Warnock Leads Inquiry into State Department Efforts to Seek Personal Health Data in Exchange for Aid to Developing Nations

In a new letter , Senator Reverend Raphael Warnock presses the Trump Administration on their efforts to obtain personal health data from African countries in exchange for global health funding The Trump Administration has requested direct, real-time access to the health data of citizens in Uganda, the Democratic Republic of the Congo, Kenya, Liberia, and several other Sub-Saharan African countries The push for the sensitive information is part of the Administration’s America First Global Health Strategy, an initiative that requires countries to sign bilateral Memoranda of Understanding (MOU) agreements to receive global health foreign assistance from the U.S. Senator Reverend Warnock, colleagues: “State has reportedly demanded that Uganda give the United States direct, real-time access to nine of the nation’s health data systems for seven years… While global health programs have historically included data sharing components, they have never required direct access to privileged electronic systems for U.S. government representatives” Washington, D.C. – U.S. Senator Reverend Raphael Warnock (D-GA), Ranking Member of the Senate Finance Subcommittee on International Trade, Customs, and Global Competitiveness, led several of his Senate colleagues in a new letter to Secretary of State Marco Rubio and senior leadership at the State Department (State) regarding the Trump Administration’s efforts to obtain personal health data from African countries in exchange for global health funding. The Administration’s push for the sensitive information is part of its America First Global Health Strategy , an initiative that requires countries to sign bilateral MOU agreements to receive global health foreign assistance from the United States. Traditionally, public health data is shared with the U.S. through anonymized exports. Under the new agreement, the U.S. government is requiring direct log-in access to foreign nations’ national health systems. “ State has reportedly demanded that Uganda give the United States direct, real-time access to nine of the nation’s health data systems for seven years ,” wrote the senators. “ While global health programs have historically included data sharing components, they have never required direct access to privileged electronic systems for U.S. government representatives.” Historically, the U.S. has played a pivotal role in the global health space, serving as the main funder and implementer of global health programs. President Trump has moved away from this legacy during his second term in a variety of ways, such as withdrawing from the World Health Organization (WHO) and dismantling the robust foreign assistance ecosystem that has cemented American leadership in the global health space. The Trump Administration has also taken actions to restructure the U.S. President’s Emergency Plan for AIDS Relief (PEPFAR), a cornerstone global health initiative that is vital for several African nations. In June , Senators Warnock and Bill Cassidy (R-LA) led 23 of their senate colleagues in a bipartisan letter urging Senate Appropriations committee leadership to oppose the Trump administration’s proposed changes to the Atlanta-based Centers for Disease Control and Prevention’s (CDC) work on global HIV/AIDS prevention and surveillance. In April, Senator Warnock led a letter with nine of his Senate colleagues, pushing the Senate Appropriations Committee to prevent PEPFAR from being misused as a tool of economic coercion. Global health advocacy groups are concerned about the Administration’s new practice of conditioning aid on real time access to surveillance data. For example, in exchange for HIV/AIDS and other global health funding, State has reportedly demanded that Uganda give the U.S. direct, real-time access to nine of the nation’s health data systems for seven years. The new initiative also appears to be at odds with the Administration’s own emphasis on digital freedom and protecting Americans’ data. The letter warns that these new MOUs may set precedents that ultimately harm Americans’ data privacy. In addition to Senator Warnock, the letter is cosigned by U.S. Senate Minority Leader Charles Schumer (D-NY) and Senators Tim Kaine (D-VA), Chris Van Hollen (D-MD), Jeff Merkley (D-OR), Brian Schatz (D-HI), Chris Coons (D-DE), and Amy Klobuchar (D-MN). A copy of the letter can be found HERE and text is below: “Dear Secretary Rubio,” “We write with great concern regarding the Department of State (“State”) Data Sharing Agreements (DSAs) negotiated with foreign nations as part of the America First Global Health Strategy. In some instances, these DSAs require U.S. government officials to have direct log-in credentials for highly sensitive nationally-owned data systems. This is unprecedented and at odds with U.S. policy concerning the data of American citizens. We request a briefing and additional information on these developments.” “In September 2025, State began negotiating Memorandums of Understanding (MOUs) with foreign governments to structure U.S. global health aid. According to recent reporting, some MOUs are conditioning aid on the establishment of mandatory data access agreements and direct log-in credentials to highly sensitive health data systems.” “For example, in exchange for HIV and other global health funding, State has reportedly demanded that Uganda give the United States direct, real-time access to nine of the nation’s health data systems for seven years. While the MOU contains some privacy restrictions, the deal requires that the United States have direct access to the Ugandan system responsible for managing individuals’ electronic medical records and laboratory results.” “We know that Uganda is not alone: 34 countries have signed MOUs, and State has not publicly shared how many