An internal memo and emails obtained by The Associated Press show that Medicaid officials unsuccessfully sought to block the data transfer, citing legal and ethical concerns.

Nevertheless, two top advisers to Health Secretary Robert F. Kennedy Jr.ordered the dataset handed over to the Department of Homeland Security, the emails show. Officials at the Centers for Medicare and Medicaid Services were given just 54 minutes on Tuesday to comply with the directive.

The dataset includes the information of people living in California, Illinois, Washington state and Washington, D.C., all of which allow non-U. S. citizens to enroll in Medicaid programs that pay for their expenses using only state taxpayer dollars. CMS transferred the information just as the Trump administration was ramping up its enforcement efforts in Southern California.

Besides helping authorities locate migrants, experts said, the government could also use the information to scuttle the hopes of migrants seeking green cards, permanent residency or citizenship if they had ever obtained Medicaid benefits funded by the federal government.

California Gov. Gavin Newsom ’s office said in a statement that it was concerned about how deportation officials might utilize the data, especially as federal authorities conduct immigration raids with the assistance of National Guard troops and Marines in Los Angeles.

“We deeply value the privacy of all Californians,” the statement said. “This potential data transfer brought to our attention by the AP is extremely concerning, and if true, potentially unlawful, particularly given numerous headlines highlighting potential improper federal use of personal information and federal actions to target the personal information of Americans.”

Some California lawmakers on Friday also expressed alarm. U.S. Rep. Laura Friedman, a Democrat, wrote on X that “we should never use a person’s need to go to the doctor against them. This will only lead to more chaos and pain in our communities.”

U.S. Health and Human Services spokesperson Andrew Nixon said the data sharing was legal. He declined to answer questions about why the data was shared with DHS and how it would be used.

“With respect to the recent data sharing between CMS and DHS, HHS acted entirely within its legal authority — and in full compliance with all applicable laws — to ensure that Medicaid benefits are reserved for individuals who are lawfully entitled to receive them,” Nixon said.

An official with DHS, Assistant Secretary Tricia McLaughlin, said in a statement that Trump “promised to protect Medicaid for eligible beneficiaries. To keep that promise after Joe Biden flooded our country with tens of millions of illegal aliens CMS and DHS are exploring an initiative to ensure that illegal aliens are not receiving Medicaid benefits that are meant for law-abiding Americans.”

The initiative appears to be part of a broader effort by the Trump administration to provide DHS with more data on migrants. In May, for example, a federal judge refused to block the Internal Revenue Service from sharing immigrants’ tax data with Immigration and Customs Enforcement to help agents locate and detain people living without legal status in the U.S.

A targeted review of millions of immigrant Medicaid enrollees

CMS announced late last month that it was reviewing some state’s Medicaid enrollees to ensure federal funds have not been used to pay for coverage for people with “unsatisfactory immigration status.” In a letter sent to state Medicaid officials, CMS said that the effort was part of Trump’s Feb. 19 executive order titled “Ending Taxpayer Subsidization of Open Borders.”

As part of the review, California, Washington and Illinois shared details about non-U. S. citizens who have enrolled in their state’s Medicaid program, according to a June 6 memo signed by Medicaid Deputy Director Sara Vitolo that was obtained by the AP. The memo was written by several CMS officials under Vitolo’s supervision, according to sources familiar with the process.

The data includes addresses, names, social security numbers and claims data for enrollees in those states, according to the memo and two people familiar with what the states sent to CMS and what was shared with DHS. Both individuals spoke on the condition of anonymity because they were not authorized to share details about the data exchange.

CMS officials attempted to fight the data sharing request from Homeland Security, saying that to do so would violate federal laws, including the Social Security Act and the Privacy Act of 1974, according to Vitolo’s memo.

“Multiple federal statutory and regulatory authorities do not permit CMS to share this information with entities outside of CMS,” Vitolo wrote, further explaining that the sharing of such personal data is only allowed for directly administering the Medicaid program.

Sharing information about Medicaid applicants or enrollees with DHS officials would violate a “long-standing policy,” wrote Vitolo, a career employee, to Trump appointee Kim Brandt, deputy administrator and chief operating officer of CMS.

Vitolo and Brandt could not be reached for comment.

The legal arguments outlined in the memo were not persuasive to Trump appointees at HHS, which oversees the Medicaid agency.

Four days after the memo was sent, on June 10, HHS officials directed the transfer of “the data to DHS by 5:30 ET today,” according to email exchanges obtained by AP.

Former government officials said the move was unusual because CMS, which has access to personal health data for nearly half the country, does not typically share such sensitive information with other departments.

“DHS has no role in anything related to Medicaid,” said Jeffrey Grant, a former career employee at CMS.

Beyond her legal arguments, Vitolo said sharing the information with DHS could have a chilling effect on states, perhaps prompting them to withhold information. States, she added needed to guard against the “legal risk” they were taking by giving federal officials data that could be shared with deportation officials.

A ‘concerning’ development

All states must legally provide emergency Medicaid services to non-U. S. citizens, including to those who are lawfully present but have not yet met a five-year wait to apply for Medicaid.

Seven states, along with the District, allow immigrants who are not living legally in the country to enroll — with full benefits — in their state’s Medicaid program. The states launched these programs during the Biden administration and said they would not bill the federal government to cover those immigrants’ health care costs.

The Trump administration has raised doubts about that pledge.

Nixon, the HHS spokesperson, said that the state’s Medicaid programs for immigrants “opened the floodgates for illegal immigrants to exploit Medicaid — and forced hardworking Americans to foot the bill.”

All of the states — California, New York, Washington, Oregon, Illinois, Minnesota and Colorado — have Democratic governors. Due to his state’s budget woes, Newsom announced earlier this year he would freeze enrollment into the program; Illinois will also shut down its program for roughly 30,000 non-U. S. citizens in July.

The remaining states — New York, Oregon, Minnesota and Colorado — have not yet submitted the identifiable data to CMS as part of the review, according to a public health official who has reviewed CMS’ requests to the states.

Illinois health officials also said they were “deeply concerned” by the AP’s findings that revealed their state’s Medicaid customer information was shared with federal agencies outside of CMS, given that their “understanding (is) that the data is protected under the federal Privacy Act of 1974 and other federal regulations — which protects the rights of Americans’ sensitive health and personal data.”

In a statement issued after publication of AP’s story, California’s Newsom said the decision to share the data “will jeopardize the safety, health, and security of those who will undoubtedly be targeted by this abuse.”

State health officials from the District and Washington did not respond to requests for comment.