Last Updated: July 29, 2026 Reading Time: 9 min

On July 23, the privacy framework for OPM's health claims database quietly went into legal effect, and within days the federal press was full of headlines about OPM "advancing" its health data collection. Some of those headlines are ahead of the facts. The monthly, claims-level data feed from all 65 FEHB carriers that alarmed everyone in December has still not been approved, and your carrier is not sending it.

What did change matters anyway, and so does the honest answer to the question every federal employee asks first: no, you cannot opt out. Here is the current state of play, what is genuinely new versus what OPM always had, and the three levers you can actually pull.

Two Documents, Not One

Nearly every confused headline this month traces to mixing up two different legal instruments:

The SORN, now in effect. A System of Records Notice is a Privacy Act document describing how an agency handles data in a system it operates. OPM updated OPM/Central-15, renamed "Health Benefits Claims and Cost Records," on June 23; its routine uses became effective July 23. This is the legal envelope for data OPM already holds, including a new routine use permitting disclosure to Treasury's "Do Not Pay" initiative. It does not order carriers to send anything new.

The ICR, still pending. The Information Collection Request (3206-NEW, docket OPM-2025-0206) is the Paperwork Reduction Act mechanism that would actually require all FEHB and PSHB carriers to begin monthly, standardized submissions of medical claims, pharmacy claims, encounter data, provider data, and drug rebate data covering roughly 8 million enrollees. The comment period closed February 10 with heavy opposition, including a 122-page objection citing 5 U.S.C. 8902(f) and a HIPAA minimum-necessary objection from CVS Health. OMB has not approved it, and no timeline is announced.

So when a headline says the data rule "took effect," what took effect is the envelope, not the pipeline.

What OPM Already Had vs. What Would Be New

The fear version of this story says OPM is suddenly seizing medical records. The accurate version is narrower and still worth your attention:

Data type Did OPM have it before? What the ICR would add
Aggregate plan-level financial data Yes, longstanding carrier reporting Nothing new
Summary utilization metrics for premium-setting Yes More granular
Targeted claims data for OIG fraud audits Yes, case-by-case Continuous and universal instead of targeted
Individual medical claims (diagnoses, procedures, providers) No continuous feed Monthly, standardized, all carriers
Pharmacy claims (drugs, dosages, refill history) No continuous feed Monthly, all carriers
Encounter and provider data No Monthly, all carriers
Drug manufacturer rebate data No Quarterly

The genuinely new thing is scale and standardization: a permanent, monthly, person-level feed across every carrier, rather than targeted pulls for specific audits.

Under the current SORN, records OPM holds are pseudonymized: names, SSNs, and addresses stripped, birth dates reduced to year, member IDs hashed. The catch, and the center of NARFE's objection, is that OPM keeps the ability to re-identify records for "authorized operational purposes." Pseudonymized data with a re-identification key is not de-identified data. As NARFE president William Shackelford put it to OPM's director, the safeguards OPM describes in blog posts are not the safeguards it is legally bound to: "It remains a blog post."

The Honest Answer on Opting Out

You cannot. FEHB carriers are contractually required to comply with OPM reporting requirements, and no individual exclusion mechanism exists in any of the notices. The only complete avoidance is leaving FEHB, which for most employees means abandoning the government premium contribution and, for retirees, potentially the right to carry coverage into retirement. That is not a privacy strategy; it is a self-inflicted benefits cut.

Which FEHB carriers share more or less data with OPM today is its own question, and it is one of the few places individual choice still operates. The carrier-by-carrier comparison lives in our companion piece on FEHB carrier privacy practices, and if it influences your plan choice, the FEHB Calculator will tell you what the switch costs in premiums.

The Three Levers You Can Actually Pull

1. File a Privacy Act access request. This one is enforceable, today. Under 5 U.S.C. 552a you can demand copies of the health-related records OPM currently holds on you, request amendment of inaccurate records, and get an accounting of who your records were disclosed to. Write to: Office of Personnel Management, Office of the Executive Secretariat, Privacy and Information Management (FOIA), 1900 E Street NW, Washington, DC 20415-7900, ATTN: Healthcare and Insurance. Include your full name and any former names, date of birth, SSN, employing agency or retirement system, and what you are requesting. The honest caveat: this shows you what OPM holds and lets you correct errors. It does not stop future collection.

2. Put your member of Congress to work. The formal comment window closed February 10, so congressional oversight is the strongest remaining lever. It has already moved once: letters from Senators Schiff and Warner and roughly a dozen other members landed in April. If your Representative sits on House Oversight, or your Senator on Homeland Security and Governmental Affairs, your constituent letter carries committee weight. The concrete asks: a hearing on OPM's re-identification capability, legislation making de-identification the default, and appropriations riders restricting funding for collection that lacks binding safeguards.

3. If you are in a union, make it a bargaining objective. AFGE's stated concern is specific: claims data could identify employees who sought care this administration has targeted, including reproductive and gender-affirming care. NARFE's four demands, de-identification by default, mandatory rather than discretionary safeguards, hard separation of key material from enrollment files, and an explicit ban on personnel-related use, are a ready-made template for union advocacy. The personnel-use prohibition is the one that most directly protects individual employees, and it currently appears in none of the binding text.

A fourth path, the HIPAA complaint to HHS, is real but narrow: it applies if your carrier mishandles your records under HIPAA's own rules, not as a route to stopping OPM's program.

What to Watch Next

  • OMB's decision on ICR 3206-NEW. This is the trigger. If approved, carriers begin monthly submissions and this story changes from proposed to operational.
  • Whether any of NARFE's four demands get converted into binding text before approval.
  • Open Season in November. Nothing about this program changes your premiums or benefits, but if carrier data practices matter to you, that is the annual window to act on the carrier comparison.

Compare Your FEHB Options

If carrier privacy practices are going to factor into your plan choice this Open Season, get the premium math first. Use the free FEHB Calculator to compare your real annual costs across plans before weighing the privacy differences. Try it now →

Frequently Asked Questions

Can I opt out of OPM collecting my FEHB medical data?

No. There is no individual opt-out, and carriers are contractually bound to OPM's reporting requirements. The expanded monthly collection is also not yet in effect; it awaits OMB approval.

What is the difference between the SORN being in effect and the new data collection starting?

The SORN is the privacy framework for data OPM already holds; it took effect July 23, 2026. The new monthly carrier feeds require separate OMB approval of ICR 3206-NEW, which has not been granted. Nothing changed at the carrier level.

Can my supervisor or agency see my FEHB claims data?

Not through this system; it flows from carriers to OPM's program office. But no binding prohibition on personnel-related use exists yet, which is exactly what NARFE has demanded OPM add.

What can I actually do right now?

File a Privacy Act access request to see your records, press your member of Congress (especially Oversight and HSGAC members) for binding safeguards, and route the NARFE demands through your union as bargaining objectives.

Is the FEHB family member verification requirement connected to this?

No. That program collects eligibility documents into enrollment systems under separate authority. Different data, different system, different rules.

Sources: SORN OPM/Central-15, 91 Fed. Reg. (June 23, 2026) · ICR 3206-NEW, 90 Fed. Reg. 57793 · GovExec on NARFE's July 2026 letter · FedSmith, July 24, 2026