The Program RFK Jr. Confirmed Before Announcing It

Introduction

RFK Jr. told a reporter in May 2026 that "we now have databases together that we can actually do the studies on. Those studies are in motion." He said that to KFF Health News before his department had announced a single thing about the program. The program is access to your full medical record (doctors' notes, prescription history, diagnosis codes, lab results) pulled from the state health information exchanges that cover most of the country. No legal authority cited. No privacy framework disclosed. When KFF sent HHS six basic questions about it, the spokesperson answered none of them.

The pipeline that made Kennedy's quote true runs through a company called CyncHealth in Nebraska, which collected $13.6 million in state contracts weeks after the federal government routed Nebraska the largest CDC grant in the country. The CEO who ran CyncHealth while that happened resigned the same month the money landed, and four months later she turned up as chief data strategist at a think tank built around Kennedy's agenda.

How Nebraska Became First

Start with the grant, because the grant is the part hiding in plain sight. On December 19, 2025, the CDC announced new funding through its Epidemiology and Laboratory Capacity program, a long-running cooperative agreement that sends money to 65 state, local, and territorial health departments for disease surveillance and "health information systems." Nebraska's share was $18.7 million, the highest award in the country. Texas got $9.2 million. California got $10.8 million. Nebraska is the 38th most populous state, and it walked away with more than either of them.

What happened next is in Nebraska's own contract records. On January 9 and January 16, 2026, the state health department awarded three contracts totaling $13.6 million to CyncHealth, the dominant health information exchange in the state, the clearinghouse that ingests records from hospitals, clinics, pharmacies, and labs across its network. CyncHealth's spokesperson told KFF the company kept $2.4 million of that specifically for Kennedy's project and passed the rest to other participating states and vendors. A former CDC official, speaking anonymously because they weren't authorized to talk, confirmed the money was meant for CyncHealth to supply data for Kennedy's vaccine-and-autism work.

That's the mechanism the original reporting gestured at but didn't fully draw out. The CDC grant announcement says nothing about vaccines, autism, or a national records project. It reads like routine public health infrastructure money. It was the vehicle. Federal officials had spent the prior year meeting with state exchange leaders asking for medical records access, and most of them said no. Nebraska's exchange said yes, and Nebraska got the biggest check in the country. Cooperate, then collect.

The Slide That Told Officials How to Talk About It

Here's the receipt that turns this from a policy fight into something else. At a meeting in October 2025, federal officials and exchange leaders reviewed a 43-slide presentation, which KFF obtained. The deck's stated subject was building real-time feeds to track opioid and chronic disease trends. It proposed that exchanges like CyncHealth ingest data "from hospitals, clinics, laboratories, pharmacies, payers, and social services agencies," then link the records through a master patient index, at a price of $3 per person per year. The proposal projected reaching 90% of the U.S. population's records by 2028.

One slide carried an instruction that doesn't appear in any press release: "frame publicly that this is not a new database, but a federated trust model."

That's a directive to the people in the room about how to describe the program to the public, a pre-written answer for the moment someone asks whether the government is building a database of medical records. You don't script the public framing of a thing unless you already know the accurate description won't survive being said out loud. The deidentification hedge sits a few words away ("deidentified where appropriate"), which is the language officials reach for when they want the option of identifiable data without committing to it in writing.

The deck itself was about opioids and chronic disease, but the vaccine intent surfaced in other conversations. Craig Behm, who runs Maryland's exchange, recalled the health IT office asking whether the exchanges could help the administration research vaccine effectiveness. His group's answer: "We can't do anything our agreements don't allow us to do, so no." John Kansky, who runs Indiana's exchange, said "vaccine safety, or whatever words you want to use, has come up pretty consistently in those conversations." HHS told USA Today it's "strengthening public health surveillance" under the Make America Healthy Again agenda, and declined to say how many states are involved, what data is collected, who can access it, or what law authorizes any of it.

This Already Happened Once

The records play has a dry run, and it's worth knowing because it tells you the October pitch wasn't a one-off idea someone floated. In July 2025, Kennedy dispatched his former deputy chief of staff, Hannah Anderson, to CDC headquarters in Atlanta to obtain Vaccine Safety Datalink records. The VSD is a system of roughly 12 million Americans' medical records that CDC has used to monitor vaccine safety since the 1990s; since 2001, the partner health systems hold the data themselves rather than CDC. The New York Times first reported the trip; per NBC News and a former CDC official cited by MedPage Today, Anderson wasn't allowed to leave until she had the data in hand. CDC then configured a computer to hold more than 80 million old records carrying personally identifiable information, spanning decades, though this was an archive rather than a live feed.

