Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 1 of 59

1 ROB BONTA
Attorney General of California
2 NELI PALMA
Senior Assistant Attorney General
3 KATHLEEN BOERGERS
Supervising Deputy Attorney General
4 MARIA F. BUXTON
KATHERINE MILTON
5 KEVIN G. REYES
ANNA RICH
6 Deputy Attorneys General
State Bar No. 230195
7 1515 Clay Street Suite 2000, P.O. Box 70550
Oakland, CA 94612-0550
8 Telephone: (510) 879-0296
E-mail: [email protected]
9 Attorneys for Plaintiff State of California

10 Additional Counsel Listed on Signature Page

11
IN THE UNITED STATES DISTRICT COURT
12
FOR THE NORTHERN DISTRICT OF CALIFORNIA
13

14

15 STATE OF CALIFORNIA; STATE OF Case No. _______________________

ARIZONA; STATE OF COLORADO; STATE OF
16 CONNECTICUT; STATE OF DELAWARE;
STATE OF HAWAII; STATE OF ILLINOIS;
17 STATE OF MAINE; STATE OF MARYLAND; COMPLAINT FOR
COMMONWEALTH OF MASSACHUSETTS; DECLARATORY AND
18 STATE OF MICHIGAN; STATE OF INJUNCTIVE RELIEF
MINNESOTA; STATE OF NEVADA; STATE OF
19 NEW JERSEY; STATE OF NEW MEXICO; Date:
STATE OF NEW YORK; STATE OF OREGON; Time:
20 STATE OF RHODE ISLAND; STATE OF Dept:
VERMONT; STATE OF WASHINGTON, Judge:
21 Trial Date:
Plaintiffs, Action Filed:
22
v.
23

24 U.S. DEPARTMENT OF HEALTH AND HUMAN

SERVICES; ROBERT F. KENNEDY JR., in his
25 official capacity as Secretary of Health and Human
Services; U.S. DEPARTMENT OF HOMELAND
26 SECURITY; KRISTI NOEM, in her official
capacity as Secretary of Homeland Security,
27
Defendants.
28

Complaint for Declaratory and Injunctive Relief (Case No. TBD)

 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 2 of 59

1 INTRODUCTION

2 1. In the seven decades since Congress enacted the Medicaid Act to provide medical

3 assistance to vulnerable populations, federal law, policy, and practice has been clear: personal and

4 private healthcare data collected about beneficiaries of the program is confidential, to be shared

5 only in certain narrow circumstances that benefit public health and the integrity of the Medicaid

6 program itself. This reticence makes sense. If members of our community cannot trust that the

7 government will keep their medical history and other personal data safe, they will think twice

8 about going to the doctor when needed.

9 2. In June, 2025, the federal government’s policy of keeping State Medicaid agencies’

10 healthcare records confidential abruptly changed, without notice, opportunity for public input, or

11 reasoned decision-making.

12 3. Upon information and belief, the U.S. Department of Health and Human Services

13 (HHS)’s Centers for Medicare & Medicaid Services (CMS) handed over a trove of individuals’

14 protected health data obtained from States, including California, Illinois, and Washington, to

15 other federal agencies, including the Department of Homeland Security (DHS). Millions of

16 individuals’ health information was transferred without their consent, and in violation of federal

17 law. In doing so, the Trump administration silently destroyed longstanding guardrails that

18 protected the public’s sensitive health data and restricted its use only for purposes that Congress

19 has authorized, violating federal laws including the requirements of the Administrative Procedure

20 Act (APA), 5 U.S.C. §§ 701 et seq. Meanwhile, the other Plaintiff States fear the

21 administration’s intent to improperly share their States’ sensitive data in the same way.

22 4. HHS claims it is giving this massive amount of personal data to the DHS “to ensure

23 that Medicaid benefits are reserved for individuals who are lawfully entitled to receive them,”

24 falsely implying the existence of widespread Medicaid beneficiary fraud. But Congress itself

25 extended coverage and federal funds for emergency Medicaid to all individuals residing in the

26 United States, even those who lack satisfactory immigration status. The States have and will

27 continue to verify individuals’ eligibility for federally funded Medicaid services using established

28 federal systems and cooperate with federal oversight activities to ensure that the federal
1
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 3 of 59

1 government pays only for those Medicaid services that are legally authorized. But never before

2 has this oversight required the type of unauthorized interagency data sharing that is at issue in this

3 case.

4 5. Moreover, the context in which CMS shared this data with ICE casts serious doubt on

5 the government’s explanation for its actions. It has been widely reported that the Department of

6 Government Efficiency (DOGE) has been amassing federal benefit data, such as Social Security

7 recipient information, and individuals’ tax information, to build a searchable database of

8 Americans’ information for several purposes, including to assist ICE in immigration enforcement

9 actions.

10 6. DOGE has enlisted the help of technology company Palantir to help build this

11 searchable database that combines federal agencies’ data on individuals. One former engineer at

12 the company has sounded the alarm in the press about Palantir’s project, warning that

13 “[c]ombining all that data, even with the noblest of intentions, significantly increases the risk of

14 misuse.” 1 Palantir’s product, Foundry, has already been pushed to DHS and HHS, paving the

15 way for the administration to more easily merge information collected from these different

16 agencies. 2

17 7. Plaintiffs bring this action to protect their State Medicaid programs, and to prevent

18 them from being used in service of an anti-immigrant crusade, or other purposes unrelated to

19 administration of those programs. Defendants’ illegal actions carry serious consequences. States

20 will lose federal funds as fear and confusion stemming from the disclosures cause noncitizens and

21 their family members to disenroll, or refuse to enroll, in emergency Medicaid for which they are

22 otherwise eligible, leaving States and their safety net hospitals to foot the bill for federally

23 mandated emergency healthcare services. States will also ultimately bear the negative public

24 health costs associated with reduced utilization of healthcare for childbirth and other emergency

25

26
1
Sheera Frenkel and Aaron Krolif, Trump Taps Palantir to Compile Data on Americans, New
27 York Times (May 30, 2025), https://www.nytimes.com/2025/05/30/technology/trump-palantir-
data-americans.html
28 2
Id.
2
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 4 of 59

1 conditions. Meanwhile, the public will suffer irreparable damage due to increased morbidity and

2 mortality.

3 8. The Court should issue declaratory and injunctive relief to protect State data

4 containing this highly sensitive information, and to bar the federal government from reneging on

5 the terms of the longstanding State/federal Medicaid partnership.

6 JURISDICTION AND VENUE

7 9. The Court has jurisdiction pursuant to 28 U.S.C. §§ 1331, 1346, and 2201(a).

