According to recent reports, CMS has begun withholding from researchers Medicare and Medicaid claims data relating to substance use diagnoses and related procedures. The agency’s decision will impair research relating not only to substance use, but also any research that depends on unbiased Medicare and Medicaid data. Much of that research is designed to improve patient care and the broader health system—and paid for with your tax dollars—so hampering it is an urgent public concern.

For data-driven reformers, the decision appears shortsighted. Its shortsightedness may have something to do with the agency’s decision to bypass the legal rules governing public input on rule changes.

Let me explain. By statute, CMS is empowered to release records pertaining to substance use and alcoholism for research purposes. Congress wasn’t insensitive to privacy concerns: it told CMS to “prescribe regulations” that, among other things, “may provide for such safeguards and procedures” as are necessary to preserve patient confidentiality. Violating such rules is a criminal offense; no sane researcher would take them lightly.

In accord with Congress’s instruction, the agency has issued rules—lengthy, complex, and carefully drafted rules—to govern the disclosure of substance use and alcoholism claims. Those rules, which were first adopted in 1975, went through notice-and-comment rulemaking, as required under the Administrative Procedure Act (APA). The agency explained at the time that the rules aim to “facilitate the search for truth, whether in the context of scientific investigation, administrative management, or broad issues of public policy, while at the same time safeguarding the personal privacy of the individuals who are the intended beneficiaries of the process or program under investigation.” 40 Fed. Reg. 20536 (1975).

What’s the point of notice-and-comment rulemaking? As Cass Sunstein explains beautifully here, the process assures that the agency has the full run of information at its disposal before making a decision. The agency announces its thinking in a proposed rule so that members of the affected community can voice their concerns in written comments. A final rule issues only after the agency takes those comments into consideration.

Without notice or even any explanation, however, CMS has now apparently scrapped its carefully considered rules. That’s not OK. Agencies can repeal their prior rules only if they go through another round of notice and comment. They otherwise risk violating the APA and making a repeal decision based on inadequate, unsound information.

I fear that’s what’s happened here. It’s possible that CMS has good reasons for acting as it did; indeed, it’s possible that no conceivable safeguards and procedures are adequate to reasonably protect patient confidentiality, even when weighed against the benefits of research. (For the record, I doubt it—in part because accepting that idea would threaten nearly all health-care research.) But we can’t possibly know since the agency sought no input and hasn’t bothered to explain itself. In the meantime, its decision to systematically withhold data will hobble the search for truth.