Are Autism Diagnoses Shared With the Government? What Parents Need to Know About Privacy, Registries, and Evaluations

Yes, some information about an autism diagnosis can reach government health systems through Medicaid or Medicare claims, public-health reporting, and legally authorized research. But that is not the same as a newly created national autism registry containing every diagnosed child, and it does not mean outside researchers can freely view children’s names or medical records.

Those distinctions matter because parents have reportedly canceled autism evaluations out of fear that a diagnosis could expose their children to federal scrutiny. The cancellations are documented. So are federal plans to connect and study healthcare data. What remains less clear is precisely which records have entered newer systems, which researchers can access them, and what control families retain over particular uses.

For a parent considering whether to keep an evaluation appointment, there is another essential fact: avoiding a diagnosis is not a reliable way to erase information already held in medical or educational records. It can, however, delay documentation needed for certain services. Other supports, including public-school evaluations, may be available without a medical autism diagnosis.

This guide separates what federal agencies have announced, what their own records establish, what independent reporting has uncovered, and what parents can actually do.

Are parents really canceling autism evaluations?

Yes, but the available reporting does not establish how widespread the cancellations are.

In a May 1, 2025, investigation, STAT interviewed clinicians and families who described canceled autism evaluations, families leaving assessment waitlists, and requests to remove diagnoses from medical files. The report also described a New Jersey father who had obtained a diagnosis for his son and then considered withholding insurance claims because he worried about how the information might be used.

Those are reported experiences, not a national cancellation count. Nor does the reporting verify the social-media claim that parents generally waited three years for the appointments they canceled. A long wait is plausible in individual cases, but it should not be converted into a national statistic without evidence.

The fears arose amid conflicting public messages from federal health officials about an autism registry, expanded medical-data research, and the potential uses of that information. The concern deserves an evidence-based answer rather than either an automatic dismissal or an unsupported claim that a surveillance list already exists.

Is there a national autism registry?

There is no publicly established new federal registry enrolling every child with an autism diagnosis. In April 2025, the Department of Health and Human Services (HHS) specifically rejected the description of its proposed initiative as an autism registry.

The dispute began when National Institutes of Health (NIH) Director Jay Bhattacharya described plans for national disease registries, including autism, at an April 2025 staff meeting. After criticism, an HHS official told CBS News on April 25 that the agency was not creating an autism registry; instead, it planned to link existing datasets for research.

That clarification settles what HHS said it was building. It does not, on its own, settle what data a linked research network can contain or who can use it.

There are also autism-related government data systems that predate this controversy:

• State registries: New Jersey’s autism registry was created under state law in 2007 and requires qualifying healthcare providers to register certain diagnosed residents under age 22. Families may request anonymous registration, although that affects direct connections to some support services. In an April 30, 2025, statement, the state said it had never shared identifiable individual-level registry information with federal agencies or studies.
• CDC autism surveillance: The Autism and Developmental Disabilities Monitoring (ADDM) Network has operated since 2000. Participating sites review health and education records to estimate autism prevalence in particular communities. This is not the same program as the newer NIH research network.
• Existing insurance and medical records: Medicaid, Medicare, private insurers, hospitals, and other providers already hold information generated through enrollment, treatment, and billing. A new autism-specific form does not have to be completed for a qualifying diagnosis code to appear in some of those systems.

The more useful question is therefore not simply whether someone uses the word registry. It is which system contains which information, under what legal authority, with what access controls.

What did HHS, NIH, and CMS actually announce?

Several initiatives are often collapsed into a single alarming description. Their purposes and documented safeguards are not identical.

The May 7, 2025, HHS announcement said NIH and the Centers for Medicare & Medicaid Services (CMS) would begin with select Medicare and Medicaid data relating to people diagnosed with autism, with plans to build capacity for other chronic-disease research. Electronic medical records and consumer wearables were described as possible broader data sources. That announcement does not establish that every child’s electronic record or wearable data was already transferred.

Meanwhile, NIH’s Autism Data Science Initiative funded projects using biological, clinical, behavioral, and services information. The HHS Office of Inspector General later audited the award process and found the awards complied with applicable federal requirements. That was an audit of how the awards were made, not a finding that all patient-data sharing across the larger initiative had been independently audited or approved.

