OPM says names will be stripped from federal health data review
A new OPM notice says analysts will review pseudonymized claims data, but critics warn the agency could still reidentify records.
By Frankie Delgado · News Reporter
3 min read
The Office of Personnel Management says its analysts will not see names, addresses or Social Security numbers when they review a new stream of health data covering more than 8 million federal workers, retirees and family members.
The agency outlined the change in a Federal Register notice posted June 23, which is set to take effect July 24. After that date, OPM can begin routine collection of personal health information tied to the Federal Employees Health Benefits and Postal Service Health Benefits programs.
Under the notice, 65 insurance companies will have to send OPM detailed claims information, including names, addresses, doctor information, diagnoses, prescriptions and payment details. OPM says identities will be “pseudonymized” before analysts examine the data.
The agency said birth years will remain in the datasets. Technical staff will receive member IDs and convert them into different unique numbers before other staffers see them, according to the notice. The notice also says OPM keeps the ability to reidentify records.
Agency cites fraud hunt
OPM says the data is needed to detect fraud and overpayments in the federal employee and postal health benefit programs. Those programs cost about $80 billion a year, with roughly $50 billion paid by the federal government and $30 billion paid by enrollees, according to the Committee for a Responsible Federal Budget.
The Trump administration has made scrutiny of publicly funded health benefits a priority, with Vice President JD Vance leading efforts focused on what the administration describes as widespread fraud and misuse.
OPM General Counsel Kurt Dykstra told KFF Health News that detailed records could reveal “potential anomalies in usage patterns” connected to an individual, provider, clinic or other care source. He said records flagged by analysts could be sent to OPM’s Office of the Inspector General for further review.
When KFF Health News asked Dykstra for examples of federal workers, retirees or relatives committing fraud, he referred generally to the existence of health care fraud, according to the outlet.
The latest notice also expands the plan to include claims from Medicare for federal employees, retirees and family members who rely on both Medicare and federal benefits. OPM is seeking cost and service-use records from the Centers for Medicare & Medicaid Services.
Privacy worries remain
The plan has drawn objections from privacy advocates, Democrats, unions and federal workers. Sen. Mark Warner, a Virginia Democrat, told KFF Health News that the administration “has not earned our trust with Americans’ sensitive data” and said OPM should work with Congress before making the changes.
The December version of the plan, first reported by KFF Health News, did not tell insurers to remove identifying information and gave fewer details about how OPM would use the data.
Matt Fisher, a health privacy lawyer, told KFF Health News that OPM’s latest approach mostly fits HIPAA requirements, but he warned that member IDs can identify enrollees. Fisher said the proposal depends on OPM’s internal controls keeping data properly separated.
Joseph Lorenzo Hall, a technologist at the Center for Democracy & Technology, told KFF Health News that medical details can identify people even when direct identifiers are removed, especially if a person is the only one in a region with a specific procedure, condition or prescription.
John Hatton of the National Active and Retired Federal Employees Association said the new notice is a major improvement over the earlier version because it gives more explanation about use and privacy protections. He added that his group would welcome stronger safeguards and a clearer wall around the data.
This story draws on original reporting from CBS News.