System Failure: Inside the Collapse of HIV Data Protections
The privacy frameworks that protect people living with HIV—built over decades through advocacy, legislation, and the lived consequences of stigma and surveillance—are now on the brink of collapse. Recent reporting from WIRED reveals that "much of the IT and cybersecurity infrastructure underpinning the nation’s health system is in danger of a possible collapse" following deep staffing cuts at the U.S. Department of Health and Human Services (HHS). Agency insiders warn that "within the next couple of weeks, everything regarding IT and cyber at the department will start to reach a point of no return operationally."
These reductions—orchestrated under the banner of "efficiency"—have eliminated the technical expertise necessary to maintain the very systems designed to protect patient information while enabling effective public health response. What took decades of careful negotiation to build could unravel in weeks.
A History of Mistrust and What It Built
In response to early AIDS panic and political scapegoating, HIV reporting systems were designed to protect privacy while still enabling public health surveillance. States initially resisted name-based reporting, opting instead for coded identifiers. These systems directly resulted from community resistance to the idea that a centralized government entity would hold a list of PLWH. By the late 1990s, the Centers for Disease Control and Prevention (CDC) and Health Resources and Services Administration (HRSA) had settled into a delicate dance: collect enough data to direct resources without breaking trust with the communities most impacted.
The Ryan White HIV/AIDS Program (RWHAP), created in 1990, is a reflection of this balance. Providers are required to report client-level data annually through the Ryan White Services Report (RSR), but it must be de-identified. Each grantee—whether a city, state, clinic, or community-based organization—must report separately, even if they serve the same client. This redundancy is intentional. It's how we avoid co-mingling funds and how we ensure that data is not aggregated in a way that risks patient re-identification. It’s messy, yes. But it’s designed to protect people, not just count them.
Why It’s So Complicated
At a structural level, RWHAP is segregated by design. Part A grantees are typically cities, Part B is for states, Part C goes to clinics, and Part D supports programs for women, infants, children, and youth. Each grantee and subgrantee reports separately. A person receiving services from a city-funded housing program and a clinic-funded medical program will appear in two different reports. They’ll be encrypted, anonymized, and counted twice—because each program needs its own audit trail. This is not a flaw. It’s a firewall.
It’s also one of the biggest complaints from providers. Clinics and case managers spend untold hours cleaning and submitting the same data to multiple entities for different grants every year. State agencies complain about the burden. But buried underneath the frustration is the reality: these walls are what keep private information from being aggregated, shared, and potentially exposed (or worse, used to target).
Molecular Surveillance and the Reemergence of Privacy Concerns
Parallel to the RSR reporting, the CDC continues to manage HIV surveillance through diagnostic reports, lab data, and increasingly, molecular surveillance—using genomic data from viral samples to track clusters and potential outbreaks. These systems operate independently from care-based reporting systems like the RSR. They’re not supposed to overlap. That’s on purpose.
Molecular surveillance is a powerful tool. It can detect transmission networks, identify gaps in care, and help allocate resources. But it also raises serious privacy concerns. People have no ability to opt out of having their viral sequence data analyzed. Community advocates have raised alarms about how this data could be misused—especially in states with HIV criminalization laws or where public health trust is already low.
When properly separated from care systems, surveillance data can inform public health strategy without endangering patient privacy. But the more these systems are tampered with, neglected, or mismanaged, the greater the risk of privacy breaches and data misuse.
The DOGE Playbook: Gutting Public Health from Within
None of this works without infrastructure. And right now, that infrastructure is being hollowed out.
On April 1, the Department of Health and Human Services (HHS) laid off roughly 10,000 employees—about 25% of its workforce. That includes entire IT teams, cybersecurity experts, and staff responsible for maintaining the systems that house Ryan White and surveillance data. As WIRED reported, these cuts have left HHS systems teetering on the edge of collapse.
The layoffs were orchestrated by the Department of Government Efficiency (DOGE), a Musk-backed initiative with a mandate to slash spending and "modernize" systems. In reality, DOGE operatives have cut critical personnel and attempted to rebuild complex legacy systems—like Social Security's COBOL codebase—without the necessary expertise. As NPR reported, DOGE staff have also sought sweeping access to sensitive federal data, raising serious concerns about the security and ethical use of health information.
A retired Social Security Administration (SSA) official warned that in such a chaotic environment, "others could take pictures of the data, transfer it… and even feed it into AI programs." Given Musk's development of "Grok," concerns have been raised that government health data might be used to "supercharge" his AI without appropriate consent or oversight.