8 10. Venue is proper in this judicial district under 28 U.S.C. § 1391(e) because the

9 California Attorney General and the State of California have offices at 455 Golden Gate Avenue,

10 San Francisco, California and at 1515 Clay Street, Oakland, California, and therefore reside in

11 this district, and no real property is involved in this action. This is a civil action in which

12 Defendants are agencies of the United States or officers of such an agency.

13 11. Assignment to the San Francisco Division of this District is proper pursuant to Civil

14 Local Rule 3-2(c)-(d) and 3-5(b) because Plaintiffs maintain offices in the District.

15 PARTIES

16 Plaintiffs

17 12. Plaintiff the State of California, by and through Attorney General Rob Bonta, brings

18 this action. The Attorney General is the chief law officer of the State of California and head of

19 the California Department of Justice. He has the authority to file civil actions to protect

20 California’s rights and interests and the resources of this State. Cal. Const., art. V, § 13; Cal.

21 Gov’t Code §§ 12510-11, 12600-12; see Pierce v. Superior Court, 1 Cal. 2d 759, 761-62 (1934)

22 (The Attorney General “has the power to file any civil action or proceeding directly involving the

23 rights and interests of the state … and the protection of public rights and interests.”).

24 13. Plaintiff the State of Arizona is a sovereign state in the United States of America.

25 Arizona is represented by Attorney General Kris Mayes, who is the chief law enforcement officer

26 of Arizona.

27

28
3
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 5 of 59

1 14. Plaintiff the State of Colorado is a sovereign state of the United States of America.

2 Colorado is represented by Attorney General Phil Weiser, who acts as the chief legal

3 representative of the state and is authorized by Colo Rev. Stat. § 24-31-101 to pursue this action.

4 15. Plaintiff the State of Connecticut is a sovereign state of the United States of America.

5 Connecticut is represented by and through its chief legal officer, Attorney General William Tong,

6 who is authorized under General Statutes § 3-125 to pursue this action on behalf of the State of

7 Connecticut.

8 16. Plaintiff State of Delaware is a sovereign state of the United States of America. This

9 action is brought on behalf of the State of Delaware by Attorney General Kathleen Jennings, the

10 “chief law officer of the State.” Darling Apartment Co. v. Springer, 22 A.2d 397, 403 (Del.

11 1941). Attorney General Jennings also brings this action on behalf of the State of Delaware

12 pursuant to her statutory authority. Del. Code Ann. tit. 29, § 2504.

13 17. Plaintiff the State of Hawai‘i, represented by and through its Attorney General Anne

14 Lopez, is a sovereign state of the United States of America. The Attorney General is Hawaii’s

15 chief legal officer and chief law enforcement officer and is authorized by Hawaii Revised Statues

16 § 28-1 to pursue this action.

17 18. Plaintiff the State of Illinois is represented in this action by the Attorney General of

18 Illinois, who is the chief legal officer of the State and is authorized to pursue this action on behalf

19 of the State under Article V, Section 15 of the Illinois Constitution and 15 ILCS 205/4.

20 19. Plaintiff the State of Maine, represented by and through its Attorney General Aaron

21 M. Frey, is a sovereign state of the United States of America. As the State’s chief law officer, the

22 Attorney General is authorized to act on behalf of the State in this matter.

23 20. Plaintiff the State of Maryland is a sovereign state of the United States of America.

24 Maryland is represented by Attorney General Anthony G. Brown who is the chief legal officer of

25 Maryland.

26 21. Plaintiff the Commonwealth of Massachusetts is a sovereign state of the United States

27 of America. Massachusetts is represented by Andrea Joy Campbell, the Attorney General of

28 Massachusetts, who is the chief law officer of Massachusetts and authorized to pursue this action.
4
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 6 of 59

1 22. Plaintiff the State of Michigan is a sovereign state of the United States of America.

2 Michigan is represented by Attorney General Dana Nessel, who is the chief law enforcement

3 officer of Michigan.

4 23. Plaintiff the State of Minnesota is a sovereign state of the United States of America.

5 Minnesota is represented by and through its chief legal officer, Minnesota Attorney General Keith

6 Ellison, who has common law and statutory authority to sue on Minnesota’s behalf.

7 24. Plaintiff the State of Nevada is a sovereign state in the United States of America.

8 Nevada is represented by Attorney General Aaron D. Ford, who is the chief law enforcement

9 officer of Nevada.

10 25. Plaintiff the State of New Jersey is a sovereign state in the United States of America.

11 New Jersey is represented by Attorney General Matthew J. Platkin, who is the chief law

12 enforcement officer of New Jersey.

13 26. Plaintiff State of New Mexico is a sovereign state in the United States of America.

14 New Mexico is represented by Attorney General Raúl Torrez, who is the chief law enforcement

15 officer of New Mexico authorized by N.M. Stat. Ann. § 8-5-2 to pursue this action.

16 27. Plaintiff the State of New York, represented by and through its Attorney General

17 Letitia James, is a sovereign State of the United States of America. As the State’s chief legal

18 officer, the Attorney General is authorized to act on behalf of the State in this matter.

19 28. Plaintiff the State of Oregon is a sovereign state of the United States of America.

20 Oregon is represented by Attorney General Dan Rayfield, who is the chief legal officer of

21 Oregon.

22 29. Plaintiff State of Rhode Island is a sovereign state in the United States of America.

23 Rhode Island is represented by Attorney General Peter F. Neronha, who is the chief law

24 enforcement officer of Rhode Island.

25 30. Plaintiff the State of Vermont is a sovereign state of the United States of America.

26 Vermont is represented by Attorney General Charity R. Clark, who is Vermont’s chief legal

27 officer and is authorized to pursue this action on behalf of the State. Vt. Stat. Ann. tit. 3, § 159.

28
5
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 7 of 59

1 31. Plaintiff State of Washington, represented by and through Attorney General Nicholas

2 W. Brown, is a sovereign state of the United States of America. The Attorney General is

3 Washington's chief law enforcement officer and is authorized under Wash. Rev. Code

4 § 43.10.030 to pursue this action.

5 Defendants

6 32. Defendant Robert F. Kennedy, Jr., is the Secretary of the U.S. Department of Health

7 and Human Services. He is sued in his official capacity.

8 33. Defendant U.S. Department of Health and Human Services is a department of the

9 executive branch of the United States government. The Centers for Medicare & Medicaid

10 Services (CMS) is an agency within HHS that is responsible for administering the Medicaid Act.

11 34. Defendant U.S. Department of Health and Human Services and Defendant Kennedy

12 shall collectively be referred to as “HHS.”

13 35. Defendant Kristi Noem is the Secretary of the U.S. Department of Homeland

14 Security. She is sued in her official capacity.

15 36. Defendant U.S. Department of Homeland Security is a department of the executive

16 branch of the United States government, responsible for enforcement of the nation’s immigration

17 laws, among other programs. Immigration and Customs Enforcement (ICE) is an agency within

18 DHS that is responsible for interior enforcement of U.S. immigration laws.

19 37. Defendant U.S. Department of Homeland Security and Defendant Noem shall

20 collectively be referred to as “DHS.”

