The Associated Press obtained a set of emails and an internal report showing that Medicaid officials unsuccessfully tried to block the data transfers, citing ethical and legal concerns. Two of Health Secretary Robert F. Kennedy Jr.'s closest advisers requested that the data be sent to the Department of Homeland Security (DHS), according to information compiled from the emails.
Employees at the Centers for Medicare and Medicaid Services (CMS) had just 54 minutes on Tuesday to carry out the order. The database includes personal information of citizens in the District of Columbia, Illinois, Washington, and California, where laws allow non-citizens to enroll in Medicaid programs funded by state taxpayers.
The content management systems sent the data just as the Trump administration was ramping up its immigration enforcement efforts in Southern California. In a statement, California Governor Gavin Newsom expressed concern about how immigration agents could use this data, particularly in connection with recent operations by ICE, other agencies, and even the National Guard and Marines in cities like Los Angeles.
“We deeply value the privacy of all Californians. This potential data transfer reported by the AP is extremely concerning, and if true, potentially illegal, particularly in light of the numerous headlines highlighting potential federal misuse of personal information and federal actions to address Americans’ personal information,” Newsom’s statement said.
Andrew Nixon, a spokesman for the U.S. Department of Health and Human Services (HHS), affirmed that the disclosure of information was legitimate. He declined to clarify why the data was provided to DHS or how it would be used. “With respect to the recent data sharing between CMS and DHS, HHS acted entirely within its legal authority, and in full compliance with all applicable laws, to ensure that Medicaid benefits are reserved for individuals who are legally entitled to receive them,” the spokesperson stated.
Experts indicated that, in addition to collaborating with authorities in identifying migrants, the government could use the data to discourage them from seeking legal residency, a permanent visa, or citizenship, especially if they have ever benefited from federally funded Medicaid.
Late last month, CMS announced it was conducting a review of some Medicaid enrollees in certain states to confirm that federal funds had not been used to provide coverage to individuals with “unsatisfactory immigration status.”
In a letter from CMS to state Medicaid administrators, they indicated that this initiative was part of an executive order from the president titled "Eliminate Taxpayer Funding for Open Borders," signed on February 19.
California, Illinois, and Washington state, as part of the investigation, disclosed information about citizens enrolled in the health program in their regions, according to a June 6 memo obtained by the Associated Press from Medicaid Deputy Director Sara Vitolo. According to sources familiar with the matter, several CMS officials under Vitolo's leadership wrote the memo.
According to the memo and two sources familiar with the information states submitted to CMS, the data includes addresses, names, Social Security numbers, and claims information for beneficiaries in those states. Both sources requested anonymity because they were not authorized to disclose details about the data transmission.
CMS officials objected to the request to release the information to DHS, arguing that it violated federal laws, including the Social Security Act and the Privacy Act of 1974. “Various federal statutory and regulatory authorities do not permit CMS to share this information with entities outside of CMS,” Vitolo said, adding that the provision of personal information is only authorized for the direct management of the Medicaid program.
Vitolo, a career civil servant, told Kim Brandt, the Trump-appointed CMS deputy administrator and chief operating officer, that providing data on Medicaid applicants or participants to DHS employees would violate longstanding policy. Neither Vitolo nor Brandt could be reached for comment.
The legal arguments presented in the document failed to convince Trump appointees at HHS, which oversees Medicaid. Four days after the memo was sent, HHS officials requested that the information be forwarded to DHS by 5:30 p.m., according to an email verified by AP.
Former government officials said this action was unusual, as CMS, which holds private health data on about half the population, generally doesn't release such sensitive information to other agencies. "DHS has no role in anything related to Medicaid," said Jeffrey Grant, a former permanent employee at CMS.
Aside from her legal reasons, Vitolo mentioned that providing information to DHS could have a chilling effect on states, possibly leading them not to disclose data. According to her, it was essential for states to protect themselves from the legal risk of sharing information that could be used by immigration authorities in connection with federal officials.
Each state is required to provide emergency Medicaid services to individuals who are not naturalized in the country, as well as to those who are legal residents but have not yet completed the five years of eligibility to apply for Medicaid.
A total of seven states, plus the District of Columbia, have decided to allow undocumented immigrants to enroll in their state's Medicaid program, enjoying full benefits. These initiatives were implemented during the administration of former President Joe Biden, and the states stated that they would not submit bills to the federal government to fund these immigrants' health care. The Trump administration has raised concerns about this commitment.
"Immigrant-friendly states 'opened the floodgates for illegal immigrants to take advantage of Medicaid, and forced hardworking Americans to foot the bill,'" said HHS spokesman Nixon.
The states of New York, Colorado, Minnesota, Washington, Oregon, Illinois, and California are led by Democratic governors. Newson said earlier this year that he would cancel enrollment in the program, citing budget constraints, while Illinois said it would close the program in July with 30 non-citizens.
On the other hand, the remaining states (New York, Oregon, Minnesota, and Colorado) have not provided information to CMS in this review process, according to a public health representative who reviewed the requests from those agencies in the states. Public health representatives from Washington, the District of Columbia, and Illinois did not provide responses to requests for comment.
The statement from Newsom's office emphasized that the data breach affects all California residents, but is particularly alarming for the most vulnerable groups.
