A coalition of 20 states is suing the Trump administration, accusing it of illegally sharing the private health records of Medicaid recipients with federal immigration authorities. The lawsuit, filed Tuesday, July 1, in U.S. District Court, alleges the U.S. Department of Health and Human Services quietly gave the Department of Homeland Security access to millions of individuals’ sensitive medical and immigration data without notice, consent or legal authority.
States say privacy laws were broken
The complaint argues the data transfer, made in June, violates federal law and decades of privacy protections. The attorneys general say that the move could deter vulnerable communities from seeking medical care and exacerbate public health outcomes.
Emails and a memo obtained by The Associated Press revealed that HHS instructed Centers for Medicare & Medicaid Services (CMS) staff to quickly turn over data, including immigration status, on millions of people enrolled in federal health programs. Reportedly, the DHS received the information. Sources say CMS staff had just 54 minutes to comply with the request.
California Attorney General Rob Bonta is leading a coalition of 19 other states, including New Jersey, Illinois, Colorado, Massachusetts, Arizona, Hawaii and New York. They claim HHS Secretary Robert F. Kennedy Jr. authorized Immigration and Customs Enforcement to access Medicaid data from states that provide coverage to noncitizens under federally supported health plans.
The lawsuit focuses on federal and state laws designed to protect people’s personal information, especially health data. One of the key laws is the Health Insurance Portability and Accountability Act, or HIPAA, which sets strict rules for how medical information can be collected, stored and shared to protect patient privacy.
State attorneys general want a federal judge to stop HHS from sharing personal health data with immigration agencies like ICE and Homeland Security.
DHS says it has received the data to ensure Medicaid benefits are only provided to those who are legally eligible. However, the lawsuit argues that Congress has already extended emergency Medicaid to anyone living in the U.S., regardless of their immigration status.
“The Trump Administration has upended longstanding privacy protections with its decision to illegally share sensitive, personal health data with ICE,” Bonta said. “I’m sickened by this latest salvo in the President’s anti-immigrant campaign. We’re headed to court to prevent any further sharing of Medicaid data — and to ensure any of the data that’s already been shared is not used for immigration enforcement purposes.”
Hospitals are required under federal law to treat anyone in a life-threatening emergency. Some states, like California and New York, go beyond that, using their own funds to offer full coverage to migrants residing in the country illegally.
Federal rules give states flexibility
States that opt into Medicaid run their own programs within federal guidelines. They decide who qualifies and what is covered, but federal funding only applies to services permitted by law.
As of January 2025, more than 78 million Americans were enrolled in Medicaid or CHIP, which helps cover kids in families who earn too much for Medicaid but not enough for private insurance, according to California’s Attorney General’s Office.
In May, federal health officials announced plans to tighten Medicaid oversight, citing concerns that some states might be using federal dollars to cover care for people without legal status. CMS said the change follows an executive order from President Donald Trump aimed at stopping taxpayer-funded benefits from going to migrants residing in the U.S. illegally.
