The debate over OPM’s plan to collect detailed medical claims data on millions of FEHB and PSHB enrollees has, until now, played out mostly between OPM and the people objecting to it — lawmakers, unions, retiree groups, and carrier organizations. A new brief from the Congressional Research Service (CRS), Congress’s nonpartisan research arm, adds a different angle. Rather than weighing in on whether the plan is good policy, CRS asks a more basic legal question: does the statute OPM is relying on actually authorize this kind of data collection?
Its answer: not clearly. The law doesn’t expressly authorize an individual-level claims repository, and CRS lays out real arguments on both sides — the kind of question that may ultimately need a court, or Congress, to settle.
A quick refresher
In December 2025, OPM proposed requiring FEHB and PSHB carriers to report detailed monthly claims and cost data. A June 23, 2026 notice reaffirmed that plan and described how OPM intends to protect privacy: carrier data would first go through OPM’s Office of Inspector General, which would strip identifying information other than a Member ID, before OPM technical staff convert that ID into a pseudonymous identifier for analysts to use.
This isn’t entirely new territory for OPM — it has maintained a claims-data repository for FEHB in some form for years, evolving from the original Health Claims Data Warehouse to what’s now called the Research and Oversight Repository (ROVR). What’s changed is the scope: far more granular, individual-level data than OPM has collected before.
That’s the plan you may recognize from earlier coverage of the privacy fight — the Schiff/Warner Senate letter, NARFE pushing for true de-identification rather than pseudonymization, and OPM’s public defense of its approach. CRS steps back from that privacy debate and asks a more fundamental question: does OPM have the legal authority to do this at all?
The legal question: “study,” “examine,” or “possess”?
OPM’s authority rests on 5 U.S.C. §8910. Subsection (a) directs OPM to “make a continuing study” of FEHB’s operation. Subsection (b) lets OPM “examine records” of carriers and requires carriers to “furnish such reasonable reports as [OPM] determines to be necessary.”
OPM argues that authority is broad enough to support a full claims repository. The trade organization representing FEHB carriers disagrees, arguing the statute lets OPM require reasonable reports and examine records — not take permanent possession of individual-level data on every enrollee.
CRS doesn’t resolve the dispute, but shows how a court would: starting with the plain meaning of “study,” then looking at context clues like Section 8910’s own heading (“Studies, reports, and audits”) and how Congress worded similar authority elsewhere when it wanted agencies to have broader data access. Differences in wording like that can matter to a court deciding how far Congress meant to go.
A second problem: how OPM got here
CRS also flags a procedural issue: whether this requirement should have gone through formal notice-and-comment rulemaking, rather than the information-collection process OPM actually used. If a court found the requirement adds a genuinely new substantive obligation, that alone could be grounds for a challenge — separate from the underlying authority question.
What this means for federal employees and retirees
Nothing about your day-to-day FEHB or PSHB coverage changes because of this report. You’ll use your plan and file claims the same way you always have. What’s changed is that the case against OPM’s data plan now has a nonpartisan legal analysis behind it, not just advocacy pushback. That raises the odds this ends up in court, or that Congress steps in to clarify the statute. For now, there’s nothing enrollees need to do — but it’s worth watching whether NARFE, the carrier trade group, or a member of Congress cites this CRS analysis directly in a lawsuit or a legislative fix. That would be the next real signal of where this heads.