Lawmakers again raise alarm over OPM’s health records collection plan

Senate Democrats again urged the Trump administration Wednesday to abandon its plans to collect detailed health information from federal workers, retirees and their families, saying recent tweaks to “de-identify” records are insufficient to protect employees’ privacy.

Last December, the Office of Personnel Management published an information collection request in the Federal Register that would require insurers who participate in the Federal Employees Health Benefits and Postal Service Health Benefits programs to provide monthly reports with identifiable health data on their enrollees.

Following pushback from federal employee groups and medical ethicists, OPM in June revised its proposal, purporting to take steps to mask employees and retirees’ identities in the data collection. But organizations that represent federal workers and retirees warned that the agency still hadn’t done enough to protect patients’ privacy.

In a letter to OPM Director Scott Kupor, a group of six Senate Democrats, led by Sens. Adam Schiff, D-Calif., and Mark Warner, D-Va., who previously requested the proposal’s withdrawal, wrote that the proposed pseudonymization of records does not their “fundamental” concerns with the plan, particularly the agency’s insistence that it may re-identify insurance claimants in the future.

“In the case of OPM’s recent [systems of records notice], a stable identifier permits repeated encounters to be linked over time, utilizing ZIP code, birth year, provider, service dates, diagnoses, procedures and drug information to reveal highly specific patterns of care,” they wrote. “OPM itself maintains the mechanism needed to reconnect the pseudonymized history to the individual, negating any intended anonymization of data.”

Another concern of the senators is that under the proposal, OPM would retain these records for 30 years, which they said “materially increases” the chance either for misuse from within the government or a security breach by outside actors. And they argued OPM should not have access to health information about retirees, spouses and other family members covered under FEHBP and PSHBP.

“OPM’s proposal covers not only federal employees but also annuitants, spouse, former spouses, family members, Postal Service employees and their families, certain tribal employees, separated employees and former family members,” the lawmakers wrote. “Many of these individuals are not federal employees and have no employment relationship with OPM. Young-adult dependents may receive reproductive, sexual-health, mental-health, substance-use or other sensitive services that should not be accessible to the federal government, regardless of their family member’s FEHB coverage.”

The letter comes shortly after Federal News Network reported that the Defense Department has begun trawling the records of service members in an effort to identify and remove trans people from the military.

The lawmakers demanded that OPM suspend implementation of its data collection plan and publish a “field-by-field necessity analysis” justifying the statutory purpose for collecting each type of data, as well as institute a series of safeguards aimed at protecting employees’ privacy and limit data-sharing.

“We support responsible efforts to protect the integrity of federal health-benefit programs,” they wrote. “However, OPM’s proposals create an unnecessarily broad, decades-long, re-identifiable medical history of millions of workers, retirees, spouses, children, and other family members. We strongly urge OPM to suspend further implementation while these concerns are addressed and to work with Congress, federal employees and retirees, health plans, privacy and civil-rights experts, reproductive-health advocates, and other affected stakeholders to establish safeguards commensurate with the sensitivity of the information at issue.”