HHS Denies Registry Status for Autism Data Platform Amid Privacy Concerns

How the Word “Registry” Became a Problem

WASHINGTON, D.C. — The word registry appeared in a government presentation before anyone had decided whether it was the right word. On April 21, 2025, NIH Director Jay Bhattacharya described his agency’s plans to a meeting of NIH advisors, outlining the development of a “real-world data platform” that would serve as the basis for “developing national disease registries, including a new one for autism.” The description landed in the autism community like a lit match.

Within days, HHS walked it back. A spokesperson told CBS News that health agencies were “not creating an autism registry,” contradicting Bhattacharya’s own framing. What the department acknowledged it was building instead was a platform to link existing federal datasets, drawing from claims records, electronic medical records, pharmacy data, and consumer wearables, to support research into the root causes of autism. The semantic shift from registry to platform did little to calm the concern that had already spread through the autism and disability communities.

The formal announcement came on May 7, 2025, when NIH and CMS jointly declared a “landmark partnership” to build the real-world data platform. NIH Director Bhattacharya said the initiative would “unlock landmark research into the complex factors that drive autism and chronic disease.” CMS Administrator Dr. Mehmet Oz said it aligned with the goal of “fostering innovation to improve Americans’ lives while safeguarding patient privacy.” HHS Secretary Robert F. Kennedy Jr. said: “We’re pulling back the curtain, with full transparency and accountability, to deliver the honest answers families have waited far too long to hear.”

As of April 2026, eleven months after that announcement, HHS has not publicly disclosed whether personally identifiable information will be stripped before sharing, whether patients have a consent mechanism, who will have access to the linked data, or how data from consumer wearables will be collected and secured. The questions the ACLU and 82 co-signing organizations submitted to Kennedy in May 2025 remain without formal public response.

What the Platform Will Actually Collect

The scope of data described by Bhattacharya in his April 21 presentation is broader than what most federal research data programs have assembled in one place. Data sources listed in the NIH presentation include: pharmacy chains, health organizations, clinical data, claims and billing records, environmental data, sensors, and consumer wearables. The formal May 7 announcement named Medicare and Medicaid claims data, electronic medical records, and consumer wearables specifically.

CMS covers roughly 36% of Americans through Medicare and Medicaid enrollment. For those enrollees diagnosed with autism spectrum disorder, the platform will start by aggregating their records. HHS outlined four initial research areas: autism diagnosis trends over time, health outcomes from specific medical and behavioral interventions, access to care and disparities by demographics and geography, and the economic burden of autism on families and health care systems.

The platform is designed to eventually expand beyond autism to chronic conditions more broadly. NIH Director Bhattacharya told advisors he hoped to pilot the system within six months of launch and that the goal was broad coverage of the U.S. population. The initiative builds on existing NIH programs, including the HEALthy Brain and Child Development Study and the NIA Data LINKAGE Program with CMS data.

On the technical safeguards, Bhattacharya offered one specific assurance: researchers will be able to do their work on the platforms but will not be able to download the data themselves. “There are state-of-the-art protections to make sure that these linkages do not in any way threaten the confidentiality of patients,” he said. Neither NIH nor CMS provided technical specifications for those protections in their public statements. Health lawyer Shannon Hartsfield of Holland and Knight noted to Healthcare IT News that CMS has made data available to researchers under HIPAA compliance since 2015, but added that the specifics of the interagency data use agreement between NIH and CMS remained unclear at the time of the announcement.

“When they announced this registry, they did not announce any information as to how this data would be used, or whether personally identifiable information would be removed.” — Nicole Clark, CEO, Adult and Pediatric Institute (Healthcare IT News, May 2025)

The Re-Identification Problem

Privacy concerns around this platform are not primarily about whether hackers can breach an NIH server. They are about a more technical and less visible risk: re-identification from data that has been formally de-identified.

Under HIPAA’s Safe Harbor de-identification standard, 18 specific identifiers must be removed from a dataset before it can be shared without patient authorization. Those 18 identifiers include name, address, phone number, email, and Social Security number, among others. What Safe Harbor de-identification does not remove are quasi-identifiers: combinations of age, sex, geography, diagnosis date, and behavioral patterns that, in combination, can narrow a population to a very small group or a single individual.

Helen Tager-Flusberg, director of the Center for Autism Research Excellence at Boston University, identified the specific mechanism in a statement to NPR in May 2025. “CMS data includes certain information about individuals, age/date of birth, sex, where they live,” she said. “It is possible to identify a person based on knowledge about these characteristics.” The concern is not theoretical. Research on health record de-identification has found that linking even modest combinations of publicly available data, such as ZIP code, birth year, and sex, can re-identify a substantial proportion of records in a dataset. A landmark 2000 study by Latanya Sweeney found that 87% of Americans could be uniquely identified using only those three fields.

The wearable data dimension compounds this problem. Wearable devices record behavioral patterns, activity sequences, location data, and physiological measurements over time. The behavioral signatures captured in longitudinal wearable streams are, in practice, nearly impossible to fully de-identify under any current standard. A 2025 study published in npj Digital Medicine specifically examined re-identification risks in combined EHR and wearable datasets, finding that high obfuscation was required to achieve meaningful privacy protection and that lower-obfuscation approaches left substantial re-identification risk. The autism platform, as described, would combine exactly the data types that the research literature identifies as most re-identification-prone: diagnostic records, behavioral histories, geographic data, and wearable streams.

