On December 12, 2025, the Office of Personnel Management (OPM) published a notice to solicit public comments on an information collection request (ICR) the agency is undertaking. OPM states that it "is collecting service use and cost data from [Federal Employees Health Benefits (FEHB)] ... Carriers, including medical claims, pharmacy claims, encounter data, and provider data." OPM states that these data will enable the agency "to oversee health benefits programs and ensure they provide competitive, quality, and affordable plans," and that OPM "requires Carriers to report necessary information and permit audits and examinations to manage the FEHB Program effectively." OPM states that under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, which governs the use and disclosure of protected health information (PHI), carriers are permitted "to disclose [PHI] including service use and cost data, to health oversight agencies, such as OPM, for oversight activities authorized under 45 C.F.R §16[4].512(d)(1)."
After receiving comments responsive to the ICR, OPM published a notice on June 23, 2026. This notice reiterates OPM's intent to collect service use and cost data (also referred to as claims data) from carriers and states that OPM's authority under 5 U.S.C. §8910(a) to "make a continuing study of the operation and administration of [the FEHB Program]" authorizes OPM to direct carriers to disclose these data. OPM states that carriers may disclose such data containing PHI to OPM "without individual authorization because OPM is acting as a health oversight agency conducting activities authorized by law." OPM states that to address privacy concerns, it will pseudonymize the records. Specifically, carrier data with personally identifiable information will be submitted to OPM's Office of the Inspector General (OIG), which will provide an encrypted copy to OPM technical staff removing all personally identifying fields except Member ID. OPM technical staff will generate a set of records containing pseudonymous identifiers that are used by analysts. This In Focus provides background on prior efforts by OPM to collect claims data from carriers and discusses selected questions raised by the ICR.
OPM has sought collection of program-wide FEHB carrier claims data since at least 2010, when OPM began discussing a Health Claims Data Warehouse (HCDW) project that would entail collection and maintenance of claims and encounter data to analyze costs and manage the FEHB program "to ensure the best value for both enrollees and tax-payers." OPM completed development of the HCDW in FY2016. Submission of data was voluntary, and not all FEHB carriers submitted data. Stakeholders had raised concerns over OPM's authority to collect HCDW data and how that related to HIPAA Privacy Rule requirements but indicated that they were near agreement with OPM in 2019 to provide de-identified claims data.
The HCDW subsequently was replaced by the Health Insurance Data Warehouse (HIDW) around 2021, at which point the previously received limited HCDW data were permanently deleted. The HIDW contained FEHB-aggregated pharmacy claims and enrollment data, which FEHB carriers had been required to report since 2019 and 2021, respectively.
In an October 29, 2025, Privacy Impact Assessment (October 2025 PIA) issued by OPM, the HIDW was formally renamed the Research and Oversight Repository (ROVR). FEHB carriers continued to report enrollment and aggregated pharmacy claims data to the ROVR. Additionally, FEHB carriers were required to report provider network and drug formulary data to the ROVR. In the October 2025 PIA, OPM stated that it would further use the ROVR "to collect and maintain service use and cost data," which "includes but is not limited to, medical claims data, pharmacy claims data, encounter data, and provider data." OPM stated that it "requires record-level identifiable data to create person-level longitudinal records" in order "to analyze and manage the FEHB Program to ensure the best value for the enrollees and taxpayers"; "detect patterns indicative of potential fraud, waste, and abuse"; and "assess the effects of new policy and legislative initiatives to improve its assessment of FEHB plan performance." It is unclear whether carriers are currently submitting such data.
Throughout this evolution, OPM pointed to its authority at 5 U.S.C. §8910 as the basis for requiring carriers to provide the requested data. Subsection (a) of Section 8910 directs OPM to "make a continuing study of the operation and administration of [FEHB], including surveys and reports on health benefit plans available to employees and on the experience of the plans." Subsection (b) requires contracts with FEHB carriers to include provisions requiring carriers to "furnish such reasonable reports as [OPM] determines to be necessary to carry out its function," and to permit OPM and Government Accountability Office (GAO) representatives "to examine records of the carriers as may be necessary to carry out the purposes of" FEHB. In addition, for the HCDW and the ROVR, OPM also asserted that it is collecting the data for health oversight, a purpose for which disclosures are permitted under the HIPAA Privacy Rule.
OPM's notices related to the ICR provide limited information regarding the data request. They do not, for instance, state that the data request relates to the implementation of ROVR as described in the October 2025 PIA. Given the similarity in the scope of claims data described in both the ICR and the October 2025 PIA, this In Focus assumes that the ICR relates to the ROVR described in the October 2025 PIA and analyzes selected questions raised by OPM's claims data request in the ICR.
