Even the records HIPAA does cover can be shared, sold or handed to the government in ways that might surprise you<\/a>.<\/p>\n This gap in protection matters more than ever because the U.S. government is pushing hard to gather health data domestically<\/a> and abroad<\/a>. This is happening even as a growing body of research shows that the safeguard which these efforts to collect data lean on \u2013 anonymizing data by removing identifying information to make it difficult to trace back to an individual \u2013 is far weaker<\/a> than officials claim.<\/p>\n As a professor of law<\/a> at Indiana University, I study health information privacy and medical data regulation, which includes tracing how sensitive health information moves among clinics, government agencies and law enforcement. As a co-investigator on a federally funded study about opioid prescribing, I rely on health data in my own research. I appreciate its value for science, and I also see the danger of collecting it without meaningful safeguards. <\/p>\n Federal privacy laws give you the right to see and correct your medical records and ensure that providers will protect your information. But they also permit hospitals to release certain types of information without telling the patient. Limits of medical privacy<\/p>\n HIPAA gives you several rights<\/a>: You can see your health records, demand corrections and expect that a covered provider will not casually disclose your information. <\/p>\n But the law also permits release of some information without your consent. A hospital fully bound by HIPAA may release certain types of records without your authorization and without telling you. There are roughly a dozen such categories<\/a>. Information about treatment, payment and routine healthcare logistics require no sign-off. Neither does information released for public health reporting<\/a>, law enforcement<\/a>, judicial and administrative proceedings<\/a>, health plan oversight<\/a>, research<\/a> or the broad catchall of essential government functions<\/a>. <\/p>\n The statute is also thick with additional exceptions<\/a>. In practice, much of your health information can be shared through these many open doors. And once data is sent outside the system covered by HIPAA, the HIPAA limits fall away. <\/p>\n For instance, prescription drug monitoring programs<\/a>, which every state now operates, assemble detailed logs of who filled which controlled substance prescription and when. Federal law enforcement can often access these logs with a self-issued administrative subpoena<\/a> \u2013 an order that doesn\u2019t require a judge\u2019s approval or oversight. <\/p>\n These programs have expanded beyond opioids into a dragnet that shares health data across state lines<\/a>, exposing patients who seek reproductive or gender-affirming healthcare to surveillance far from home. <\/p>\n Health records can flow to many destinations under different rules. A given disclosure might feel more like a violation depending on who decides where it can go and who can then see it.<\/p>\n RFK Jr.\u2019s push to access Americans\u2019 health records<\/p>\n Since the spring of 2025<\/a>, Health and Human Services Secretary Robert F. Kennedy, Jr. has sought federal access<\/a> to Americans\u2019 medical records to investigate whether vaccines cause autism. The scientific community has studied this question for decades and has shown decisively that they do not<\/a>. <\/p>\n According to KFF Health News<\/a>, HHS has been courting state health information exchanges<\/a> \u2013 the little-known systems that let hospitals and clinics swap detailed, identifiable patient records \u2013 and asking how those records might be used for vaccine research. One proposal floated by state organizations would give HHS data on 90% of Americans\u2019 medical records<\/a> by 2028. In Nebraska, millions of federal grant dollars<\/a> have flowed to a statewide health information exchange nonprofit that has cooperated with the effort.<\/p>\n Large health datasets can be useful<\/a>. Pooled records can expose drug side effects<\/a>, track outbreaks<\/a> and reveal disparities in care<\/a> that smaller studies miss. Public health has always depended on some surrender of individual privacy<\/a> for collective benefit.<\/p>\n The concern is not that the government should never collect health data. It is that meaningful safeguards have not kept pace<\/a> with the scale of collection and capabilities of modern data analytics. <\/p>\n In seeking access to Americans\u2019 medical records for a vaccine and autism study, HHS has declined to say<\/a> how many states are involved, what data it collects, who can see it or how it will be protected.