too, that while pseudonymizing workers’ details is a step in the right direction, it might not go far enough to protect their privacy.

OPM’s notice mostly complies with the Health Insurance Portability and Accountability Act, the federal law commonly called HIPAA that protects sensitive health data from being shared, said Matt Fisher, a health privacy lawyer. But he noted one exception: The member ID that insurers provide enrollees can be used to identify them.

“The described process arguably comes down to trusting internal controls in OPM to ensure that data is walled off as proposed,” Fisher said in an email. “The ideal would be for only truly de-identified information to be shared in the first place.”

Insurers regularly share information about claims with employers who offer health plans to employees, in efforts to control costs. But since employers themselves are not covered by HIPAA, large datasets are typically de-identified, meaning the insurers remove identifying information such as employees’ names or addresses, to comply with the law.

Employers, too, have been accused of using health information to target employees for dismissals. Most recently, a group of Meta employees filed a lawsuit of using artificial intelligence to target for layoffs those who had taken medical or family leave.

Pseudonymizing details such as names or addresses would go only so far to protect privacy, since medical conditions in particular can make it very easy to identify certain employees, said Joseph Lorenzo Hall, a technologist at the Center for Democracy & Technology, a nonprofit that advocates for data privacy.

“The richer the data, the more likely it is going to be identifying,” Hall said.

“In this case, you may be the only person in a region that has that particular kind of medical procedure, condition, or even prescription,” he said. “All of those things can be extremely identifying, even when you remove or obfuscate or pseudonymize direct identifiers.”

Most federal retirees decide to continue with FEHB plans and enroll in Medicare once they turn 65, which provides more comprehensive coverage and allows family members to remain enrolled in FEHB plans, said John Hatton, the staff vice president for policy and programs at the National Active and Retired Federal Employees Association.

OPM wants to analyze medical records for those dual enrollees as well. The agency is asking for all of their cost and service use records from the Centers for Medicare & Medicaid Services.

Still, Hatton said, OPM’s latest notice provides more details about how the agency says it will use the sensitive health information it receives and safeguard it.

“It’s a big improvement over the last notice, which was very lacking in detail and explanation for why they wanted all the medical claims data and how they’re going to protect the privacy of the data,” Hatton said.

“We’d be open to seeing even more security around the privacy of the data so there really is a clear wall,” he added.

This article first appeared on Ñî¹óåú´«Ã½Ò•îl Health News and is republished here under a .

The Department of Health and Human Services is seeking data from little-known state systems that allow hospitals and clinics to exchange detailed, identifiable patient information, Ñî¹óåú´«Ã½Ò•îl Health News has learned.

In private meetings, some public health leaders have objected to giving Kennedy’s team access to such data, raising doubts that it’s legal or that the information would even be useful.

They have also expressed concerns about allowing the federal government to peer into the minutiae of Americans’ medical records, which could mean viewing anything from doctors’ notes to prescription history. HHS has offered no insight into how it will protect or handle the personal health information it obtains.

But Kennedy told Ñî¹óåú´«Ã½Ò•îl Health News that medical records are key to investigating the cause of autism, vaccine safety, and chronic diseases. And millions of dollars in grant money has poured into a Nebraska nonprofit that has assisted Kennedy’s effort, according to state records.

He and his advisers have been frustrated that federal access to Americans’ medical records has been limited.

“We need a good health record system, and one of the things that really surprised me most when I came into office is that there is — that the systems are broken,” Kennedy said in a May interview. “We’ve had to go to the states and, luckily, we’ve got a lot of cooperation from the states, but we now have databases together that we can actually do the studies on. Those studies are in motion.”

HHS has not publicly announced any new projects involving medical records and autism or vaccine research. Kennedy faced blowback last year when he proposed compiling the medical records of people with autism to create a federal disease registry — which health department officials .

But Kennedy said in May, “We have a whole pipeline of studies that will be done over the next year.”

