The Government Is Asking Your Insurer for Your Medical Records. What Federal Employees Need to Know.

The current administration has asked health insurers covering federal employees and retirees to provide detailed medical data, including records of medical visits, pharmacy claims, and diagnostic information. KFF Health News reported on the request on April 8, 2026.¹

The Federal Employees Health Benefits Program, known as FEHB, covers approximately 8 million federal employees, retirees, and their dependents through a network of private insurance plans administered by the Office of Personnel Management. It is one of the largest employer-sponsored health insurance programs in the country.

The data being requested, as reported by KFF Health News, includes information that goes beyond aggregate enrollment and claims totals. It extends into individual-level medical records: which physicians beneficiaries visited, which prescription drugs they filled, and what diagnoses appear in their claims history.¹

What the Law Permits

HIPAA, the Health Insurance Portability and Accountability Act, governs the privacy of individually identifiable health information. It restricts how health insurers, providers, and other covered entities may disclose personal health information without patient authorization.

HIPAA does include exceptions. One significant exception permits disclosure to government authorities for certain oversight activities — including audits, investigations, and oversight of government benefit programs. The FEHB program is a government benefit program. Whether this exception covers the breadth of data being requested in the current situation is a question being raised by health law experts and has not been definitively resolved.

FEHB regulations also address data sharing. OPM, as the administrator of the program, has broad authority to request data from contracted carriers for program administration purposes. But the scope of what is "program administration" has not historically extended to individual-level medical record data for all beneficiaries across all plans.

The legal analysis is live, not settled.

Why Pharmacy and Medical Data in Particular

Prescription drug claims records contain a specific type of information that is sensitive beyond what appears in a typical medical record. A pharmacy claim reveals not just what drug was dispensed, but the diagnosis it was dispensed for, the prescribing physician, the dose, and the frequency. In aggregate, pharmacy claims data creates a detailed picture of a person's health status.

Mental health prescriptions, medications for substance use disorders, HIV treatment, reproductive health drugs, and medications for stigmatized conditions carry specific privacy interests recognized in law. Many states have enacted enhanced protections for this category of health information beyond HIPAA's baseline requirements.

HIPAA's regulations at 45 CFR Part 164 establish certain categories of information that require more careful treatment, and some state laws go further — requiring separate written authorization for disclosure of mental health records, for example, even in contexts where other health records could be shared more freely.

Federal employees whose prescription history includes any of these categories have a particular interest in understanding what data may be in scope.

What Federal Employees Can Do

Request your FEHB plan's privacy notice. Every HIPAA-covered entity is required to maintain and provide a Notice of Privacy Practices explaining how it uses and discloses health information. The notice should describe the circumstances under which your insurer may disclose your data to third parties, including government entities. If the notice does not clearly address disclosures to OPM or the federal government beyond routine program administration, that is worth noting.

Understand what HIPAA permits you to request. Under HIPAA's right of access provision, you are entitled to request and receive a copy of your health information held by your health plan. You can also request an accounting of disclosures — a record of certain disclosures your health plan has made of your protected health information. This accounting does not cover all disclosure types, but it covers many non-routine ones.

If your plan has received a data request and complied with it, a disclosure accounting request may surface information about what was shared. Submit such a request in writing to your plan's privacy officer.

Know your state's additional protections. If you live in a state with enhanced protections for mental health, reproductive health, substance use, or other sensitive categories, those protections may apply to your FEHB plan to the extent your state's insurance regulations govern the plan. This varies depending on whether your specific FEHB plan is a self-insured federal plan (which is regulated under federal law only) or a fully insured state-regulated product.

The Scope of What Was Reported

KFF Health News reported on April 8, 2026 that the administration's request extends to detailed individual-level claims data, not simply aggregate statistics.¹ The outlet reported that health law experts were examining the request's legal basis and that some FEHB carriers had not yet determined how to respond.

This post is based on what was reported as of that date. The legal and regulatory situation is developing. Federal employees who want current information should follow KFF Health News coverage and check OPM's website for official guidance as it becomes available.

The Accounting Request Is Worth Filing

The most concrete step available to federal employees who want visibility into whether their data has been shared is to file a HIPAA accounting of disclosures request with their FEHB plan. The plan has 60 days to respond (with one 30-day extension if they notify you of the delay). The accounting covers disclosures for purposes other than treatment, payment, and health care operations made within the prior six years.

File the request in writing, address it to the plan's Privacy Officer, and keep a copy. If the response reveals disclosures that you did not authorize and that do not fall within HIPAA's standard exceptions, you can file a complaint with the Department of Health and Human Services Office for Civil Rights, which enforces HIPAA.

¹ KFF Health News. "Administration Asks Federal Employee Health Plans for Detailed Medical Data." April 8, 2026.