CMS secretly gave ICE access to personal data of all 79 million Medicaid enrollees for immigration enforcement

On July 18, 2025, CNN reported that the Centers for Medicare and Medicaid Services had entered into an Information Exchange Agreement with U.S. Immigration and Customs Enforcement, granting ICE access during business hours to personal data — including names, home addresses, birthdates, Social Security numbers, and racial and ethnic identifiers — for all 79 million people enrolled in Medicaid. The agreement had not been made public and was disclosed only because AP obtained the document. ICE officials were authorized to query the database from 9 a.m. to 5 p.m. Monday through Friday to identify and locate Medicaid-enrolled immigrants for enforcement purposes.

Medicaid enrollment requires applicants to provide sensitive personal data under statutory privacy protections, including the Social Security Act's confidentiality provisions and applicable federal health privacy standards. Enrollees submitted that data under an implicit assurance that it would be used for health benefit administration. The Kaiser Family Foundation estimated that roughly 7.3 million non-citizen Medicaid enrollees faced direct risk of identification and targeting; the broader chilling effect on healthcare-seeking behavior extended to the full enrollee pool, as immigrant and mixed-status families began to disenroll or avoid seeking care to prevent being located by immigration authorities.

A coalition of 22 state attorneys general filed suit challenging the agreement, and a federal court issued a preliminary injunction blocking the data sharing in August 2025. The administration's decision to establish the agreement without public disclosure and in the absence of any statutory authorization for using healthcare enrollment data as an immigration enforcement tool drew condemnation from healthcare advocates and civil rights organizations. The administration converted safety-net infrastructure — enrollment in which requires disclosure of sensitive personal information — into a targeting tool against the marginalized communities that depend on it most.

Updates

2026-07-16 — ICE shared improperly held Medicaid data with Palantir, court filings show [4]

2026-09-03 — Judge signaled narrower data-sharing scope, excluding valid visa holders [5]

At a hearing on narrowing the scope of his December 2025 injunction governing CMS-to-ICE Medicaid data sharing, U.S. District Judge Vince Chhabria (N.D. Cal.) stopped short of a formal ruling but indicated that people with a valid, nonexpired visa should not have their Medicaid data shared with ICE, and expressed skepticism about including DACA recipients and Temporary Protected Status holders. He rejected the government's request for the broadest possible reading -- that HHS should be able to share data on "anyone not in the country permanently" -- and directed the parties to draft an agreement consistent with his guidance.

According to a motion filed by state attorneys general on July 16, 2026 in the coalition's ongoing lawsuit over the CMS-ICE data-sharing agreement, ICE shared Medicaid data it had improperly obtained in January 2026 with data-analytics contractor Palantir Technologies, whose ELITE application ICE agents use to display the addresses of noncitizens who may be subject to deportation. Palantir told NPR the dataset had been purged. U.S. District Judge Vince Chhabria, who had allowed CMS to share limited Medicaid details with ICE in a December 2025 ruling and then paused CMS-ICE data sharing in late May 2026 after officials admitted the January dataset exceeded what his order permitted, was separately told that the Department of Justice again inadvertently reshared that same dataset with ICE while transferring data for states not party to the suit; ICE said the file was deleted after discovery, though a later search found several users still held copies of it.