POTENTIAL IMPLICATIONS OF THE NEW MEDICAID DATA SHARING AGREEMENT BETWEEN CMS AND ICE

The following information was released by the Henry J. Kaiser Family Foundation:

Authors: Drishti Pillai, Samantha Artiga, Alice Burns, and Jennifer Tolbert

Published: Jan 14, 2026

Introduction

The Trump Administration has taken action to share Medicaid data provided by states to the Centers for Medicare and Medicaid Services (CMS) with the Department of Homeland Security (DHS) and Immigration and Customs Enforcement (ICE) for immigration enforcement purposes. This action represents a reversal in prior policy that asserted CMS would not share such information and ICE would not use such information for immigration enforcement purposes, including assurances made to the public, applicants and enrollees, health care providers, and states that information collected to determine eligibility for health coverage programs would not be used for immigration enforcement.

This issue brief provides an overview of a new data sharing agreement for CMS to share Medicaid data with ICE and its potential implications. This sharp departure in policy to allow sharing of Medicaid enrollee data with ICE for immigration enforcement raises several key issues:

Data limitations may make it difficult for CMS to comply with a current court order to share data only for individuals who are not lawfully present for the 20 plaintiff states challenging the data sharing. Underpending litigation,CMS is prohibited from sharing certain information from the plaintiff states, including information for lawfully present individuals or citizens. If the data available to CMS are similar to the data researchers have access to, it is not possible to isolate immigrants who are not lawfully present in the dataset that will be shared with ICE.

Going forward, the sharing of Medicaid enrollee data with ICE will likely make immigrant families, including citizen children in those families, more reluctant to access health coverage and care and other programs and services. The policy exacerbates already heightened fears among immigrant families due to increased immigration enforcement activity overall. Even prior to the public notice of the new data sharing policy, the KFF/New York Times 2025 Survey of Immigrants found that about half (51%) of immigrant adults were "very concerned" or "somewhat concerned" that health officials or health care providers may share their information with ICE or U.S. Customs and Border Protection (CBP).

The data sharing raises broader questions and concerns about data privacy and protections, which may extend beyond immigrant families. Individuals enrolled in Medicaid did so under prior assurances that information would not be shared for immigration enforcement purposes. Applying new policy retroactively to people who took actions under previous policy and safeguards may broadly increase concerns about privacy and safeguards of data. Health care providers, including community health centers and hospitals, may also have growing concerns about potentially being required to share patient information.

What Medicaid data do states report to CMS?

Medicaid is jointly administered by the federal government and states, and states must share certain information with CMS for program administration. State Medicaid agencies collect and maintain personal and health information for applicants and enrollees to determine eligibility and provide care. Undocumented immigrants arenot eligiblefor Medicaid or other federally-funded coverage, but payments for emergency services may be made to hospitals on behalf of individuals who are otherwise eligible for Medicaid but for their immigration status. States include information about these payments in their reports to CMS. Somestatesprovide health coverage to some immigrants regardless of immigration status using state-only funds. However, states are not required to submit this state-only program information to CMS. States cannot require applicants to provide citizenship or immigration status for any family or household members not applying for coverage.

Under the data sharing agreement, CMS will be sharing data from the Transformed Medicaid Statistical Information System or T-MSIS with ICE, which provides robust information on Medicaid enrollees but is significantly lagged. T-MSIS data also are made available to researchers, providing insight into what data it includes. The data available to researchers are generally almost two years old (e.g., calendar year 2024 data are available in 2026) and include demographic and eligibility files with information on age, gender, race and ethnicity, Medicaid eligibility, Medicaid enrollment, and coverage through Medicaid managed care. There are also claims files that include claims for all services covered by the states, premium payments from the states to managed care plans, and records of services used by managed care enrollees. In some cases, states provide more data to the federal government than are made available to researchers such as KFF. It is likely that CMS has access to more timely data too, but it is unknown how timely those data are and the extent to which timeliness varies across the states.

In the T-MSIS data available to researchers, there are a few types of information related to immigration status, but no indicator that allows for separate identification of immigrants who are undocumented. Specifically, T-MSIS includes the following data elements:

Immigration status, which indicates whether a person is one of the following:

"A qualified alien," which is a specific subset of noncitizens with lawful immigration status, such as lawful permanent residents (LPRs or "green card" holders), who may be eligible for Medicaid and CHIP and certain other federal programs. Many must wait five years after obtaining qualified status before they may enroll in coverage.

