How have state preliminary injunctions affected CMS data-sharing with DHS in practice?
Executive summary
The preliminary injunctions secured by 20 states have materially narrowed how the Centers for Medicare & Medicaid Services (CMS) can share Medicaid data with the Department of Homeland Security (DHS), blocking broad transfers and use of sensitive health and mixed‑status household data while permitting limited sharing of basic biographical and contact information in narrowly defined circumstances [1] [2] [3]. In practice the injunctions operate as a partial, geographically limited brake: they stop wholesale, untethered access in the plaintiff states but leave open both limited exchanges and the possibility of broader sharing if agencies cure procedural defects or the litigation ends [4] [3].
1. How the courts drew the line between “basic” and “broader” data
Federal courts—most prominently Judge Vince Chhabria in the Northern District of California—found that DHS and HHS abruptly reversed long‑standing policies and failed to provide reasoned decision‑making under the Administrative Procedure Act, so the judges enjoined the agencies from sharing anything beyond narrow categories of information such as citizenship/immigration status, address, phone number, date of birth and Medicaid ID for people not lawfully present [1] [2] [3]. The rulings repeatedly emphasize that sensitive medical records and data that could implicate citizens or lawful permanent residents remain off limits under the injunctions, because the government did not explain why such data were necessary or how risks would be mitigated [5] [3].
2. What the injunctions have stopped—practically speaking
Practically, the preliminary injunctions halted the real‑time, unfettered pipeline that CMS had established in mid‑2025—an agreement that reportedly gave DHS daily access to millions of enrollees’ personal data—by barring new transfers of the broader dataset and by prohibiting DHS from using data already obtained from the plaintiff states for immigration enforcement unless it meets the court’s limitations [5] [6] [1]. States’ lawsuits successfully framed the government move as an “arbitrary and capricious” reversal of prior policy, which in turn persuaded judges to impose immediate, enforceable limits [1] [7].
3. Where data sharing can still proceed—and where it cannot
The injunctions are not an all‑country ban: they apply only to the 20 plaintiff states, meaning the CMS–DHS information exchange can proceed in non‑plaintiff jurisdictions subject to whatever safeguards the agencies specify and to further legal challenges [3]. Even within the injunction’s reach, courts have allowed sharing of the narrowly defined “basic” biographical/contact fields for unlawfully present individuals, while enjoining disclosure of sensitive health details and any data that is inseparable from information about citizens or lawful residents [2] [3].
4. Operational and legal consequences for agencies and beneficiaries
Operationally the injunctions force CMS and DHS to segregate datasets, implement additional legal reviews, and limit DHS’s operational use of Medicaid data pending a reasoned rulemaking or final judgment—an outcome the court tied to compliance with APA requirements or to the conclusion of the litigation [8] [4]. For Medicaid enrollees the injunctions create geographic patchworks of protection: enrollees in the plaintiff states enjoy stronger interim safeguards against their medical or mixed‑status household data being turned over to immigration authorities than enrollees in states not part of the suit [3] [9].
5. The unresolved pathways forward
The preliminary injunctions are provisional: judges signaled they could be dissolved if HHS and DHS adopt a reasoned, law‑compliant policy explaining exactly what data is needed and why, or if appeals/further proceedings change the legal landscape, meaning the current limits represent a temporary, conditional barrier rather than an absolute prohibition [8] [4] [1]. Meanwhile agencies have published notices indicating they plan to proceed with broader sharing when injunctions lift, a posture that suggests litigation and potential rulemaking—not immediate operational paralysis—will determine the eventual scope of CMS‑to‑DHS data flows [10] [6].