Federal Data Breach Exposes Millions of Medicaid Records
Immigration and Customs Enforcement (ICE), according to court filings in a lawsuit led by a coalition of Democratic attorneys general. This data, which included personal details of both citizens and noncitizens, was subsequently shared by ICE with the data analytics firm Palantir, raising significant concerns regarding healthcare privacy and the security of government-held information.
Injunction Violated by Unauthorized Transfers
The controversy centers on a data-sharing agreement between the Centers for Medicare and Medicaid Services (CMS) and ICE. In January, CMS improperly transferred a dataset containing the records of millions of people to ICE, despite a court-ordered injunction. U.S. District Judge Vince Chhabria had previously ruled in December that federal health officials could share only specific, limited details—such as home addresses and immigration status—regarding individuals without lawful status from the states involved in the litigation.
According to court filings, the January transfer included information on individuals who were in the country legally, as well as some U.S. citizens. While Judge Chhabria ordered a temporary pause on data sharing in late May after federal officials admitted to the unauthorized transfers, the Department of Justice recently disclosed that CMS inadvertently reshared the same problematic dataset with ICE while attempting to process data from states not included in the lawsuit.
Palantir Integration and Purging Failures
ICE utilizes a software application called ELITE, developed by Palantir, to identify the addresses of noncitizens who may be subject to deportation. Court filings reveal that the improperly shared Medicaid data was transferred to Palantir via a Microsoft Teams chat.
Alberto Briseno, a section chief for ICE’s Homeland Security Investigations, stated in a court declaration that the agency deleted the files once the errors were identified and confirmed the data was not used for law enforcement purposes. However, the internal search process proved difficult. Briseno noted that a secondary search conducted by the agency discovered that half a dozen users still possessed copies of the January 7 dataset after the initial deletion attempt. He acknowledged the “technological difficulties” inherent in ensuring every variation of the file has been located and purged.
Legal Scrutiny of Federal Oversight
The ongoing litigation, brought by more than 20 Democratic attorneys general, challenges the federal government’s handling of protected health information. The plaintiffs argue that the repeated violations demonstrate a systemic inability to secure sensitive records. In their recent motion, the attorneys general stated, “ICE’s inability to identify Medicaid records in its possession undercuts any claim that the agency should be entitled to more access to that data.”
August Hearing to Determine Data Access
The Department of Justice is currently petitioning Judge Chhabria to expand the scope of data sharing, seeking access to information on a broader category of noncitizens, including those who are not legal permanent residents. Judge Chhabria has scheduled a hearing for August to address the ambiguity surrounding which categories of data may be lawfully shared and to evaluate the government’s compliance with privacy mandates. During an April 30 hearing, the judge warned that if the federal government could not maintain the necessary level of care in handling these records, it would be barred from using Medicaid data for immigration enforcement purposes entirely.
Related reading