The person HHS brought in to analyze them is David Geier, hired as a "senior data analyst" in 2025. This is the same David Geier who was barred from VSD access in 2004 for misusing the data, whose earlier work the Institute of Medicine called "fundamentally flawed to the point of making their results uninterpretable." Senator Ben Ray Luján wrote to Kennedy in April 2026 pointing out that Kennedy had told the Senate Finance Committee in September 2025 that Geier's study protocols were "public," and that after a diligent search, his staff couldn't find them anywhere. So the HIE program is the second time this team has gone after identifiable records outside the normal protocol, with the same person waiting to analyze them. The October pitch was that approach scaled up from one database to the records of most of the country.

Who Benefits

Kennedy gets the thing he has wanted for years: a feed of identifiable medical records he can run his own analyses on, outside peer review, and announce findings from with the weight of government data behind them. He confirmed to a reporter that the studies are "in motion" before any public disclosure, so the value isn't just the data, it's controlling when and how the public learns the program exists. That's what the October slide was scripting for.

CyncHealth and Jaime Bland get money and a launchpad. Bland was paid nearly $420,000 a year as CyncHealth's CEO. She resigned in December 2025, the same month the contracts were finalized. By April 2026 she was named chief data strategist at the MAHA Institute, the Kennedy-aligned think tank co-founded by Tony Lyons and backed by allies including Del Bigtree. A Forbes profile framed her appointment as a win for healthcare data interoperability, placing her alongside Oracle Health's Seema Verma. Bland had also founded a healthcare data integration company, Aquila, which emerged from stealth in March 2026 (first reported by Forbes Digital Assets on March 9 and HIT Consultant on March 10) claiming "active state and federal contracts already underway." That's a company-asserted claim, not something I can confirm against federal spending records. The documented sequence: take the grant, sign the contracts, resign in the same month, land at the aligned think tank by April, and stand up a data company along the way. Each step has a date on it.

What "No Legal Authority Cited" Actually Means

The legal question here is genuinely contested, and I want to be precise about it. HIPAA has a public health exception that lets covered entities disclose protected health information to a public health authority "authorized by law" to receive it for disease control. HHS is a public health authority. So the easy version ("this violates HIPAA") isn't quite right, and I'm not going to pretend it is.

But the exception requires a specific legal authorization and a qualifying public health purpose, and HHS has cited none for this program. A former CDC official told KFF the federal government has limited legal authority to pull records from state exchanges this way; asked how satisfying a forced approach would be, he said, "It's not going to be very satisfying." The exchanges aren't just bound by statute. They're bound by their own data-sharing agreements, which typically require hospital, research-board, and state sign-off before any new use. Maryland's Behm cited both. That's why the slide deck mattered so much: when you can't point to clear legal authority and you can't force the contracts, the next best thing is to control how the public hears about what you're doing. That framing instruction is what you write when persuasion and authority both run short.

Kennedy's HHS has spent the past year making it harder for information to get out of the department through FOIA, while quietly making it easier for the government to get in to records that were never collected with this use in mind. The ACLU, the Autistic Self Advocacy Network, and more than 80 organizations warned in May 2025 about exactly this risk, surveillance and stigmatization of disabled people through government data platforms, back when the public-facing version of this was a proposed autism registry that HHS then denied building.

The Bottom Line

If you've seen a doctor, filled a prescription, or had a lab test in a state whose exchange cooperated, your full record was the target of a year-long federal acquisition campaign that HHS never announced and still refuses to explain. The grant routing, the contracts, and Kennedy's own confirmation to a reporter are all documented; the part nobody can answer is which states beyond Nebraska said yes, because HHS won't say and the exchanges that declined only know about their own conversations. Indiana told KFF it's still "weighing" participation, which is not a no.

The thing I keep coming back to is the gap between the quote and the silence: Kennedy will tell a reporter the studies are running, but his department won't answer six basic questions about the program those studies depend on. So the open question is whether the next disclosure comes from HHS at all, or from a state contract database, an exchange executive who decides the agreements don't cover this, or a senator who reads the same records I did.

This story is developing. Details may change.