21 LEGAL BACKGROUND

22 I. Overview of Federal Medicaid Act and Related Healthcare Laws

23 38. Created in 1965, Medicaid is an essential source of health insurance for lower-income

24 individuals and particular underserved population groups, including children, pregnant women,

25 individuals with disabilities, and seniors. See Social Security Amendments of 1965, Pub. L. No.

26 89-97, §121, 79 Stat. 286, 343-352 (codified as amended at 42 U.S.C. §1396 et seq.).

27 39. States choose whether to participate in the Medicaid program. Each participating

28 State develops and administers its own unique health plans; so long as States meet threshold
6
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 8 of 59

1 federal statutory criteria, they can tailor their plans’ eligibility standards and coverage options to

2 residents’ needs. States implement their Medicaid programs in accordance with comprehensive

3 written plans that must be reviewed and approved by the Secretary of HHS. See generally 42

4 U.S.C. § 1396a.

5 40. Medicaid is jointly funded by state and federal expenditures. The federal

6 government’s share of funds available for services provided to States for Medicaid beneficiaries,

7 known as Federal Financial Participation (FFP), is calculated according to statutory formulae, the

8 Federal Medicaid Assistance Percentage (FMAP). The Children’s Health Insurance Program

9 (CHIP) provides health coverage to children in families with incomes too high for regular

10 Medicaid but too low for private coverage; it is also jointly funded by state and federal

11 expenditures.

12 41. Eligibility for Medicaid depends in part on citizenship and immigration status.

13 Federal law divides individuals who are not United States citizens into “qualified” and “non-

14 qualified” categories for purposes of eligibility for federally funded Medicaid coverage not

15 limited to emergencies or childbirth (also known as “full-scope” Medicaid). 63 Fed. Reg. 41,658,

16 41,659 (Aug. 4, 1998) (explaining that non-qualified immigrants are excluded from non-

17 emergency, federally funded Medicaid, and other federal benefits). “Qualified immigrants”

18 currently include (1) lawful permanent residents (green card holders); (2) individuals granted

19 asylum; (3) refugees; (4) persons paroled into the United States under INA Section 212(d)(5) who

20 have been in the country for at least one year; (5) certain individuals subject to withholding of

21 removal (deportation); (6) noncitizens granted conditional entry prior to April 1, 1980; (7) certain

22 Cuban and Haitian entrants; and (8) individuals lawfully residing in the U.S. in accordance with a

23 Compact of Free Association (COFA). 8 U.S.C. § 1641(b). Certain victims of domestic violence

24 or human trafficking are also “qualified.” 8 U.S.C. § 1641(c).

25 42. Not all qualified noncitizens are eligible for federally funded benefits like Medicaid,

26 however; some (such as lawful permanent residents) must wait five years before becoming

27 eligible. 8 U.S.C. § 1613. Others, like asylees and refugees, do not need to wait five years before

28 becoming eligible for full-scope, federally funded Medicaid.

7
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 9 of 59

1 43. Non-qualified immigrants include temporary visitors, asylum seekers whose

2 applications are still pending, recipients of Deferred Action for Childhood Arrivals (DACA)

3 status, holders of Temporary Protected Status (TPS), other lawfully present individuals not listed

4 in 8 U.S.C. § 1641, as well as persons who are present in the United States without authorization

5 from DHS. 8 U.S.C. § 1641(c).

6 44. Congress has ensured that a specific set of important and urgent healthcare services

7 are available to all United States residents, including those in the “not qualified” category of

8 noncitizens. These important and urgent services include emergency medical treatment and

9 public health assistance for immunization and testing and treatment of communicable disease.

10 8 U.S.C. § 1611(b)(1)(A), (C). The federal Medicaid Act provides States with funding for

11 emergency medical treatment for serious conditions, including emergency labor and delivery.

12 42 U.S.C. § 1396b(v)(3). A separate federal law, the federal Emergency Medical Treatment and

13 Labor Act (EMTALA), requires hospitals to provide emergency medical treatment to everyone in

14 need, regardless of insurance coverage or ability to pay and regardless of citizenship or

15 immigration status. 42 U.S.C. § 1395dd.

16 45. Congress also gives States the choice to cover, with regular federal matching dollars,

17 lawfully residing children and pregnant individuals under Medicaid and CHIP during their first

18 five years in the United States. Section 214 of the Children’s Health Insurance Program

19 Reauthorization Act of 2009 (CHIPRA), Pub. L. No. 111-3, 123 Stat. 8. States also have an

20 option to cover prenatal services regardless of immigration status under the “From-Conception-

21 to-the-End-of-Pregnancy” option. See 42 C.F.R. § 457.10.

22 46. States also may use state funds to extend additional Medicaid-like benefits to a

23 broader range of immigrants. See, e.g., 8 U.S.C. § 1621(d).

24 II. Federal Laws Authorizing Data Sharing

25 a. Eligibility Verification

26 47. Personal data is routinely exchanged between the States and the federal government

27 for purposes of verifying eligibility for Medicaid. States are required to affirmatively verify the

28
8
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 10 of 59

1 immigration status of all applicants for federally funded, full-scope Medicaid. 8 U.S.C. § 1642

2 (a-b); 42 C.F.R. § 435.910(a), (e)(2).

3 48. States must have an income and eligibility verification system for the exchange of

4 information regarding federally funded benefits that meets federal requirements. 42 U.S.C.

5 § 1320b-7(a). This system must include “adequate safeguards […] so as to assure that […] the

6 information exchanged by State agencies is made available only to the extent necessary to assist

7 in the valid administrative needs of the program receiving such information” and that “the

8 information is adequately protected against unauthorized disclosure for other purposes, as

9 provided in regulations established by the Secretary of Health and Human Services.” 42 U.S.C.

10 § 1320b-7(a)(5).

11 49. Applicants without Social Security Numbers who indicate an applicable status for

12 non-emergency, full-scope Medicaid will have that information verified with DHS, through an

13 automated system that “protects the individual’s privacy to the maximum degree possible.” Id.

14 § 1320b-7(d)(3)(B). States can comply by checking applicants’ eligibility via a centralized “Data

15 Services Hub” run by CMS that provides access to the Department of Homeland Security’s

16 Systematic Alien Verification for Entitlement (SAVE). Operated by DHS, SAVE is the federal

17 government’s central repository for biographic, citizenship, and immigration status information

18 on all individuals in the United States. SAVE data indicates whether an applicant is lawfully

19 present; whether the applicant is a qualified noncitizen, or a naturalized or acquired citizen; and

20 whether waiting periods or the Children’s Health Insurance Program Reauthorization Act

21 (CHIPRA) Section 214 exemptions for qualified noncitizens apply and have been met.

