California and 19 other states filed a federal lawsuit July 1 against the U.S. Department of Health and Human Services, alleging the agency unlawfully shared Medicaid beneficiaries’ personal health data with immigration enforcement authorities.
The complaint, filed in the U.S. District Court for the Northern District of California, claims the Centers for Medicare & Medicaid Services transferred protected health information from state Medicaid programs to the Department of Homeland Security without patient consent, public notice or legal justification. The lawsuit names HHS Secretary Robert F. Kennedy Jr. and DHS Secretary Kristi Noem as defendants, along with their respective agencies.
According to the suit, CMS gave DHS access to identifiable data from millions of Medicaid enrollees, including residents in California, Illinois and Washington. The plaintiffs argue the data sharing violates the Administrative Procedure Act, the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act.
The complaint cites reports that a federal data aggregation initiative may be using this information to build a searchable database to assist Immigration and Customs Enforcement.
States argue such data sharing could deter eligible residents — including undocumented individuals and mixed-status families — from seeking medical care. The complaint contends this would undermine public health efforts and shift financial burdens onto state governments and safety-net hospitals.
The states are seeking a court order to block any further data transfers and prohibit use of previously shared information. In addition to California, plaintiffs include New York, Massachusetts, Illinois, Oregon and Washington.
According to the complaint, HHS said the data sharing was intended to ensure Medicaid funds go to individuals lawfully eligible for the program. But the plaintiffs assert they already use federally approved systems to verify immigration status and that the additional data sharing is unnecessary and unlawful.
