CMS Gives ICE Access to Medicaid Enrollee Data; Court Enjoins DHS Use of 20 States' Data on Administrative Procedure Act Grounds

CNN, relaying an Associated Press report, said Immigration and Customs Enforcement officials would be given access to the personal data of the nation’s 79 million Medicaid enrollees, under an agreement saying the information will give ICE “the location of aliens.” The agreement did not allow ICE to download the data; ICE officials could access it “from 9am to 5pm, Monday through Friday, until September 9.”

Judge Vince Chhabria of the Northern District of California described the sequence this way: in June 2025 CMS began sharing Medicaid patient data with ICE for immigration enforcement, and in July 2025 CMS and ICE entered into a formal data-sharing agreement. He wrote that “CMS appears to have granted ICE unfettered access to all information about all Medicaid patients.”

The ruling

On August 12, 2025 the judge granted in part a preliminary injunction sought by a coalition of states, 20 states according to HIPAA Journal. The ground was the Administrative Procedure Act: “the states have demonstrated a likelihood of success on their ‘arbitrary and capricious’ claim under the APA.” DHS is “preliminarily enjoined from using Medicaid data obtained from the plaintiff states for immigration enforcement purposes,” including data already acquired. The judge also wrote that “using CMS data for immigration enforcement threatens to significantly disrupt the operation of Medicaid,” and that “there does not appear to be anything categorically unlawful about DHS obtaining data from agencies like HHS for immigration enforcement purposes.”