Though the White House has steered Kennedy away from further changes to U.S. vaccine policy ahead of November’s crucial midterm elections, President Donald Trump has regularly echoed Kennedy’s doubts about vaccine safety and last week signed an executive order calling for the U.S. to reduce the number of vaccines recommended for children.

Kennedy’s political appointees and allies — including William “Reyn” Archer III, a former Texas health official and whom Kennedy hired as a senior adviser — have led the initiative for the health department to collect and examine medical records.

Federal officials met with leaders of the state-run health information exchange systems several times over the past year and asked how the personal medical records they maintain could be used for vaccine research, according to seven people who participated in the discussions or were familiar with them.

Craig Behm, who runs the Maryland health information exchange, said Kennedy’s team asked about how the vast trove of medical records they store from hospitals and health systems could be used to study vaccines.

“If this administration wants to conduct research on the effectiveness of vaccines, are you saying you all can help us conduct that research?” Behm recalled being asked by a top official at HHS’ health information technology office.

Last June, Behm and leaders of other state exchanges met with Kennedy’s top advisers to discuss sharing more medical data with federal agencies. The state organizations followed up with a pitch in October for a new surveillance system that would give the federal health department “real-time, 24-hour data feeds on opioid and chronic disease trends” within a year, according to a presentation reviewed by Ñî¹óåú´«Ã½Ò•îl Health News. Under the proposal, HHS would get data from 90% of the population’s medical records by 2028.

Administration officials regularly asked during the meetings how the records could be used to monitor vaccine safety. Kennedy has rejected the federal government’s current vaccine-monitoring systems; decades of research has shown immunizations are safe and effective for most people.

“Vaccine safety, or whatever words you want to use, has come up pretty consistently in those conversations,” said John Kansky, CEO of the Indiana Health Information Exchange.

Kansky sees the potential value of sharing information from the exchanges for public health but is worried about the focus on vaccines: “It’s like, oh man, I wish you would have picked something that pushed fewer buttons for people.”

A System To Monitor Chronic Disease

Nearly every state has at least one health information exchange — often regulated by state laws and run by private companies or nonprofits — that enables hospitals and health systems to immediately share patients’ medical records with one another. The systems allow doctors and nurses to quickly pull up nearly anyone’s medical history and records at emergency rooms or share after-visit summaries and notes with patients’ primary care providers, for example.

In certain circumstances — most often dealing with cases of infectious diseases such as measles or flu — the exchanges notify public health authorities, like the state health department or the Centers for Disease Control and Prevention. Using the exchanges for broader public health purposes is not an unusual idea in itself. But it can present privacy, legal, and ethical complications, health officials say.

In the end, Behm said his organization in Maryland declined to share more data with the federal government for vaccine research, noting that sharing medical records for that purpose would require a rash of approvals from hospitals, state political leaders, and research boards. Any new data-sharing agreement should also have a clear, detailed framework outlining what would be shared and with whom, he added.

“A number of us said, ‘We can’t do anything our agreements don’t allow us to do, so no,’” Behm said. Indeed, most health information exchanges have contractual restrictions on who can access clinical data.

Kansky said Indiana is still weighing whether to provide additional data for Kennedy’s project, and that nothing has yet been shared.

HHS spokesperson Emily Hilliard did not answer questions about how many states are participating in Kennedy’s project, what new data the agency is collecting, how much the federal government is spending on the initiative, how it is protecting patient privacy, or who has access to the data.

“HHS is strengthening public health surveillance and modernizing data systems to better understand and combat the childhood chronic disease epidemic as part of Secretary Kennedy’s Make America Healthy Again agenda,” Hilliard said in an emailed statement. “Americans deserve robust systems to monitor the drivers of chronic illness.”

Kennedy has asserted, without evidence, that vaccines can cause chronic illness.

A Kennedy Partner in Nebraska

At least one state has been cooperative.

The former leader of Nebraska’s state health information exchange has led the effort to share data from medical records with the federal government.