The ACLU letter, signed May 12, 2025, explicitly raised the historical context for why the disability community views these risks as more than theoretical. “Disabled people in the United States have a long and troubled history with governmental efforts to find and track disability for the purpose of eliminating it,” the letter stated, citing the history of eugenics registries. The letter did not attribute that intent to the current administration. It argued that history made the obligation to demonstrate meaningful safeguards higher, not lower.

Disabled people in the United States have a long and troubled history with governmental efforts to find and track disability for the purpose of eliminating it. — ACLU, ASAN, and 82 co-signing organizations. Coalition letter to Secretary Kennedy, May 12, 2025

The ACLU Letter: What 82 Organizations Asked For

The coalition letter, submitted by the ACLU, the Autistic Self Advocacy Network, and 82 co-signing organizations including the Electronic Frontier Foundation, Electronic Privacy Information Center, Autism Society of America, National Disability Rights Network, and Easterseals, was sent to Kennedy on May 12, 2025. Its signatories represent a broad cross-section: civil liberties organizations, disability rights groups, and public health bodies that rarely appear on the same letter.

The letter organized its demands around three requirements. First, meaningful engagement: the signatories argued that autism advocates had historically had direct lines of communication with HHS autism policy experts under both Democratic and Republican administrations, and that the current administration had severed those channels. “Autism advocates have been pointedly denied the opportunity to weigh in on our community’s research priorities,” the letter stated. Second, fundamental privacy safeguards, including purpose-limited data use, public transparency, and individual consent for personally identifiable information sharing. The letter cited the Fair Information Practice Principles and OMB Circular A-130 as the applicable federal standards. Third, a commitment that the platform would advance the well-being of autistic people and minimize potential harms, including by conducting privacy impact assessments under the e-Government Act before deployment.

“Instead of engaging with the communities this proposal would impact most, federal health agencies have taken every opportunity to shut disabled and autistic people out of the conversation, leaving unanswered questions, a sense of alarm, and deepening mistrust,” said Vania Leveille, ACLU senior legislative counsel, in the press release accompanying the letter. Colin Killick, executive director of ASAN, said: “It is critical that autistic people’s private data not be shared without our consent. We hope the administration answers our questions to shine light on how autistic people and our rights will be protected.”

HHS did not provide a substantive public response to the letter’s three demands as of this writing. The agency’s position, stated through spokespeople, is that all data use will comply with applicable privacy laws, that the platform is not a registry, and that the initiative is necessary to address the autism epidemic Kennedy has described as a central public health priority.

What ABA Providers Should Understand

For BCBAs, practice owners, and ABA organizations, this platform has implications beyond the abstract debate over privacy. ABA therapy generates some of the most detailed behavioral data in all of health care. Session-by-session data collection, target behavior tracking, skill acquisition rates, behavioral assessments, communication profiles, and antecedent-behavior-consequence documentation all sit inside the EHR systems that ABA providers use daily. Those records already exist inside the health data infrastructure that the NIH platform is designed to draw from.

Whether and how ABA-generated behavioral records flow into the platform depends on a set of questions HHS has not yet answered publicly: which EHR systems will provide data feeds, what data elements will be extracted, whether behavioral intervention records will be included alongside diagnostic and claims data, and how the platform will handle the especially sensitive content of detailed behavioral histories. ABA providers who use EHR platforms that connect to CMS billing infrastructure are most directly in the data chain. The answer to whether their clients’ behavioral session data enters the platform may turn on technical details of data use agreements that have not been made public.

The clinical risk flagged by Krista Boe, chief clinical and compliance officer for Acorn Health, in a statement to Autism Business News in May 2025 is worth taking seriously: “It would be disastrous if concerns around a new registry or database lead to a reduction in children receiving needed, timely treatment.” That concern has a documented precedent in other health contexts. Research on HIV testing and care, immigrant health access, and mental health disclosure has consistently shown that surveillance concerns, whether well-founded or not, reduce willingness to seek diagnoses and treatment. In an autism context, delayed diagnosis means delayed access to early intervention, including ABA. The research evidence for the effectiveness of early ABA is clear; the window for early intervention is narrow. A chilling effect on diagnosis-seeking driven by privacy fears would be a direct harm to the children the platform is supposed to benefit.

Jim Spink, CEO of Autism Care Partners, offered a measured assessment in the same ABN coverage, acknowledging that a well-constructed data platform could “advance the nation’s understanding of incidence, treatment patterns and regional variability of autism,” while stressing it was “critically important, however, to recognize the limitations of claims information given health equity and access to care barriers, insurance coverage challenges.” Claims data captures what was billed, not necessarily what happened clinically. Families who cannot access ABA, or who pay out of pocket, or who live in areas with provider shortages, are systematically underrepresented in claims-based research. A platform that draws primarily from Medicare and Medicaid claims will produce a picture of autism care that reflects the populations covered by those programs, not the full spectrum of autistic people in the United States.

The platform is still being built. The data use agreement between NIH and CMS has not been made public. The consent framework, if one exists, has not been announced. Whether the platform will be subject to independent oversight, IRB review requirements, or audit mechanisms has not been specified. What ABA providers can do now is stay current on public disclosures, review their own data sharing agreements with the EHR platforms they use, and be prepared to answer client and family questions about data privacy with accuracy rather than reassurance they cannot substantiate.

AT A GLANCE

SOURCES & REFERENCES