The Trump administration is forging ahead with a controversial plan to collect the medical records of millions of federal workers and retirees, as well as their family members.
The Office of Personnel Management said in a notice posted last month that it will begin routinely collecting identifiable, personal health information on more than 8 million people — despite concerns from privacy advocates and Democrats, who have demanded the agency drop the plan. The notice will go into effect July 24, allowing OPM to begin its collection at any point afterward.
In reaction to privacy concerns raised by insurers and others, OPM now says the identities of enrollees will be “pseudonymized” — meaning names, addresses, and Social Security numbers will be removed — before the agency’s analysts review the massive new health datasets it will soon begin receiving.
Birth years of enrollees will be retained, and the agency’s “technical staff” will receive member IDs that it will scramble into different, unique numbers before releasing them to other staffers, according to the notice.
But the notice also specifies that OPM retains the right to reidentify the records.
Sixty-five insurance companies will be required to routinely send OPM detailed data — including names, addresses, doctor information, diagnoses, prescriptions filled, and payment details — on health care services paid through the Federal Employees Health Benefits and Postal Service Health Benefits programs.
In a change to its original proposal, first reported by KFF Health News, the agency says it also wants to peek at records kept by Medicare, the federally funded health insurance for older and disabled Americans, to examine claims from federal employees and retirees, and their families, who depend on both programs.
In its latest notice, OPM argues that the vast trove of data is necessary to ferret out fraud and overpayments in the FEHB and PSHB programs. Those programs cost roughly $80 billion a year, with about $50 billion covered by the federal government and $30 billion funded by enrollees. The Trump administration has ramped up efforts, led by Vice President JD Vance, to curtail what it says is rampant fraud and misuse of publicly funded health benefits.
The effort still faces criticism that it doesn’t go far enough to protect the privacy of federal workers and their families.
“Clearly, this administration has not earned our trust with Americans’ sensitive data,” Sen. Mark Warner (D-Va.) said in an emailed statement to KFF Health News. “If OPM wants to work in good faith to reduce fraud, they should come to Congress, including to folks like me who are engaged on this issue and represent many federal workers and retirees and their families, and work to build consensus and trust before implementing these sweeping changes.”
The original notice, posted in December, sparked concerns in part because it did not specify what the Trump administration planned to do with the sensitive health information it receives — and did not instruct insurers to redact identifying information.
OPM General Counsel Kurt Dykstra said the detailed records are critical to the administration’s mission of rooting out fraud and could help identify fraud perpetrated not only by medical providers but also by enrollees.
But when pressed for instances of workers, retirees, or their relatives committing such fraud, Dykstra only noted generally that healthcare fraud does occur.
The information could demonstrate “potential anomalies in usage patterns that could be related to the individual, but really also could be related to the provider, the treater, the clinic — whoever it is that’s actually providing the care,” Dykstra told KFF Health News in an interview.
Records deemed suspicious by OPM’s data analysts could then be referred to the agency’s Office of the Inspector General for further investigation, which could include “determining who’s involved and what the potential issues are, what the ramifications look like,” Dykstra said.
Mark Schiefelbein / AP 
OPM’s plan to collect and analyze medical records has prompted unease among unions and federal workers, who have been subjected to mass firings and layoffs — in some cases, they say, driven by political retribution — since President Donald Trump took office.
Health privacy lawyers say, too, that while pseudonymizing workers’ details is a step in the right direction, it might not go far enough to protect their privacy.
OPM’s notice mostly complies with the Health Insurance Portability and Accountability Act, the federal law commonly called HIPAA that protects sensitive health data from being shared, said Matt Fisher, a health privacy lawyer. But he noted one exception: The member ID that insurers provide enrollees can be used to identify them.
“The described process arguably comes down to trusting internal controls in OPM to ensure that data is walled off as proposed,” Fisher said in an email. “The ideal would be for only truly de-identified information to be shared in the first place.”
Insurers regularly share information about claims with employers who offer health plans to employees, in efforts to control costs. But since employers themselves are not covered by HIPAA, large datasets are typically de-identified, meaning the insurers remove identifying information such as employees’ names or addresses, to comply with the law.
Employers, too, have been accused of using health information to target employees for dismissals. Most recently, a group of Meta employees filed a lawsuit accusing the tech giant of using artificial intelligence to target for layoffs those who had taken medical or family leave.
Pseudonymizing details such as names or addresses would go only so far to protect privacy, since medical conditions in particular can make it very easy to identify certain employees, said Joseph Lorenzo Hall, a technologist at the Center for Democracy & Technology, a nonprofit that advocates for data privacy.
“The richer the data, the more likely it is going to be identifying,” Hall said.
“In this case, you may be the only person in a region that has that particular kind of medical procedure, condition, or even prescription,” he said. “All of those things can be extremely identifying, even when you remove or obfuscate or pseudonymize direct identifiers.”
Most federal retirees decide to continue with FEHB plans and enroll in Medicare once they turn 65, which provides more comprehensive coverage and allows family members to remain enrolled in FEHB plans, said John Hatton, the staff vice president for policy and programs at the National Active and Retired Federal Employees Association.
OPM wants to analyze medical records for those dual enrollees as well. The agency is asking for all of their cost and service use records from the Centers for Medicare & Medicaid Services.
Still, Hatton said, OPM’s latest notice provides more details about how the agency says it will use the sensitive health information it receives and safeguard it.
“It’s a big improvement over the last notice, which was very lacking in detail and explanation for why they wanted all the medical claims data and how they’re going to protect the privacy of the data,” Hatton said.
“We’d be open to seeing even more security around the privacy of the data so there really is a clear wall,” he added.
KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF — the independent source for health policy research, polling, and journalism.