Jaime Bland, former CEO of CyncHealth — the Nebraska health information exchange used by in the state — said several states are looking to “open up channels” to provide more analysis to Kennedy’s team.

“They’re looking at the data differently and providing some insights back to the CDC,” Bland told Ñî¹óåú´«Ã½Ò•îl Health News.

Bland was among a group who proposed that CyncHealth would help kick off the initiative, according to a 43-slide PowerPoint presented to federal officials during an October meeting.

CyncHealth and other state health information exchanges would “ingest data from hospitals, clinics, laboratories, pharmacies, payers, and social services agencies,” then “link claims and clinical records through a master patient index.”

Data from the exchanges “will be deidentified where appropriate,” according to one slide.

The federal government would pay the exchanges for furnishing the records, according to the proposal: $3 a person, annually.

Officials would “frame publicly that this is not a new database, but a federated trust model that delivers real-time data for all HHS missions,” the presentation reads.

After the meeting, Nebraska’s health department was awarded a large grant from the CDC, and CyncHealth in turn got millions of dollars from the state.

On Dec. 19, the CDC announced new funding under its , which sends money to state and local health departments for lab work, health information enhancements, and solutions for outbreaks.

Nebraska’s state health department was awarded $18.7 million — the most of any state last year, though Nebraska is the 38th most populous state. By comparison, Texas received $9.2 million, and California got $10.8 million.

CyncHealth was then awarded three contracts totaling $13.6 million from the state health department just weeks later, on Jan. 9 and Jan. 16, according to a publicly accessible database of state contracts.

Grace McNamara, a spokesperson for CyncHealth, said it retained $2.4 million of the funding for Kennedy’s project; the remaining money was distributed to “other participating states and various vendor organizations for implementation support.”

A former CDC official who was aware of the transaction, but not authorized to speak publicly about it, confirmed the money was intended for CyncHealth to supply data for Kennedy’s initiative to look at vaccines and autism. McNamara said that the “work is focused on improving outcomes related to acute and chronic illnesses.”

“The referenced project is not research, but rather a proof-of-concept project on how health information exchange and public health can work together to improve health outcomes and is not specific to autism,” she said in an emailed statement.

McNamara did not answer questions about what type of medical data is being provided to the federal health department or whether patients’ identifying information is removed.

Bland left her post at CyncHealth — where she was paid nearly — in December. She was named in April as the chief data strategist for the MAHA Institute — a think tank founded by allies of Kennedy and Trump to advance their Make America Healthy Again movement.

Bland agreed with Kennedy that data from state health information exchanges could provide more insight into autism’s causes or vaccine injuries.

“The data is so fragmented, so modeled when it comes to population health and public health, that we lose sight of the individual stories,” Bland said. She told a story she had heard about a woman who had a seizure after receiving the HPV vaccine.

“You know, the vaccine is safe — it absolutely is — but it wasn’t safe for her,” Bland said. “As public health officials, we say the vaccine is safe. But there are cases where it is not.”

Daniel Jernigan, a former top CDC official who left the agency last summer, said he tried to point Kennedy to data that would help the health secretary study vaccine safety and autism.

After 31 years at the CDC overseeing public health surveillance, emerging infectious diseases, and the influenza divisions, Jernigan thought the solution was simple. The secretary could work with researchers to obtain huge databases pulled from health systems nationwide and maintained by major electronic health records companies.

Those databases are deidentified, meaning they don’t include patient names or other information that can identify individuals. Jernigan said Kennedy didn’t seem interested.

Instead, as The New York Times first reported, the health secretary dispatched two top advisers — Archer and Hannah Anderson, his former deputy chief of staff — to the CDC’s headquarters in Atlanta last July to download millions of identifiable patient records directly from the Vaccine Safety Datalink, the system the health agency uses to investigate complications from vaccines. The records, though, were decades old.

Jernigan said the federal government has limited legal authority to access medical records from state health information exchanges. In any case, examining those records may provide a view of a person’s medical history that will not necessarily produce answers to Kennedy’s questions about vaccines and autism.

