The Office of Personnel Management has proposed a rule that would give the federal government broad authority to collect the medical records of its own employees — and the justification, according to critics, is alarmingly thin.
Published in the Federal Register on April 11, 2025, the proposed System of Records Notice (SORN) would establish a new database called “OPM/GOVT-1, General Personnel Records,” consolidating and expanding the types of information the government can gather on its roughly 2.1 million civilian workers. Buried within the bureaucratic language is a provision that has set off alarm bells among privacy advocates, labor unions, and health policy experts: the explicit inclusion of medical records, disability documentation, and health-related information in what the agency describes as a government-wide personnel file system.
The public comment period on the proposal has drawn thousands of responses. And the overwhelming majority are hostile.
According to KFF Health News, the proposed rule would allow OPM to collect “medical histories, disability records, and health-related documentation” from federal employees across agencies. The stated purpose is sweeping: to support “recruitment, hiring, employment, pay, benefits, performance, retention, separation, and retirement” functions. That covers, essentially, every phase of a federal worker’s career. What it doesn’t cover, critics argue, is a clear explanation for why medical records are necessary for most of those functions.
“This is a fishing expedition,” said one commenter on Regulations.gov, where the proposal is posted for public feedback. Thousands of others echoed that sentiment. Many invoked the Health Insurance Portability and Accountability Act, or HIPAA, arguing that the proposal would effectively circumvent the medical privacy protections Americans have relied on for decades. Others raised the Americans with Disabilities Act, which strictly limits when and how employers — including the federal government — can request medical information from workers.
OPM has pushed back on these characterizations. The agency argues the SORN is a routine update to existing records systems and that it complies with the Privacy Act of 1974, which governs how federal agencies handle personal data. But the scope of the new system goes well beyond what previous SORNs have authorized, consolidating records that were previously maintained under separate, narrower authorities.
As Ars Technica reported, the proposal lists more than a dozen categories of records that could be collected, including “medical records and documentation related to disability, health conditions, work-related injuries, reasonable accommodation requests, and fitness-for-duty examinations.” The breadth of these categories is what worries legal scholars. A reasonable accommodation request, for instance, might reveal that an employee has a psychiatric condition, a chronic illness, or a physical disability — information that, under existing law, is supposed to be kept confidential and stored separately from general personnel files.
That separation exists for a reason. The ADA requires employers to maintain medical information in files distinct from standard employment records, accessible only to specific personnel with a legitimate need. Consolidating these records into a single government-wide system, accessible to OPM and potentially shared across agencies, could violate that principle.
The timing hasn’t gone unnoticed either.
The proposal arrives amid the Trump administration’s aggressive push to shrink the federal workforce. The Department of Government Efficiency, led by Elon Musk, has been at the center of efforts to identify and eliminate positions deemed redundant or unnecessary. Tens of thousands of federal workers have already been targeted for layoffs or buyouts. Against that backdrop, the collection of medical records looks to many like a tool for identifying employees who might be easier to dismiss — those on medical leave, those who’ve requested accommodations, those with documented disabilities.
“There’s a real concern that this information could be weaponized,” a federal employee union representative told KFF Health News. That fear isn’t abstract. During earlier rounds of federal workforce reductions, employees on probationary status and those in positions requiring accommodations were disproportionately affected, according to reports from the American Federation of Government Employees.
Legal experts have also questioned whether the Privacy Act itself provides sufficient protection in this context. The Act allows agencies to collect personal information, including medical data, if it’s “relevant and necessary” to an authorized purpose. But the proposed SORN’s purposes are so broadly defined that almost any piece of medical information could arguably fit. Performance management? An employee’s chronic condition might affect attendance. Retention decisions? A worker’s disability status could factor into cost calculations. The vagueness is the point, critics say.
So what would the data actually be used for?
OPM’s notice doesn’t say with precision. It lists “routine uses” — the Privacy Act term for authorized disclosures — that include sharing records with other federal agencies, the Department of Justice, congressional offices, and even debt collection agencies. One routine use permits disclosure “to appropriate agencies, entities, and persons when the agency suspects or has confirmed a breach of the system of records.” Another allows sharing with the National Archives. The list is long, and each entry expands the universe of people who could potentially see a worker’s medical file.
Ars Technica noted that the proposed system would also cover former federal employees and applicants — not just current workers. That means someone who applied for a government job and disclosed a medical condition during the hiring process could have that information swept into the new database, potentially years after the fact.
The public comment period on Regulations.gov has become a clearinghouse for outrage. Comments range from terse objections — “This violates my rights as a federal employee” — to multi-page legal analyses submitted by advocacy organizations. Several commenters identified themselves as federal workers with disabilities who fear retaliation. Others are healthcare providers alarmed at the precedent. A few supporters of the proposal argue that the government, as an employer, has a legitimate interest in understanding the health status of its workforce for planning purposes. They are vastly outnumbered.
Privacy organizations have weighed in forcefully. The Electronic Frontier Foundation and the American Civil Liberties Union have both flagged the proposal as a significant threat to federal workers’ medical privacy. Their concern isn’t hypothetical. The federal government’s track record on data security is, to put it charitably, uneven. The 2015 OPM data breach exposed the personal information of 21.5 million people, including sensitive background investigation records. Adding centralized medical records to the mix raises the stakes considerably.
And then there’s the question of enforcement. Even if OPM promises to safeguard the data, who ensures compliance? The Privacy Act provides a private right of action for individuals whose records are improperly disclosed, but winning such cases is notoriously difficult. Courts have set a high bar for proving that a disclosure was “willful or intentional,” and damages are often modest. For a federal worker whose medical information is leaked or misused, the legal remedy may be cold comfort.
The proposal also intersects with broader debates about government surveillance and employee rights. In the private sector, employers’ access to medical records is tightly regulated by HIPAA, the ADA, and state laws. The federal government, as an employer, is exempt from HIPAA’s employer provisions but is still bound by the ADA and the Rehabilitation Act. Whether the proposed SORN complies with those statutes is a question that could ultimately land in court.
For now, the comment period remains open. OPM is required to review and respond to substantive comments before finalizing the rule, a process that can take months. But the administration has shown a willingness to move quickly on personnel matters, and there’s no guarantee that public opposition will slow the timeline.
What’s clear is that the proposal has struck a nerve far beyond the federal workforce. If the government can build a centralized database of its employees’ medical records with minimal justification, the implications extend to every American who interacts with a large institutional employer. The precedent matters. And right now, the people most directly affected are making their voices heard — loudly, and in large numbers.
The outcome will say a great deal about where the line falls between an employer’s claimed need to know and a worker’s right to keep their health information private. That line has always been contested. It’s about to be tested in a way it hasn’t been before.
WebProNews is an iEntry Publication