Privacy Daily is a service of Warren Communications News.

Federal Court Blocks HHS From Using State Medicaid Data for Immigration Enforcement

A federal court granted a preliminary injunction Tuesday blocking the U.S. Department of Health and Human Services (HHS) from using certain states' Medicaid data for immigration enforcement purposes. The block from the U.S. District Court for Northern California comes after a multistate coalition, led by California, filed a lawsuit against HHS for providing individuals' health data to the Department of Homeland Security (DHS) and its Immigration and Customs Enforcement (ICE) agency (see 2507010060).

Sign up for a free preview to unlock the rest of this article

Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.

"At the outset, it bears noting that there does not appear to be anything categorically unlawful about DHS obtaining data from agencies like HHS for immigration enforcement purposes," said Judge Vince Chhabria. "Regardless, under the Administrative Procedure Act, when federal agencies make policy changes, they may not do so arbitrarily," he said, noting those "changes must be the product of a reasoned decisionmaking process and must be properly explained."

Given that "since at least 2013, ICE has had a policy against using Medicaid data for immigration enforcement purposes ... it was incumbent upon the agencies to carry out a reasoned decisionmaking process before changing them," he added. "The record in this case strongly suggests that no such process occurred," and so "the states have demonstrated a likelihood of success on their 'arbitrary and capricious' claim under the APA, which means that HHS and DHS likely must go back and engage in a reasoned decisionmaking process before adopting and implementing such a significant change."

The judge also noted that the states filing the suit were likely to suffer irreparable harm from the change in longstanding policy. HHS is enjoined from using Medicaid data from California, Arizona, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Vermont and Washington state for immigration purposes.

However, Chhabria denied the states' request in case 25-05536 for an "injunction requiring the agencies to undertake notice-and-comment rulemaking before deciding whether to change their policies," saying they have not demonstrated that a reversal of sharing information for immigration purposes would require that kind of rulemaking. The judge also denied as moot the claim that using Medicaid data for immigration enforcement is a spending clause violation.

“The Trump Administration’s move to use Medicaid data for immigration enforcement upended longstanding policy protections without notice or consideration for the consequences [and] sowed a culture of fear that threatens our Medicaid system, caused chaos for states and providers, and created a chilling effect for patients seeking vital emergency medical care,” said California Attorney General Rob Bonta (D) in a release Tuesday. The "preliminary injunction rightfully blocks any sharing of California's Medicaid data for immigration enforcement for now -- and ensures any of the data that’s already been shared is not being used for immigration enforcement purposes."

Michigan AG Dana Nessel (D) also celebrated the injunction. “I am relieved that the Court has recognized that the Trump Administration cannot abandon longstanding policies to personal healthcare data to advance a political agenda,” she said in a Wednesday release. “Medicaid exists to serve the needs of some of our most vulnerable residents, not to provide unrelated agencies access to some of our most sensitive information. I will continue to fight to ensure Michiganders’ medical data remains protected and confidential.”

HHS did not respond to a request for comment.