Medicaid Data on Millions Shared Improperly With ICE, Then Passed to Palantir
Officials improperly shared millions of Medicaid records with ICE, who then passed data to Palantir, raising privacy and legal concerns.
Mika Baumeister/Unsplash
Federal officials improperly shared Medicaid enrollment data for millions of Americans with Immigration and Customs Enforcement (ICE), who in turn passed the sensitive information to data analytics firm Palantir, according to court filings made public on July 17, 2026. The data breach involves Medicaid recipients across multiple states, including those in North Carolina, and has sparked a legal battle led by California and a coalition of Democratic attorneys general challenging the government’s use of personal health information for immigration enforcement.
Details of the Data Sharing and Legal Challenges
Newly released court documents filed in a federal case based in California reveal that the Centers for Medicare and Medicaid Services (CMS) improperly shared a large dataset containing millions of Medicaid and CHIP enrollees’ personal information with ICE on January 7, 2026. This dataset reportedly included personally identifiable information, such as immigration status and addresses, encompassing citizens, lawful permanent residents, and others enrolled in Medicaid programs.
ICE then shared this data with Palantir, a private company known for its data analytics software used by government agencies. According to declarations included in the filings, ICE personnel deleted the dataset after discovering the improper sharing and claimed it was not used for law enforcement purposes. Federal officials also reported that the data was shared via a Microsoft Teams chat and deleted from that platform shortly afterward.
The coalition of more than 20 Democratic attorneys general, led by California Attorney General Rob Bonta, has pushed for greater transparency and accountability regarding what data was shared, how it was used, and whether privacy laws were violated. California, Illinois, and Washington were among the states whose Medicaid data was transferred to the Department of Homeland Security (DHS) in June 2025, a precursor to the January 2026 data sharing highlighted in the recent filings.
Implications for Medicaid Recipients in North Carolina
While the lawsuit is centered in California, the Medicaid data breach has implications for millions of recipients nationwide, including those in North Carolina. The state’s Medicaid program serves hundreds of thousands of residents, including noncitizens and lawful residents who may have had their sensitive healthcare information shared without consent.
State officials in North Carolina have yet to release detailed information about the scope of local data affected or whether any residents were included in the improperly shared dataset. Advocates express concern over how such data exchanges could undermine trust in public health programs and deter vulnerable populations from seeking care.
The ongoing legal dispute emphasizes the need to protect Medicaid enrollment information tied to individuals lawfully residing in the United States, with federal court orders seeking to define what data can lawfully be shared for immigration enforcement.
Background of the Dispute and Federal Data Practices
The controversy began in 2025 when CMS and the Department of Health and Human Services (HHS) initiated reviews of Medicaid enrollment data to identify individuals with purportedly unsatisfactory immigration status. States learned in June 2025 that HHS had transferred Medicaid files to DHS, sparking immediate legal challenges.
The lawsuit alleges that the federal government’s actions violated privacy laws by transferring personal health records and immigration details without proper authorization. Media reports have long highlighted the federal government’s efforts to integrate agency records for immigration enforcement purposes, including the use of Palantir’s data platforms, such as Foundry, to build expansive government databases.
The July 2026 court filings reveal that data improperly shared with ICE was subsequently passed to Palantir, raising further questions about data security and oversight within federal immigration enforcement operations.
Next Steps in the Legal Proceedings
U.S. District Judge Vince Chhabria has scheduled further hearings for August 2026 to clarify what categories of Medicaid information may be lawfully shared for immigration enforcement and to demand a fuller accounting from the federal government regarding the data exchanges.
The coalition of states is seeking court orders to prevent further unauthorized data sharing and to ensure that Medicaid recipients’ private information is protected from misuse. ICE maintains that the data file was deleted and not operationally used, but the states remain skeptical and push for greater transparency.
For now, Medicaid recipients across North Carolina and the nation remain uncertain about the full extent of the breach and how their personal health information might have been handled outside Medicaid systems.
This case highlights ongoing tensions between immigration enforcement policies and the protection of sensitive healthcare data, underscoring the need for clear regulations and robust safeguards to protect vulnerable populations.
