Consolidating Americansâ medical, claims, genomics, and wearable data into a government-enabled registry architecture sets a precedent for surveillance-by-research that can outlive any single program and erode our expectation of medical privacy. On these facts alone, criminality is not established; the legal fault line will run through whether collection, linkage, and disclosure comply with HIPAAâs Privacy Rule (45 C.F.R. Parts 160 & 164), the Privacy Act of 1974 (5 U.S.C. § 552a), and applicable federal security standards for handling sensitive records. Even if technically authorized, routing broad âreal-time health monitoringâ capabilities to 10â20 outside groups via grants invites mission creep and turns public health research into an institutional pathway for normalized tracking of peopleâs lives.