- Health Secretary Robert F. Kennedy Jr. is seeking federal access to Americans' identifiable medical records from state health information exchanges to research vaccine-autism links.
- HHS officials have held multiple meetings with state exchange leaders over the past year requesting data for vaccine safety studies.
- Privacy advocates and public health officials question the legality and scientific value of accessing detailed patient records without clear consent frameworks.
- Nebraska's CyncHealth received $18.7 million in CDC funding, the largest state award, after agreeing to share medical data with Kennedy's team.
- Maryland and other states have refused participation, citing contractual restrictions and lack of proper approvals.
A new chapter in the vaccine safety debate
In a move that has reignited long-simmering tensions between public health transparency and medical privacy, U.S. Health Secretary Robert F. Kennedy Jr. is pursuing federal access to millions of Americans' medical records stored in state health information exchange systems. The initiative, confirmed by multiple participants in private meetings with HHS officials, aims to investigate potential links between vaccines and autism—a connection that decades of scientific research have consistently rejected.
At stake is a fundamental question: How should the federal government balance its interest in studying chronic disease and vaccine safety against individuals' rights to keep their medical histories private? The answer could reshape how Americans interact with a health data ecosystem that has quietly expanded over two decades, touching nearly every doctor's visit and hospital stay.
The data at issue: State health information exchanges
Nearly every state operates at least one health information exchange, regulated by state law and managed by private companies or nonprofits. These systems allow hospitals and clinics to share patients' medical records instantly—from emergency room visits to prescription histories and doctor's notes. Designed primarily for clinical care coordination, the exchanges also notify public health authorities about infectious disease outbreaks.
HHS officials have sought to expand this role dramatically. In meetings over the past year, Kennedy's team asked whether the exchanges could provide "real-time, 24-hour data feeds" for vaccine safety monitoring and chronic disease surveillance, according to participants. A proposal presented in October called for the federal government to receive data from 90% of Americans' medical records by 2028, at a cost of $3 per person annually.
States divided on participation
The response from state exchanges has been mixed but revealing. Craig Behm, who runs Maryland's health information exchange, said he declined to share data after Kennedy's team asked directly whether the system could support vaccine research.
"A number of us said, 'We can't do anything our agreements don't allow us to do, so no,'" Behm recalled.
Most exchanges have contractual restrictions on who can access clinical data. Sharing identifiable medical records for research would require approvals from hospitals, state political leaders and institutional review boards—approvals that had not been obtained.
Indiana's exchange is still weighing its response. "Vaccine safety has come up pretty consistently," said CEO John Kansky, who expressed unease: "It's like, oh man, I wish you would have picked something that pushed fewer buttons for people."
Nebraska: A cooperative partner
At least one state has moved forward. Nebraska's CyncHealth, the state's health information exchange, received $18.7 million in CDC funding—the largest award to any state despite Nebraska ranking 38th in population. CyncHealth then received $13.6 million in state contracts in January, retaining $2.4 million for Kennedy's project.
Former CyncHealth CEO Jaime Bland, who now serves as chief data strategist for the MAHA Institute, a think tank aligned with Kennedy's agenda, described the work as "a proof-of-concept project on how health information exchange and public health can work together to improve health outcomes and is not specific to autism." She said data would be "deidentified where appropriate," though HHS has offered no details on privacy protections.
Historical context and concerns
This is not the first time Kennedy has sought to build a federal autism database. In May 2025, he announced plans for a "real-world platform" drawing from Medicare and Medicaid claims, electronic health records and wearable devices. The announcement followed weeks of confusion after the NIH director floated—then walked back—the idea of an autism registry.
The controversy echoes earlier debates about government access to medical data. In 2009, the HITECH Act spurred electronic health record adoption, creating the infrastructure that exchanges now rely upon. Privacy advocates have long warned that such systems, while improving care coordination, create unprecedented opportunities for government surveillance.
Daniel Jernigan, a former top CDC official who left the agency last year after 31 years, questioned both the legality and the utility of Kennedy's approach. The federal government has limited authority to access state exchange records, he noted. And even if obtained, electronic health record data captures only what occurs during medical encounters.
"If they're only looking at electronic health record data, all you're going to get is what was captured in the encounter," Jernigan said. "It's not going to be very satisfying."
Kennedy has countered that existing systems are "broken" and that new databases will "restore CDC's commitment to gold-standard science." But critics worry the effort risks steering research toward predetermined conclusions about vaccine safety, while exposing intimate medical details to federal scrutiny without clear legal safeguards.
What comes next
The conflict reflects a deeper question about trust in public health institutions. Supporters of Kennedy's initiative argue that only comprehensive, unredacted data can answer lingering questions about autism's causes. Opponents warn that pursuing a scientifically discredited hypothesis through mass data collection threatens both privacy rights and the integrity of medical research.
As states weigh participation, the outcome may depend on whether HHS can demonstrate robust privacy protections and scientific rigor—or whether this marks the beginning of a more fundamental clash between government transparency and individual medical autonomy. For now, most states are watching Nebraska closely, waiting to see what the data reveals, and at what cost to patient privacy.
Sources for this article include:
Please contact us for more information.