The value of this data—especially when aggregated across systems like HHS, SSA, Veterans Affairs, and the Internal Revenue Service—is enormous. On the black market, a single comprehensive medical record can command up to $1,000 depending on its depth and linkages to other data sets. For commercial AI training, the value is even greater—not in resale, but in the predictive and market power that comes from large, high-quality datasets. If private companies were paying for this kind of dataset, it would cost billions. Musk may be getting it for free—with no consent, no oversight, and no consequences.
Meanwhile, at USAID, funding portals were shut off. Grantees couldn’t access or draw down funds. Even after systems came back online, no one was there to process payments. The same scenario is now playing out at HHS. Grantees have reported delays, missed communications, and uncertainty about reporting requirements—because the people who used to run the systems have been fired.
What's at Stake: Beyond Data Points
The crisis we're witnessing isn't merely technical—it threatens the foundation of HIV services in America. When data systems fail, grants cannot be properly administered. When grants are disrupted, services are compromised. And when privacy protections collapse, people living with HIV may avoid care rather than risk unwanted disclosure of their status.
We've been here before. In the early days of the epidemic, mistrust of government systems drove people away from testing and treatment. The privacy frameworks built into today's reporting systems were designed specifically to overcome that mistrust, enabling effective public health response while respecting human dignity.
A Call for Immediate Action
To address this growing crisis, we need action at multiple levels:
Congress must exercise oversight over DOGE's activities by requiring transparent reporting on HHS staffing changes and their operational impacts, and by establishing strict limits on data access and audit trails to ensure administrative accountability.
HHS must rapidly rehire technical expertise with the institutional knowledge needed to maintain these complex systems before contracts expire and systems fail.
Advocacy organizations should demand clear guardrails on any use of healthcare data, particularly regarding AI applications, including explicit prohibitions on repurposing data collected for public health for commercial training without consent or compensation.
HRSA must immediately address the continuity of the RSR and other reporting systems to ensure grant requirements don't become impossible to meet due to system failures.
But let’s be clear: none of this is a call to keep broken systems frozen in time. Public health data infrastructure can—and should—be modernized. There is real opportunity to streamline reporting, reduce administrative burden, and build tools that serve patients more effectively. But modernization must be done carefully, collaboratively, and with privacy at the center—not with a chainsaw in one hand and a Silicon Valley slogan in the other.
The “move fast and break things” ethos may work for social media startups, but it has no place in systems that safeguard the lives and identities of people living with HIV. What we’re witnessing is not innovation—it’s ideological demolition. The goal isn’t better care or stronger systems. It’s control, profit, and a reckless dismantling of public trust.
The myth that federal IT systems are merely bloated bureaucracies in need of disruption ignores their critical role in protecting sensitive information. Our public health data infrastructure has been built layer by layer, through hard-fought battles over privacy, accountability, and service delivery. Dismantling these systems doesn’t represent modernization—it threatens to erase decades of progress in building frameworks that enable effective care while respecting the rights of people living with HIV.
The privacy architectures designed in response to the early AIDS crisis weren’t just policy innovations—they were survival mechanisms for communities under threat. We cannot afford to let them collapse through neglect, arrogance, or privatized pillaging. The stakes—for millions of Americans receiving care through these programs—couldn't be higher.
Ensuring Equitable Access to PrEP for Minors in the South
In 2022, young people under 35 accounted for over half (56%) of all new HIV diagnoses in the United States. The Southern states bore a disproportionate burden of this epidemic, accounting for more than half of new HIV diagnoses that year. Particularly high rates among youth in this region highlight the urgent need for effective HIV prevention strategies tailored to young people. This alarming statistic underscores the urgent need to ensure that all young people, regardless of where they live or their family circumstances, have access to effective HIV prevention tools, including pre-exposure prophylaxis (PrEP). The CHOOSE study (Combatting HIV Or Other STIs Early), currently underway, offers a promising approach to increasing PrEP uptake among young gay, bisexual, and other men who have sex with men (YGBMSM) aged 13-24, a population at elevated risk for HIV. CHOOSE leverages the power of mobile health technology to provide tailored information, support, and reminders to help young people choose and adhere to PrEP.
However, the promise of CHOOSE and other similar PrEP initiatives for young people is threatened by a wave of restrictive policies and legal decisions in the United States, creating significant barriers for minors seeking to protect their health, especially those who live in the South. In Texas, the 5th Circuit Court of Appeals ruled that Title X-funded clinics must notify parents before providing sexual and reproductive healthcare services to minors, including contraception. This ruling has far-reaching implications for PrEP access, as Title X clinics are often the only source of sexual health services for young people, particularly those without access to private insurance. Similarly, in Tennessee, the state government's politically motivated decision to reject federal HIV prevention funding and redirect resources away from organizations serving marginalized communities, including those providing PrEP, further jeopardizes the health of young people.
