CMS secretly gave ICE access to personal data of all 79 million Medicaid enrollees for immigration enforcement

On July 18, 2025, CNN reported that the Centers for Medicare and Medicaid Services had entered into an Information Exchange Agreement with U.S. Immigration and Customs Enforcement, granting ICE access during business hours to personal data — including names, home addresses, birthdates, Social Security numbers, and racial and ethnic identifiers — for all 79 million people enrolled in Medicaid. The agreement had not been made public and was disclosed only because AP obtained the document. ICE officials were authorized to query the database from 9 a.m. to 5 p.m. Monday through Friday to identify and locate Medicaid-enrolled immigrants for enforcement purposes.

Medicaid enrollment requires applicants to provide sensitive personal data under statutory privacy protections, including the Social Security Act's confidentiality provisions and applicable federal health privacy standards. Enrollees submitted that data under an implicit assurance that it would be used for health benefit administration. The Kaiser Family Foundation estimated that roughly 7.3 million non-citizen Medicaid enrollees faced direct risk of identification and targeting; the broader chilling effect on healthcare-seeking behavior extended to the full enrollee pool, as immigrant and mixed-status families began to disenroll or avoid seeking care to prevent being located by immigration authorities.

A coalition of 22 state attorneys general filed suit challenging the agreement, and a federal court issued a preliminary injunction blocking the data sharing in August 2025. The administration's decision to establish the agreement without public disclosure and in the absence of any statutory authorization for using healthcare enrollment data as an immigration enforcement tool drew condemnation from healthcare advocates and civil rights organizations. The administration converted safety-net infrastructure — enrollment in which requires disclosure of sensitive personal information — into a targeting tool against the marginalized communities that depend on it most.