NEWS: Sens. Schiff, Warner, Schumer Lead 16 Senators in Urging Trump Admin to Reverse Course on Illegal Efforts to Seek Medical Records of Federal Workers

Washington, D.C. - Today, U.S. Senators Adam Schiff (D-Calif.) and Mark Warner (D-Va.) and Senate Democratic Leader Chuck Schumer (D-N.Y.) led 16 Senators in urging the Trump administration to immediately reverse course on their illegal and dangerous decision to seek unprecedented access to the personal medical records of millions of federal workers, retirees, and their families.

According to a notice by the White House Office of Personnel Management, this effort would involve the widespread aggregation of individuals' health data, including medical visits, prescriptions, and treatment histories. The Senators express deep concern regarding such sweeping access of private medical data, which violates core principles of the law and places the personal information of Americans at serious risk of potential cyberattacks, unauthorized access and political exploitation.

"This proposal is another step in the stated goal of traumatizing the federal workforce, this time by requiring the most sensitive health information about federal employees and their families to be shared with OPM. We are deeply concerned this information will be used in employment actions, including actions related to hiring, suitability determinations, appeals, reductions in force, disability accommodation requests, labor-management relations, and performance reviews," the Senators wrote.

"We strongly urge you to cease any further consideration of this proposal. Our federal employees work every day to serve the American people and deserve to have their health data protected," the Senators continued.

In addition to Schiff, Warner, and Leader Schumer this letter is also signed by Richard Blumenthal (D-Conn.), John Fetterman (D-Pa.), Kirsten Gillibrand (D-N.Y.), Angus King Jr. (I-Maine), Amy Klobuchar (D-Minn.), Andy Kim (D-N.J.), Angela Alsobrooks (D-Md.). Dick Durbin (D-Ill.), Tim Kaine (D-Va.), Alex Padilla (D-Calif.), Chris Van Hollen (D-Md.), Sheldon Whitehouse (D-R.I.) and Edward J. Markey (D-Mass.).

The full text of the letter can be found here and below.

Dear Director Kupor,

We are writing with grave concern regarding the Information Collection Request (ICR) noticed in the Federal Register on December 12, 2025, by the Office of Personnel Management (OPM). If implemented, this proposal would require health insurance carriers that participate in the Federal Employees Health Benefits (FEHB) and Postal Service Health Benefits (PSHB) programs to report broad medical record data of federal workers, retirees, and their families to OPM on a monthly basis. According to the notice, this effort would involve the widespread aggregation of these individuals' health data, including medical visits, prescriptions, and treatment histories. This proposal raises profound statutory, constitutional, and public health concerns. We demand that OPM immediately reverse this action and abstain from any future efforts to illegally collect federal workers' sensitive health data.

Since January 2025, federal employees have been pushed into early retirement, illegally fired, demonized, seen their civil service protections weakened, and more. This proposal is another step in the stated goal of traumatizing the federal workforce, this time by requiring the most sensitive health information about federal employees and their families to be shared with OPM. We are deeply concerned this information will be used in employment actions, including actions related to hiring, suitability determinations, appeals, reductions in force, disability accommodation requests, labor-management relations, and performance reviews.

Such sweeping access to personal health information would violate the core principles of the Health Insurance Portability and Accountability Act (HIPAA), which was enacted to strictly regulate how protected health information (PHI) can be disclosed to ensure that patient data is shared only for limited, clearly defined purposes. Mass, centralized access to identifiable medical records absent individualized consent, clear necessity, or narrowly tailored legal authority undermines those protections and lacks a valid statutory basis. Both HIPAA regulations that apply to all covered entities as well as the Privacy Act statute that governs the federal government's use of data about individuals require only the minimum amount of information necessary to be shared;[1] the data collection contemplated in this proposal to collect individualized medical claims data from all federal employees, retirees, and their families every month would far exceed those legal limits and violate OPM's statutory authority.

Furthermore, this proposal threatens the foundational principle of confidentiality between a patient and their health care provider. Patients must be able to trust that sensitive disclosures regarding mental health, chronic illness, or other deeply personal conditions will remain private. If individuals with health care coverage through FEHB and PSHB fear their medical records will be accessed by government agencies for unclear or non-clinical purposes, millions of Americans may withhold critical information from their providers or forego health care services altogether. This erosion of trust directly harms medical care and public health outcomes.

The risks of misuse of the data to be shared in OPM's proposal and subsequent data breaches cannot be overstated, as large, centralized databases of health records are prime targets for cyberattacks and unauthorized access. Past incidents across industries demonstrate that even "secure" systems are vulnerable, and breaches involving health data have historically exposed millions of individuals to identity theft, discrimination, and long-term privacy harms. Expanding access to PHI increases the number of potential failure points and amplifies these risks.

Additionally, the potential for secondary use or mission creep is deeply concerning. This administration has demonstrated a cavalier approach toward utilizing sensitive data, breaking down firewalls that work to protect individuals' privacy and security, and an incompetence in protecting that data. In January 2026, the Department of Justice admitted in a legal filing that employees of President Trump and Elon Musk's so-called Department of Government Efficiency (DOGE) stole individuals' Social Security data and stored it improperly. And as a data point that DOGE was never truly about efficiency, the legal filing also noted that one employee was working with an advocacy group to try and connect Social Security data with voter rolls in order to "find evidence of voter fraud and to overturn election results in certain States." Additionally, the effort by the Department of Health and Human Services to share Medicaid enrollee data with the Department of Homeland Security for immigration enforcement purposes raises serious concerns that this data collection would serve a far more nefarious purpose than those stated in the Federal Register.

Finally, we have substantial constitutional concerns regarding OPM's proposal. The Supreme Court has recognized a protected privacy interest in avoiding disclosure of highly personal information, including medical data. While not absolute, this interest requires that government intrusions be justified, narrowly tailored, and accompanied by clear safeguards. Broad policies without individualized justifications raise Fourth Amendment concerns and encroach on Americans' reasonable expectations of privacy. We do not believe any employee, including federal employees, should be forced to give up basic rights to privacy as a condition of their employment, especially regarding their health information.

For these reasons, we strongly urge you to cease any further consideration of this proposal. Our federal employees work every day to serve the American people and deserve to have their health data protected. Protecting patient privacy is not a bureaucratic obstacle, but a cornerstone of ethical medicine, legal compliance, and public trust. Any effort to modernize or improve data systems must prioritize strict privacy protections, transparency, and respect for individual rights.

###