The Trump administration wants to require health insurance companies to hand over troves of sensitive, detailed, and identifiable medical records from millions of federal workers and retirees, along with their families. The move is raising immediate concern from legal and health policy experts, according to a report by KFF Health News.
The unprecedented proposal was quietly revealed in a short notice from the Office of Personnel Management in December, KFF notes. OPM said it is seeking “service use and cost data,” which would be harvested from medical records such as “medical claims, pharmacy claims, encounter data, and provider data.”
That list could give the federal government access to prescriptions employees have filled and their diagnoses, as well as provider information, doctors’ notes, treatments, and visit summaries, among other sensitive health information. The collection would affect more than 8 million Americans and harvest data from 65 insurance companies, according to KFF.
Experts who spoke to KFF said OPM’s brief explanation for collecting the data—which would occur monthly—is vague and broad. The agency said it’s needed to oversee benefits programs and “ensure they provide competitive, quality, and affordable plans.” It also claimed that as an oversight agency, it is authorized to collect such protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
But experts were wary of OPM’s proposal. Jodi Daniel, a digital health strategist who helped develop the legal framework for HIPAA privacy rules over two decades ago, told KFF of the proposal that “the language in it seems quite broad and encompasses potentially a lot of information and data and is sort of light on justification.”
Other experts expressed concern over how the Trump administration could use the data, with fears including potential political retaliation or targeting of workers who sought certain medical care, such as abortion or transgender care. They also note that there isn’t any stated safeguards on how the data will be handled.
KFF said several health insurance companies declined to comment on the proposal. But CVS Health executive Melissa Schulman made a public comment, saying, “We strongly recommend the OPM not proceed” with the proposal. Schulman laid out several concerns, including those related to HIPAA compliance, OPM’s lack of legal authority, lack of consumer protections, duplicative reporting requirements, and proprietary data concerns.
Schulman wrote that OPM already requires insurance providers to share certain data for audits and examinations. “However, the data collection described in this [Information Collection Request] goes far beyond this and is unprecedented in its scope and lack of specificity. Rather than seeking necessary and targeted data in an audit or examination setting, OPM is proposing the wholesale collection of vast amounts of granular data from all [benefits providers of federal workers]. This raises significant concerns,” she said.