What Kennedy said in September 2026

At the September 28 MAHA Open Data Summit, HHS Secretary Robert F. Kennedy Jr. described using Medicaid records and other linked health information to investigate vaccination, chronic disease, and outcomes including autism. In The Guardian’s report on his remarks, he said officials wanted health data prepared for analysis by hundreds of external researchers. STAT’s reporting likewise described his criticism of institutions that control research access.

The remarks show an intention to expand research access. They do not tell us that hundreds of researchers have already received unrestricted access to named children’s records. Nor do they identify a single approval system governing every federal and state data source he discussed.

That distinction is central to evaluating the controversy fairly.

Where does a child’s autism diagnosis actually go?

There is no universal path. It depends on who evaluated the child, who paid, whether records were shared, the family’s state, and which agencies or institutions hold the information.

Consider a four-year-old referred for a developmental assessment. The clinic may record developmental concerns before making any diagnosis. If the visit is billed to insurance, a claim can be generated. A school may independently evaluate the same child for educational services, creating a separate record. Certain records may later be used by authorized public-health programs or research arrangements, but none of these steps proves that all the records automatically flow into one federal database.

The reverse is also important. Skipping the specialist’s final appointment does not necessarily remove earlier screening notes, developmental concerns, therapy records, or school evaluations. That is an inference from how these distinct systems create and retain records, not evidence that every child is included in a federal study.

Can school autism classifications be used in government statistics?

Sometimes, yes. The CDC explains that ADDM sites identify children through records showing a clinical autism diagnosis, an autism special-education classification, or an autism diagnostic code. Sites obtain access through agreements with health departments, school districts, and early-intervention providers.

That surveillance program produces population estimates for participating communities. Its existence should not be used as evidence that schools routinely transmit entire IEPs into NIH’s newer research network. The systems have different purposes and authorities. See the CDC’s detailed ADDM methodology.

Can researchers see identifiable Medicaid or medical records?

It depends on the dataset and the authorization. The term research data does not answer that question.

CMS already distinguishes two major kinds of researcher-accessible files: limited data sets, which exclude specified direct identifiers but remain protected health information, and research-identifiable files, which may include personal identifiers. Both require research applications and CMS data-use agreements under the agency’s stated procedures. Not every study uses the same kind of file.

For the particular NIH Real-World Data Network, the publicly available September 2025 NIH Council of Councils minutes, pages 18–19, described a narrower arrangement:

• CMS had agreed to provide de-identified data relating to people with an autism diagnosis.
• Researchers would submit requests reviewed for technical feasibility, policy alignment, and privacy.
• Institutions holding matching data could decline a request.
• Authorized researchers would analyze approved data in a restricted workspace.
• Only aggregated results could be exported after another review. The minutes also described compliance logging and a one-year limit on activity in the workspace.

These are meaningful safeguards on paper. But meeting minutes describe the network’s design at that time; they are not a published audit of every actual access decision in October 2026. And the minutes do not prove that separate state-exchange projects, commercial partnerships, or later programs follow identical procedures.

What about states sharing more detailed medical records?

This is where the public record remains incomplete.

In a June 4, 2026, investigation, KFF Health News reported that federal officials had approached state health-information exchanges about using detailed patient records for vaccine and chronic-disease research. It described a proposed system capable of linking clinical records and claims. Such records can be more detailed than insurance claims alone.

The reporting also documented substantial differences among states and organizations. Maryland’s exchange said it declined expanded sharing for vaccine research because legal and contractual approvals were needed. Indiana’s exchange said it was still considering the request and had not shared additional data at the time. Nebraska’s CyncHealth was involved in a federally funded proof-of-concept effort; public statements differed about whether that work was autism-specific, and precise data fields or identifying-information protections had not been fully disclosed.

At the September 2026 summit, speakers described Nebraska as an early example of broader state-federal data cooperation. That provides evidence of progress beyond a hypothetical presentation, but it still does not establish that the same records, legal terms, or privacy controls apply nationwide. STAT reported the state-federal distinctions.

The unresolved question is not whether federal health-data projects exist. They do. It is the exact scope of records transferred and the enforceable terms governing their use.

Does de-identified mean anonymous?

Not necessarily in the everyday sense of the word. Four categories are worth separating:

The HHS de-identification guidance explains that information can become identifiable when combined with other reasonably available data. That is why dataset linkage makes governance, permitted uses, audit trails, and controls against re-identification important even when direct names have been removed.

A statement that data are de-identified is therefore meaningful, but it is not a substitute for identifying the method, recipient, permitted linkage, and safeguards in the relevant agreement.