"Lawfully present under CHIPRA 214," which includes lawfully residing pregnant people and children in states that have taken up the option to eliminate the five-year wait to enroll in coverage for eligible immigrants with qualified status and extend coverage to lawfully present pregnant people and/or children beyond those with a qualified status.

"Eligible only for payment of emergency Medicaid services," which includes individuals who would otherwise be eligible for Medicaid but for their immigration status. This group includes undocumented immigrants, noncitizen immigrants with a qualified status who are in the five-year waiting period for coverage, and lawfully present immigrants without a qualified status.

"A U.S. citizen or U.S. national."

Whether or not the enrollee's immigration status has been verified, and

The date on which the five-year waiting period for receiving Medicaid and other federally funded benefits ends.

Undocumented immigrants are included in the population that is "eligible for payment of emergency Medicaid services," but that group also includes some groups of lawfully present immigrants, and the dataset available to researchers does not separately identify these groups within that population. Additionally, because of the data lag, immigration status may have changed for some people since the data were collected.

What actions has the Trump Administration taken to share Medicaid enrollee data?

In July 2025, CMS and ICE established an Information Exchange Agreement that enables immigration enforcement officials to access the personal data of millions of Medicaid enrollees. A news organization made the agreement public in January 2026, after it was released as part of a lawsuit several states brought against the Department of Health and Human Services and DHS. Under the agreement, CMS will provide ICE, "access to the CMS Integrated Data Repository to retrieve information concerning the identify and location of aliens in the United States." The agreement indicates this information will allow ICE to, "receive information concerning the identity and location of aliens in the United States, such as address, telephone number, banking information (routing number, account type, account number), email address, internet protocol (IP) addresses and other information relevant to identifying and locating aliens in the United States."

The agreement specifies that CMS will provide direct access to the T-MSIS to a select set of ICE employees for renewable two-month periods, and that ICE employees will access the T-MSIS to receive information concerning the identification and location of aliens in the U.S. It identifies Medicaid recipients' name, address, Medicaid identification number, social security number, date of birth, sex, phone number, locality, ethnicity and race as the data elements to be shared. The agreement does not specify whether ICE access to Medicaid data is limited to a certain subset of Medicaid enrollees, such as noncitizens. As such, the agreement could provide ICE employees access to these data for all Medicaid enrollees, regardless of their immigration status. Also, the stated purpose of the access is to identify and locate aliens in the United States, not specifically those who are undocumented.

This action represents a reversal in prior policy that asserted CMS would not share and ICE would not use health coverage eligibility information for immigration enforcement purposes. Under this prior policy, ICE, CMS, and states made assurances to the public, applicants and enrollees, and health care providers that information collected to determine eligibility for and administer health coverage programs, including Medicaid and the Affordable Care Act (ACA) Marketplace, would not be used for immigration enforcement. CMS previously stated on its website that the information regarding individuals that it collects will only be used for administration of its programs: "To protect your privacy, we'll tell you before we collect any personal information we need to run our health care programs and only use it for that purpose." CMS also previously stated on its website that it will not use immigration status for immigration enforcement purposes: "We won't use any immigration status you share with us for immigration enforcement purposes."

A preliminary injunction temporarily halted the Trump Administration's actions to share Medicaid enrollee data with ICE in some states. In June 2025, there were reports that the Trump administration shared the personal and health data of millions of noncitizen Medicaid enrollees living in California, Illinois, Washington, and D.C. with immigration enforcement officials. Following court challenges, a preliminary injunction temporarily blocked the data sharing in the 20 plaintiff states challenging the data sharing in August 2025. The court found that while "there does not appear to be anything categorically unlawful about DHS obtaining data from agencies like HHS for immigration enforcement, that the data sharing was implemented without a "reasoned decision making process" and likely violated the Administrative Procedures Act (APA). The injunction did not govern data sharing in other states that are not involved in the lawsuit.

