OPM Health Data and Federal Employee Privacy
Federal employees have reason to feel uneasy right now. The identity-theft protection offered after the 2015 OPM breach is beginning to expire, ten years after enrollment, even though the exposed information cannot simply be “changed” like a password. That breach affected roughly 22 million people and included personnel files, security-clearance information, family details, and millions of fingerprints.
At the same time, OPM has proposed collecting monthly health-related data from FEHB and Postal Service Health Benefits carriers, including medical claims, pharmacy claims, encounter data, and provider data. OPM says the data would help it oversee health benefits programs and ensure competitive, quality, affordable plans. But for federal employees, the concern is not merely administrative efficiency. It is whether deeply personal information could be centralized without adequate safeguards.
Why Encounter Data Matters
“Encounter data” may sound technical, but it can be highly revealing. Depending on how it is defined and transmitted, it may reflect diagnoses, treatment patterns, prescriptions, provider relationships, and sensitive medical visits. Reports on the proposal have noted concerns that the request does not clearly require redaction or de-identification before submission.
For a GS-9 or above employee managing a clearance, probationary period, EEO matter, reasonable-accommodation request, or disciplinary investigation, privacy is not abstract. Medical information can affect how safe someone feels seeking care, reporting discrimination, or requesting workplace support. Even if OPM’s stated purpose is benefits oversight, federal employees are entitled to ask: who will access the data, how will it be secured, how long will it be retained, and what limits will prevent secondary use?
The Legal Issue Is Accountability
Sixteen Democratic senators, led by Adam Schiff, Mark Warner, and Chuck Schumer, urged OPM to withdraw the proposal, warning that it raised statutory, constitutional, HIPAA, confidentiality, cybersecurity, and misuse concerns. Carriers and privacy advocates have also questioned whether OPM’s authority to examine records supports broad, ongoing collection of claims-level health data.
That distinction matters. An agency’s ability to audit or examine records is not necessarily the same as a standing demand to centralize sensitive personal health information. Federal employees should watch this issue closely because privacy protections often matter most before harm occurs, not after a breach, misuse, or retaliatory disclosure.
What Federal Employees Can Do Now
Start with calm, concrete action. Consider filing a Privacy Act access request with OPM’s privacy office asking what records OPM currently maintains about you. Keep a copy of the request and any response. Contact your senators and representatives about the proposed data collection. If you are in an EEO, discipline, accommodation, or clearance-related situation, be especially careful about where medical documentation goes and why it is being requested.
Mindfulness does not mean ignoring risk. It means refusing to let anxiety become paralysis. Take one grounded step, document it, and then take the next.
Legal Disclaimer: The information provided in this article is for informational purposes only and should not be construed as legal advice. While I am a federal employment attorney, this post does not create an attorney-client relationship. Every situation is unique, and legal outcomes depend on specific facts and circumstances.