The U.S. Department of Health and Human Services is pursuing access to detailed, identifiable patient medical records from state health information exchanges to research a link between vaccines and autism, according to KFF Health News reporting published June 4. HHS Secretary Robert F. Kennedy Jr. has been meeting privately with leaders of state health information exchanges seeking data that would cover an estimated 90% of the U.S. population's medical records by 2028.

The effort has not been publicly announced by HHS, and the agency has refused to answer questions about how many states are participating, what specific data is being collected, total spending, or how patient privacy will be protected.

What HHS Is Requesting

HHS is seeking access to state-level health information exchanges, little-known systems that allow hospitals and clinics to share detailed patient information. These systems contain comprehensive medical records including diagnoses, prescriptions, lab results, vaccination records, and treatment histories.

Kennedy told KFF Health News the data will be used to investigate autism causation, vaccine safety, and chronic diseases. Administration officials in the meetings repeatedly asked how the records could be used to monitor vaccine safety, according to sources who attended.

CNN confirmed the reporting and added that Kennedy said HHS has "a whole pipeline of studies that will be done over the next year."

State Participation and Funding

Nebraska's state health department was awarded $18.7 million in 2025, the largest grant of any state despite being the 38th most populous state. Texas received $9.2 million and California received $10.8 million, according to KFF Health News.

The former leader of Nebraska's state health information exchange has led the effort to share data with the federal government. In October, state organizations pitched a surveillance system that would give HHS "real-time, 24-hour data feeds on opioid and chronic disease trends" within a year.

HHS has not disclosed the total number of participating states or the total funding allocated to the project.

Privacy and Legal Concerns

Maryland's health information exchange declined to share data for this research, citing the need for approvals from hospitals, state leaders, and research boards before participating.

HIPAA regulations typically limit government access to identifiable patient data. Federal agencies can access such data under specific circumstances including public health surveillance, court orders, or regulatory oversight, but those exceptions are narrowly defined and subject to privacy protections.

South Dakota Searchlight reported that some public health leaders in private meetings raised doubts about whether the data access is legal or whether the information would be useful for Kennedy's stated research goals.

HHS has offered no public explanation of how patient data will be protected, who will have access, how long records will be retained, or what privacy safeguards are in place.

Medical Consensus on Vaccines and Autism

The medical establishment has studied the claimed vaccine-autism link for decades and rejected it. Major studies involving hundreds of thousands of children across multiple countries have found no causal relationship between vaccines and autism.

Kennedy has long promoted the vaccine-autism connection despite the scientific consensus. His appointment as HHS Secretary raised concerns among public health experts about the direction of federal health research and the credibility of government health communications.

What This Means for Autism Families

Children with autism diagnoses are likely to have their medical records included in this database if their state's health information exchange is participating. Families were not notified of the data sharing, and it's unclear whether opt-out provisions exist.

The research direction raises questions about how autism will be framed in federal health policy. If the underlying premise of the research contradicts established science, autism families may face renewed public skepticism about evidence-based interventions, increased vaccine hesitancy in their communities, and policy decisions based on research the broader medical community doesn't recognize as valid.

There's also no clarity on data security. Health information exchanges have been targets for cyberattacks, and expanded federal access increases the number of potential access points.

What Families Can Do Now

• Contact your state health information exchange. Ask whether your state is participating in the HHS data-sharing initiative, what patient data is being shared, and whether your family can opt out.
• Request disclosure from state health departments. Ask for copies of any agreements with HHS regarding medical record access, the funding your state received, and what privacy protections are included in those agreements.
• Contact your congressional representatives. Ask them to request oversight hearings on HHS's use of health information exchange data, disclosure of participating states and funding amounts, and explanation of privacy safeguards.
• Review your child's health information exchange enrollment. Some states allow patients or guardians to opt out of having their records included in the exchange. Check your state's health information exchange website for opt-out procedures.

Where to Find More Information

State health information exchanges are typically managed by state health departments or independent nonprofit organizations. Search for "[your state] health information exchange" to find your state's system.

HIPAA privacy rights are explained on the U.S. Department of Health and Human Services Office for Civil Rights website. You can file a HIPAA complaint if you believe your medical records were accessed or disclosed improperly.

The KFF Health News investigation includes additional details on the meetings between HHS officials and state health information exchange leaders.