CCHF warns: “HIPAA provides no privacy protection”
ST. PAUL, Minn. — Citizens’ Council for Health Freedom (CCHF) is raising concerns about the new “CMS Aligned Network” launched by the Centers for Medicare & Medicaid Services (CMS) on July 31. Although CMS describes this network as a patient-centered, voluntary, and opt-in “Health Tech Ecosystem,” a deeper review of the framework, also called the “CMS Interoperability Framework” reveals a much broader buildout—one that enables widespread data sharing without patient consent.
“This is a Big Government data system. CMS isn’t just creating a tool for patients—they’re constructing a nationwide digital government infrastructure to connect everything and everyone. No wonder the health tech industry is all onboard to participate,” said Twila Brase, RN, PHN, CCHF Co-founder and President. “Although CMS claims it will be a ‘seamless, secure’ network, patients will likely have no idea how far their data will flow, who will have access, or how it will be used.”
More than a decade ago, CCHF launched a “Truth About HIPAA” campaign to share the truth about data-sharing under HIPAA and to encourage Americans not to sign the ‘Notice of Privacy Practices acknowledgement statement’ as by law they are not required to do.
“HIPAA is a ruse. The privacy notice is a ruse. HIPAA does not protect privacy; it’s a permission data-sharing rule. No patient consent is required. By expanding data-sharing through a CMS “come one, come all” nationwide network that will include data at every level, including apps, the administration is further undermining patient privacy rights,” says Brase.
The federal initiative outlines how patient records, insurance data, and identity verification will link together. Mobile driver’s licenses (mDLs), now being developed in many states often as the controversial REAL ID, are listed as an approved digital credential for access, turning a driver’s license into a potential backdoor patient ID remote-accessible to DMVs
The framework allows apps to pull full medical records—structured and unstructured data—when patients log in using approved credentials. Dozens of major tech and health system players have voluntarily committed to the “CMS Aligned Network”, including Amazon, Epic, CVS Health, Oracle, and UnitedHealth Group.
The new Health Tech Ecosystem also aims to permit AI-generated medical advice and encourages “value-based care” models led by health plans. In these models, government agencies and corporations—not patients or doctors—define what counts as “value,” often prioritizing cost savings over individual medical needs. Patients could face care denials determined by algorithms instead of physicians.If an AI-generated diagnosis or clinical decision goes wrong, it is unclear if terms of service for the use of AI or the app could block patients from suing.
“For 27 years, CCHF has fought to protect patient and doctor freedom and the patient privacy rights that protect that freedom. We’ve also successfully fought against the creation of a unique patient identifier,” said Brase “The proposed ‘Health Tech Ecosystem’ is an alarming move in the wrong direction.”
For more information or to schedule an interview with Twila Brase, contact Alexandra de Scheel at media@cchfreedom.org.
