FEHB Medical Records and OPM Privacy Risks
Federal employees are right to ask careful questions when the agency that oversees their health benefits seeks access to detailed medical claims data. The issue now surrounding the Federal Employees Health Benefits Program and Postal Service Health Benefits Program is not simply administrative. It touches privacy, trust, and the reasonable fear that sensitive medical information could one day be misused.
According to the transcript, OPM’s Federal Register notice asked health carriers for records involving office visits, treatment, and prescriptions, without making clear in the notice itself whether personally identifying information would be removed before OPM received or used the data. For the roughly 8.3 million federal employees, retirees, and family members covered by FEHB and PSHB, that is a serious concern.
The Legal Problem Is Not Just the Data — It Is the Safeguards
The government can have legitimate reasons to review program data, including fraud detection in a large health benefits program. But legitimacy depends on boundaries. NARFE’s concern, as described in the transcript, goes to the heart of the matter: Why does OPM need the data? How will it use the data? How will it secure the data? What safeguards are enforceable?
Those are not technical questions. They are accountability questions. A federal employee should not have to wonder whether seeking reproductive care, gender-affirming treatment, mental health care, or any other sensitive service could later place them under scrutiny at work.
AFGE’s warning is especially important because privacy concerns do not exist in a vacuum. When an administration has made certain categories of care part of its policy agenda, employees may reasonably fear that health information could be used to identify or pressure people who sought that care.
A Blog Post Is Not a Binding Rule
OPM Director Scott Kupor reportedly responded by saying that the inspector general would remove names, Social Security numbers, phone numbers, and addresses, while leaving ZIP code, year of birth, and a scrambled member ID. If implemented properly, de-identification can reduce risk.
But the key mindfulness lesson here is to stay grounded in what is legally binding. Reassuring language in a blog post is not the same thing as enforceable safeguards in a regulation, notice, contract term, or binding agency procedure. NARFE’s point that “it remains a blog post” is the line federal employees should remember.
The practical takeaway is simple: watch the Federal Register, not just public statements. If OPM moves forward, the protections should appear in the operative legal documents. Employees deserve clear limits on collection, access, retention, security, re-identification, and secondary use.
When Privacy Becomes a Workplace Rights Issue
For now, this is primarily a privacy and governance issue. But if medical data were ever used to target an employee because of protected activity, disability-related information, sex-based medical care, religion, pregnancy-related care, gender identity, or another protected status, the legal analysis could change quickly. What begins as a data policy concern could become an EEO, retaliation, or discrimination matter.
A mindful response is not panic. It is informed attention. Federal employees should keep using the benefits they earned, while insisting that the government place real guardrails around deeply personal information.
Legal Disclaimer: The information provided in this article is for informational purposes only and should not be construed as legal advice. While I am a federal employment attorney, this post does not create an attorney-client relationship. Every situation is unique, and legal outcomes depend on specific facts and circumstances.