When people share information with a health care program, they very reasonably expect their personal information will be used for their health care, and otherwise kept private. However, recent moves by the Department of Health and Human Services (HHS) in Medicaid threaten to violate this trust – and quite possibly a judicial order – to help U.S. Immigration and Customs Enforcement (ICE) track immigrants, including people who are lawfully present.
Let’s start with the background here. Last summer, HHS (through CMS, its Center for Medicare and Medicaid Services) entered into a formal agreement to share Medicaid data with ICE. California, eventually joined by 21 other states, filed a lawsuit challenging the data sharing arrangement. In August, the judge in the case granted a preliminary injunction to block data sharing in the 22 plaintiff states. The data sharing is legally suspect because it appears to violate several privacy laws and HHS provided insufficient reasoning for taking such disruptive action. However, after HHS and ICE provided the judge with more justifications, the judge issued a narrower preliminary injunction which allows HHS to begin sharing data even in the 22 states—subject to at least three critical limitations. The judge’s decision to allow data sharing after these justifications is surprising, considering that the justifications are weak and the federal government still hasn’t reasonably analyzed the damage its policy will cause, as the Administrative Procedure Act (APA) requires. The judge obliquely acknowledged this, saying the government’s explanations are “hardly masterpieces,” but he ultimately applied a “highly deferential standard” and allowed some data sharing because the government at least provided an explanation. Under the Administrative Procedure Act, however, the government must do more than write pretextual words on paper—the judge should have required it be a reasonable explanation.
Turning to the three key limitations on permissible data sharing, first, the judge’s order limits HHS’s data sharing to Medicaid—so it does not authorize sharing data for any other programs, such as the Children’s Health Insurance Program (CHIP). Second, HHS can only share six specific pieces of information with ICE: citizenship, immigration status, address, phone number, date of birth, and Medicaid identification number. While this does not include many types of sensitive medical information, the inclusion of addresses is of highest interest to ICE and of gravest concern to individuals.
Third, and most importantly as it turns out, the judge’s order prohibits HHS from sharing with ICE the data of anyone who is lawfully present. Why is this so significant? As we have covered previously, undocumented immigrants are not eligible for full Medicaid coverage. The only available Medicaid coverage related to their care is Emergency Medicaid, a program which reimburses emergency care providers (typically hospitals through their emergency rooms) for emergency services provided to immigrants who would otherwise qualify for full Medicaid but for their immigration status. (Hospitals are required to provide such emergency care under the Emergency Medical Treatment & Labor Act, known as EMTALA.) However, the list of immigrants that do not qualify for full scope Medicaid is a long one, including for example, people with student visas, people in temporary protected status, permanent residents in a waiting period, and many other individuals who are lawfully present and need emergency services covered by Emergency Medicaid. And because disclosure of immigration status is not required for Emergency Medicaid (nor is it included in the file HHS receives), HHS cannot generally identify which individuals that have received Emergency Medicaid are lawfully present and which are undocumented. And remember, under the judge’s order, HHS can’t share the information of lawfully present individuals.
So ultimately, the Medicaid files themselves do not provide HHS with a sufficient basis to legally share Medicaid data with ICE in the plaintiff states. There is some concern, however, that in its rush to empower ICE, HHS might begin (or has begun) sharing such data in violation of the court’s order. This is a developing issue that we will continue to monitor.
In the meantime, here are four critical considerations to protect the rights of Medicaid enrollees at risk of being harmed by illicit data sharing:
First, families should be reminded that only the immigration status of the applicant for Medicaid is relevant to an application. For example, if a parent is applying for benefits only for a child, the parent’s immigration status is irrelevant and not needed for the application. States, providers, community partners, etc., should all work to educate parents (and other family members) that the immigration status of non-applicants need not be disclosed.
Second, because Emergency Medicaid is precisely for reimbursing hospitals for furnishing emergency services to individuals who do not meet Medicaid’s strict immigration status requirements, disclosure of immigration status is not relevant or necessary for an Emergency Medicaid application. Again, the public should be educated that they don’t need to disclose their immigration status for an Emergency Medicaid application. In fact, if an individual is in a non-qualified status (student visa, green card waiting period, undocumented, etc.) they never need to disclose their status for Medicaid purposes. Finally, individuals should understand that they can decline to apply for Emergency Medicaid if they have concern (but that may leave them with large debts for uncompensated care provided by the hospitals).
Third, hospitals should review their policies to ensure that their staff do not include immigration status details in Emergency Medicaid applications. Considering that HHS may be sharing files in unpredictable ways, hospitals should not include any type of unnecessary information in Medicaid applications. Hospitals could also consider whether in some cases they should pursue other sources of reimbursement for Emergency Medicaid covered services, such as charity care dollars that may be available.
Finally, states should also ensure that their files—which will be transferred to HHS—do not inadvertently include extraneous personal information, such as immigration status for an Emergency Medicaid file. This may be especially true for states that have state programs for immigrants that they may integrate into shared computer systems with federally funded Medicaid.
Ultimately, HHS sharing Medicaid files with ICE is problematic for two basic reasons. Without more information, broad file sharing by HHS is in direct violation of a judge’s order. More importantly, it’s also horrendous health policy. The data sharing will scare a large group of people from accessing health care—including the U.S. citizen children of immigrants and many lawfully present immigrants. And about half of Emergency Medicaid spending goes towards labor and delivery services. Do we really want pregnant women, giving birth to U.S. citizens babies, avoiding the emergency room and health care when they have a pregnancy complication or go into labor?