#hipaa)

In case medical care in the US wasn't enough of a horror show already... our fascist government is trying to collect the kind of data that none of us really want them to have. Because while it would be nice to think Big Brother was watching out for us, history says otherwise.

Dr. Céline Gounder for Zeteo:

The Trump administration’s new drug strategy does more than escalate the war on fentanyl. It sketches the architecture for a national surveillance system built from some of Americans’ most personal data: prescriptions, toxicology results, wastewater, electronic health records, license plate scans, and law enforcement intelligence. The plans are laid out in the 2026 National Drug Control Strategy, a 195-page blueprint released in early May. Drug Czar Sara Carter announced it on Sean Hannity’s Fox show, calling it “a battle cry.” The document promises to “fully resource and empower” Homeland Security Task Forces, “leverage advanced technology and Artificial Intelligence,” and “modernize and integrate public safety and public health data collection,” applying “advanced data science methods” to “toxicology results, wastewater analysis, electronic health records, and law enforcement seizures.”

The strategy describes a surveillance architecture but never addresses how it may or may not be used. Nowhere does the strategy mention HIPAA. Nowhere does it say how patient privacy would be protected. Nowhere does it explain what limits would prevent a system built for fentanyl from being used to monitor abortion, pregnancy, gender transition, methadone treatment, protest activity, or any other behavior a future administration decides to target.

To law enforcement veterans, the appeal of a system that fuses health data, law enforcement intelligence, and modern analytics into a single system is obvious. Derek Maltz, a former acting DEA administrator who spent a decade running the agency’s Special Operations Division, has spent years arguing that cartels, Chinese chemical brokers, money laundering networks, and synthetic drug suppliers have outpaced a fragmented federal response. “If you wanna connect the dots, you have to collect the dots,” Maltz told me.

Maltz talks about families whose children died from fentanyl, the collages of dead kids he takes to public events, and the parents who told him they never got the warning that might have saved their child. He describes his work as “not a red or a blue issue,” but “red, white, and blue.” The threat is real: Chinese chemical networks linked to Mexican cartels feed a synthetic-drug supply that kills tens of thousands of Americans a year. Maltz argues that agencies need integrated data and modern tools to keep pace with networks that already operate across borders, banks, chemicals, and encrypted platforms. Even so, he conceded the limits of enforcement. “We are not going to seize our way out of this problem,” he said. “We are not going to arrest our way out of this problem." That is what makes the strategy’s surveillance ambitions so consequential. Fentanyl is deadly, and law enforcement does need better tools. The harder question is what happens when public health infrastructure becomes law enforcement infrastructure, and the government builds a machine with no clear oversight. Much of the machinery already exists. Every state runs a prescription drug database. Police use national license plate reader networks. Wastewater surveillance expanded during COVID. Risk scores sit atop prescription records, and health data is already used in criminal cases. The 2026 strategy doesn’t invent these systems from scratch. It connects them, which is the more consequential move.

A Prescription Database With No Privacy Law

Every time a doctor prescribes a controlled substance – painkillers, stimulants, anti-anxiety medication, certain hormones – that prescription goes into a state-run database called a Prescription Drug Monitoring Program (PDMP). Every state has one. These databases are not protected by HIPAA. Federal drug agents can access any state’s database by filing a subpoena that requires no judicial review. “This is a wild, wild west,” said Jennifer Oliva, a law professor at Indiana University who has spent a decade studying prescription drug databases. The federal government helped build these systems through grants from the Department of Justice. The DEA could not collect prescriber-level data on its own, so it funded states to build the databases. The opioid crisis made that politically easy. But the databases were never limited to opioids. “There’s no reason to think that the same mechanisms in place to track and respond to potential opioid misuse can’t be turned to other drugs,” said Corey Davis, a senior attorney at the Network for Public Health Law. And there is “decent evidence that PDMPs do move people from prescription opioid misuse to misuse of street opioids, which is a net negative.” The system that was supposed to solve the opioid crisis made it worse. The same architecture is now being expanded.

States can also expand prescription-monitoring databases beyond opioids through controlled-substance scheduling, “drugs of concern” categories, or similar reporting rules. Others formally reschedule drugs under state law. Louisiana went further in 2024, becoming the first state to classify mifepristone and misoprostol as Schedule IV controlled dangerous substances, placing abortion medications inside the state’s controlled-substances monitoring regimen. Texas and Indiana lawmakers have introduced similar reclassification proposals, and Idaho has reportedly been considering similar tracking measures. Testosterone is already federally controlled as a Schedule III anabolic steroid and has been tracked through controlled-substance reporting since anabolic steroids were added to the Controlled Substances Act in 1990. You cannot tell, from a database entry, whether testosterone is prescribed for low hormone levels or for gender transition. You cannot tell whether mifepristone is prescribed for an abortion or a miscarriage.