These actions demonstrate a concerning trend of policies that prioritize parental control over the health and well-being of young people, even when those policies contradict evidence-based public health strategies and potentially put youth at risk. We must address these barriers to ensure that all young people in the South have equitable access to PrEP and other life-saving HIV prevention tools. Failing to do so will not only do material harm to vulnerable people but also hinder our collective progress towards ending the HIV epidemic.
The Landscape of PrEP Access for Minors
PrEP has proven highly effective in reducing the risk of HIV acquisition, particularly for young gay, bisexual, and other men who have sex with men. When taken as prescribed, PrEP can reduce the risk of sexual HIV transmission by up to 99%. Studies have shown that a majority of young people on PrEP demonstrate adequate adherence, further supporting its effectiveness as a prevention tool. However, realizing the full potential of PrEP for young people hinges on ensuring equitable access, a goal hindered by a complex and often restrictive legal landscape surrounding minors' consent to healthcare. While PrEP offers a powerful tool for HIV prevention, accessing this medication can be challenging for young people, particularly due to the complex legal landscape surrounding minor consent to healthcare.
The legal framework for minor consent to healthcare varies significantly across states, creating a patchwork of access for young people seeking PrEP and other sexual health services. Many state laws governing a minor's ability to give informed consent for STI and HIV services do not explicitly mention PrEP. This lack of clarity within these statutes leaves it unclear whether minors can consent to PrEP independently and confidentially. This ambiguity can deter healthcare providers from offering PrEP to minors and leave young people uncertain of their rights. The situation is particularly concerning in the South, where restrictive parental consent laws are prevalent and often extend to sexual and reproductive healthcare services more broadly.
The 5th Circuit ruling in Texas, requiring parental notification for Title X services, exemplifies this trend. Planned Parenthood, a leading provider of sexual and reproductive healthcare, condemned the ruling as "a significant and dangerous departure from decades of precedent that has allowed all young people to confidentially get basic health care like birth control through Title X." This ruling, and the legislation it protects, creates significant barriers for young people seeking basic sexual and reproductive healthcare, including PrEP. For example, a young person in Texas seeking PrEP who fears being outed to unsupportive parents due to their sexual orientation might forgo seeking this essential prevention method altogether to avoid mandatory parental notification, putting their health at risk. For those experiencing family conflict, abuse, or rejection due to their sexual orientation or gender identity, mandatory parental notification can be particularly dangerous, deterring them from seeking essential care.
However, recent actions by the federal government offer a glimmer of hope. In a case involving Oklahoma, the Supreme Court upheld the Biden administration's right to redirect federal family planning funds from states that restrict access to abortion information. This decision demonstrates the potential for using federal funding as leverage to incentivize states to comply with public health guidelines and protect access to care, even in politically charged areas like sexual and reproductive health.
Even in states where minors can legally consent to PrEP, confidentiality is not always guaranteed. Some states allow or require providers to notify parents or guardians, potentially compromising young people's privacy and putting them at risk. Additionally, the inadvertent disclosure of sensitive health information through insurance Explanation of Benefits (EOBs) sent to parents or guardians can further erode confidentiality. These policies fail to recognize the unique vulnerabilities of young people and the importance of confidential healthcare access in fostering trust and encouraging early intervention.
Political Interference: The Case of Tennessee
While restrictive laws present a significant barrier to PrEP access for minors, the case of Tennessee illustrates how political agendas can further undermine public health efforts, even in the absence of explicit legal restrictions. In 2023, the Tennessee government made the controversial decision to reject $6.2 million in annual funding from the Centers for Disease Control and Prevention (CDC) specifically designated for HIV treatment and prevention programs, including those supporting PrEP access. This decision, projected to result in 166 additional HIV transmissions and 190 additional deaths over 10 years, jeopardized years of progress in reducing new HIV diagnoses and expanding PrEP uptake in a state with one of the highest HIV burdens in the country.
This funding rejection was not driven by evidence-based public health priorities but rather by a politically motivated agenda to defund organizations like Planned Parenthood and shift resources away from communities deemed undesirable by those in power. The state government attempted to justify its actions by claiming a desire to prioritize other populations, such as first responders, but these groups have significantly lower HIV transmission rates, making this rationale dubious at best.
