Earlier this year, the National Institutes of Health (NIH) and the Centers for Medicare & Medicaid Services (CMS) announced a partnership to create a “real-world data platform” to better understand the potential “root causes of autism.” They said the platform would use claims data, electronic medical records, and data from wearable devices. 

The project has been framed as novel scientific research, but disability advocates and researchers have raised concern about data privacy and the potential misuses of federal medical services and insurance data for disabled people’s treatment. And although the Department of Health and Human Services’ announcement mentions starting with CMS data use agreements and following data privacy laws, various disability advocacy groups have raised concerns about needing strong guardrails on sharing data about such specific conditions.

Throughout history, the federal government has used data against disabled people in harmful ways, including forcing sterilization of tens of thousands of women deemed “feebleminded”; undercounting disabled people in the census, limiting their access to programs and services; and using outdated definitions of disability to deny people access to Social Security Disability Insurance (SSDI) and Supplemental Security Income (SSI). To prevent improper data use, the systems collecting and reporting disability data should implement privacy guardrails and channels for accountability.

How the federal government uses personal data

Personal information that federal agencies collect is protected by strict privacy laws that govern how an agency may use or share people’s personal information. Several laws also dictate how the federal government can access data produced and stored by states. These rules are particularly important for programs like Medicaid and the Supplemental Nutrition Assistance Program (SNAP), which are dually operated by the state and federal governments.

States tend to have more-detailed information about the populations they serve because they directly administer these programs, and they share certain data with the federal government through routine procedures like audits.

But recently, the Trump administration has made efforts to access more-detailed state eligibility review and service data, which contain more-personal details than what’s usually reported to the federal government. In addition, the administration is breaking with privacy rules and norms, outlined in the Health Insurance Portability and Accountability Act and the Privacy Act of 1974, by proposing to use the data not for health care provision, but for immigration enforcement purposes.

Data privacy is complex for disabled people, many of whom depend on federal programs for their well-being

The administration’s proposal to use Medicaid and Medicare data to better understand people who have an autism diagnosis, while not yet implemented, has already raised fears about the intentional targeting of people with disabilities. The recent pronouncements about unsubstantiated links between Tylenol and autism and vaccines and autism have only reinforced concerns that the administration’s pursuit to study autism could further harm disabled people.

Disabled people often must disclose information about the nature and severity of their condition as part of eligibility determination processes for SSDI, SSI, or other safety net programs (PDF). The information requested varies by program, but it can include people’s medical records, the names of doctors they visit, the medications they take, and the locations they go for treatment. 

For example, Connecticut’s home and community-based care application (PDF) asks for medical history and the results of a person’s most recent physical evaluation. It also asks applicants for copies of their birth certificate and Social Security number. Depending on the program, people might also have to share their personal financial information, like pay stubs or bank statements.

Other occasions when personal data are collected include when people seek medical care in their community from local providers who submit billing and claim information to insurers, like Medicare and Medicaid. This information may include personal details about the patient and the medical services and treatment provided.

That government agencies and service providers collect this information isn’t inherently problematic. They have done so for decades and maintained the appropriate safeguards. The problem now is that the government is proposing to use new technologies that people did not consent to and to use these data for unplanned purposes. Many disabled people fear these new efforts will violate their privacy, label them “problematic,” and force them to accept services or treatments that they do not want or be denied services they need.

The CMS data sharing agreement threatens disabled people’s medical data privacy

When CMS signed a data sharing agreement with the US Department of Homeland Security (DHS) to give the US Immigration and Customs Enforcement access to state Medicaid data, which would show citizenship status of those who sought emergency care services covered by Medicaid, several states filed a lawsuit against CMS and DHS claiming privacy violations. The lawsuit resulted in a federal injunction on data sharing in those states.

Now, the federal government is proposing to use personal medical data to flag people who have sought treatment for themselves or their children for autism. Disability advocates fear these data could be used to make outside determinations about a person or their condition and force autistic children or adults into unwanted and unproven treatments. These fears are not without historic basis. For years, various policies have harmed disabled people by limiting their personal autonomy through guardianship arrangements, taking away disabled parents’ children, and forcing sterilization to eliminate “undesirable” traits. As of 2022, 31 states and the District of Columbia have laws that allow disabled people to be sterilized.

In the gravest scenario, advocates fear the federal government could set harmful precedent and use data to flag people with other conditions and disabilities like cerebral palsy, severe epilepsy, and intellectual and developmental disabilities, without their consent. The fear is that data could be used to force people with these conditions into institutions to receive interventions they do not want.

Strategies to bolster data protections 

People need to able to trust that the data collected about them are accurate and that government agencies will only use their data for intended purposes. Without accurate information and data, we expose disabled people to stigma, misinformation, and marginalization. The proposed autism registry and other new data sharing agreements undermine this confidence. Without that transparency, people may be afraid to ask for help and more likely to opt out of applying to the programs and services they want and need.

To mitigate future harms, states and localities can:

• Enforce established privacy laws. Upholding and enforcing existing privacy laws and protocols, including through the court system when necessary, protects access to people’s sensitive data. For example, 21 states and DC are currently challenging US Department of Agriculture demands for access to sensitive SNAP data on the grounds that the agency isn’t adhering to federal privacy laws.
• Expand state privacy policies. Strengthen state-level privacy policies, such as through comprehensive data privacy laws like those recently enacted in several states. These laws vary in scope and can offer a variety of different protections.
• Rebuild trust. Meaningfully engage with disabled people and work collaboratively with disability advocates, privacy experts, researchers, and those who use medical services to strategize on how to rebuild trust and best safeguard their sensitive information. Successfully rebuilding trust includes continuing to deliver the services people depend on.

Meanwhile, advocates can use evidence to press for stronger data privacy rules at the federal, state, and local levels. Without these protections, disabled people’s worst fears of overreach could be realized.