OPM Proposes New Medical Data Access Policy Raising Privacy Concerns

The Office of Personnel Management (OPM) has proposed increased access to medical records for over eight million Americans enrolled in Federal Employees Health Benefits and Postal Service Health Benefits plans. This initiative mandates 65 insurance providers to submit detailed monthly reports with identifiable health data, including medical and pharmacy claims, without redacting personal identifiers.

This proposal has raised concerns among insurers, health policy specialists, and legal experts about potential data privacy issues and regulatory compliance. There is apprehension regarding OPM's measures to safeguard sensitive information and the intended use of such comprehensive health records. According to Sharona Hoffman, a health law ethicist at Case Western Reserve University, the data could be utilized to analyze costs and enhance services, but extensive misuse risks persist.

Compounding these concerns is OPM's lack of public comment on the matter. Michael Martinez, a senior advisor, emphasized uncertainties in handling sensitive data, particularly related to personal health decisions like abortions or transgender treatments, which face legal scrutiny in numerous states.

Critics argue that the proposal might violate the Health Insurance Portability and Accountability Act (HIPAA), which demands strict conditions for sharing patient information. Jodi Daniel, a strategist in digital health law, highlighted that the proposal’s broad scope raises significant privacy concerns.

Major insurers such as Blue Cross Blue Shield, Kaiser Permanente, and UnitedHealthcare remain silent on their responses and compliance plans. However, CVS Health has expressed legal concerns regarding HIPAA compliance under the current proposal's vague requirements. The legal implications for potential privacy breaches or data mishandling represent substantial risks.

Insurance representatives have supported data sharing through de-identified reports during past negotiations with OPM. However, the new proposal challenges this stance by seeking identifiable personal data. As the industry anticipates further developments from OPM, this regulatory shift highlights the ongoing tension between data oversight and privacy within the healthcare benefits landscape. Finalization of the proposal awaits further action from OPM.