Following a public outcry and intense advocacy efforts by HIV organizations, the Tennessee legislature ultimately approved $9 million in state funding for HIV, and the CDC intervened by directly allocating $4 million to community-based organizations, resulting in a net increase in funding. While this outcome appears positive on the surface, the disruption caused by the initial funding rejection and the ongoing uncertainty surrounding the state's commitment to evidence-based HIV prevention strategies raise serious concerns.
The Tennessee case exemplifies the dangers of political interference in public health. The initial funding cuts disproportionately impacted marginalized communities, including young people, people of color, and LGBTQ+ people, who already face significant barriers to accessing healthcare. The attempt to redirect funding away from proven prevention strategies towards less vulnerable populations further demonstrates a disregard for health equity and the principles of evidence-based policymaking. This case also highlights the critical role of advocacy in holding policymakers accountable and protecting the health of vulnerable communities. The mobilization of HIV organizations and community members was essential in securing a partial reversal of the funding decision, demonstrating the power of collective action in challenging harmful policies.
The Promise of Telehealth and Other Innovative Solutions
As we grapple with the legal and political barriers hindering PrEP access for minors, it's important to explore innovative solutions that can circumvent these obstacles and reach young people where they are. Telehealth has emerged as a particularly promising approach, offering the potential to expand access, enhance confidentiality, and reduce stigma, especially in the South, where geographic barriers and social conservatism can be significant.
Studies have shown that telehealth interventions can effectively increase PrEP initiation among young people. For example, the PrEPTECH study demonstrated that a telehealth platform providing online education, home testing, and PrEP prescriptions significantly increased PrEP uptake among young men who have sex with men (MSM) and transgender women (TW) in Florida and California. Telehealth offers a convenient and discreet way for young people to access PrEP services, potentially overcoming logistical barriers and reducing the stigma associated with seeking sexual healthcare in person.
However, while telehealth holds promise, it's not a panacea. It's essential to recognize the limitations of telehealth and develop comprehensive strategies that address adherence challenges, digital equity, and the broader social determinants of health that can impact PrEP access and effectiveness. For example, young people may need additional support to adhere to daily PrEP regimens, and those without reliable internet access or digital literacy skills may face challenges navigating telehealth platforms.
Therefore, a multi-pronged approach is needed that combines telehealth with other innovative solutions tailored to the unique needs of young people. Youth-friendly clinics that prioritize confidentiality and provide non-judgmental care can create safe spaces for young people seeking sexual health services, including PrEP. Mobile testing units can bring PrEP services directly to communities with limited access to healthcare, and community-based outreach programs can raise awareness, reduce stigma, and connect young people to PrEP providers. By embracing a combination of strategies, we can create a more robust and equitable system for delivering PrEP to young people in the South.
Policy Recommendations and Call to Action
To truly protect future generations from the burden of HIV, we must move beyond simply acknowledging the barriers to PrEP access for minors in the South and embrace a proactive policy agenda that centers the needs of young people. This requires an approach that leverages our collective expertise and influence as advocates, healthcare professionals, and policymakers.
First, we must challenge the existing legal framework that hinders minor access to PrEP. Advocating for clear and consistent state laws explicitly granting minors the right to consent to PrEP confidentially is paramount. Removing ambiguity in statutory language and eliminating provider discretion will ensure legal clarity and empower young people to seek PrEP without fear of parental notification. Simultaneously, we must push for stronger confidentiality protections for all sexual and reproductive healthcare services for minors, recognizing the unique vulnerabilities and potential risks associated with mandatory parental notification.
Second, we must address the systemic inequities that disproportionately impact PrEP access for young people of color, LGBTQ+ people, and those living in rural communities. Adopting the PrEP Equity Ratio (PER) and other equity metrics as standard practice in program design and evaluation is necessary for monitoring progress and holding stakeholders accountable for achieving equitable PrEP access.
Third, we must actively engage in the political process to safeguard and increase federal funding for HIV prevention programs, particularly those targeting youth and communities of color. The Tennessee case exemplifies the vulnerability of public health funding to political interference. We must advocate for policies that protect these funding streams and ensure that resources are allocated based on epidemiological evidence and public health needs, not ideological agendas.
Finally, we must leverage the power of innovation to expand PrEP access and address the unique needs of young people. This includes supporting the expansion of telehealth services, promoting youth-friendly clinics, and investing in community-based outreach programs tailored to the specific challenges faced by young people in the South.
This is not a passive call to action; it is a call to mobilize our expertise, resources, and influence to create a policy environment that prioritizes the health and well-being of all young people. The time for bold action is now. Let us work together to ensure that no young person is denied the opportunity to protect themselves from HIV.