include an accompanying DSA. Only eight of these MOUs and only one of the DSAs have been made publicly available, either by State or partner countries. State has not published all of the MOUs and annexes on either their website or in the Federal Register—despite statutory requirements to do so.” “While global health programs have historically included data sharing components, they have never required direct access to privileged electronic systems for U.S. government representatives.” “Indeed, these new demands set an alarming precedent that is seemingly contrary to the Administration’s longstanding support for the privacy of U.S. citizens’ data. In this year’s National Cyber Strategy, the Trump Administration affirmed that it “will emphasize the right to privacy for Americans and American data.” The Federal Trade Commission recently reminded U.S. technology companies “to protect the privacy and data security of American consumers despite pressure from foreign governments to weaken such protections.” Likewise, just months ago, a State cable reportedly criticized China for “bundling enticing technology infrastructure projects with restrictive data policies that expand . . . access to international data for surveillance and strategic leverage.” Vice President Vance has even personally urged foreign governments to drop their demands for access to Americans’ personal user data, with U.S. officials citing the importance of “maintain[ing] each country’s sovereignty.” “We support efforts to protect the privacy of Americans’ data, and we are concerned that requiring U.S. government officials be provided access credentials to other nations’ sensitive health data systems may set international precedents that ultimately harm Americans. Therefore, we request that State provide a briefing to our offices and respond in writing to the following questions by August 31, 2026 : Federal law requires that State make global health agreements publicly available. Why have the text of these MOUs and associated annexes not been published online and in the Federal Register, as required by law and consistent with precedent? If State does not intend to publish the MOUs and all associated annexes, including the data access agreements, what legal authority does State believe justifies withholding them? We understand that most but not all of the MOUs that have been signed include DSAs. How did State determine which countries would require or be exempted from DSA requirements? For each DSA, please identify every category of data that may be accessed directly by a U.S. representative, including whether the data may include names, national identification numbers, dates of birth, addresses, telephone numbers, GPS/location information, HIV status, laboratory records, treatment histories, biometric information, pseudonymized identifiers, unique patient identifiers, metadata, or other sensitive health information. How did State determine the minimum data elements necessary to achieve public health objectives? Describe the technical architecture for each DSA, including whether data are transferred through bulk exports, application programming interfaces, remote database access, federated queries, or other mechanisms. Did the State Department consider alternative data collection or access approaches, such as requiring automated exports of pre-aggregated data or encouraging countries to publicly publish data at the necessary levels of aggregation and in accordance with national data safety laws? Do any of the DSAs contain provisions for accessing and/or exporting data at a more granular level than would have been obtained through PEPFAR’s traditional data collection system? Does State intend to make the data obtained through the DSAs public in a similar format, granularity, and cadence as PEPFAR’s traditional public reporting? If not, why not, and how do these decisions support oversight and transparency by Congress and the American taxpayer? What policies, procedures, and safeguards has State established for protecting personally identifiable information? Will any of the data be shared with U.S.-based third parties for any commercial purpose, including to train any artificial intelligence models? Do data subjects or the relevant countries have a right to object to the use of their data for these purposes? Are there any limitations on the specific purposes for which data can be shared with third parties? Which U.S. authority will oversee data transfers and management? How will this authority monitor and supervise use of this data, including any use by third parties? Who is liable for any misuse of foreign citizens’ personal data? Reporting suggests that these data transfers may not be consistent with domestic data protection law and the African Union’s Data Policy Framework. If these data transfers are found to violate domestic laws, will foreign nations be able to suspend the data transfers while continuing to access global health assistance? If the health agreement is terminated, will the data transferred to the U.S. be deleted? How long will data be retained by the U.S. and associated third parties? What privacy rights will foreign data subjects have over data that is transferred to the U.S.? How will foreign citizens’ privacy rights be enforced in case of a data breach or other unethical use of their data while it is in the U.S.? What procedures govern notification of foreign governments, affected individuals, Congress, and other stakeholders following a security incident or unauthorized disclosure? How are these DSAs consistent with the Trump Administration’s priority of elevating digital freedom? Would the Administration object if another country, such as the People’s Republic of China, established similar requirements for a nation to receive foreign development assistance, loans, or other aid? “Thank you for your consideration of this important issue.” ###