Protecting Noncitizens’ Data while Medicaid is in the Crosshairs
The Trump administration continues to target noncitizens, and health care is at the center of it all.
Authors: Eric Gold and Elizabeth Dervan
Editors: Patti Boozang and Amanda Eisenberg
tl;dr
In July, news reports revealed that the Centers for Medicare & Medicaid Services (CMS) had shared Medicaid data, including names and addresses of individuals enrolled in the program, with the Department of Homeland Security (DHS) for immigration enforcement — breaking from longstanding federal policy and privacy protections. Following a lawsuit by 20 states, the Trump administration is now subject to a court order suspending its ability to use or share Medicaid data for immigration purposes in those states.
Medicaid coverage for immigrants has been in the crosshairs of the administration since Day One. Now, the administration and Republicans in Congress are laser-focused on the phantom issue of health care for undocumented individuals during the government shutdown, which has stretched into its second month. Just last week, the administration accused a handful of states of improperly covering noncitizens, which states swiftly challenged. CMS will no doubt be closely examining immigrants’ coverage through Medicaid going forward, with more data audits and requests likely ahead.
Collectively, these actions raise uncertainty and concern among immigrants and their family members seeking care, potentially deterring people from seeking the health care for which they are eligible. They also raise concerns for states, who will need to consider how to ensure that Medicaid funds are used properly and respond to CMS inquiries while also protecting individuals’ information.
Looking ahead, states can take steps to ensure that any data they share with CMS complies with the court’s order and the underlying obligation that states and CMS use Medicaid data only for purposes directly connected to administering the program and not immigration enforcement. Engaging directly with immigrant communities will also be critical to ensure that people eligible for Medicaid get the coverage and care they need.
The 80 Million Impact
What’s at Stake
Under federal law, only income-eligible citizens and certain lawfully residing noncitizens are eligible for full Medicaid coverage. Additionally, states are legally required to provide Medicaid coverage for emergency services to individuals who would qualify for Medicaid but for their immigration status. Those who qualify for emergency services through Medicaid include undocumented individuals — that is, people living in the country without a legal immigration status — as well as lawful residents who do not qualify for full Medicaid.
For years, to encourage people to apply for health coverage (and be consistent with federal privacy protections), the federal government assured Medicaid applicants that their information would be safeguarded and used only for ensuring the proper administration of the Medicaid program. CMS included this guarantee on its model application — which states across the country use. Even today, these promises are still on Healthcare.gov and DHS’ websites.
In a sharp departure, The Associated Press reported in July (and the administration confirmed) that CMS had given DHS data about Medicaid enrollees, including their addresses, to aid immigration enforcement. The data included, in part, information about people receiving emergency Medicaid coverage, which, as we noted above, states are required by law to provide regardless of a person’s immigration status. Following the disclosure, 20 states filed suit, leading a federal judge to issue a preliminary injunction in August prohibiting the Department of Health and Human Services (HHS) (including CMS) and DHS from sharing or using Medicaid data for that purpose. The court order applies only to states in the lawsuit.1 As of this writing, the federal government has not appealed, although the injunction may change as the litigation proceeds.
Medicaid For Noncitizens Under Fire
The administration’s unprecedented sharing of Medicaid data for immigration enforcement was another step in its broader agenda on immigration and health care. This year, the administration announced multiple oversight efforts targeting noncitizens’ coverage through Medicaid, narrowed lawfully residing noncitizens’ Medicaid eligibility under H.R.1, and extended broad restrictions across other health care and human service programs.
In recent days, Medicaid for noncitizens is once again under fire during the government shutdown stalemate as Republicans claim that Democrats wish to expand coverage for undocumented individuals by reversing H.R.1. To be clear, reversing H.R.1 would not change coverage for undocumented individuals. H.R.1 reduced federal Medicaid funding to states for emergency services that they are required to provide, and scaled back eligibility for many lawfully residing individuals who have long been eligible for the program. The White House has now gone so far as to create a website posting the photographs of people it claims are undocumented, have received Medicaid, and have been charged with a crime.
In an escalation, just last week, the administration announced on X that it is continuing to audit states and identified six states that improperly provided Medicaid to undocumented individuals. The administration pointed to this as evidence of major federal spending on these patients. These states have since pushed back. All of this underscores that the administration will continue to hone-in on these services and patients going forward.
What’s Next?
The administration will likely continue to target access to HHS programs for noncitizens, including those legally residing in the country. CMS will also no doubt continue to scrutinize noncitizens’ coverage through Medicaid. This means the agency will likely continue to request and closely audit Medicaid data from states.
These developments raise serious concerns and uncertainty for immigrants seeking health care for themselves and their families, threatening to lead people to forgo the care they need and for which they are eligible. They have also raised questions and concerns from states as they navigate CMS’ requests and work to ensure that Medicaid coverage is provided to eligible individuals, including in emergency circumstances. To protect noncitizens’ data and their access to care — whether they are eligible for full Medicaid coverage or emergency services — certain considerations will be crucial for states to keep in mind:
States can ensure that they are sharing data with CMS consistent with the law and the federal court order protecting individuals’ data. As noted above, HHS and DHS are currently subject to a preliminary injunction barring their sharing or use of Medicaid data for immigration enforcement in the 20 states participating in the lawsuit. Those states, in coordination with their attorneys general, should ensure that data is handed over to CMS only for purposes directly connected to the administration of the Medicaid program, consistent with the law and the court order.
In doing so, states can point to existing federal legal protections that apply to Medicaid data, as detailed in the states’ lawsuit. Those protections include the Medicaid Act (section 1902(a)(7)(A) of the Social Security Act) and associated regulations; the Privacy Act (5 U.S.C. § 552a), the Social Security Act (42 U.S.C. 1306(a)(1)); the Health Insurance Portability and Accountability Act and the Privacy Rule (42 C.F.R. Parts 160 and 164); and the Federal Information Security Management Act.
States can also continue to engage and communicate with immigrant communities to help eligible people access the care they need. Federal announcements focusing on immigration and health care, as well as CMS’ data disclosures earlier this year, have fueled uncertainty and fear that may lead people to forgo essential health care services. States, health care providers, and other stakeholders should communicate and engage closely with noncitizen patients and communities going forward.
The Bottom Line
As the federal government intensifies its crackdown on noncitizens, Medicaid has become a target and tool of the administration. Congress limited noncitizens’ coverage through H.R.1, and the administration has used Medicaid to limit noncitizens’ access and for immigration enforcement — drawing legal scrutiny. As this moment marks a dangerous intersection of health policy and immigration, coverage and access to care for millions are at risk.
The states protected under the order are Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Vermont and Washington.