[...]

Palantir Inside the Government

The company positioned to run the data architecture where those missions converge is already inside the federal health system. HHS has an agreement worth up to $90 million, making Palantir’s platform available across the department. The department’s later-installed Chief Information Officer, Clark Minor, previously spent more than a decade at Palantir and oversees health data infrastructure across HHS.

Minor’s financial disclosure shows he held between $1 million and $5 million in Palantir stock for more than five months after taking office before selling. President Trump made Palantir stock purchases totaling six figures, disclosed in a transaction report signed May 8, 2026, while his administration has awarded the company more than $1 billion in federal contracts. The concern is not that one company holds federal contracts. It is that the government is expanding integrated data infrastructure while failing to set boundaries around medical privacy, law enforcement access, and political repurposing.

What’s Off-Limits? The administration’s 2026 Counterterrorism Strategy, also released in May, classifies fentanyl and its precursor chemicals as “Weapons of Mass Destruction,” merging drug enforcement with counterterrorism and opening access to the broader surveillance authorities that come with it. “There’s a tremendous danger that you have the executive branch throwing together a whole bunch of stuff in an attempt to look tough,” Wessler said. “And it will be years potentially before judges are able to get involved.”

Maltz sees integrated data as a matter of public safety. Law enforcement and the intelligence community, he argues, have long needed systems that pull together data collected under court order, so agencies can map criminal networks rather than get buried in scattered records. “The data sets that these agencies are receiving from the providers pursuant to court orders and search warrants and things like that, it’s a tidal wave of data,” he said. “It’s impossible to go through it without having robust technology tools.” But health data is not just another intelligence stream. It is generated when people seek care, fill prescriptions, get screened in pregnancy, use medication, receive addiction treatment, drive to clinics, or live in communities whose sewage is tested. Once those data streams are fused with law enforcement and counterterrorism tools, the question is not whether the system can find people. It is whether there is anything it is forbidden to find.

I know there's like atleast some rule to not tell strangers less your fired, but I also worry for parents or schools or goverment etc. Conservative parent doesn't believe in mental health(normal ppl or r-word and nothing else) and I generally have had bad experiences with social workers telling the things I tell them to others. I fear how I might be treated or how freely info like me being autistic might spread or be used. Do you know how much therapists usually share what they find with such people/organisations?

Obligatory “therapist but not your therapist” disclaimer, then the answer is: it depends. In the U.S. therapists are bound by HIPAA, although recent moves with the federal government may impact how HIPAA works going forward at-present it means that people cannot share “PHI” or personal health information unless you permit them to do so. This is impacted by multiple variables - for example, at one of the sites I worked at we made parents sign a confidentiality agreement before treating their kids to avoid having to disclose information to parents as the legal guardians of a child (and by extension their PHI). Our contracts permitted us to work with parents if a child was going to engage in behavior that could reasonably endanger them, such as meeting an internet stranger for sex or using powerful drugs. At that site I only ever involved parents in a child patient’s care twice - once with a child’s permission to discuss an ongoing stressor in their life, and the other after a child expressed serious suicidal ideation and I needed dad to know to safely secure his firearms.

I also worked at a site that provided forensic evaluations for kids going into the Juvenile justice system. In those cases we often could not disclose information to parents but were obligated to disclose information to the courts. This was always disclosed beforehand and almost always worked in the patient’s favor, but sometimes kids would confess to crimes they had plead “not guilty” to and that would get sent to the judge overseeing their case. In forensic cases we were not allowed to share information about the person receiving the assessment with them or their caregivers as our client was legally considered to be the Arizona Office of Corrections.

With adult patients, my work with patients who had committed sex offenses had some unusual aspects related to confidentiality. Patients were not permitted to choose to seek treatment, and often refusal to see treatment was considered a violation of parole, so many patients were being treated against their will and with limited confidentiality due to the nature of their probation arrangements, which permitted us to share information with probation officers if needed. It also gave probation officers access to therapy documentation, which was an additionally confounding factor. But these were factors which were known to patients prior to engaging in treatment, so while it is ethically dubious it was still allowed.

In general, therapy patients who are adults and not involved with the legal system in some way are protected by HIPAA, where information cannot be shared barring extreme circumstances (imminent risk of danger to self/others) unless the information is de-identified (meaning the information used cannot be so specific as to identify you to others.) Some states have extended these same protections to minors, although not all of them have. A good general rule of thumb to use is “If the state lost the civil war, it does not protect the confidentiality of minors by default.”

Meditech - the medical portal contractor my local hospital uses - doesn't know how to sanitize form inputs. I have some doubts about how secure my records are!