22 50. Federal law exempts noncitizens applying for or receiving Medicaid for treatment of

23 an emergency medical condition from providing Social Security Numbers and/or documenting

24 their immigration or citizenship status. 42 U.S.C. § 1320b-7(f).

25 51. If a State follows the required procedures for verification of citizenship or

26 immigration status, the federal government is not allowed to take “any compliance, disallowance,

27 penalty, or other regulatory action against a State” with respect to erroneous citizenship or

28 immigration status determinations. 42 U.S.C. § 1320b-7(e).

9
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 11 of 59

1 b. Transformed Medicaid Statistical Information System

2 52. In addition to eligibility verification, the States routinely share more detailed,

3 protected health information with CMS. To obtain an enhanced FMAP, States must provide

4 “detailed individual enrollee encounter data and other information that the Secretary may find

5 necessary and including […] data elements […] that the Secretary determines to be necessary for

6 program integrity, program oversight, and administration, at such frequency as the Secretary shall

7 determine.” 42 U.S.C. § 1396b(r)(1)(F); 42 C.F.R. § 438.818.

8 53. Using its statutory authority, CMS mandates State participation in the Transformed

9 Medicaid Statistical Information System (T-MSIS), CMS’s main Medicaid dataset. See 42

10 C.F.R. §§ 433.116, 438.242, 438.604, and 438.818. States must submit data to T-MSIS on at

11 least a monthly basis. State-reported data held by CMS in T-MSIS includes Medicaid beneficiary

12 eligibility and demographic information, including unique identifiers, addresses, sex, race and

13 ethnicity, etc.; records of health claims and encounters, including beneficiaries’ diagnosis and

14 treatment information; and Medicaid provider enrollment data, including identifiers and

15 addresses. See CMS, T-MSIS Data Guide (Ver. 3.38.0),

16 https://www.medicaid.gov/tmsis/dataguide/v3/.

17 54. The purpose of T-MSIS is to provide “improved program monitoring and oversight,

18 technical assistance with states, policy implementation, and data-driven and high-quality

19 Medicaid and CHIP programs that ensure better care, access to coverage, and improved health.”

20 See CMS, Notice of a Modified System of Records, 84 Fed. Reg. 2,230-02 (Feb. 6, 2019).

21 c. Quality Reviews and Audits

22 55. The States also routinely provide CMS with Medicaid reports and data for federal

23 oversight purposes. These include (but are by no means limited to) Quarterly Expenditure

24 Reports & Data, an accounting statement of the state’s actual recorded expenditures and

25 disposition of Federal funds; and Monthly Eligibility Determination, & Enrollment Reports &

26 Data, which reflect the state’s enrollment activity for all populations receiving comprehensive

27 Medicaid and CHIP benefits, as well as state program performance data. For example, every

28 quarter, States file reports with CMS containing an estimate of their Medicaid benefit costs and
10
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 12 of 59

1 administrative expenses, and certifying the availability of state funds. The States further provide

2 responses to “such other investigation as the Secretary may find necessary” to calculate proper

3 payments to States. 42 U.S.C. § 1396b(d)(1).

4 III. Federal Laws Limiting Data Sharing and Protecting Data Security

5 a. Social Security Act and Implementing Rules

6 56. In recognition of the sensitive nature of personal data collected pursuant to the Social

7 Security Act, Congress has authorized special guardrails that limit use of this collected data for

8 purposes related to administration of Medicaid and other Social Security Act programs.

9 57. The Social Security Act provides, “[n]o disclosure ... of any file, record, report, or

10 other paper, or any information […] shall be made except as the head of the applicable agency

11 may by regulations prescribe and except as otherwise provided by Federal law.” 42 U.S.C.

12 § 1306 (a)(1) (emphasis added); see also id. § 1306(a)(2) (applying this privacy provision to both

13 HHS and the Social Security Administration). This prohibition applies to all of the Medicaid data

14 containing protected health information obtained by HHS in paragraphs 47-55 above.

15 58. HHS has not issued regulations authorizing the unfettered transfer of Medicaid data

16 containing protected health information to DHS (or other law enforcement agencies), nor does

17 federal law otherwise provide for this type of transfer from CMS to other federal agencies.

18 59. To the contrary, well-established HHS regulations prioritize confidentiality and

19 limitations on disclosures of this type of data.

20 60. Most Medicaid data can only be made available “when this can be done consistently

21 with obligations of confidentiality and administrative necessity.” 42 C.F.R. § 401.126(c).

22 61. Most Medicare information (and by extension Medicaid information, see 42 C.F.R.

23 § 401.101(a)(1) (applying this subpart to “any other information subject to” the Social Security

24 Act’s privacy mandate)) may only be released to “an officer or employee of an agency of the

25 Federal or a State government lawfully charged with the administration of a program receiving

26 grants-in-aid under title V and XIX [Medicaid] of the Social Security Act for the purpose of

27 administration of those titles[,]” or the uniformed services civilian health program. 42 C.F.R.

28 § 401.134(a) (emphasis added).

11
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 13 of 59

1 62. Disclosure for purposes of investigating program integrity concerns is permitted, but

2 again, HHS regulations impose strict limits. Medicaid data may be shared with:

3 any officer or employee of an agency of the Federal or a State government lawfully charged
4 with the duty of conducting an investigation or prosecution with respect to possible fraud or
abuse against a program receiving grants-in-aid under Medicaid, but only for the purpose of
5 conducting such an investigation or prosecution […] provided that the agency has filed an
agreement with CMS that the information will be released only to the agency’s enforcement
6 branch and that the agency will preserve the confidentiality of the information received and
will not disclose that information for other than program purposes.
7
42 C.F.R. § 401.134(c).
8
63. State Medicaid plans similarly are required by federal statute to provide “safeguards
9
which restrict the use or disclosure of information concerning applicants and recipients to
10
purposes directly connected with […] the administration of the plan[.]” 42 U.S.C.
11
§ 1396a(7)(A)(i); see also, e.g., 42 C.F.R. Chapter IV, Subchapter C, Part 431, Subpart F
12
(“Safeguarding Information on Applicants and Beneficiaries”), including §§ 435.907(e)(1)
13
(limiting state agency collection of information to only what is necessary to make eligibility
14
determinations or administer state Medicaid plan), (e)(3) (limits on state collection of SSNs,
15
including that non-applicant SSNs be voluntary and “used only to determine an applicant’s or
16
beneficiary’s eligibility for Medicaid or other insurance affordability program or for a purpose
17
directly connected to the administration of the State plan”).
18
64. State Medicaid agencies must enact their own state confidentiality protections to
19
enforce the federal regulations for safeguarding information about beneficiaries and applicants.
20
42 C.F.R. § 431.303. States must also make assurances in their Medicaid plan that they submit
21
for approval to CMS that such protections are in place.
22
65. HHS has communicated its confidentiality policy to Medicaid applicants and
23
beneficiaries. For example, CMS’s template Medicaid application expressly states to prospective
24
applicants, “We’ll keep all the information you provide private and secure as required by law.
25
We’ll use personal information only to check if you’re eligible for health coverage.” 3 States are
26

27 3
CMS Single Streamlined Application, OMB No. 0938-1191, expires: Sept. 30, 2027 (last visited
Jun. 21, 2025), https://www.medicaid.gov/state-resource-center/mac-learning-
28 collaboratives/downloads/single-streamlined-application.pdf.
12
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 14 of 59

1 required to use this, or similar language, in their state-specific materials. 42 C.F.R. § 435.907(b).