<\/p>\n University of Maryland school of medicine professor Dr. Omer Awan fact-checks Health and Human Services Secretary Robert F. Kennedy Jr.\u2019s claims about COVID-19, vaccines and autism.<\/p>\n Building a comprehensive repository to chase a question that science has already answered<\/a> inverts the logic of research. Usually a hypothesis justifies the data collected, rather than the reverse. <\/p>\n Collecting identifiable records for tens of millions of people in a single database also creates a target for breaches<\/a>, secondary uses that no one consented to<\/a> and abuses by current or future administrations with different priorities.<\/p>\n \u2018Anonymized\u2019 doesn\u2019t protect your health privacy<\/p>\n Officials have offered reassurances<\/a> that data will be aggregated and stripped of identifiers so no individual can be singled out<\/a>. <\/p>\n Decades of computer science research undercuts that promise<\/a>. A study published in Nature in June 2026 sharpened the point, showing that in this age of artificial intelligence, stripping identifiers from patient records to protect identity does not protect all patients equally. <\/p>\n The researchers audited AI diagnostic models trained on clinical data, including chest X-rays, electrocardiograms and electronic health records. They asked whether an outsider could tell if a particular person\u2019s data had been used to build the model. For instance, confirming that someone\u2019s record helped train a cancer-prediction tool can reveal that that person has cancer. This exploit is known as a membership inference attack<\/a>.<\/p>\n The research team found that while the average risk of being identified from data stripped of identifying information often looked reassuringly low, some patients faced near-certain reidentification The burden fell unevenly: Underrepresented groups<\/a>, sorted by race, insurance status or diagnosis, were most at risk. Those most exposed were frequently already most vulnerable to discrimination. <\/p>\n Researchers have long established that removing identifiers from rich datasets does not reliably protect<\/a> the people in them, and that identification gets easier the more information you have. Today\u2019s AI technology makes it possible to carry out these attacks remotely and quickly.<\/p>\n The same privacy problems, exported<\/p>\n The U.S. government\u2019s appetite for health data does not stop at the border. As ProPublica reported in June 2026, the State Department has been conditioning lifesaving aid to African nations on access to their citizens\u2019 health data. <\/p>\n Under the Trump administration\u2019s global health plan<\/a>, Uganda agreed to give the United States real-time access<\/a> to nine of its health data systems for seven years, including the central repository of the nation\u2019s health information and the system managing individual electronic medical records, in exchange for up to US$1.7 billion over five years, a sum that shrinks each year and falls below prior U.S. support. Kenya struck a similar deal<\/a>; Zambia, Zimbabwe and Ghana walked away from the initial terms.<\/p>\n The U.S. government has promised that the data will be aggregated and anonymized, but privacy experts warn that the agreements are vague and omit standard limits on how much data is taken and how it can be used. A Ugandan digital rights lawyer called the choice his country faced the essence of digital colonialism<\/a>: Accept the deal and risk exploitation, or refuse it and watch people die. <\/p>\n Medical records no longer live on shelves that can only be easily accessed at your doctor\u2019s office. The common thread<\/p>\n Domestic records collection and foreign data-for-aid deals rest on the same faith that anonymization neutralizes the risk of pooling sensitive health data. <\/p>\n The evidence says otherwise. This does not mean health data should never be gathered or studied, but I believe that the reassurances deserve skepticism, the safeguards deserve scrutiny, and the people whose bodies generated the data deserve a say. To safeguard privacy, a government seeking sensitive medical records should have to show why it needs them and how the safeguards it relies on hold up. <\/p>\n Privacy law was built for a world where data resided in filing cabinets. Governments from Kalamazoo to Kampala now operate in a world where even an anonymized digital record can point back to you.<\/p>\n![\"Black-and-white](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/08\/file-20260810-59-6i5n8k.jpg\")
<\/p>\n
\n Hailshadow\/iStock via Getty Images<\/a><\/p>\n![\"Woman](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/08\/file-20260810-50-sh45ao.jpg\")
<\/a><\/p>\n
\n John Greim\/LightRocket via Getty Images<\/a><\/p>\n