Millions of Medicaid Enrollees' Data Illegally Shared with Palantir via ICE

A July 16 court filing by more than 20 Democratic attorneys general has revealed that U.S. Immigration and Customs Enforcement (ICE) shared improperly obtained Medicaid data with data analytics firm Palantir Technologies. The disclosure marks a significant escalation in an ongoing legal battle over government data-sharing practices, raising new questions about privacy, legal oversight, and the role of private contractors in law enforcement surveillance. According to the motion, in January 2026, the Centers for Medicare and Medicaid Services (CMS) transferred datasets containing personally identifiable information—including home addresses, dates of birth, and immigration status—of millions of individuals to ICE. This transfer violated the scope of a December 2025 order by U.S. District Judge Vince Chhabria, which had permitted only the limited sharing of data on immigrants without lawful status from the plaintiff states. Among the improperly shared records were those of refugees in Minnesota, including U.S. citizens, and another dataset transferred on January 7 affecting millions. Judge Chhabria had temporarily halted the data flow in late May after CMS admitted the overbroad disclosure and ordered ICE to delete the improperly obtained information. The new filing reveals that ICE, instead of fully purging the data, had integrated it into Palantir’s ELITE application—a tool used by ICE agents to identify addresses of noncitizens potentially subject to deportation. Palantir responded that the dataset in question has since been purged, but the admission that a private contractor gained access to sensitive health-related data without proper legal authorization injects a new dimension of risk. This development unfolds in the context of a broader lawsuit challenging the legality of a Trump administration-era agreement between CMS and ICE to use Medicaid data for immigration enforcement, a practice that critics say undermines the healthcare system's trust and violates constitutional protections. The legal implications are multifaceted. The data transfer exceeds the December court order, potentially placing ICE and CMS in contempt. Moreover, the subsequent sharing with Palantir may constitute a violation of the Privacy Act, the Health Insurance Portability and Accountability Act (HIPAA), and Fourth Amendment protections against unreasonable searches. For millions of individuals—citizens and lawful residents included—their medical enrollment data, which they provided in confidence to a health program, was weaponized for deportation targeting without their knowledge or consent. The involvement of Palantir, a company with deep federal contracts and a history of supplying analytics for immigration enforcement, highlights the accountability gap when sensitive government data flows into private hands. From a market and security perspective, the incident underscores the vulnerability of large-scale government data systems to misuse and the cascading consequences of poor access controls. For Palantir, the admission could generate reputational damage, scrutiny over its government contract compliance, and potential legal exposure, although the company’s statement suggests it has attempted to remedy the situation. The August hearing before Judge Chhabria will be crucial in defining the permissible boundaries of data sharing and could result in a permanent injunction or further sanctions. The case may also spur legislative action to reform the legal framework allowing such disclosures, posing long-term operational impacts for companies like Palantir that sit at the intersection of data analytics and law enforcement. For the millions of affected individuals, the path to remedy is unclear, but the incident has already eroded public trust in both the healthcare system and immigration enforcement oversight. As the legal process unfolds, the episode will likely serve as a cautionary tale about the unchecked expansion of government surveillance and the ethical responsibilities of private contractors handling sensitive personal data.