In today's digital age, where our personal information is often just a click away, the issue of medical record privacy has become increasingly complex and concerning. This article delves into the US government's push for access to our medical records, a move that raises critical questions about data protection and individual privacy.
The Illusion of Privacy
You might think that your medical records are safely tucked away, accessible only to you and your healthcare providers. However, the Health Insurance Portability and Accountability Act (HIPAA), the federal law governing health information privacy, has limitations that many are unaware of. While it regulates hospitals, doctors, and insurers, it falls short when it comes to the vast amount of health data we generate outside these traditional healthcare settings.
For instance, HIPAA doesn't cover the data generated by period-tracking apps, online searches about health conditions, or even the DNA samples we send to genealogy companies. And even the records that HIPAA does cover can be shared, sold, or accessed by the government in ways that might surprise and concern many individuals.
The Government's Data Appetite
What makes this particularly fascinating is the US government's aggressive pursuit of health data, both domestically and internationally. This push comes at a time when research is increasingly showing that the practice of anonymizing data, a key safeguard in data collection, is not as effective as officials claim.
As a professor of law specializing in health information privacy, I've studied the movement of sensitive health data among various entities, including government agencies and law enforcement. I've seen the value of health data in research, but also the potential dangers of its collection without robust safeguards.
Limits of HIPAA
HIPAA does provide individuals with certain rights, such as the ability to access and correct their health records and expect that their information won't be casually disclosed. However, the law also allows for the release of some information without consent. A hospital, for example, can release certain types of records without your authorization or knowledge, and there are numerous categories where this is permissible.
Additionally, HIPAA is riddled with exceptions, meaning a significant portion of your health information can be shared through these loopholes. Once data leaves the HIPAA-covered system, those protections no longer apply.
RFK Jr.'s Quest and Its Implications
Since 2025, Health and Human Services Secretary Robert F. Kennedy, Jr. has been seeking federal access to Americans' medical records to investigate the link between vaccines and autism, a question that science has already decisively answered in the negative. This pursuit has involved courting state health information exchanges, which allow hospitals and clinics to share detailed patient records.
One proposed plan would give HHS access to data on 90% of Americans' medical records by 2028. In Nebraska, millions of federal grant dollars have been directed to a health information exchange nonprofit that has cooperated with this effort.
While large health datasets can be useful for identifying drug side effects, tracking outbreaks, and revealing care disparities, the concern here is the lack of meaningful safeguards. HHS has been vague about the details of this data collection, including the number of states involved, the type of data collected, and how it will be protected.
The Fallacy of Anonymization
Officials have assured the public that data will be aggregated and stripped of identifiers, but decades of computer science research tell a different story. A study published in Nature in 2026 showed that stripping identifiers from patient records doesn't protect all patients equally, especially those from underrepresented groups.
This issue isn't limited to domestic data collection. The US government's appetite for health data extends beyond its borders. As reported by ProPublica, the State Department has been conditioning lifesaving aid to African nations on access to their citizens' health data.
A Call for Skepticism and Scrutiny
The common thread in these domestic and international data collection efforts is the faith placed in anonymization as a safeguard. However, the evidence suggests otherwise. While health data can be valuable for research and public health, the reassurances given by officials should be met with skepticism, and the safeguards should be thoroughly scrutinized.
In my opinion, the people whose health data is being collected deserve a say in how it's used and protected. Governments should be required to justify their need for sensitive medical records and demonstrate the effectiveness of the safeguards they claim to have in place.
Privacy law was designed for an era when data was stored in filing cabinets, but in today's digital world, even an anonymized record can lead back to an individual. It's time we updated our approach to data privacy to reflect these modern realities.
