One pivotal, if less publicized, area of public health law is who can access what data for which purpose. In June 2025, the Associated Press reported that the Centers for Medicare & Medicaid Services (CMS) “provided deportation officials with personal data—including the immigration status—on millions of Medicaid enrollees” to further the federal government’s policy priorities on immigration. In response, 22 states and the District of Columbia sued the federal government over the question of whether Medicaid data should be used for immigration enforcement.
In California v. U.S. Department of Health and Human Services (N.D. Cal), the plaintiffs challenge the Department of Health and Human Service (HHS) decision to change its data sharing and use policy. The data at issue is personal information of Medicaid enrollees, originally collected for the purpose of administering health insurance benefits. Specifically, the states challenge HHS decision to depart from its longstanding practice of restricting inter-agency data sharing to purposes directly connected to the reason the information was collected—Medicaid enrollment—by sharing that personal information with the Department of Homeland Security (DHS) for immigration enforcement purposes.
This ongoing lawsuit highlights how the federal government’s approach to using and sharing Medicaid data has changed, the arguments a subset of states are making to oppose the federal government’s actions, and the potential impacts on public health.
Understanding the States’ Arguments
In the complaint filed on July 1, 2025, the states argued that the change in policy illegally circumvented proper procedure and exceeded the authority granted to HHS by law. The states’ arguments include:
- HHS’ decision to transfer Medicaid data to DHS was “arbitrary and capricious” and violated the Administrative Procedure Act (APA) because HHS did not consider the important privacy and public health consequences of the action.
- HHS engaged in rulemaking without proper procedure, again in violation of the APA, by abandoning or substantially amending well-established confidentiality requirements that limit the transfer of data without opportunity for notice and comment.
- The federal government illegally ignored proper procedure by failing to publish a “System of Records Notice” (SORN) as required by the Privacy Act of 1974.
- The change in policy exceeds the data collection and use powers granted to the federal government in the Privacy Act of 1974 and the Social Security Act, which limit inter-agency data sharing to purposes directly connected with the administration of benefits, or to purposes compatible with the original purpose for which the data was collected. The data were originally collected to administer the Medicaid program, not for immigration enforcement purposes.
- Additionally, the states argued that the federal government is violating the Spending Clause of the Constitution because it is threatening to impose retroactive conditions on the use of federal funds after they have already been accepted by the states.
Current Status of the Case
In a recent ruling on the states’ request for a preliminary injunction, Judge Chhabria, denied in part but also granted in part the states’ request. Judge Chhabria noted that the federal government’s recent demands for states’ Medicaid data “represent an abrupt departure from…past policies of not sharing or using Medicaid data for immigration enforcement purposes.” The order allows the HHS to continue sharing “basic biographical information and contact information” with DHS but prohibits HHS from sharing any information beyond that. This means that, while the litigation is ongoing, the federal government cannot share any data with DHS that is not biographical or contact information without triggering significant penalties. The judge also noted that, regarding the states’ argument that the change was a violation of the Spending Clause, “the Court is somewhat skeptical of that claim. But for now, it will be denied as moot in light of the ruling under the APA that the agencies must go back and engage in a reasoned process before deciding how to handle this data.”
The Public Health Impact
The field of Public Health relies on access to identifiable personal data. Health departments at all levels of government use health information from a wide range of sources to protect the public’s health and inform community health programming. The federal, state and local laws that govern public health data sharing are in place to protect privacy, avoid unwarranted discrimination, and ensure lawful and ethical data exchanges. The federal government’s actions in this case uses data collected for administration of a health insurance program to further policy priorities that are unrelated to health care delivery or public health. If Medicaid recipients do not trust that government agencies will protect their data, they may be less likely to share information with case workers and health care providers working within government-funded health agencies. This will likely lead to poorer health outcomes among patients and impact the ability of public health programs to address community-wide health incidents such as infectious disease outbreaks.
Litigation Status (Open)
The case is pending in the Northern District of California at the time of writing.
Staying Informed and Engaged
During this turbulent time for the field of public health, it is important for professionals, policymakers, and the public to remain informed and engaged. California v. U.S. Department of Health and Human Services exemplifies the complex legal and public health policy issues that are implicated in federal policy shifts.
Jackson Moore, 2L, University of California, Berkeley Law School
Manel Kappagoda, Senior Staff Attorney, Public Health Law Center
April 15, 2026