Protect Democracy files amicus brief challenging HHS’s disclosure of personal heath data to DHS

Alongside the Electronic Privacy Information Center (EPIC) and the Electronic Frontier Foundation (EFF), Protect Democracy has filed an amicus brief in California v. U.S. HHS. This lawsuit, brought by a multistate coalition, challenges the Department of Health and Human Services (HHS)’s illegal disclosure of sensitive personal health data to the Department of Homeland Security (DHS) under the Trump administration.

When individuals enroll in Medicaid, they entrust the government with their personal and health data, expecting this information to remain confidential and be used only in service of the Medicaid program and public health. This data includes some of the most sensitive information collected on individuals in the United States, including their health claims, demographic data, home addresses, and even medical diagnosis and treatment details. It was exactly these types of data that inspired the data privacy and security protections mandated by federal laws, including the Social Security Act, Privacy Act, Health Insurance Portability and Accountability Act (HIPAA), and Federal Information Security Modernization Act (FISMA). 

On June 13, 2025, public reporting revealed that HHS had transferred en masse to DHS the Medicaid personal and health records of millions of people from four states  – in spite of objections from career staff who warned the transfer likely violated federal law. HHS’s wholesale data sharing is unprecedented in the history of the Medicaid program.

HHS’s actions are the latest in a growing number of examples of the widescale effort by the Trump administration to collect and aggregate the sensitive data of people across the country. Other examples include federal agencies laying claim to sensitive state-held data related to social benefit programs like the Supplemental Nutrition Assistance Program. In addition, the administration reportedly has moved to combine troves of sensitive data across federal agencies, including the Social Security Administration, Internal Revenue Service, and HHS. While the Trump administration has attempted to justify this activity under the vague and unsubstantiated claim of fraud detection, its unrelenting pursuit of “unfettered access” to sensitive information implicates and should concern every American.

With this backdrop, Protect Democracy, EPIC, and EFF in the amicus highlight the broader public interests that are at stake and have already been harmed by HHS’s data-sharing. The case raises critical issues that go to the core of longstanding federal privacy law – information collected on individuals by the government can be deployed only for uses compatible with the purpose for which it was collected that have been subject to meaningful public notice and comment.

In light of HHS’s failure to make any effort to comply with longstanding privacy procedures and protections, the amicus highlights how the resulting harms are all too real and not limited to Medicaid recipients. As the brief explains: 

“First, in violating the reasonable expectation of privacy of Medicaid recipients and sharing private data with DHS, eligible beneficiaries may fear detention by DHS if they appear at a medical facility. This could lead many to avoid seeking essential and/or emergency medical care, including publicly funded prenatal, labor and delivery, and other emergency health care. Further public health consequences could follow from any such deterrent effect, including increased public cost to care for children born after insufficient prenatal care, elevated communicable disease risk, and expanded public health capabilities. Second, organizations like amici and the broader public have a statutory right to understand and express their point of view on how their personal data is used.”

Protect Democracy, EPIC, and EFF, therefore, urge the court to grant the immediate relief sought by the filing states in the form of a preliminary injunction. Such a ruling would acknowledge the harm HHS’s transfer of four states’ Medicaid data has already done, and prevent its further spread to other states’ highly sensitive data.