Your Medicaid data may have been shared with ICE in a secret deal

Secret agreement finally goes public

A data-sharing deal between federal health officials and ICE stayed hidden for months.

The Centers for Medicare and Medicaid Services (CMS) and ICE signed the agreement in July 2025, but nobody announced it. The Associated Press first reported it existed that same month.

Then in January 2026, 404 Media and the Freedom of the Press Foundation published the full text after winning a Freedom of Information Act lawsuit against the Department of Homeland Security (DHS).

Agreement promises ICE more than expected

The full document revealed ICE would get access to far more personal data than earlier reports suggested.

The agreement opens the door to the CMS Integrated Data Repository, which collects Medicaid information from every state.

ICE would receive addresses, phone numbers, email addresses, banking details like routing and account numbers, and even IP addresses.

A small group of ICE employees would get their own login credentials to search the database directly during renewable two-month windows.

Data sharing started before the deal

CMS actually started handing over Medicaid data to DHS a month before the agreement, in June 2025.

That first transfer covered states that had let noncitizens enroll in state-funded Medicaid programs, including California, Illinois, and Washington.

The data included names, addresses, birth dates, racial and ethnic details, and Social Security numbers. Some CMS officials pushed back internally before the transfer went through.

The July agreement then expanded access to cover all Medicaid enrollees nationwide, roughly 77 million people.

CMS broke its own privacy promises

CMS had told enrollees on its website that their personal information would only go toward running health care programs. The agency also said it would not use immigration status for enforcement purposes.

Those assurances leaned partly on a 2013 ICE policy that said the agency would not use CMS data for enforcement. ICE formally dropped that policy in October 2025.

A month later, CMS published a Federal Register notice saying it planned to share Medicaid data with ICE once legal issues were cleared up.

Twenty-two states filed suit to stop it

California Attorney General Rob Bonta led 20 states in suing the Department of Health and Human Services (HHS) and DHS in July 2025.

The states argued the mass data transfer skipped the required legal steps and broke federal privacy rules. Wisconsin and Kentucky joined later, bringing the total to 22.

On Aug. 12, 2025, U.S. District Judge Vince Chhabria blocked DHS from using the Medicaid data for immigration enforcement in those states.

He found the agencies likely violated the Administrative Procedure Act by changing longstanding policy without a reasoned process.

Judge loosened the block in December

On Dec. 29, 2025, Judge Chhabria partly lifted his own order.

He ruled that sharing basic biographical and contact information is clearly allowed by law and that the agencies explained that decision well enough. But he kept the block on everything beyond those basics.

The judge wrote that the broader policies were “totally unclear” and did not look like the result of a careful process. The updated ruling took effect on Jan. 6, 2026.

Courts drew a line on what ICE gets

Under the current court order, CMS can share citizenship and immigration status, address, phone number, date of birth, and Medicaid ID. That data can only cover people who are not lawfully present in the United States.

Health records, data on U.S. citizens, and data on lawful permanent residents stay off limits.

If basic data on people who are unlawfully present cannot be separated from data on citizens or legal residents, CMS cannot share it. The order only applies in the 22 states that sued.

Undocumented immigrants can’t get federal Medicaid

Federal law bars undocumented immigrants from enrolling in federally funded Medicaid, Medicare, or the Children’s Health Insurance Program (CHIP).

Hospitals must still treat all emergency patients regardless of immigration status, and states can get Medicaid reimbursement for that care. That emergency spending accounts for less than 1% of total Medicaid costs.

A handful of states had used their own money to cover some noncitizens through state Medicaid programs, but several, including California, have since pulled back some of that coverage.

Medicaid covers about 77 million people

As of October 2025, about 77 million people were enrolled in Medicaid and CHIP combined. That number dropped from a peak of roughly 94 million in early 2023, when pandemic-era rules kept people on the rolls.

Enrollment fell after states started checking again whether people still qualified. Medicaid covers low-income adults, children, pregnant women, elderly adults, and people with disabilities.

The federal government and the states split the cost of the program.

Immigrant families pull back from doctors

A 2025 survey by KFF and The New York Times found that about half of immigrant adults worried that health officials or providers might share their information with ICE.

About one in seven said they or a family member had skipped medical care since January 2025 because of immigration-related fears.

Health policy researchers warned the data-sharing policy could push eligible families away from Medicaid, including U.S. citizen children in mixed-status households.

CMS data covers all enrollees, not just noncitizens, so citizens in those families could also feel the effects.

Other agencies share data with ICE too

The Medicaid deal fits a broader pattern. The Department of Housing and Urban Development signed its own data-sharing agreement with DHS in March 2025.

The IRS began sharing taxpayer data with ICE, though a court later blocked that arrangement. The Social Security Administration and the U.S. Postal Inspection Service also started sharing data with DHS.

In January 2026, reporting revealed that ICE uses a tool built by Palantir that pulls from Medicaid and other government databases to help find and locate people for immigration enforcement.

Case moves forward in federal court

The lawsuit by 22 states against HHS and DHS continues.

The current court order stays in place until the case ends or until 14 days after HHS and DHS finish a formal policy process and notify the court.

DHS called the December ruling a victory for the rule of law.

California and other plaintiff states said they were disappointed the court allowed basic data sharing but noted the judge blocked broader access to sensitive records.

The case could shape how the federal government handles personal data from health care programs going forward.

This article was created with AI assistance and human editing.

Read more from this brand:

• DHS demands Google and Meta hand over data on Americans who criticize ICE
• ICE can now ID you by pointing a phone at your face — and you can’t say no
• Trump says no bail for immigrants. Over 300 judges say that’s illegal.