The US government's push for unprecedented access to medical records is a cause for concern, especially as data protection measures are being weakened. While the Health Insurance Portability and Accountability Act (HIPAA) is in place to protect health information, it has limitations. HIPAA only regulates hospitals, physicians, insurers, and their business associates, but not the health data generated by individuals outside these entities. This gap in protection is significant, as the US government is actively seeking to gather health data domestically and abroad. The issue is further complicated by the fact that the anonymization of data, which is the primary safeguard used to protect individual privacy, is far weaker than officials claim. As a professor of law who studies health information privacy and medical data regulation, I see the danger of collecting sensitive health information without meaningful safeguards. The limits of medical privacy are evident in the various exceptions to HIPAA, which allow for the release of health information without individual consent. Prescription drug monitoring programs, for example, can access detailed logs of controlled substance prescriptions with a self-issued administrative subpoena, exposing patients to surveillance. The push for access to Americans' medical records by Health and Human Services Secretary Robert F. Kennedy, Jr. to investigate vaccine-autism links is also concerning. The scientific community has already answered this question, and the proposal to give HHS data on 90% of Americans' medical records by 2028 raises questions about the purpose and potential misuse of the data. The concern is not that the government should never collect health data, but that the current safeguards are inadequate. The anonymization of data is not as effective as officials claim, and the risk of reidentification is higher for underrepresented groups. The US government's appetite for health data extends beyond its borders, with the State Department conditioning lifesaving aid on access to citizens' health data in African nations. The agreements are vague and omit standard limits on data usage, raising concerns about digital colonialism. The common thread in these efforts is the faith in anonymization to neutralize the risk of pooling sensitive health data. However, the evidence suggests that this faith is misplaced. The government should be required to demonstrate the necessity of accessing sensitive medical records and the effectiveness of the safeguards in place. Privacy law needs to adapt to the modern world where data can reside in digital records, and individuals need to have a say in how their data is collected and used.
