President Donald Trump, left, speaks as Health and Human Services Secretary Robert F. Kennedy Jr. listens during a Make America Healthy Again (MAHA) Commission Event in the East Room of the White House, Thursday, May 22, 2025, in Washington (AP Photo/Jacquelyn Martin).
A coalition of 20 states are suing the Trump administration for allegedly violating federal privacy laws by sharing individuals” Medicaid data with federal immigration officials in an effort to further facilitate the president’s mass deportations.
According to the 54-page complaint, filed Tuesday in the U.S. District Court in the Northern District of California, the legal challenge stems from the U.S. Department of Health and Human Services’ (HHS) decision to give the Department of Homeland Security (DHS) and Immigration and Customs Enforcement (ICE) “unfettered access to individual personal health data” that could be used to identify, detain, and remove migrants from the country.
“The Trump Administration has upended longstanding privacy protections with its decision to illegally share sensitive, personal health data with ICE. In doing so, it has created a culture of fear that will lead to fewer people seeking vital emergency medical care,” Rob Bonta, the attorney general for California, said in a statement accompanying the filing. “I’m sickened by this latest salvo in the President’s anti-immigrant campaign. We’re headed to court to prevent any further sharing of Medicaid data — and to ensure any of the data that’s already been shared is not used for immigration enforcement purposes.”
In addition to California, the attorneys general Arizona, Colorado, Connecticut, Delaware, Hawaii, Illinois, Massachusetts, Maine, Maryland, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Vermont and Washington state also signed onto the complaint.
The lawsuit asserts that HHS handed over the protected health data of “millions of individuals” in California, Illinois and Washington to DHS without the patients’ consent and in violation of federal laws such as the Administrative Procedures Act, the Social Security Act, the Health Insurance Portability and Accountability Act (HIPAA), the Federal Information Security Modernization Act, and the Privacy Act. The remaining plaintiff States signed onto the complaint because they “fear the administration’s intent to improperly share their States’ sensitive data in the same way.”
HHS allegedly said the “massive amount of personal data” was provided to DHS “to ensure that Medicaid benefits are reserved for individuals who are lawfully entitled to receive them.” That explanation, plaintiffs say, is meant to falsely imply the existence of “widespread Medicaid beneficiary fraud” despite Congress having extended funding and coverage for “emergency Medicaid” to “all individuals residing in the United States, even those who lack satisfactory immigration status.”
The states allege that the information is really being used by the administration to assist with its policy of mass deportations.
“Moreover, the context in which CMS shared this data with ICE casts serious doubt on the government’s explanation for its actions. It has been widely reported that the Department of Government Efficiency (DOGE) has been amassing federal benefit data, such as Social Security recipient information, and individuals’ tax information, to build a searchable database of Americans’ information for several purposes, including to assist ICE in immigration enforcement actions,” the complaint says. “DHS, with the assistance of DOGE and external entities, such as ICE contractor Palantir, are combining federal, state, and local databases of information into a single interoperable database for the purpose of ‘mass deportations’ and other large-scale immigration enforcement and mass surveillance purposes.”
In using the data to bolster removal numbers, the administration has created “fear and confusion” that will result in otherwise eligible noncitizens unenrolling from emergency Medicaid, “leaving states and their safety net hospitals to foot the bill for federally mandated emergency healthcare services,” according to Bonta.
“This is about flouting seven decades of federal law, policy, and practice that have made it clear that personal healthcare data is confidential and can only be shared in certain narrow circumstances that benefit the public’s health or the Medicaid program,” California’s AG said during a Tuesday news conference.
In addition to the agency defendants, HHS Secretary Robert F. Kennedy Jr. and DHS Secretary Kristi Noem were both named as defendants in their official capacities.
In response to the lawsuit, HHS spokesperson Andrew Nixon told The Associated Press that the agency was “aggressively cracking down on states that may be misusing federal Medicaid funds.”
Plaintiffs are seeking a court order prohibiting HHS from sharing individuals’ Medicaid data with other federal agencies as well as the impoundment and disgorgement of any protected Medicaid data that has “already been unlawfully disclosed to DHS and DOGE.”
