Medicaid patient data on millions of Americans was improperly shared with immigration enforcement officials in January 2026, and immigration agents then forwarded that data to the technology firm Palantir, which uses it in an app called ELITE that displays the addresses of noncitizens subject to deportation, according to court filings made public on July 17, 2026. The disclosure came in a motion filed by more than 20 Democratic attorneys general who have been suing the Trump administration over its data-sharing agreement between the Centers for Medicare and Medicaid Services and U.S. Immigration and Customs Enforcement.
The revelation adds a significant new dimension to an ongoing legal dispute: not only was CMS data shared with ICE in violation of court oversight, but ICE then shared that data with a private contractor operating a law enforcement tool, extending the chain of disclosure beyond federal agencies to a for-profit technology company.
Why This Matters
Medicaid is a public health insurance program that serves approximately 90 million Americans. Enrollment requires disclosure of sensitive personal information, including home addresses, dates of birth, income details, and in many cases health conditions. Participants in Medicaid, particularly those in mixed-immigration-status households, may have reasonably believed their health information was protected by federal privacy law and could not be used for immigration enforcement purposes.
The Health Insurance Portability and Accountability Act (HIPAA) and the Medicaid statutory framework both contain confidentiality protections for beneficiary data. The court case at the center of this story concerns whether those protections were honored and whether court-ordered restrictions on data sharing were followed.
The addition of Palantir to the disclosure chain raises its own set of questions. Palantir is a private company, and once data moves from a government agency to a private contractor's system, it is subject to a different set of legal protections and accountability mechanisms than government-held data.
What We Know So Far
According to reporting by NPR and multiple public radio affiliates that distributed the story, the sequence of events as documented in court filings is as follows:
In January 2026, CMS improperly shared a dataset containing millions of names with ICE. This was the first improper disclosure. ICE then shared that dataset with Palantir, which operates an app called ELITE used by ICE agents to display the home addresses of noncitizens subject to deportation. This was the second level of disclosure, extending the data to a private contractor.
When plaintiffs in the attorneys general lawsuit asked what was done to ensure Palantir and other contractors had purged the data, federal officials responded that the data had been shared over a Microsoft Teams chat and the shared file was deleted from the chat. A declaration filed by California deputy attorney general Anna Rich included a document showing a redacted transcript of what appears to be ICE personnel asking Palantir to delete the file.
However, according to a declaration filed by Alberto Briseno, a section chief for ICE's Homeland Security Investigations, after ICE personnel deleted the file and confirmed the deletion, a subsequent broader search found that half a dozen ICE users still had copies of the January dataset. The Department of Justice also acknowledged in a separate court filing that CMS again inadvertently reshared with ICE the same dataset during an effort to share data from states not in the lawsuit.
Palantir issued a statement to NPR saying the dataset in question had been purged.
U.S. District Judge Vince Chhabria in California had previously ruled in December 2025 that health officials could share with ICE certain details from Medicaid data about immigrants without lawful status from the states that had sued, such as home addresses, dates of birth, and related information. In an April 30, 2026 hearing, Judge Chhabria warned the federal government directly: "If the federal government cannot be sufficiently careful then it can't use the information, ok?"
Where This Affects People
The improper data sharing involved a national dataset containing "millions of names," according to court filings. The specific states whose residents' data was involved in the January improper disclosure have not been fully specified in public court filings, though the case involves plaintiff states that include California, New York, and other large Medicaid states.
Medicaid enrollees who may be most directly affected include:
- U.S. citizens enrolled in Medicaid who share an address with noncitizen family members
- Legal permanent residents enrolled in Medicaid
- Noncitizens enrolled in Medicaid under specific eligibility categories (emergency Medicaid, DACA-eligible individuals in some states, or other permitted categories)
- Anyone who enrolled in Medicaid between the program's founding and January 2026 whose data appears in the CMS database shared with ICE
The disclosure is concerning not only for the people whose data was shared with ICE but also for the broader public health implications: when immigrant and mixed-status families fear that seeking Medicaid or other government health services could expose household members to immigration enforcement, they may avoid medical care even when it is legal for them to seek it.
What Doctors and Experts Say
Public health researchers have documented what they call the "chilling effect" of immigration enforcement on health care utilization in immigrant communities: fear of government surveillance reduces vaccination rates, prenatal care visits, and emergency department utilization among people who are legally entitled to those services. The concern articulated by the attorneys general suing over this data sharing is that coupling Medicaid enrollment data with immigration enforcement tools amplifies exactly this chilling effect.
