Labor & Employment Law Daily Wrap Up, BENEFITS NEWS—AFGE, others raise alarm on privacy concerns at stake in OPM’s information collection request seeking medical records, (Apr 13, 2026)

By Brandi O. Brown, J.D.

“OPM is proposing the wholesale collection of vast amounts of granular data from all FEHB and PSHB carriers,” going “far beyond” what is necessary, says CVS Health, also noting that the “federal procurement statutes allow record examination, not broad data acquisition.”

The American Federation of Government Employees (AFGE), the largest union representing federal employees, has expressed that it is deeply alarmed by OPM’s proposal, published in an issue of the Federal Register in December 2025, to collect personally identifiable medical records from the insurance companies covering more than eight million federal workers, retirees, members of Congress, postal employees, and their families.

Serious legal concerns. “This proposal, published without fanfare in December, would require 65 insurers to submit monthly reports to OPM containing individual health data, including prescription records, diagnoses, treatment histories, and provider information, with no requirement that identifying information be removed,” said AFGE National President Everett Kelley. “Health law experts, former OPM officials, and major insurance carriers have raised serious legal concerns about whether this proposal complies with HIPAA. CVS Health has stated plainly that complying with OPM’s request would require insurers to break the law.”

Kelley added, “OPM has provided no meaningful explanation for why it needs identifiable data rather than the de-identified claims data that would serve any legitimate cost-management purpose. It has offered no information about how the data would be protected or how it would be used. That silence is not reassuring.”

Oversight and comparison. In the 60-day notice and request for comments, published in the Federal Register on December 12, 2025, OPM stated that it will be “collecting service use and cost data from FEHB and PSHB Carriers, including medical claims, pharmacy claims, encounter data, and provider data.” It said the data would enable the agency to “oversee health benefits programs and ensure they provide competitive, quality, and affordable plans.”

“OPM requires Carriers to report necessary information and permit audits and examinations to manage the FEHB Program effectively,” the notice states. It also claims that HIPAA’s “Privacy Rule permits covered entities, including carriers, to disclose protected health information (PHI), including service use and cost data, to health oversight agencies, such as OPM, for oversight activities authorized under 45 CFR 165.512(d)(1).”

Comments were solicited and it stated that they would be accepted until February 10, 2026.

CVS (Aetna) sees “significant concerns.” In a response filed on February 10, Aetna, a CVS Health company, stated:

“Aetna supports OPM’s goal to ensure that the FEHB and PSHB programs provide high quality, affordable care, and it appreciates the need for relevant data to conduct oversight of carriers. As OPM states, it has long required carriers to provide necessary information to OPM to perform audits and examinations to manage the FEHB program effectively. However, the data collection described in this ICR goes far beyond this, and is unprecedented in its scope and lack of specificity. Rather than seeking necessary and targeted data in an audit or examination setting, OPM is proposing the wholesale collection of vast amounts of granular data from all FEHB and PSHB carriers.”

“This raises significant concerns,” CVS explains, including the risk of HIPAA non-compliance for carriers, the lack of consumer protections, and the creation of duplicative reporting requirements. OPM lacks reasonable authority to obtain and retain beneficiary-level claims data of all FEHB/PSHB members, CVS says, noting that 5 U.S.C. Sec. 8910 “allows OPM to require ‘reasonable reports’ and to examine carrier records,” but “does not authorize OPM to obtain and retain beneficiary-level claims data of all FEHB/PSHB members.” Moreover, CVS explains, “federal procurement statutes allow record examination, not broad data acquisition.”

Similar and additional concerns have been raised by the Association of Federal Health Organizations and Civil Service Strong.

Additional comment period? AFGE notes that it expects OPM “will publish a corresponding notice in the coming weeks, opening an additional public comment period” and notes that it “will submit formal comments opposing this proposal and urging its withdrawal.”

The Docket is No. OPM-2025-0206.

News: AgencyNews BenefitsNews PensionBenefitPlans PublicEmployees LaborNews FederalRegulations