What can parents control under HIPAA?

HIPAA offers real rights, but not a universal right to prevent every lawful use of a child’s health information.

You can request and review records. Parents generally act as the personal representatives of their minor children, subject to important state-law and confidentiality exceptions. HHS also explains the rights to access and correct medical records.

You can request an amendment, not demand that accurate information be erased. If a diagnosis or record is wrong or incomplete, the provider must consider a correction request. A covered provider can deny an amendment of accurate, complete information; a disagreement process may still be available. Canceling an appointment does not create a right to delete prior medical documentation.

You can ask for the Notice of Privacy Practices. A provider’s notice describes permitted uses, disclosures, and privacy contacts. Importantly, HHS says signing an acknowledgment that you received the notice is not the same as giving special consent for all disclosures. Conversely, refusing to sign does not stop uses otherwise permitted by HIPAA.

You can request limits on sharing. Providers generally need not accept every requested restriction. One important exception applies when an item or service is paid in full out of pocket and the request concerns disclosure to a health plan for payment or healthcare operations, where the disclosure is not otherwise required by law. Even then, the medical record itself still exists. See HHS guidance on requesting restrictions.

Research consent is not all-or-nothing. Under the HIPAA research rules, identifiable health information can sometimes be used without an individual’s specific authorization, including through qualifying review-board waivers; limited data sets may be shared under data-use agreements; properly de-identified data can generally be used without HIPAA authorization. Other legal and institutional rules may impose further restrictions.

Families may also request an accounting of certain disclosures, but that accounting is not a complete log of every record access: HIPAA exempts categories such as treatment, payment, operations, and specified research disclosures. The existence or absence of an entry is not, by itself, a complete answer to whether information has ever been used in research.

Can parents opt out of a health-information exchange?

Some exchanges offer a formal opt-out. The scope is not universal.

For example, Nebraska’s CyncHealth patient page states that patients can opt out of participating providers viewing protected health information through its exchange, subject to exceptions listed on its form. The exchange separately explains that information may be used in certain circumstances for public health or research purposes.

An exchange opt-out should not be assumed to erase the originating provider’s records, undo previously lawful disclosures, stop all required public-health reporting, or block every research use. Ask the exchange’s privacy office which specific activities the opt-out covers and whether it applies to previously collected data.

Are school evaluations and IEP records protected differently?

Yes. A child’s medical autism diagnosis and a school’s educational disability determination are different decisions. Their records often follow different legal rules.

Many records maintained by public schools, including IEPs and school evaluations, fall under the Family Educational Rights and Privacy Act (FERPA), not the ordinary HIPAA framework used by healthcare providers. Parents generally have rights to inspect education records and seek correction of inaccurate information. FERPA ordinarily requires consent before disclosure of personally identifiable information, but it permits specific exceptions, including some audits, authorized studies, and health or safety disclosures. It is not an absolute ban on education-data sharing. See the Education Department’s privacy-and-data-sharing guidance and its joint FERPA/HIPAA guidance.

Can a school bill Medicaid without parental consent?

Federal special-education rules provide an especially relevant protection.

Under 34 CFR §300.154(d)(2), before a public agency first accesses a child’s or parent’s public benefits or insurance to pay for covered IDEA services, it must obtain specified written parental consent after giving notice. It must also provide an annual written notice addressing consent and rights. Parents may withdraw consent to disclose personally identifiable information for the Medicaid billing purpose.

Refusing or withdrawing that consent does not relieve the school of its responsibility to provide required services at no cost to the parents. That protection concerns the specified school-to-benefits billing disclosure; it should not be misread as the power to block every FERPA exception or every other lawful government use of records.

Families should ask their school district whether a form authorizes a school Medicaid billing disclosure, a clinical records release, or some other action. These are not interchangeable consents.

Can a child receive support without a medical autism diagnosis?

Yes, depending on age, needs, eligibility, and the service. This is one of the most important facts for families considering a delay.

The CDC’s October 2026 guidance on accessing autism-related services explicitly says a parent can request evaluation through an early-intervention system without a physician’s referral. It also says treatment for specific concerns, such as speech-language delay, often need not wait for a formal autism diagnosis.

