HHS Appointment Seeks CDC Vaccine Safety Data Amid Privacy Concerns
Background: The Geiers and Vaccine-Autism Myth
In June 2025, the U.S. Department of Health and Human Services (HHS) announced that David Geier, a long‐time anti‐vaccine advocate, has begun working within the department under Secretary Robert F. Kennedy Jr.. Geier and his late father, Mark Geier, have for decades promoted the thoroughly debunked hypothesis that the mercury‐based preservative thimerosal in vaccines causes autism. Despite numerous epidemiological studies and meta‐analyses finding no credible link, the duo published multiple low‐impact papers advancing this claim and devised the unorthodox “Lupron Protocol” for treating autism with hormone therapy.
Vaccine Safety Datalink: Architecture & Governance
The CDC’s Vaccine Safety Datalink (VSD) is a large‐scale active surveillance system established in 1990. It integrates standardized Electronic Health Records (EHR) data—diagnoses, immunizations, laboratory results, and enrollment information—from 13 participating healthcare organizations. The VSD uses a distributed query model:
- Data Standardization: Sites transform local EHR data into a common data model (CDM) based on HL7 FHIR and custom CDC schemas.
- Secure Distributed Queries: Researchers submit vetted study protocols; CDC issues encrypted queries that run locally at each site.
- Aggregate Reporting: Only de‐identified, aggregated counts are returned to the CDC, preserving individual privacy under HIPAA.
This architecture balances research needs and data governance. Access requires IRB approval, a detailed statistical analysis plan, and strict data use agreements.
Data Privacy & Security Concerns
Geier’s renewed bid for VSD access has triggered alarms among CDC officials and participating sites. Key concerns include:
- Patient Confidentiality: Potential re‐identification risks if raw data were mishandled.
- Regulatory Compliance: Possible violation of HIPAA’s minimum necessary standard.
- Data Integrity: Ensuring that released datasets remain unaltered and fully representative.
Cybersecurity specialists warn that any mismatch between query outputs and original EHR records could suggest tampering or incomplete data extraction. The CDC employs NIST SP 800‐53 controls for system integrity, but edge cases—like a high‐profile external researcher—pose new challenges.
Thimerosal and Autism: The Scientific Consensus
Multiple large‐scale studies, including the Vaccine Safety Datalink Cohort Study (goldstein et al., 2004) and the European Union Thimerosal Safety Review (2015), found no elevated autism risk. In 2001, thimerosal was removed or reduced to trace levels in most pediatric vaccines solely as a precaution. Both the Institute of Medicine and the World Health Organization concluded that thimerosal is not causally related to neurodevelopmental disorders.
Regulatory Oversight and Historical Disciplinary Actions
In 2011, the Maryland State Board of Physicians disciplined the Geiers for diagnosing autism without proper credentials and administering Lupron (leuprolide acetate). Mark Geier lost his medical license; David Geier, who holds only a bachelor’s degree, was sanctioned for unlicensed practice. A subsequent lawsuit briefly awarded the family nearly $5 million over a cease‐and‐desist order, but an appellate court overturned that judgment in 2019.
Implications for Public Health Policy
Critics argue that appointing a known vaccine skeptic to HHS undermines public confidence in immunization programs. Dr. Helen Chu, infectious disease specialist at the University of Washington, warns:
“Introducing unsubstantiated claims into federal data systems could fuel vaccine hesitancy at a time when we need record coverage for COVID‐19, influenza, and childhood immunizations.”
Beyond optics, there are operational concerns: revising or reanalyzing VSD data requires robust version control and provenance tracking—capabilities embedded in modern data pipelines but stressed by high‐volume longitudinal datasets.
Expert Perspectives & Next Steps
- Data Scientists note that reanalysis must accommodate confounders, batch effects, and site‐specific coding differences—a nontrivial task requiring R or Python scripts, statistical expertise, and transparent methodology.
- Bioethicists emphasize the importance of oversight from Institutional Review Boards and the HHS Office for Human Research Protections (OHRP) when reopening closed data access pathways.
- Policy Analysts suggest Congress may revisit data‐sharing statutes within the 21st Century Cures Act to clarify the balance between scientific transparency and participant privacy.
Conclusion
David Geier’s role at HHS highlights tensions between data access, scientific rigor, and public health safeguarding. As HHS and the CDC deliberate on this request, the outcome will set a precedent for how controversial actors interface with federally managed health data.