“If they’re just using the electronic health record data, there are limits to that,” Jernigan said. “If they’re only looking at electronic health record data, all you’re going to get is what was captured in the encounter. It’s not going to be very satisfying.”

Ñî¹óåú´«Ã½Ò•îl Health News data reporter Maia Rosenfeld contributed to this article.

This article first appeared on Ñî¹óåú´«Ã½Ò•îl Health News and is republished here under a .

The Office of Personnel Management 65 insurance companies to provide monthly reports with detailed medical and pharmaceutical claims data of more than 8 million people enrolled in federal health plans, Ñî¹óåú´«Ã½Ò•îl Health News reported earlier this month. The request, which could dramatically expand the personally identifiable medical information OPM can access, alarmed health ethicists, insurance company executives, and privacy advocates.

Now, OPM Director Scott Kupor has two letters on his desk — one from 16 U.S. senators and another led by Rep. Robert Garcia, the top Democrat on the House Oversight Committee — asking him to drop the agency’s proposal.

“The collection of broad, personally identifiable data regarding medical care and treatment raises concerns that OPM could target certain federal employees seeking vital health care services that the Administration disagrees with on political grounds,” the Democratic House members , citing Ñî¹óåú´«Ã½Ò•îl Health News.

The letters from congressional Democrats alone are unlikely to reverse OPM’s plans. Republicans — who control Congress and, ultimately, any oversight activities — have not weighed in on OPM’s notice.

OPM did not immediately respond to a request for comment on the letters. The agency, which said in its notice that it will use the data for oversight and to manage the federal health plans, has not publicly addressed written concerns about its proposal.

The notice, posted and sent to insurers in December, states that insurers are legally permitted to disclose “protected health information” to OPM and does not provide instructions to redact identifying information, such as names or diagnoses, from the claims.

That data could be used to implement cost-saving measures, health policy experts told Ñî¹óåú´«Ã½Ò•îl Health News earlier this month. But it would also give the Trump administration — which has laid off or fired tens of thousands of federal workers — access to a vast trove of personal information.

In the letters, Democratic lawmakers lay out a number of concerns about potential consequences of OPM’s obtaining detailed medical claims for millions of federal workers.

The — led by Adam Schiff of California and Mark Warner of Virginia — argues that OPM is not equipped to safeguard such sensitive data and that the administration could share the records across government agencies, as it has done with personal information on millions of Medicaid enrollees.

They also assert that the agency does not have a legal right to the data and that insurers’ sharing the information with OPM would “violate the core principles of the Health Insurance Portability and Accountability Act.” HIPAA requires certain organizations that maintain identifiable health information — such as hospitals and insurers — to protect it from being disclosed without patient consent. The proposal, the senators warn, threatens patients’ relationships with their clinicians, especially “sensitive disclosures regarding mental health, chronic illness, or other deeply personal conditions.”

“For these reasons, we strongly urge you to cease any further consideration of this proposal,” states the letter, which was sent to Kupor on April 19.

The American Federation of Government Employees, the largest union for federal employees, to Ñî¹óåú´«Ã½Ò•îl Health News’ reporting. The union noted in a statement from its national president, Everett Kelley, that OPM’s proposal “comes in the context of coordinated attacks on federal employees and repeated stretching of the legal boundaries for sharing sensitive personal data across government agencies.

“The question of what this administration intends to do with eight million Americans’ most private health information is not academic,” the AFGE statement read. “It is urgent.”

In an emailed statement, Kelley applauded the congressional letters.

“We are pleased that Democratic lawmakers on the Hill are just as outraged as we are over this administration’s blatant attempt to breach the privacy of millions of Americans across the country,” Kelley wrote. “We share their concerns regarding potential misuse of the information to continue illegally targeting workers and their demand for OPM to withdraw this proposal.”

This article first appeared on Ñî¹óåú´«Ã½Ò•îl Health News and is republished here under a .