The Trump administration is advancing a contentious initiative to gather the comprehensive medical records of millions of federal employees, retirees, and their family members. The Office of Personnel Management (OPM) has signaled its intent to commence the routine collection of identifiable personal health information for over 8 million individuals, a move that has ignited significant concerns among privacy advocates and Democratic lawmakers who have urged the agency to abandon the plan. A notice published last month in the Federal Register will take effect on July 24, empowering OPM to initiate data collection at any point thereafter.
This development follows an initial proposal that drew sharp criticism for its lack of explicit privacy safeguards. In response to escalating concerns voiced by insurers and other stakeholders, OPM has now stated that the identities of enrollees will be "pseudonymized" before their health data is reviewed by agency analysts. This process involves the removal of direct identifiers such as names, addresses, and Social Security numbers. However, the notice also explicitly reserves OPM’s right to re-identify these records.
Scope of Data Collection and OPM’s Rationale
The expansive data collection effort will mandate that 65 insurance companies routinely transmit detailed information to OPM. This data will encompass sensitive particulars including names, addresses, physician details, diagnoses, prescription histories, and payment information for health services rendered through the Federal Employees Health Benefits (FEHB) and Postal Service Health Benefits (PSHB) programs. In a significant expansion from its initial proposal, OPM also intends to access records held by Medicare, the federal health insurance program for individuals aged 65 and older, as well as those with disabilities. This includes examining claims for federal employees and retirees, and their dependents, who utilize both FEHB and Medicare.
OPM’s justification for this broad data acquisition centers on its stated mission to combat fraud and overpayments within the FEHB and PSHB programs. These programs represent a substantial financial commitment, costing approximately $80 billion annually, with the federal government contributing roughly $50 billion and enrollees covering the remaining $30 billion. The Trump administration, spearheaded by Vice President JD Vance, has intensified efforts to curb what it characterizes as widespread fraud and improper utilization of publicly funded health benefits. The administration’s stance is that such measures are essential for fiscal responsibility and the integrity of these vital programs.
Privacy Concerns Persist Despite Pseudonymization Efforts
Despite OPM’s assurances of pseudonymization, critics argue that the measures do not sufficiently safeguard the privacy of federal workers and their families. Senator Mark Warner (D-Va.), a vocal critic of the plan, expressed a lack of confidence in the administration’s handling of sensitive data. In a statement to KFF Health News, Senator Warner asserted, "Clearly, this administration has not earned our trust with Americans’ sensitive data. If OPM wants to work in good faith to reduce fraud, they should come to Congress, including to folks like me who are engaged on this issue and represent many federal workers and retirees and their families, and work to build consensus and trust before implementing these sweeping changes."
The initial notice, published in December, drew particular ire due to its vagueness regarding the intended use of the collected health information and the absence of instructions for insurers to redact identifying details. OPM General Counsel Kurt Dykstra defended the necessity of detailed records, stating that they are critical for identifying fraud perpetrated not only by medical providers but also by enrollees. However, when pressed for specific examples of fraud committed by federal workers, retirees, or their relatives, Dykstra offered only general acknowledgments of healthcare fraud occurrences. He elaborated that the data could reveal "potential anomalies in usage patterns that could be related to the individual, but really also could be related to the provider, the treater, the clinic – whoever it is that’s actually providing the care." Records flagged by OPM analysts as suspicious could then be forwarded to the agency’s Office of the Inspector General for further investigation.
Historical Context and Broader Implications
The proposed data collection has amplified unease among federal employee unions and workers who have experienced significant workforce reductions, including mass firings and layoffs, since the inception of the Trump presidency. Many have alleged that these actions were politically motivated, contributing to a climate of distrust regarding the government’s handling of their personal information.
Health privacy legal experts echo concerns that pseudonymization, while a step forward, may not fully insulate individuals’ privacy. Matt Fisher, a health privacy attorney, noted that while OPM’s notice largely aligns with the Health Insurance Portability and Accountability Act (HIPAA), a critical exception exists: the member ID assigned by insurers to enrollees can still be used for identification. Fisher commented, "The described process arguably comes down to trusting internal controls in OPM to ensure that data is walled off as proposed. The ideal would be for only truly de-identified information to be shared in the first place."
Insurers commonly share claims data with employers to manage costs. However, under HIPAA, these datasets are typically de-identified to protect employee privacy. The potential for misuse of health information by employers has also been a subject of concern. Most recently, a lawsuit filed by Meta employees accused the tech company of employing artificial intelligence to target individuals with medical or family leave for layoffs.
Joseph Lorenzo Hall, a technologist at the Center for Democracy & Technology, a nonprofit advocating for data privacy, highlighted that even pseudonymized data can remain highly identifying. "The richer the data, the more likely it is going to be identifying," Hall explained. "In this case, you may be the only person in a region that has that particular kind of medical procedure, condition, or even prescription. All of those things can be extremely identifying, even when you remove or obfuscate or pseudonymize direct identifiers."
Dual Enrollee Data and Evolving Safeguards
A significant portion of federal retirees maintain their FEHB plans and subsequently enroll in Medicare upon reaching age 65. This dual enrollment strategy offers more comprehensive coverage and allows family members to remain on FEHB plans. OPM’s plan extends to analyzing the medical records of these dual enrollees, requesting all cost and service utilization records from the Centers for Medicare & Medicaid Services.
Despite ongoing reservations, John Hatton, staff vice president for policy and programs at the National Active and Retired Federal Employees Association, acknowledged that OPM’s latest notice demonstrates an improvement in detailing how the agency intends to use and safeguard sensitive health information. "It’s a big improvement over the last notice, which was very lacking in detail and explanation for why they wanted all the medical claims data and how they’re going to protect the privacy of the data," Hatton stated. He added, "We’d be open to seeing even more security around the privacy of the data so there really is a clear wall."
Chronology of the Initiative
- December 2025: OPM publishes its initial notice outlining plans to collect federal employee and retiree medical records. The notice lacks specifics on data usage and de-identification requirements, sparking widespread concern.
- Early 2026: Privacy advocates, Democratic lawmakers, and federal employee unions express strong opposition to the proposed data collection, citing potential privacy violations and a lack of trust in the administration’s handling of sensitive information.
- Mid-2026 (specific date not provided in source but implied): In response to criticism, OPM releases an updated notice detailing plans to pseudonymize identifiable information before data review. The agency also expands its scope to include Medicare records for dual enrollees.
- July 24, 2026: The updated notice is set to take effect, allowing OPM to begin collecting medical data from federal employees, retirees, and their families.
Broader Impact and Future Outlook
The administration’s push to collect extensive medical data from federal workers and retirees raises fundamental questions about the balance between government oversight and individual privacy. While the stated objective of fraud detection is a legitimate concern for any public program, the methods employed and the potential for data misuse are subjects of ongoing debate. The inclusion of Medicare data suggests a significant expansion of federal reach into the health information of a large segment of the population.
The effectiveness of pseudonymization as a privacy protection measure, particularly in the context of highly detailed medical data, remains a critical point of contention. The ability of OPM to re-identify records introduces a layer of risk that many privacy experts find unacceptable. As this initiative moves forward, continued scrutiny from Congress, privacy organizations, and the public will be essential to ensure that the privacy rights of federal employees and their families are adequately protected. The precedent set by this collection could also influence how similar sensitive data is handled in other sectors of government and private industry, underscoring the broad implications of OPM’s actions. The administration’s commitment to transparency and robust security protocols will be paramount in mitigating the concerns that have been voiced.