The HIPAA Privacy Rule (45 C.F.R. Part 164, Subparts A, E) governs the use and disclosure of certain health information by specific covered entities, including health plans such as FEHB carriers. The rule generally requires individual authorization for the use and disclosure of protected health information, as defined in the rule, unless an exception applies. The rule permits covered entities to disclose, without authorization, PHI to noncovered entities in several circumstances, including for purposes of health oversight. As noted, the OPM data request relies on this health oversight exception, noting that the disclosure of PHI to OPM (a noncovered entity) by FEHB carriers without authorization would generally be permissible because OPM meets the definition of a health oversight agency. This exception, however, allows disclosures pursuant to "oversight activities authorized by law" and other activities necessary for oversight. Thus, OPM's ability to rely on this exception depends on whether the intended data collection is an oversight activity "authorized by law," as discussed below.
Assuming OPM may rely on the health oversight exception, FEHB carriers' provision of claims data containing PHI are subject to the rule's "minimum necessary" standard, which requires a covered entity to generally "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." In the 2026 notice, OPM states it is "collect[ing] and maintain[ing] only those data elements reasonably necessary to carry out its authorized oversight, program administration, payment integrity, and fraud prevention functions." Historically, other versions of this request sought aggregate data or contemplated sharing de-identified PHI with OPM to avoid privacy concerns. More recently, stakeholders have expressed concern that even the sharing of de-identified claims data with OPM may allow OPM to re-identify records given the information held by OPM on enrollees and family members.
The 2026 notice describes a process that would address privacy concerns not by receipt of de-identified data, but by directing specified components of OPM to receive data containing PHI and pseudonymize the data for use by OPM analysts. The notice does not specify how the data would be used or whether any third parties may facilitate such use. As a noncovered entity, OPM is not subject to the HIPAA Privacy Rule, but other state or federal law or requirements may apply to OPM with respect to its use or disclosure of this information (e.g., the Privacy Act of 1974). The 2026 notice states that all or a portion of the records may be disclosed outside OPM as a routine use for several purposes, including, subject to Privacy Act requirements, to "OPM contractors when OPM determines that it is necessary to accomplish an agency function."
One question raised by the ICR is whether OPM's authority under 5 U.S.C. §8910 authorizes the agency to require carriers to furnish the requested claims data and maintain a repository of such data. OPM states that Section 8910 provides such authority because it "requires OPM to continually study the operation and administration of the FEHB Program and requires the Carriers to furnish reports and provide OPM access to records upon request." In contrast, throughout the ROVR's evolution, the trade organization representing FEHB carriers has consistently maintained—including in response to the December 2025 ICR—that OPM's claims data request "falls outside the scope of Section 8910," because that provision authorizes OPM to (1) require carriers to "to furnish 'reasonable reports' OPM determines to be necessary, not to furnish the individual claims data of every individual covered under the FEHB Program" and (2) "to 'examine' carrier records, not to possess them."
Should a court be asked to consider this statutory interpretation question, it may employ a range of interpretive tools, including the ordinary meaning of the relevant statutory text, relevant statutory context, and evidence of how the statute has been implemented. If the relevant statutory interpretation question is framed as whether OPM's authority under Section 8910(a) to "make a continuing study" of FEHB's operation and administration authorizes OPM to collect and maintain a repository of each covered individual's claims data, for instance, a court may first consider the ordinary meaning of the term "study," which includes "a careful examination of analysis of a … development." A court may also consider Section 8910(a)'s surrounding context to discern any limits to the data that may underlie such study. Relevant context may include the provision's reference to "surveys and reports on health benefits plans available to employees" as an example of a relevant "study"; subsection (b)(1)'s requirement for carriers to "furnish such reasonable reports" as requested by OPM; and Section 8910's heading "Studies, reports, and audits." A court may also compare Section 8910(b)(1)'s requirement that carriers furnish "reasonable reports" against requirements in related statutory schemes, such as a provision authorizing the Secretary of Labor overseeing private-sector, employer-sponsored health plans to "requir[e] any information or data from any such plan ... where he finds such data or information is necessary to carry out" that regulatory scheme. A court may also consider both OPM's prior efforts to interpret Section 8910(b)(2) to authorize the claims data collection, as well as regulations implementing the minimum standards for carriers. Those standards require carriers to "furnish such reasonable financial and statistical reports with respect to the plan, as may be requested by OPM" and to permit OPM and GAO representatives to audit and examine their plan records. Applying these and other statutory interpretation tools, a court would weigh this evidence of meaning and determine whether the "best reading" of Section 8910(b)(2) authorizes OPM to collect and maintain a repository of carrier claims data.
To the extent the ICR requires carriers to provide the relevant claims data, there may also be a question regarding whether the imposition of this requirement is subject to notice-and-comment rulemaking. If a court were to analyze this question, relevant considerations may include whether the requirement "add[s] substantive content" to Section 8910 and whether noncompliance subjects carriers to any legal consequences.