Medicaid enrollee data sent to immigration enforcement, partly blocked and partly allowed

HHS and the Centers for Medicare and Medicaid Services may share, from plaintiff states, only Medicaid-program data on immigrants residing unlawfully, limited to citizenship and immigration status, address, phone number, date of birth, and Medicaid identifier. Everything beyond that is enjoined, as is the use of previously obtained data for immigration enforcement. DHS called the December ruling a victory for the rule of law and American taxpayers. In March 2026 the states moved to enforce the order after learning HHS had shared what they described as a large and complex data set.

The Centers for Medicare and Medicaid Services had long declined to share Medicaid enrollee data with immigration authorities, and since at least 2013 ICE had a policy of not using such data for immigration enforcement. In June 2025 that changed: CMS began transferring enrollees' personal data, including names, addresses, dates of birth, ethnicities, Social Security numbers, and immigration status, to the Department of Homeland Security, which ICE officials could view. The Associated Press reported the transfer on June 13. In July, CMS and ICE entered a formal data-sharing agreement. The federal government said the purpose was to ensure Medicaid benefits go only to those lawfully entitled to them. Every state must offer emergency Medicaid regardless of immigration status; it is less than one percent of program spending.

On July 1, 2025, twenty states led by California sued in the Northern District of California, claiming violations of the Administrative Procedure Act, the Social Security Act, HIPAA, the Privacy Act, the Federal Information Security Modernization Act, and the Spending Clause. Judge Vince Chhabria granted a preliminary injunction in August, finding the states likely to succeed on the claim that the change was arbitrary and capricious, and barring DHS from using the data for immigration enforcement.

On December 29, 2025 he ruled again, and split the difference. He held that basic biographical, location, and contact information is something DHS has always had authority to request in pursuit of legitimate law-enforcement objectives, and that HHS and DHS had adequately explained that decision despite the abrupt departure from past practice. As to everything else he granted the injunction, writing that beyond the basic information the policies are totally unclear and do not appear to be the product of a coherent decisionmaking process, and questioning why data on citizens and lawful permanent residents would be needed at all. He said he was somewhat skeptical of the Spending Clause claim. DHS welcomed the ruling. In March 2026 the states moved to enforce the order, saying HHS had nonetheless shared a large data set whose contents were unclear. The government won part of the ruling, and the merits are not decided. The IRS transfer of taxpayer addresses is documented at SDA-03, and the cross-agency search layer at SDA-08.

Documented; a complaint, a preliminary-injunction opinion, and a later order partly granting and partly denying relief

California v. U.S. Dept. of Health and Human Services, No. 3:25-cv-05536 (N.D. Cal.), Judge Vince Chhabria. Preliminary injunction August 2025. On December 29, 2025 the court denied the states' motion in part, holding that sharing basic biographical, location, and contact information is lawful, and granted it in part as to everything beyond that. The court was skeptical of the states' Spending Clause claim. Litigation continues

Data sharing began 2025-06; AP report 2025-06-13; suit filed 2025-07-01; formal data-sharing agreement 2025-07; preliminary injunction 2025-08; partial ruling 2025-12-29; motion to enforce 2026-03