OPM Health Data Collection: Oversight or Overreach?
Federal employees are right to pause when they hear that the Office of Personnel Management (OPM) is requesting large-scale health data from FEHB carriers. On paper, OPM has clear authority to oversee the Federal Employees Health Benefits program under 5 U.S.C. § 8910. That includes the ability to request reports necessary to administer the program.
But the key legal question is not whether OPM has any authority—it’s whether this specific data request crosses into something far more expansive. There is a meaningful difference between reviewing aggregate plan performance and building a system that tracks identifiable individuals over time. That distinction is where risk begins.
The Shift to Person-Level Data
OPM’s December 2025 notice signals a shift from traditional oversight to something closer to continuous surveillance. The agency is seeking medical claims, pharmacy claims, encounter data, and provider data from dozens of carriers—on a recurring, monthly basis.
Even more significant, OPM’s own privacy documentation acknowledges that the goal is to create longitudinal, person-level records. In practical terms, that means data tied to specific individuals across time—not anonymized trends.
From a legal standpoint, this matters. Traditional oversight typically relies on aggregated or de-identified data. A recurring pipeline of identifiable claims data raises different questions about necessity, proportionality, and downstream use.
HIPAA Allows—But Does Not End the Inquiry
OPM’s strongest legal footing comes from HIPAA. Under 45 C.F.R. § 164.512(d), health oversight agencies can receive protected health information for authorized oversight activities. That provision likely permits some level of data sharing.
But HIPAA is not a blanket authorization. It does not eliminate the need for clear limits, defined purposes, and safeguards against misuse. The scale and identifiability of the requested data are what make this situation different—and why experts are raising concerns.
Even former agency officials have suggested that de-identified analysis would achieve many oversight goals without introducing the same level of risk. When identifiable data is requested without clearly articulated guardrails, scrutiny is not only appropriate—it is necessary.
Why Federal Employees Should Pay Attention
The most important takeaway is not abstract privacy theory—it is how this data could be used in practice.
If this information remains strictly within the bounds of benefits administration, the legal concerns may remain contained. But if it begins to influence workplace decisions—such as reasonable accommodations, fitness-for-duty evaluations, return-to-office disputes, or disciplinary actions—the legal landscape changes dramatically.
At that point, the issue shifts from benefits oversight to potential violations of the Rehabilitation Act and other workplace protections. Health data used outside its authorized purpose can quickly become evidence in an EEO complaint or MSPB appeal.
A Grounded, Mindful Perspective
Uncertainty like this naturally creates anxiety. A grounded approach is to focus on what can be controlled: awareness, documentation, and early legal guidance if concerns arise. Not every policy shift results in harm—but ignoring early warning signs can limit options later.
This is not routine bureaucracy. It is a developing issue where legal boundaries are still being tested. Staying informed allows federal employees to respond thoughtfully rather than reactively.
Legal Disclaimer: The information provided in this article is for informational purposes only and should not be construed as legal advice. While I am a federal employment attorney, this post does not create an attorney-client relationship. Every situation is unique, and legal outcomes depend on specific facts and circumstances.