2 CMS has approved the States’ application language.

3 66. In accord with these limits, DHS policy historically has not allowed use of Medicaid

4 personal information for immigration enforcement purposes. An October 25, 2013 ICE policy

5 memorandum states:

6
ICE does not use information about such individuals or members of their household that is
7 obtained for purposes of determining eligibility for [Medicaid and other federally funded
healthcare] coverage as the basis for pursing a civil immigration enforcement action
8 against such individuals or members of their household, whether that information is
provided by a federal agency to the Department of Homeland Security for purposes of
9 verifying immigration status information or whether the information is provided to ICE by
another source.
10 This ICE policy has been publicly available on DHS’s website for years.
11

12 b. Privacy Act

13 67. Congress enacted the Privacy Act of 1974 to “provide certain safeguards for an

14 individual against an invasion of personal privacy,” by requiring governmental agencies to

15 maintain accurate records and providing individuals with more control over the gathering,

16 dissemination, and accuracy of agency information about themselves. Pub. L. No. 93-579, § 2(b),

17 88 Stat. 1896 (1974).

18 68. To accomplish this purpose, the Privacy Act sets forth conditions for disclosure of

19 private information and precludes an agency from disclosing information in its files to any person

20 or to another agency without the prior written consent of the individual to whom the information

21 pertains. See 5 U.S.C. § 552a(b).

22 69. Among these instructions, the Privacy Act requires federal agencies to follow specific

23 procedures before they “maintain, collect, use, or disseminate,” any covered information. 5

24 U.S.C. §§ 552a(a)(3), (e)–(f).

25 70. When an agency “establish[es] or revis[es]” a “system of records” containing

26 retrievable information about individuals, it must “publish in the Federal Register . . . a notice of

27 the existence and character of the system of records.” 5 U.S.C. § 552a(e)(4), (a)(5) (defining

28 “system of records”).
13
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 15 of 59

1 71. This notice, commonly referred to as a System of Records Notice (“SORN”), must

2 identify, inter alia, the name and location of the system; the categories of individuals on whom

3 records are maintained in the system; the purpose for which information about an individual is

4 collected; the policies and practices of the agency regarding storage, retrievability, access

5 controls, retention, and disposal of records; and the procedures by which individuals can request

6 notification of and access to information pertaining to them. Id. § 552a(e)(4).

7 72. Each SORN provides the public with information regarding the relevant system of

8 records, which is a necessary precondition for an individual to exercise their right to “gain

9 access” to records that are “contained in the system.” 5 U.S.C. § 552a(d)(1).

10 73. At least 30 days before publishing a SORN, the agency must also publish notice in

11 the Federal Register “of any new use or intended use of the information in the system” and

12 provide an opportunity for interested parties to submit “written data, views, or arguments to the

13 agency.” Id. § 552a(e)(11).

14 74. Thus, before an agency can establish or revise a system of records, it must provide

15 notice and an opportunity for public comment at least 30 days in advance. The Privacy Act

16 establishes a similar notice and comment requirement for the establishment or revision of a data

17 match with other federal, state, or local government entities. 5 U.S.C. § 552a(e)(12).

18 75. The Privacy Act further provides that “[n]o agency shall disclose any record which is

19 contained in a system of records ... except pursuant to a written request by, or with the prior

20 written consent of, the individual to whom the record pertains.” 5 U.S.C. § 552a(b) (1982 ed.,

21 Supp. V).

22 76. The Privacy Act also lists exceptions to the bar on disclosure.

23 77. For example, an agency may disclose the records it maintains within the agency “to

24 another agency or to an instrumentality of any governmental jurisdiction within or under the

25 control of the United States for a civil or criminal law enforcement activity if the activity is

26 authorized by law, and if the head of the agency or instrumentality has made a written request to

27 the agency which maintains the record specifying the particular portion desired and the law

28 enforcement activity for which the record is sought.” Id. § 552a(b)(7).

14
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 16 of 59

1 78. Additionally, an agency may disclose a record “for a routine use,” defined as “the use

2 of such record for a purpose which is compatible with the purpose for which it was collected.”

3 Id. §§ 552a(a)(7), (b)(3). Any “routine use” must be detailed in the relevant System of Records

4 Notice, published in the Federal Register.

5 c. Health Insurance Portability and Accountability Act (HIPAA)

6 79. The Health Insurance Portability and Accountability Act (HIPAA), is another key

7 data privacy law that governs the use and disclosure of individuals’ protected health information.

8 Pub. L. 104–191, 110 Stat. 1936; 45 C.F.R. pts. 160, 164.

9 80. Protected health information is, in part, information (including demographic

10 information) that relates to the provision of health care to an individual, as well as the past,

11 present, or future payment for health services provided to an individual. 45 C.F.R. § 160.103.

12 Covered entities may not use or disclose protected health information unless expressly permitted

13 or required, or at the individual’s consent. Id. at § 164.502.

14 81. Covered entities include health plans, health care clearinghouses, and health care

15 providers. 45 C.F.R. § 160.103. CMS is a covered entity subject to HIPAA’s requirements with

16 respect to Medicaid program administration because it pays for individuals’ health coverage

17 through Medicaid.

18 82. HIPAA does contain exceptions for certain types of disclosures, such as compliance

19 with an administrative request for which response is required by law (e.g., an administrative

20 subpoena). 45 C.F.R. § 164.512(f). However, that exception is limited to requests that are

21 sufficiently “specific and limited in scope.” Id. at § 164.512(f)(1)(ii)(C).

22 d. Federal Information Security Management Act (FISMA)

23 83. The Federal Information Security Management Act (“FISMA”) is a federal law

24 enacted under Title III of the E-Government Act of 2002. Pub. L. 107-347, 116 Stat. 2933 (Dec.

25 17, 2002).

