Attorney General Dan Rayfield and a multistate coalition today filed a lawsuit challenging the U.S. Department of Health and Human Services’ (HHS) decision to provide unfettered access to individual personal health data to the Department of Homeland Security (DHS), which houses Immigration and Customs Enforcement (ICE) and other federal agencies. In the seven decades since Congress enacted the Medicaid Act to provide medical assistance to vulnerable populations, federal law, policy, and practice has been clear: the personal healthcare data collected about beneficiaries of the program is confidential, to be shared only in certain narrow circumstances that benefit public health and the integrity of the Medicaid program itself.
In today’s lawsuit filed in the U.S. District Court for the Northern District of California, the attorneys general argue that mass transfer of this data violates the law and ask the court to block any new transfer or use of this data for immigration enforcement purposes.
“This has a chilling impact on people who need healthcare in our country,” Rayfield said. “Parents may choose not to take their kids to the doctor because they’re afraid of what may happen. We need to protect the privacy and dignity of every person who calls Oregon home.”
Created in 1965, Medicaid is an essential source of health insurance for lower-income individuals and particular underserved population groups, including children, pregnant women, individuals with disabilities, and seniors. The Medicaid program allows each participating state to develop and administer its own unique health plans; states must meet threshold federal statutory criteria, but they can tailor their plans’ eligibility standards and coverage options to residents’ needs. As of January 2025, 78.4 million people were enrolled in Medicaid and the Children’s Health Insurance Program (CHIP) nationwide.
OHA operates the Oregon Health Plan (OHP), Oregon’s Medicaid program regulated by the U.S. Department of Health and Human Services. This program is jointly funded by both state and federal dollars, though at different rates. Oregon has also elected to use state-only funds to extend OHP coverage to all state residents who meet income and other criteria regardless of their immigration status.
A certain amount of personal data is routinely exchanged between the states and the federal government for purposes of administering Medicaid, including verifying eligibility for federal funding. Historically, DHS has acknowledged that the Medicaid Act and other federal healthcare authorities foreclose the use of Medicaid personal information for immigration enforcement purposes. Yet now, the federal government appears to have — without formal acknowledgment — adopted a new policy that allows for the wholesale disclosure and use of state residents’ personal Medicaid data for purposes unrelated to Medicaid program administration.
On June 13, 2025, states learned through news reports that HHS has transferred en masse their state’s Medicaid data files, containing personal health records representing millions of individuals, to DHS. Reports indicate that the federal government plans to create a sweeping database for “mass deportations” and other large-scale immigration enforcement purposes.
In today’s lawsuit, the coalition highlights that the Trump Administration’s illegal actions are creating fear and confusion that will lead noncitizens and their family members to disenroll, or refuse to enroll, in emergency Medicaid for which they are otherwise eligible, leaving states and their safety net hospitals to foot the bill for federally mandated emergency healthcare services. These individuals may not get the emergency health services they need and will suffer negative health consequences — and even death — as a result.
In filing the lawsuit, Attorney General Rayfield joins the attorneys general of California, Arizona, Colorado, Connecticut, Delaware, Maine, Maryland, Massachusetts, Michigan, Minnesota, New Jersey, New York, Rhode Island, and Washington.
