The federal government’s newly announced plan to build a national autism data platform is moving forward quickly — and quietly.
Spearheaded by Secretary of Health and Human Services Robert F. Kennedy Jr. and initially described by NIH Director Dr. Jay Bhattacharya as a “registry,” this initiative would collect and centralize sensitive medical and behavioral data from across the country, including insurance records, genomic profiles, pharmacy histories and even smartwatch data. After public backlash, HHS walked back the term “registry,” now describing it as a real-world data platform. But the scope and function remain largely unchanged.
This is not how public health is protected. It is how personal rights are violated.
Utah is at the center of this issue. We are one of the few states that already operates an autism registry. We have the infrastructure — and therefore, the most to lose — if state-controlled health data is co-opted by a sweeping federal mandate that overrides consent and due process.
The privacy risks are not theoretical. The Fourth Amendment protects Americans from unreasonable searches. The Fourteenth guarantees due process before personal information can be taken or used. HIPAA limits how and why health data can be disclosed. And while the government claims all personal identifiers will be removed, a growing body of research — including NIH-funded studies — shows that de-identified data can often be re-identified once combined across multiple sources. That makes this platform functionally indistinguishable from a registry in practice.
If Utah allows this to proceed without challenge, we will be setting a dangerous precedent: that federal health agencies can claim broad authority over deeply personal medical information, sidestepping both state governments and the individuals most affected.
But we have an opportunity to lead.
Gov. Spencer Cox should initiate or support a legal challenge — Utah v. Kennedy — to halt this platform before it is implemented. By doing so, Utah would be defending not just the rights of its own citizens, but the privacy rights of millions across the country. A successful legal challenge would reaffirm that data belongs to individuals first, not to the federal government.
It’s easy to underestimate how quickly policy becomes practice — and how difficult it is to undo once data is collected and systems are in place. That is why action must be taken now, not after the platform is built.
This is not a partisan issue. It is a constitutional one.
If Utah speaks up, other states will follow. If we don’t, we may find that the door to medical privacy — once opened — cannot be closed.