26 84. FISMA requires each federal agency to develop, document, and implement an

27 agency-wide program to provide information security for the information and systems that

28 support the operations and assets of the agency, including those provided or managed by another
15
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 17 of 59

1 agency, contractor, or other sources. As defined in FISMA, “[t]he term ‘Federal information

2 system’ means an information system used or operated by an executive agency, by a contractor of

3 an executive agency, or by another organization on behalf of an executive agency.” 40 U.S.C. §

4 11331(g)(1).

5 85. FISMA was later amended by the Federal Information Security Modernization Act of

6 2014, Pub. L. 113-283, 128 Stat. 3073 (Dec. 18, 2014). As the CMS website devoted to FISMA

7 explains, these 2014 reforms were “passed in response to the increasing amount of cyber attacks

8 on the federal government.” CMS, Federal Information Security Modernization Act (FISMA),

9 https://security.cms.gov/learn/federal-information-security-modernization-act-fisma (last visited

10 June 25, 2025). The changes, among other things, strengthened the use of continuous monitoring

11 in systems and increased focus on the agencies for compliance and reporting that is more targeted

12 at the issues caused by security incidents. 44 U.S.C. § 3551.

13 86. In support of and reinforcing FISMA, OMB through Circular A-130, “Managing

14 Information as a Strategic Resource,” requires executive agencies within the federal government

15 to: plan for security; ensure that appropriate officials are assigned security responsibility;

16 periodically review the security controls in their systems; and authorize system processing prior

17 to operations and periodically thereafter, among other requirements. Off. of. Mgmt. & Budget,

18 Exec. Off. of the President, OMB Cir. No. A-130, Managing Information as a Strategic Response

19 (2016). This includes following standards set by the National Institute of Standards and

20 Technology (“NIST”). See CMS, Federal Information Security Modernization Act (FISMA),

21 https://security.cms.gov/learn/federal-information-security-modernization-act-fisma (last visited

22 June 25, 2025) (“While FISMA sets the legal requirement for annual compliance, the National

23 Institute of Standards and Technology (NIST) is the government body responsible for developing

24 the standards and policies that agencies use to ensure their systems, applications, and networks

25 remain secure.”).

26 87. Accordingly, under FISMA, federal agencies need to provide “information security

27 protections commensurate with the risk and magnitude of the harm resulting from unauthorized

28 access, use, disclosure, disruption, modification, or destruction of (A) information collected or

16
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 18 of 59

1 maintained by or on behalf of an agency; [and] (B) information systems used or operated by an

2 agency or a contractor of an agency or other organization on behalf of an agency.” 44 U.S.C.

3 § 3553(a)(2). In addition, “federal agencies need to ‘com[ply] with the information security

4 standards’ and guidelines, and mandatory required standards developed by NIST.” NIST, NIST

5 Risk Management Framework (updated Sept. 24, 2024), https://csrc.nist.gov/projects/risk-

6 management/fisma-background (emphasis in original).

7 88. The information security requirements established by NIST are binding on all federal

8 agencies. See NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for

9 Information Systems and Organizations, at 2 (Sept. 2020) (“The use of these controls is

10 mandatory for federal information systems.”).

11 89. NIST requires that federal agencies have, at a minimum, policies and procedures that

12 address the following information security risks:

13 a. Access control: Each agency must establish an internal control to “[d]efine

14 and document the types of accounts allowed and specifically prohibited for

15 use within the system;” “[r]equire approvals by” a designated official “for

16 requests to create accounts;” and “[m]onitor the use of accounts.” Id. at 19.

17 Each agency must ensure that “[u]sers requiring administrative privileges on

18 system accounts receive additional scrutiny by organizational personnel

19 responsible for approving such accounts and privileged access.” Id.

20 b. Information exchange: Each agency must establish an internal control to

21 “[a]pprove and manage the exchange of information between the system and

22 other systems,” whether through memoranda of understanding or

23 information exchange security agreements. Id. at 86-87. This includes any

24 “organization-to-organization communications,” such as e-mails, and

25 requires “[a]uthorizing officials [to] determine the risk associated with

26 system information exchange and the controls needed for appropriate risk

27 mitigation.” Id. at 87. Furthermore, each agency must have a process in

28 place for responding to “information spillage,” or “instances where

17
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 19 of 59

1 information is placed on systems that are not authorized to process such

2 information.” Id. at 159-60.

3 c. Insider threats: Each agency must “[i]mplement an incident handling

4 capability for incidents involving insider threats,” and must provide for

5 intra-organization coordination of insider threat response. Id. at 153-54.

6 d. Personnel sanctions: Each agency must “[e]mploy a formal sanctions

7 process for individuals failing to comply with established information

8 security and privacy policies and procedures.” Id. at 227.

9 90. CMS has implemented these requirements by establishing a set of “Acceptable Risk

10 Safeguards” (ARS) that “provides the standard to CMS and its contractors as to the minimum

11 acceptable level of required security and privacy controls.” CMS, CMS Acceptable Risk

12 Safeguards (ver. 5.1, April 22, 2022), https://security.cms.gov/policy-guidance/cms-acceptable-

13 risk-safeguards-ars. These safeguards (which can be downloaded as an Excel spreadsheet from

14 that website) set forth detailed policies for handling CMS data, including policies governing

15 information sharing and the processing of personally identifiable information (PII).

16 FACTUAL ALLEGATIONS

17 I. Background on State Medicaid Programs and Data Sharing

18 91. Plaintiffs’ Medicaid programs provide comprehensive healthcare benefits to tens of

19 millions of participants. As of January, 2025, according to CMS records, 78.4 million people

20 were enrolled in Medicaid and CHIP nationwide.

21 Arizona

22 92. The Arizona Health Care Cost Containment System (AHCCCS) is Arizona’s

23 Medicaid agency that offers healthcare programs to serve qualifying Arizona

24 residents. AHCCCS is Arizona’s largest insurer, covering more than 2 million

25 individuals. AHCCCS uses federal, state, county, and other funds to provide healthcare coverage

26 to the State’s Medicaid population.

27

28
18
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 20 of 59

1 93. Consistent with federal law, AHCCCS provides certain emergency healthcare

2 services to uninsured qualified and nonqualified immigrants through the Federal Emergency

3 Services Program.

4 94. AHCCCS uses the federal SAVE database to verify individuals' eligibility for

5 federally-funded Medicaid services.

6 95. AHCCCS also routinely responds to CMS requests related to Medicaid auditing and

7 oversight, including its supplemental review of reports required to determine the amount of FFP

8 to which the Arizona is entitled.

9 96. AHCCCS sends data to T-MSIS each month. This data contains personally

10 identifying and protected health information about all AHCCCS beneficiaries.

11 California

12 97. The California Health and Human Services Agency (CHHS) is an agency within the

13 executive branch of the State of California. CHHS, through its sub-agency, California

14 Department of Health Care Services (DHCS), administers California’s Medicaid program, known

15 as Medi-Cal.

