OPM Seeks Detailed Medical Records on 8 Million Federal Workers, Raising Privacy Fears

The Office of Personnel Management wants 65 insurance carriers to hand over monthly medical claims, pharmacy records, encounter data and provider details on more than 8 million federal employees, retirees and their dependents, under a proposal that offers no instructions to strip out names, addresses or other personally identifying information before submission.

The data request, posted to the Federal Register on December 12, 2025, targets carriers managing both the Federal Employees Health Benefits program and the newer Postal Service Health Benefits program. OPM described the collection as "service use and cost data" and framed it as necessary to "oversee health benefits programs and ensure they provide competitive, quality, and affordable plans." What the notice did not do was specify how long OPM would retain the records, which other agencies could access them, or what safeguards would prevent internal misuse. Carriers would be required to submit claims-level files monthly and manufacturer rebate data quarterly, and OPM's own carrier letter warned that compliance would be factored into each insurer's Plan Performance Assessment, the rating system that shapes whether a carrier can continue offering coverage to federal workers.

The FEHB program is the largest employer-sponsored health insurance program in the country. Assembled into a single federal database, the requested files would constitute an extraordinarily detailed longitudinal record of where eight million people sought care, what drugs they were prescribed, what diagnoses they received and which providers treated them.

Sharona Hoffman, a health law ethicist at Case Western Reserve University, put the risk plainly: OPM might have legitimate uses for cost analysis and plan quality oversight, but "they are going to get very, very detailed and granular data about everything that happens." Hoffman and other experts raised the prospect of political targeting and employment-based discrimination, noting that the same administration pursuing this data collection has also carried out sweeping mass removals across the federal workforce.

OPM cited HIPAA's health oversight exception, found at 45 CFR 165.512(d)(1), as legal justification for obtaining protected health information without individual patient consent. Critics at Democracy Forward's Civil Service Strong project, which submitted formal opposition comments in February 2026, pointed out that HIPAA also requires requesters to apply a "minimum necessary" standard, limiting disclosures to what is actually needed for the stated purpose. The OPM notice addresses that standard nowhere. Experts say the agency has not articulated why individually identifiable data is necessary to accomplish any oversight goal that de-identified or aggregated claims data could not achieve equally well.

The risk calculus is further sharpened by recent history. A 2015 cybersecurity breach at OPM, attributed to Chinese government actors, exposed the personal records of 21.5 million people. Adding granular medical claims to OPM's data holdings would raise the stakes of any future breach considerably, and re-identification of supposedly anonymized data remains a well-documented vulnerability across health databases generally.

OPM Director Scott Kupor's office did not respond to requests for comment. With the public comment period already closed and no formal rulemaking requiring the agency to publish redaction standards or retention limits, the path to implementation is unobstructed absent congressional action, insurer litigation or a court order compelling OPM to justify the breadth of what it is asking for.