The Push for Your Medical Records (08/17/2026)

Three of today’s stories describe the same move from different directions. Somebody wants a category of records they were not previously entitled to, and the argument for handing them over is always framed around a specific bad actor. The records are always about everybody.

Top 5 Critical Privacy Alerts

1. The Government Wants Your Medical Records While the Protections Thin Out

Federal agencies are pushing for a level of access to medical records that has no precedent, and the legal protections around those records are being narrowed at the same time. Two trends that would each be significant alone are running together, which is the part worth sitting with. PogoWasRight

Operator Note: A medical record is the most complete description of a person that exists in writing. It carries their conditions, their medications, their pregnancies, their addictions, their mental health, and the dates of every one. Any organization holding that data as a covered entity should be asking a question it has never had to ask: what is our position when the request arrives, and who in this building is authorized to answer it.

2. Homeland Security Surveilled Churches, Libraries, and Union Halls

During the Minneapolis protest crackdown, the Department of Homeland Security conducted surveillance on churches, libraries, and union halls. Those three categories share a property. They are the places people go precisely because attendance there has historically not been recorded. PogoWasRight

Operator Note: This is the Shadow Risk pattern operating on institutions rather than data. A library kept no attendance list because it had no reason to, and that absence was the protection. Once somebody else is recording who walks through the door, the institution’s own restraint stops mattering. Ask what your building records about who visits, how long it keeps it, and who can compel it.

3. Private Firms Are Selling Dossiers on Data Center Critics

Private intelligence companies are compiling and selling dossiers on people who publicly oppose AI and data center projects. Speaking at a zoning hearing is now a thing that can put a person in a commercial file. PogoWasRight

Operator Note: I am pro-AI and I want these projects built, and this is still corrosive. Public comment only works when people believe the cost of speaking is bounded. Make that cost unbounded and you do not get consent, you get silence that looks like consent, and the projects get built on a foundation nobody tested.

4. A Site Now Tells Drivers If Their Plate Was Searched

Have I Been Flocked lets a driver check whether their vehicle has been queried in the Flock camera network. Until now, the person being searched has been the only party with no visibility into it. PogoWasRight

Operator Note: Watch what happens to the search volume once the searched can see the search. Most surveillance systems are built assuming the subject never finds out, and that assumption is doing more load-bearing work in the policy than anyone writes down. This closes an arc we have been tracking since plate readers started reading the devices in the car.

5. Homeland Security Demands the National Commercial Driver Database

The Department of Homeland Security is seeking access to the American Association of Motor Vehicle Administrators database covering commercial drivers nationally. That record set was built for licensing and safety enforcement. PogoWasRight

Operator Note: Every one of these databases was assembled for a narrow purpose that the people in it agreed to. Nobody consented to the second use, because the second use did not exist when they handed the data over. If you run a fleet, your drivers are in this one.

Additional Privacy Alerts

Privacy Laws & Regulations

• France’s social media age check ruling carries weight across the EU: The Constitutional Council decision we covered on August 14 has implications for other member states and the large platforms. Biometric Update
• Thai regulators propose linking Roblox to the national digital ID: Age assurance for a children’s platform, delivered through a government identity system. Biometric Update

Regulatory Fines & Enforcement Actions

• Pornhub’s parent company will pay $120 million to settle child sexual abuse lawsuits: 404 Media
• Bill payment firm Doxo will pay $2.1 million over deceptive add-on fees: The Federal Trade Commission alleged consumers were misled about who they were paying and what it cost. FTC

Data Minimization & User Consent

• Fraudulent accounts got past Login.gov identity checks, the Government Accountability Office warns: The identity proofing that federal services depend on did not hold. Biometric Update
• A hijacked children’s smartwatch was used to stalk its owner: The device sold as a safety product became the tracking mechanism. PogoWasRight

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.