How have state attorneys general and courts challenged HHS/CMS data-sharing with ICE, and what limits did judges impose?
Executive summary
State attorneys general from multiple states sued to stop a November 2025 CMS–DHS agreement that would give ICE access to Medicaid enrollee data, winning preliminary injunctions in some courts and forcing judicial limits on what HHS/CMS may share; judges have allowed limited sharing of basic biographical and contact data while barring disclosure of sensitive medical records and constraining the scope of use pending further review [1][2]. Courts also found procedural problems under the Administrative Procedure Act (APA) and confined injunction relief to the plaintiff states, leaving data-sharing in non‑litigating states potentially intact [1][3].
1. The attorneys general’s legal theory and immediate remedies
Twenty state attorneys general mounted coordinated litigation arguing CMS’s abrupt reversal of long‑standing non‑sharing policies threatened privacy and state Medicaid programs, and they secured preliminary injunctions in at least one federal court that initially blocked the transfer of Medicaid data derived from plaintiff states to ICE while litigation proceeds [3][2]. Plaintiffs emphasized the sudden policy change, the risk to beneficiaries, and claimed the agencies failed to follow required APA procedures when implementing the new data‑sharing regime [1].
2. What judges said about the legality of sharing in principle
Federal judges—most prominently U.S. District Judge Vince Chhabria in California—recognized that statutes on their face do not categorically prohibit DHS from obtaining data from agencies like HHS, noting several federal statutes permit or sometimes require interagency sharing, and therefore declined to declare the basic concept unlawful [4][5]. Chhabria wrote that the agencies had “adequately explained their decisions” and that sharing certain categories of Medicaid data is “clearly authorized by law,” reflecting the court’s view that lawfulness turns on statutory authority and administrative record rather than on an absolute bar [6][7].
3. Judicially imposed limits: what may — and may not — be shared
While some courts allowed limited resumption of data transfers, they imposed concrete limits: judges have authorized HHS/CMS to provide only basic biographical, contact and location information (citizenship/immigration status, addresses, phone numbers, dates of birth, and Medicaid IDs) about individuals unlawfully present, and they expressly barred sharing of detailed or potentially sensitive medical records and other health information unless the agencies can show a lawful, reasoned justification [2][8]. Courts stressed that where basic info is not severable from sensitive data (for example, mixed files including citizens or lawful residents), those portions may not be shared with DHS/ICE [1].
4. Procedural findings and the injunction’s geographic and temporal scope
Courts found procedural defects—particularly that the data‑sharing was implemented without a sufficiently “reasoned decision‑making process” as required by the APA—supporting injunctive relief for suing states; however, those injunctions were often limited in geography to the 20 plaintiff states, meaning CMS’s agreement could proceed in non‑participating states unless further orders are issued [1]. Some rulings modified earlier preliminary injunctions, allowing sharing to resume with constraints while litigation continues and preserving previously set administrative timelines [9][3].
5. Competing narratives and remaining uncertainties
HHS and CMS have defended the move as consistent with federal law and an effort to ensure program integrity, with agency statements asserting lawful authority to share certain Medicaid data [6][10]. State attorneys general and privacy advocates counter that the policy undermines health care access and chills care seeking; judges have tried to balance those concerns by limiting data categories and enforcing APA review, but substantial uncertainty remains about daily operational access (e.g., T‑MSIS contents and lag), how ICE will use the data, and whether courts will ultimately enjoin the policy nationwide—questions not fully resolved in the sources reviewed [1][9].