From a legal perspective, the case turns on whether the court-ordered restrictions on data sharing were followed, whether the sharing with Palantir as a private contractor exceeded what the court had permitted, and whether the multiple instances of inadvertent re-sharing represent a pattern of noncompliance sufficient to restrict further data access. Judge Chhabria has already signaled skepticism about the government's data-handling practices.
MedicalDaily is presenting the facts of this case as documented in court filings and primary reporting. The legal question of whether the data sharing was lawful or unlawful is before the court and has not yet been adjudicated.
What the Evidence Shows and What It Does Not
MedicalDaily Evidence Check
- Document type: Court filings and declarations submitted in ongoing litigation before U.S. District Judge Vince Chhabria in the Northern District of California
- Motion date: Filed by 20-plus Democratic attorneys general, made public July 17, 2026
- First improper disclosure: CMS shared a dataset containing millions of names with ICE in January 2026
- Second disclosure: ICE shared that same dataset with Palantir, which uses it in the ELITE deportation app
- Third disclosure: DOJ acknowledged CMS inadvertently reshared the dataset with ICE a second time during an effort to share data from non-plaintiff states
- Palantir response: Stated the dataset was purged
- ICE response: ICE personnel deleted the file after discovery; subsequent search found six users still had copies
- Court's prior warning: Judge Chhabria warned April 30 the government could not continue using Medicaid data if it kept improperly sharing it
- What it does not show: Whether the Medicaid data in Palantir's ELITE app was ever used to identify or locate specific individuals for deportation actions
- What readers should know: This is an ongoing legal case; final adjudication of whether data-sharing practices were lawful or violated court orders has not occurred
Who Should Pay Attention?
This story most directly affects:
- Medicaid enrollees, particularly those in mixed-immigration-status households
- Health care providers who see Medicaid patients and who counsel patients about privacy and safety
- Public health officials monitoring health care utilization trends among immigrant communities
- Legal professionals representing individuals in immigration proceedings who may want to know whether Medicaid data was used as evidence
- Policymakers evaluating the appropriate boundaries between public health data systems and law enforcement uses of that data
What You Can Do Now
- If you are enrolled in Medicaid and are concerned about data privacy, you can file a complaint with the HHS Office for Civil Rights , which enforces HIPAA and other health privacy protections. OCR complaints about data-sharing practices can trigger investigations of federal agency conduct.
- Immigrant families with concerns about Medicaid enrollment and potential immigration consequences should consult with an immigration attorney or contact a legal aid organization in their area for guidance specific to their situation.
- Anyone who wants to follow the legal case can access court documents through the federal PACER system (pacer.uscourts.gov) using the case name in the Northern District of California.
- Local health departments and community health centers in most major cities have patient navigators who can provide guidance on health care access and privacy rights for immigrant and mixed-status families.
- Advocacy organizations including the National Immigration Law Center (nilc.org) and the California Immigrant Policy Center maintain updated information on health data and immigration enforcement developments.
Cost and Access: What Patients Should Know
Medicaid enrollment itself is not at risk as a result of this disclosure. Eligible individuals remain legally entitled to enroll. However, families with immigration-related concerns about Medicaid data should know:
- HIPAA's Privacy Rule applies to Medicaid data held by state agencies and CMS, though exceptions for law enforcement exist
- State-level Medicaid programs have their own privacy rules that may offer additional protections
- Free legal consultations are available through legal aid societies, law school clinics, and nonprofit immigration legal services organizations in every major city
- The National Immigration Legal Services Center directory (immigrationadvocates.org) maintains a searchable list of accredited immigration legal services providers
What Happens Next
The case will return before Judge Chhabria, who has already warned about noncompliance and signaled that continued improper sharing would result in the government losing access to Medicaid data for immigration enforcement purposes. The attorneys general's motion filed July 17 is expected to trigger a court response, potentially including additional restrictions, sanctions, or an evidentiary hearing. MedicalDaily will report on significant court rulings or additional disclosures as they emerge.
The Bottom Line
Court filings confirm that Medicaid data on millions of Americans was improperly shared with ICE in January 2026, and that ICE then forwarded that data to Palantir's ELITE deportation app, which displays addresses of noncitizens subject to deportation. The government acknowledged a second inadvertent re-sharing. A federal judge has already warned the government that continued mishandling of Medicaid data would cost it access to that data for enforcement purposes. Medicaid enrollees in mixed-status households have legitimate reasons to monitor this ongoing case and consult with legal advocates about their rights.