16 98. California’s Medi-Cal program provides healthcare coverage for one out of every

17 three Californians. In California, full-scope Medi-Cal gives beneficiaries access to primary and

18 preventative care, oral healthcare, hospitalization, prescription drugs, behavioral healthcare, and

19 other vital services.

20 99. California has elected to use state-only funds to provide a version of the Medi-Cal

21 program to all eligible state residents, regardless of immigration status. Cal. Welf. & Inst. Code

22 § 14007.8(a)(2)(A). California’s Medi-Cal program provides healthcare coverage for more than

23 two million noncitizens.

24 100. DHCS has an agreement with CMS and DHS to use the federal SAVE database to

25 verify individuals’ eligibility for federally funded Medicaid.

26 101. DHCS sends data to T-MSIS each month. This data contains protected health

27 information about all Medi-Cal enrollees.

28
19
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 21 of 59

1 102. DHCS also routinely responds to CMS requests for supplemental review of reports

2 required to determine the amount of FFP to which the State is entitled, and other program audit

3 and oversight functions.

4 103. On March 18, 2025, CMS sent a letter to DHCS stating that it would be reviewing

5 claims for FFP to determine whether California “is using federal money to pay for or subsidize

6 healthcare for individuals without a satisfactory immigration status.” The letter did not cite any

7 new evidence or new concerns about improper use of federal dollars. Instead, the letter cited

8 earlier audits initiated by California itself when it informed CMS that it had erroneously claimed

9 FFP for non-emergency or non-pregnancy services to undocumented Medi-Cal enrollees, an error

10 that has been corrected and led to the return of funds back to the federal government.

11 104. On March 31, 2025, CMS sent DHCS a follow up email requesting information the

12 agency stated was necessary to confirm California was not applying federal funding unlawfully

13 for individuals with unsatisfactory immigration statuses. CMS requested claim submission and

14 enrollee data for the quarter ending on March 31, 2025, including individual enrollees’ Medicaid

15 ID, immigration status, and the period they were eligible for emergency Medicaid, as well as

16 descriptions of how DHCS operates Medi-Cal, including how emergency Medicaid services are

17 paid for, how DHCS verifies immigration status, and how DHCS defines “emergency condition.”

18 CMS required DHCS to respond by April 30, 2025. Nothing in the request indicated that CMS

19 would share this information outside HHS.

20 105. DHCS responded to CMS’s information request on April 30, 2025, and provided a

21 substantial amount of the requested information, including protected health information,

22 assuming CMS planned to use this information for routine auditing consistent with that agency’s

23 statutory authority to administer the Medicaid program.

24 Colorado

25 106. Colorado administers its state Medicaid program through the Colorado Department of

26 Health Care Policy and Financing (HCPF). HCPF is Colorado’s single-state agency responsible

27 for administering Health First Colorado, Colorado’s Medicaid Program. C.R.S. § 25.5-1-104(1).

28
20
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 22 of 59

1 HCPF’s mission is to “improve health care equity, access and outcomes for the people we serve

2 while saving Coloradans money on health care and driving value for Colorado.”

3 107. Health First Colorado is regulated by HHS and is jointly funded through both state

4 and federal dollars.

5 108. HCPF spends considerable resources to ensure that eligibility determinations for

6 Health First Colorado are correct. This ensures that only individuals who are eligible for

7 Medicaid are enrolled in Health First Colorado and that only those services provided to eligible

8 members are billed to the federal government.

9 109. HCPF sends eligibility data to CMS through the T-MSIS database. This data contains

10 sensitive, personally identifiable information about all Health First Colorado members.

11 110. HCPF routinely responds to CMS requests for data and information to substantiate

12 the amount of FFP HCPF requests from the federal government.

13 111. On June 6, 2025, HCPF received an email from CMS that included significant

14 requests for data related to the administration of Emergency Medicaid Services for certain

15 immigrant populations. CMS also requested data related to Colorado’s state-only health care

16 program, Cover All Coloradans, which provides services for children and pregnant persons who

17 otherwise would be eligible for Health First Colorado but for immigration status.

18 112. CMS represented in the email that it “will be reviewing claims for FFP submitted by

19 the state to ensure that only claims for FFP that meet all applicable statutory requirements for

20 individuals without a satisfactory immigration status are included within the state’s” claims

21 submission to the federal government.

22 113. The email does not cite any evidence or concerns about HCPF improper use of

23 federal dollars as related to “individuals without a satisfactory immigration status.” Nor does the

24 email city any evidence or concerns regarding Colorado state-only health care program, Cover

25 All Coloradans.

26 114. The email asks HCPF to respond to the data requests by July 30, 2025. A meeting

27 between HCPF and CMS is scheduled for July 2, 2025 to discuss the data requests.

28
21
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 23 of 59

1 Connecticut

2 115. Connecticut’s HUSKY Health is the State’s program that provides comprehensive

3 health coverage to all qualifying Connecticut residents, and it includes Connecticut’s Medicaid

4 and CHIP programs. Connecticut’s Department of Social Services (DSS) is Connecticut’s single

5 state Medicaid agency and functions as one of the largest providers of health coverage in

6 Connecticut. It is a leader in ensuring Connecticut residents have access to high-quality,

7 affordable healthcare, and it is committed to whole-person care, integrating physical and

8 behavioral health services for better results and healthier communities in Connecticut. DSS

9 provides healthcare for over 1 million state residents annually through HUSKY. Connecticut

10 implemented the CHIP option to cover the cost of prenatal care in 2022.

11 116. Connecticut has also elected to use state-only funds to provide a version of the

12 HUSKY program to all eligible state residents up to the age of 19, regardless of immigration

13 status. Connecticut has also elected to use state-only funds for postpartum services for women

14 who do not qualify for Medicaid or CHIP based on their immigration status.

15 117. Connecticut DSS routinely shares protected health information concerning

16 Connecticut residents and their use of Medicaid healthcare services with CMS. DSS sends data to

17 T-MSIS on a regular basis, and also routinely responds to CMS requests for additional

18 information concerning Medicaid claims and the use of federal dollars.

19 Delaware

20 118. The Division of Medicaid and Medical Assistance (DMMA) is an agency within the

21 executive branch of the State of Delaware. DMMA administers the Medicaid and CHIP programs

22 in Delaware, which provide health coverage to over 300,000 Delawareans.

23 119. Delaware routinely shares protected health information concerning Delaware

24 residents and their use of Medicaid healthcare services with CMS. DMMA sends data to T-MSIS

25 on a regular basis, and also responds to occasional CMS requests for additional information

26 concerning Medicaid claims and the use of federal dollars.