On November 25, 2025, CMS issued a notice outlining its plans to begin sharing Medicaid data it receives from states with DHS and ICE once the preliminary injunction is lifted. The notice specifies that ICE, "contemplates requesting from CMS available biographical, contact, and location information, though ICE reserved the right, in a specific case, to consider requesting other information on a case-by-case basis as permitted by law." CMS indicates that the notice makes the public aware that it intends to disclose certain information to DHS and that it will update relevant websites to reflect its authority to share information with DHS. CMS asserts that the policy change is exempt from a notice and comment period because it is a policy statement outlining actions that are consistent with federal law. ICE also issued a policy memorandum to rescind its previous policy of not using health coverage eligibility information to pursue immigration enforcement action.

In December 2025, the court updated its ruling, allowing CMS to share a subset of information it intends to share as outlined in the CMS notice. Under the injunction, CMS may only share information with DHS and ICE that is associated with the Medicaid program (not any other health programs); pertains only to individuals who are not lawfully present in the U.S.; and is limited to citizenship and immigration status, address, phone number, date of birth, and Medicaid ID. It prohibits the sharing of any additional information, such as health information, or information related to lawfully present individuals or citizens and precludes sharing additional information that may be requested on a case-by-case basis. It also specifies that, "to the extent that such basic biographical, contact, or location information about unlawfully present aliens is not severable from other information that DHS and ICE are not entitled to obtain (e.g., information about lawful permanent residents or citizens, sensitive health records), HHS or CMS may not share it."The injunction only applies in the 20 plaintiff states involved in the lawsuit, meaning the data sharing can proceed as outlined in the agreement and notice in other states.

Issues to Consider

Courts will ultimately determine the legality of the data sharing policy within the context of existing data privacy and protection laws. Beyond that determination, there are also issues to consider regarding how the data sharing policy can be operationalized in ways consistent with what the courts have allowed so far and broader implications for families, health care providers, and states.

Data limitations may make it difficult for CMS to comply with the current court order to share data only for individuals who are not lawfully present for the 20 states challenging the data sharing agreement. If the T-MSIS data available to CMS are similar to the data researchers have access to, it is not possible to isolate immigrants who are not lawfully present. Existing T-MSIS data elements identify individuals eligible only for payment of emergency Medicaid services. However, any data shared with ICE using that identifier will include people who are lawfully present (those subject to the five-year waiting period and those who do not have qualified status) as well as individuals who are not lawfully present. The data may also include some individuals who may not have been lawfully present at the time their information was entered into the system, but who have since transitioned to lawfully present status. In the future, the 2025 reconciliation law's restrictions on Medicaid eligibility for certain lawfully present immigrants (including refugees and asylees among others), which begin in October 2026, will mean that the share of lawfully present immigrants identified as eligible only for payment of emergency Medicaid services will increase.

Going forward, the sharing of health coverage data with ICE will likely make immigrant families, including citizen children in those families, more reluctant to access health coverage and care as well as other programs and services. The policy exacerbates already heightened fears among immigrant families due to increased immigration enforcement activity overall as well as other restrictive immigration policies, including changes in public charge policy and the recission of protections from immigration enforcement in sensitive locations such as health care facilities. Prior to the CMS notice of plans to share data, the KFF/New York Times 2025 Survey of Immigrants found that about half (51%) of immigrant adults were "very concerned" or "somewhat concerned" that health officials or health care providers may share their information with ICE or CBP (Figure 1). These fears may contribute to individuals delaying or avoiding medical care. About one in seven (14%) immigrant adults, including 48% who are likely undocumented and 20% who are parents, say that they or a family member have avoided seeking medical care since January 2025 due to immigration-related concerns.

The new data sharing policy may increase questions and concerns about data privacy and protections, not only for immigrants but for the public more broadly. People already enrolled in Medicaid did so under prior assurances that information would not be shared for immigration enforcement purposes. Applying new policy retroactively to people who took actions under previous policy and safeguards may broadly increase concerns about privacy and safeguards of data. Health care providers, including community health centers and hospitals, may also have growing concerns about potentially being required to share patient information. Additionally, the policy raises questions about what other data could be shared in the future. This policy represents one piece of broader Trump Administration actions to share data for immigration enforcement. While being challenged in courts, the Trump administration has directed theInternal Revenue Serviceto share personal information of individuals for immigration enforcement purposes. The Transportation Security Administration is sharing the names of passengers with ICE to seek out and expel people under deportation orders, although ICE previouslyhad avoidedinterfering with domestic travel. It is unknown whether the Trump Administration might share additional information from other programs in the future for immigration enforcement; or whether future data sharing will extend to other purposes beyond immigration enforcement.