• Before age 3: Contact the state’s early-intervention program and request an evaluation under Part C of the Individuals with Disabilities Education Act (IDEA). Eligibility depends on the state’s criteria and the child’s development.
• At age 3 and older: Contact the local public-school district and request a Child Find evaluation, even if the child is not yet enrolled in kindergarten. IDEA permits parents to request an initial evaluation; the applicable deadline is generally 60 days after parental consent or the state’s established timeframe, subject to exceptions.
• For school accommodations: A clinical autism diagnosis is not automatically required to evaluate eligibility under Section 504. The U.S. Department of Education’s disability-discrimination FAQ says a medical diagnosis is not a precondition for a school’s Section 504 determination.
• For insurance-funded services: Some plans, programs, and specialized therapies do require particular diagnostic documentation. Families should ask about those requirements before deciding whether to postpone a clinical evaluation.

A diagnosis can clarify a child’s needs and open access to some services. It does not automatically guarantee an IEP or every requested therapy. And the absence of a diagnosis does not eliminate a public school’s duty to evaluate children who may need special-education services.

For the step-by-step process, see our guides on what to do while waiting for an autism evaluation, how autism is diagnosed, and IEPs, 504 plans, and school accommodations.

Why is the government studying vaccines and autism again?

Kennedy has repeatedly advanced the possibility of a causal vaccine-autism connection. His administration’s health-data efforts include studies examining vaccination and developmental outcomes, according to his September 2026 remarks and federal research announcements.

That policy interest should be distinguished from the underlying evidence. The World Health Organization’s September 3, 2026, systematic evidence review examined studies published between 2010 and August 2025 and found that the most methodologically rigorous evidence did not support a causal link between vaccines, including thiomersal-containing vaccines, and autism. Studies reporting positive associations were judged to have high risk of bias or very weak evidence; none of the included meta-analyses supported causality.

Large datasets can help answer legitimate questions about healthcare access, developmental outcomes, and exposures. But adding more records does not automatically produce stronger causal evidence. A study comparing vaccinated and unvaccinated children, for example, must account for differences in healthcare access, health conditions, documentation, diagnostic opportunity, and other factors that can affect both vaccination patterns and recorded diagnoses.

There is also a statistical problem. When researchers test many exposures, time windows, subgroups, and outcomes, some associations will emerge by chance. Reliable findings require transparent methods, careful controls, independent replication, and scrutiny of alternative explanations. See our guide to reading autism studies without being misled by their headlines.

A new study should be judged on its design and evidence, not accepted or dismissed solely because of the official who commissioned it. That standard does not require giving unsupported vaccine-autism claims the same weight as decades of stronger research.

What can we reasonably infer—and what remains unknown?

The available record supports a chain of conclusions without requiring speculation about secret intentions.

First, autism-related information already exists across healthcare and education systems. Claims, provider notes, school classifications, and some state reporting laws establish that independently of any new federal project.

Second, federal officials have an expressed goal of linking more of those systems for research. The NIH–CMS announcement, 2025 NIH minutes, and Kennedy’s 2026 remarks establish the direction of the effort. KFF’s reporting documents steps toward additional state participation.

Third, greater linkage can create both scientific value and privacy risk. Combining datasets can improve longitudinal research, but also increases the importance of knowing who can link records, whether they can be re-identified, and whether use limitations are enforceable. This follows from the technical nature of linkage and HHS’s own de-identification guidance; it does not prove actual misuse.

Fourth, there is no demonstrated basis to tell every parent that canceling a diagnostic evaluation will keep a child out of government-held data. Related records may already exist, and educational and medical systems are not the same. Nor is there a basis to say that every child with a diagnosis has been placed on a list intended for punishment or discrimination.

The outstanding accountability questions are concrete: Which state exchanges have signed current agreements? What data fields have actually been transferred? Are names or re-linkable keys retained, by whom, and for how long? Who approves external researchers in each system? Are research questions independently reviewed? Can families opt out of a specific use, and is there an audit trail available to regulators?

A public assurance that the government is protecting privacy matters. The underlying agreements, access policies, and independent verification matter more.

Before canceling an autism evaluation: questions worth asking

For families facing an actual appointment decision, a short list of written questions can be more useful than trying to resolve the entire national debate first.

