US OPM Health Insurance Data Collection Plan Draws Concern

A plan by the U.S. federal agency that oversees federal benefits that would require insurers to hand over the identifiable health data of civil servants received pushback from House of Representatives Democrats who said it throws up privacy and security risks.

See Also: Using the Netskope HIPAA Mapping Guide

The Office of Personnel Management in December published a notice soliciting public comment on agency plans to collect “service use and cost data” from federal employee and postal service health benefit carriers including medical claims, pharmacy claims, encounter data and provider data.

Democratic members of the House Oversight Committee said in an April 17 letter that the Trump administration could use the data it receives to target civil servants who accessed sensitive healthcare, such as an abortion or gender-affirming care. The mandate could run afoul of HIPAA, they said, and invoked repeated security failures at the agency to suggest that it could be unable to protect such data from hackers.

Approximately 65 health insurers provide coverage benefits for more than 10 million federal and postal service employees, retirees and their family members.

OPM said in the public notice that the data sought will enable the agency to better oversee health benefits programs “and ensure they provide competitive, quality and affordable plans.”

The agency also contended that HIPAA permits insurers to disclose protected health information, including service use and cost data, to oversight agencies like OPM. The agency is seeking data including clinical notes, diagnosis, treatment plans and prescriptions records. House Democrats proposed information collection would not require insurers to anonymize the data before providing it to the agency.

Concern extends beyond lawmakers. Medical care giant CVS Health – one of only six organizations or individuals that submitted public input to OPM’s request for comment – said it too has privacy and regulatory compliance concerns.

“As OPM states, it has long required carriers to provide necessary information to OPM to perform audits and examinations to manage the [Federal Employees Health Benefits] program effectively. However, the data collection described goes far beyond this, and is unprecedented in its scope and lack of specificity,” CVS Health wrote.

Although the HIPAA privacy rule allows the disclosure of PHI to health oversight agencies, “any such disclosure is subject to HIPAA’s minimum necessary requirement,” the firm added. “It is not intended to allow for the wholesale extraction of all data held by the covered entity for the vague and broad general purposes of ensuring quality and competitive plans.”

CVS Health also questioned OPM’s legal authority to obtain and retain beneficiary-level claims data of all federal and postal service members in a “proposed warehouse approach.”

Like the House Oversight Committee members’ letter, CVS Health also said it feared potential data compromises involving federal employees and their dependents’ data.

“Submitting this data has the potential for data/security breaches, and invasion of privacy for consumer health information,” CVS Health wrote.

“This would also increase carriers’ legal liability with respect to data breaches and other instances where consumer health information is inappropriately shared and outside of our control.”

Organizations submitting public comment that generally supported OPM’s plans also voiced data security and privacy concerns.

“As OPM considers collecting claims data, it also should plan carefully how it will use security and privacy protocols to protect the information provided,” wrote the Health Care Cost Institute, an independent, non-profit, non-partisan organization.

The collection of federal employee’s sensitive health information could have health knock on effects, said Andrew Crawford, senior policy counsel of the privacy and data project at advocacy group the Center for Democracy and Technology.

“Effective healthcare relies on patients being able to trust their doctors and share very personal details about themselves with their doctor and healthcare providers,” Crawford told ISMG. “I fear that OPM’s plans will chill and erode this essential trust because some patients won’t want their sensitive and personal data shared with the government.”

In June 2015, OPM revealed that personal information for 4.2 million federal employees and retirees had been stolen. Days later, the agency disclosed that 21.5 million individuals’ background-check records were also exposed. The hack was tied to Chinese espionage agencies (see: Analysis: Why the OPM Breach is So Bad).