RFK Jr HHS "Vaccine Vault" Claims

Introduction

Robert F. Kennedy Jr. was confirmed as US Secretary of Health and Human Services on 13 February 2025 following his nomination by President Trump. Kennedy had for decades been one of the most prominent critics of vaccine safety policy in the United States, most prominently through his organisation Children's Health Defense (CHD) and his book The Real Anthony Fauci (2021).

A recurring theme in Kennedy's pre-confirmation advocacy — and in statements made after his confirmation — is the claim that federal health agencies, particularly the CDC and FDA, possess suppressed or hidden adverse-event data about vaccines that would, if released, demonstrate broader patterns of vaccine harm than are publicly acknowledged. This framing has sometimes described a specific "vault" of concealed data.

This page assesses the specific factual claims about suppressed or hidden vaccine-safety data. It does not adjudicate the broader question of Kennedy's cabinet performance or vaccine policy generally.

What Is VAERS?

The Vaccine Adverse Event Reporting System (VAERS) is a national passive surveillance system jointly managed by the CDC and FDA. It was established in 1990 under the National Childhood Vaccine Injury Act. Reports of adverse events following vaccination — from healthcare providers, vaccine manufacturers, and members of the public — are submitted to VAERS and made publicly available.

VAERS data is accessible without restriction at vaers.hhs.gov. The full dataset can be downloaded in CSV format. CDC and FDA publish annual summaries, and VAERS data is regularly cited in peer-reviewed literature.

VAERS is explicitly designed as a signal-detection system. Its published documentation — and the standard disclaimer prominently displayed on the VAERS website — notes that a VAERS report does not establish causation between a vaccine and a reported adverse event. The system is designed to detect potential safety signals that then require further epidemiological investigation; it is not a registry of confirmed vaccine injuries.

What CDC Publishes

Beyond VAERS, CDC operates several vaccine-safety surveillance platforms whose data is substantially public:

• Vaccine Safety Datalink (VSD): A collaborative program between CDC and nine integrated health-care organisations. VSD data is used in peer-reviewed published studies; summary data and published analyses are publicly accessible.
• Clinical Immunization Safety Assessment (CISA) Project: CDC-funded network that evaluates complex adverse events. Published findings are in the public literature.
• Biologics Effectiveness and Safety (BEST) System: FDA's active surveillance system using insurance claims data.

CDC also publishes vaccine-safety monitoring results through the CDC website and through the Morbidity and Mortality Weekly Report (MMWR), a public peer-reviewed journal.

The "Vault" Claim: What the Evidence Shows

Kennedy and allied advocates have at various points claimed:

1. That VAERS data is suppressed or not publicly accessible. This is false. VAERS data has been publicly downloadable since the system's inception.
2. That a separate repository of adverse-event data exists and is withheld from the public. No documentary evidence of such a repository has been produced. HHS, CDC, and FDA have not acknowledged the existence of such a repository. No whistleblower documentation, FOIA-produced material, or congressional investigation has surfaced records consistent with this claim.
3. That CDC possesses unpublished autism-prevalence analyses showing a vaccine-autism link. No such unpublished analyses have been produced as documentary evidence. The 2004 IOM (now National Academy of Medicine) report Immunization Safety Review: Vaccines and Autism conducted a comprehensive review of the evidence and found no causal relationship. This finding has been replicated in large-scale epidemiological studies in multiple countries.
4. That, as HHS Secretary, Kennedy would be able to "release" hidden data. Statements along these lines imply that data exists in a hidden form within HHS that his appointment would unlock. No such data has been produced or acknowledged as existing.

What Is Legitimately Debated

Some aspects of the broader transparency debate at federal health agencies are legitimate policy questions distinct from the specific "vault" claim:

• VSD data access: Researchers have at various times argued that individual-level VSD data is insufficiently accessible for independent replication of CDC-funded analyses. This is a real methodological and transparency debate in vaccine epidemiology, though it is distinct from claiming a "vault" of suppressed data.
• FOIA responsiveness: Public records request backlogs at HHS and CDC are documented and have been subject to congressional scrutiny.
• Data granularity: Some specific disaggregated datasets (e.g., VAERS reports with full identifying information) are restricted for privacy reasons consistent with health privacy law, not as a concealment of safety data per se.

These are real policy discussions. They do not support the specific claim that a "vault" of hidden adverse-event data exists and could be released by the HHS Secretary.

IOM / NAM Vaccine Safety Review

The 2011 Institute of Medicine (now National Academy of Medicine) report Adverse Effects of Vaccines: Evidence and Causality reviewed more than 1,000 peer-reviewed studies and assessed the causal evidence for a broad range of claimed adverse events following eight vaccines. The report found convincing evidence of causality for some adverse events (e.g., MMR and febrile seizure; varicella vaccine and disseminated Oka VZV disease in immunocompromised recipients); found inadequate evidence to accept or reject other claimed relationships; and found convincing evidence to reject specific claimed relationships (MMR and autism; MMR and Type 1 diabetes).

