National Bleeding Disorders Foundation (NBDF) and Hemophilia Federation of America (HFA) joint statement
Background. According to multiple news outlets, the U.S. Centers for Medicare & Medicaid Services (CMS) in mid-July provided the personal data of millions of Medicaid enrollees to the U.S. Department of Homeland Security (DHS), as part of the Administration’s ongoing immigration enforcement efforts. This action marked a change from longstanding policy and previous practice barring such information sharing.
The data reportedly included names, addresses, social security numbers, and health claims data for Medicaid enrollees in states including California, Washington, Illinois, and the District of Columbia.
A coalition of 20 states has sued the Administration in federal district court, arguing that the data sharing violates federal health and privacy laws. And the National Health Law Program (a legal nonprofit dedicated to the defense of health and civil rights in the U.S.) has filed a Freedom of Information Act request with CMS’s parent agency, the Department of Health and Human Services (HHS), to understand the scope of the CMS data request.
UPDATE 8/13/2025:
A federal district court in California has entered a preliminary injunction on August 12th, 2025 barring DHS from using the data that was previously shared for purposes of immigration enforcement. The court noted that CMS and ICE both had longstanding, publicized policies against using Medicaid data in this way.
According to the court order: “Given these policies, and given that the various players in the Medicaid system have relied on them, it was incumbent upon the agencies to carry out a reasoned decision-making process before changing [the policies]” – and CMS and ICE failed to do that in the present instance.
To read the entire court order: https://storage.courtlistener.com/recap/gov.uscourts.cand.452203/gov.uscourts.cand.452203.98.0.pdf
The court’s order is not final but will remain in place until the earlier of (1) the litigation ends, or (2) 14 days after both DHS and HHS have completed a reasoned decision-making process or rulemaking.
Click Here for NBDF and HFA’s Position Statement on Patient Privacy