1. Ask the evaluator: What will go into my child’s clinical record, and what diagnostic or procedure codes will be submitted if insurance is billed?
2. Ask the provider’s privacy office: Can I obtain the Notice of Privacy Practices, request copies of records, and learn which health-information exchanges the clinic uses?
3. Ask the exchange, if relevant: Is there an opt-out? Does it affect treatment access, research use, public-health reporting, or only the exchange’s provider-to-provider functions?
4. Ask the insurer: Which services need a formal autism diagnosis for coverage, and which can be evaluated based on speech, developmental, or other specific concerns?
5. Ask the school or early-intervention program: Can we request an evaluation now without the private diagnosis? Which records will you create and share?
6. Ask before signing a school billing form: Is this consent for disclosure to Medicaid? What happens if I decline or later withdraw it?
7. Ask about postponement: If we cancel or delay, how soon could we obtain another appointment, and what documentation or services might be postponed?

Do not assume that paying privately, avoiding insurance claims, declining one disclosure, or withholding an autism diagnosis blocks all legally permitted data uses. Equally, do not assume that seeking an evaluation automatically authorizes every proposed research use.

If privacy questions remain unresolved, ask for written explanations and, where appropriate, guidance from a qualified privacy professional or disability-rights advocate. If the child’s needs are affecting communication, safety, daily functioning, or learning, pursue available clinical and educational supports while working through those concerns.

The choice is not simply between protecting a child’s privacy and helping that child. Parents deserve to know which records exist, which uses are authorized, which disclosures they can control, and what services remain available. A sound public-health system should make those answers clear enough that families do not have to guess.

References and Further Reading

Federal announcements, research programs, and oversight

• HHS: NIH and CMS partnership on autism research (May 7, 2025). The original federal announcement describing the selected Medicare/Medicaid pilot and the larger envisioned data network.
• NIH Council of Councils: September 2025 meeting minutes, pp. 18–19. Describes the Real-World Data Network’s proposed researcher review, institutional choice, protected workspace, export restrictions, and de-identified CMS contribution.
• NIH: Autism Data Science Initiative awards (September 22, 2025). Documents the 13 funded projects and distinguishes these research awards from a universal patient registry.
• HHS Office of Inspector General: Audit of the Autism Data Science Initiative awards (2026). Reviews the award process; does not constitute an audit of all federal autism-data disclosures.
• CMS: Data Available to Researchers. Explains the difference between limited data sets and research-identifiable files and the agency’s application and data-use agreement processes.
• CDC: Tracking Methods for Autism Spectrum Disorder. Explains existing autism surveillance based on specified medical and educational records.
• New Jersey Department of Health: Statement on Autism Registry Privacy (April 30, 2025). Defines the state’s registry and its position on identifiable federal disclosures and anonymous registration.

Medical and educational privacy rights

• HHS: HIPAA and Research. The research-authorization rules, exemptions, waivers, and limited data-set safeguards.
• HHS: Guidance on De-identification. Explains Safe Harbor, Expert Determination, and residual identification risks.
• HHS: Your Medical Records. Rights to obtain and seek amendments to medical and billing records.
• U.S. Department of Education: FERPA Privacy and Data Sharing. FERPA’s consent rules and defined disclosure exceptions.
• IDEA: 34 CFR §300.154(d)(2). Parental consent and annual notice rules for specified school public-insurance billing.
• CDC: Accessing Services for Autism Spectrum Disorder. How families can request early intervention or educational evaluation without waiting for a clinical diagnosis.
• CyncHealth: Nebraska Patient Privacy and Opt-Out Information. A real-world example of a health-information exchange’s rights and stated opt-out limits.

Independent reporting and scientific evidence

• STAT: Autism evaluations are being canceled over registry fears (May 1, 2025). Original interviews documenting parental concern and some canceled evaluations.
• CBS News: HHS says it is not creating an autism registry (April 25, 2025). Records the department’s direct response to the initial registry controversy.
• KFF Health News: RFK Jr. Seeks To Peek at Americans’ Medical Records (June 4, 2026). Original reporting on state exchange negotiations, differing state responses, and the Nebraska project.
• STAT: Why MAHA wants health data more accessible (September 29, 2026). Reports Kennedy’s recent data-access remarks and the questions surrounding state exchanges.
• WHO: Vaccines, thiomersal and autism spectrum disorder, evidence review 2010–2025 (September 3, 2026). The current systematic appraisal of vaccine-autism research quality and conclusions.

Editorial currency note (October 14, 2026): This article describes the federal announcements, primary legal guidance, and publicly reported data arrangements available at publication. State privacy rules, signed data agreements, research access policies, and education procedures can change. This is an informational guide, not an individualized legal or medical determination.