On August 12, a federal court issued a preliminary injunction blocking the Department of Health & Human Services (HHS) and Department of Homeland Security (DHS) from using Medicaid data for immigration enforcement in 20 states.1
Earlier this year, news reports indicated that the Centers for Medicare & Medicaid Services (CMS) had shared the personal data of people who received Medicaid-covered services with DHS' Immigration and Customs Enforcement (ICE) in order to aid immigration enforcement. The two agencies eventually entered into a formal data-sharing arrangement. While undocumented individuals are not eligible for Medicaid, states receive federal Medicaid funding for emergency services regardless of immigration status, giving states and CMS important information about patients who are noncitizens. Following the data disclosure, nearly two dozen states sued HHS and DHS in federal court, arguing the agencies violated federal privacy laws, as well as the Administrative Procedure Act (APA).
The court's preliminary injunction prohibits DHS from using the Medicaid data it obtained from the plaintiff states and HHS from sharing new data with DHS for immigration enforcement purposes. Calling the Administration's data sharing policy a "bolt-from-the-blue reversal," the court agreed that the government had failed to undertake a reasoned decision-making process and likely acted arbitrarily and capriciously in violation of the APA. As the court noted, CMS' disclosure broke from decades of federal precedent, with HHS and DHS publicly indicating for years (and continuing to indicate) that Medicaid data will only be used for health coverage purposes. The order remains in place until 14 days after DHS and HHS have completed a "reasoned decisionmaking process" regarding the data sharing policy or until the litigation ends (whichever comes sooner).
The court left open the question of whether the Medicaid data disclosure violated federal privacy laws, though it suggested DHS may be able to obtain data from HHS subject to certain limitations. While the preliminary injunction is a key victory for states seeking to protect Medicaid enrollees' data, it is possible DHS and CMS may be able to establish a data-sharing policy in the future, depending on how the litigation unfolds.
Footnote
1.The plaintiff states protected under the order are Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Vermont, and Washington.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