This report, produced by an independent National Academy body, is publicly available in full.

Why the Verdict Is "Partially True"

The specific claim — that a "vault" of suppressed adverse-event data exists within federal health agencies — is unsubstantiated. VAERS and other surveillance data are publicly accessible. No documentary evidence of a secret repository has been produced. The broader questions about data granularity, VSD access, and research transparency at federal agencies are legitimate policy debates, and some specific data-access constraints (privacy-protected individual records) are real. The "vault" framing specifically, and the implication that a discoverable hidden dataset awaits release by a sympathetic HHS Secretary, is not supported by evidence.

What Would Change Our Verdict

• Production of documentary evidence — FOIA materials, whistleblower records, congressional subpoena results — demonstrating a suppressed adverse-event dataset
• An HHS Secretary announcement of a specific previously-unreleased dataset with accompanying documentation of why it was withheld
• Peer-reviewed analysis of newly-released data confirming safety signals not previously apparent in public data

Verdict

Partially true. VAERS and CDC surveillance data are publicly accessible; the specific "vault of suppressed data" framing is unsubstantiated. Legitimate policy debates about VSD data granularity and research transparency at federal agencies are real but distinct from the suppression claim. The "hidden data awaits release" framing assumes facts not in evidence.

The Vaccine Safety Datalink: The Database Behind the "Vault" Language

The database most often invoked in "vault" framing is the CDC's Vaccine Safety Datalink (VSD), a collaboration between CDC and eleven healthcare organizations covering the electronic health records of roughly 12 million people. Kennedy has described it in stark terms, saying in 2023 — before he became HHS Secretary, and repeating the framing in office (as reported by NBC News, April 30, 2025) — that "for decades, the CDC has kept a tight grip on the Vaccine Safety Datalink, concealing vital vaccine safety information from the public." The VSD's scale is real, but its existence, purpose, and published outputs have been publicly documented since the 1990s, and it has served as the source dataset for dozens of peer-reviewed vaccine-safety studies, including several of the largest studies finding no vaccine-autism link. The "concealment" narrative traces substantially to a 2004 episode in which researcher Mark Geier told an Institute of Medicine panel that VSD data showed a vaccine-autism connection; Kaiser Permanente, which helped manage the data, said Geier's team had violated data-use protocol, and his findings were never replicated. That access-control failure is often cited by critics as proof that records were hidden, though it did not change the scientific consensus built from properly conducted VSD research.

Direct HHS Access to VSD and State Health Records

In 2025, Kennedy's HHS moved from advocacy into direct data-access actions. Aides dispatched by Kennedy visited CDC headquarters in Atlanta to download identifiable VSD patient records, and HHS separately pursued data-sharing arrangements with state health-information exchanges holding detailed, identifiable clinical records, as part of a push to study a vaccine-autism link already studied extensively for two decades. Some state health-data administrators reportedly declined or delayed sharing data, citing existing contractual and privacy obligations, and public-health officials outside HHS questioned whether the department has clear legal authority for bulk transfers of identifiable records to a small internal team. These are real, reported governance disputes over data access and authority. They document that a large vaccine-safety database exists and is now being actively mined by the administration; they do not document the discovery of a previously undisclosed cache of adverse-event records.

The VAERS Control Dispute

A related but distinct episode involves VAERS rather than VSD. Former FDA vaccine chief Peter Marks has said he was pushed out of the agency after refusing to give Kennedy's team unrestricted access to VAERS. Marks's own account makes clear his staff already had the ability to view VAERS reports — the same public data described elsewhere on this page — and that the dispute was over whether they would also receive editing rights to the live database, which Marks refused over data-integrity concerns. This was a fight over administrative control of an existing public system, not a revelation that VAERS had been withheld from public view.

VICP: What Vaccine-Injury Payouts Do and Don't Show

Claims of hidden vaccine harm sometimes point to the National Vaccine Injury Compensation Program (VICP), a no-fault program Congress created under the 1986 National Childhood Vaccine Injury Act to compensate a defined set of injuries without the adversarial burden of tort litigation. For injuries on the program's Vaccine Injury Table occurring within a specified window after vaccination, causation is legally presumed for compensation purposes; many other claims are resolved through negotiated settlement without any factual finding that a vaccine caused the injury. VICP's structure and claims process are publicly documented. Because payouts do not require individualized scientific proof of causation, the existence of compensated claims cannot be read as a count of scientifically confirmed vaccine injuries, and the program's public record does not, on its own, support a broader suppressed injury dataset.