27

28
22
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 24 of 59

1 Hawai‘i

2 120. Hawaii’s Medicaid program, Med-QUEST, is administered by the State of State of

3 Hawai‘i Department of Human Services. Med-QUEST provides health coverage to 400,000 low-

4 income Hawai‘i residents. In addition, Hawai’i administers federally funded emergency

5 Medicaid benefits that provide emergency care and services to individuals regardless of their

6 immigration status.

7 121. Med-QUEST routinely shares protected health information concerning

8 Hawai‘i residents and their use of Medicaid healthcare services with CMS. Med-QUEST sends

9 data to T-MSIS on a regular basis, and also responds to occasional CMS requests for additional

10 information concerning Medicaid claims and the use of federal dollars.

11 Illinois

12 122. The Illinois Department of Healthcare and Family Services (IDHFS) administers

13 Medicaid, CHIP, and other affordable health care programs in the state of Illinois. These

14 programs provide critical healthcare coverage to nearly 3.5 million individuals and families

15 across Illinois, making IDHFS the largest source of medical insurance in the state.

16 123. Illinois has also significantly invested in outreach and enrollment for affordable

17 health programs within the state.

18 124. Illinois has additionally elected to use state-only funds to expand healthcare coverage

19 for certain noncitizens. For example, the Health Benefits for Immigrant Seniors program

20 provides health benefits for Illinois residents 65 years and older regardless of their immigration

21 status. 305 ILCS 5/12-4.35. Illinois also funds and administers the All Kids program, which

22 provides comprehensive, affordable, health insurance for all Illinois children, regardless of

23 immigration status.

24 125. Applications for Illinois benefits, including affordable health programs, in the state of

25 Illinois are handled through a single web-based application portal called ABE, the Application for

26 Benefits Eligibility. Applications may also be completed in person at certain locations, by mail,

27 or initiated by telephone with Illinois caseworkers.

28
23
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 25 of 59

1 126. ABE can be used by anyone seeking Illinois Medicaid coverage, including new

2 groups covered as a result of national health care reform under the Affordable Care Act.

3 127. Illinois uses an Integrated Eligibility System (IES) to determine eligibility for benefits

4 programs including affordable healthcare benefits. This program interfaces with state and federal

5 data sources to verify certain financial and nonfinancial information to assist in determining

6 eligibility for various benefits programs.

7 128. Illinois verifies USCIS status of noncitizens applying for federally-supported medical

8 benefits through the federal SAVE database.

9 129. Illinois sends extract data to T-MSIS on a monthly basis as required and full data on

10 an annual basis.

11 130. Illinois also responds to CMS requests for information and data when CMS reviews

12 Illinois' claims for reimbursement of expenditures, and when CMS performs other program audit

13 and oversight functions. Given CMS's role in jointly administering the Medicaid program with

14 Illinois, IDHFS complies with all routine requests for information.

15 Maine

16 131. Maine’s Medicaid program is operated by the Maine Department of Health and

17 Human Services (Me. DHHS). Maine’s Medicaid program, known as MaineCare, provides

18 healthcare coverage for approximately 400,000 residents in Maine. This includes 38,000 people

19 with disabilities and 5,000 children with special health care needs.

20 132. In certain circumstances and consistent with federal law, non-qualified noncitizens

21 who live in Maine are eligible for Medicaid coverage. For example, as with all Maine

22 residents—regardless of immigration status—non-qualified noncitizens are eligible for

23 Emergency Services Only Medicaid, which covers emergency medical services.

24 133. Consistent with federal law, non-qualified pregnant women are eligible for federal

25 CHIP coverage for medical care during pregnancy and for twelve months after delivery.

26 134. Maine has elected to use state-only funds to provide a version of MaineCare to all

27 eligible state residents under the age of 21 who are not qualified to receive federal match due to

28 their immigration status. 22 M.R.S. § 3174-FFF.

24
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 26 of 59

1 135. MaineCare participants’ personal data is available to CMS through T-MSIS.

2 136. Me. DHHS has an agreement with CMS and DHS to use the federal SAVE database

3 to verify individuals’ eligibility for federally funded MaineCare.

4 137. Me. DHHS also routinely responds to CMS requests for supplemental review of

5 reports required to determine the amount of FFP to which the State is entitled, and other program

6 audit and oversight functions.

7 Maryland

8 138. Maryland’s Medicaid program (also known as the “Maryland Medical Assistance

9 Program”) is operated by the Maryland Department of Health (MDH). The Medicaid program

10 provides healthcare coverage for approximately 1.5 million Maryland residents.

11 139. Consistent with federal law, Maryland affords emergency Medicaid coverage for

12 immigrants who are otherwise eligible for Medicaid. Coverage extends from when the individual

13 enters the hospital until the individual’s emergency medical condition is stabilized. Under the

14 state's Healthy Babies Equity Act of 2024, Maryland Medicaid provides comprehensive medical

15 care and other health care services to noncitizen pregnant individuals who would be eligible for

16 Medicaid but for their immigration status. Those individuals have full Medicaid benefits up to 4

17 months postpartum. See Md. Code. Ann. Health-Gen. §15-103(a)(2)(xviii).

18 140. MDH maintains the personal data of Medicaid enrollees through the Medicaid

19 Management Information System (“MMIS”), while the Maryland Health Benefit Exchange

20 (“MHBE”) maintains the integrated eligibility system and statewide eligibility information

21 database of Medicaid enrollees through the Health Benefit Exchange (“HBX”). Maryland

22 Medicaid enrollees’ personal data is available to CMS through the T-MSIS.

23 Massachusetts

24 141. Massachusetts administers Medicaid and CHIP through the MassHealth program,

25 which is administered by the Massachusetts Executive Office of Health and Human Services

26 (“EOHHS”).

27 142. EOHHS’s MassHealth and CHIP programs provide healthcare coverage for over

28 1,600,000 Massachusetts residents.

25
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 27 of 59

1 143. EOHHS maintains personal data of MassHealth enrollees, including eligibility

2 information. Massachusetts MassHealth enrollees’ personal data is available to CMS through the

3 T-MSIS system used by CMS to collect and standardize Medicaid and CHIP data across states.

4 144. EOHHS additionally at times provides CMS with data in response to Medicaid

5 supplemental reviews and audits for federal oversight purposes.

6 Michigan

7 145. Michigan’s Medicaid program is operated by the Michigan Department of Health and

8 Human Services (MDHHS). Michigan Medicaid provides healthcare coverage for approximately

9 2.6 million residents in Michigan.

10 146. In certain circumstances and consistent with federal law, undocumented noncitizens

11 who live in Michigan are eligible for Medicaid coverage. For example, Michigan residents—

12 regardless of immigration status—are eligible for Emergency Services Only Medicaid, which

13 covers emergency medical services. And undocumented pregnant women are eligible for

14 Medicaid and CHIP coverage for limited maternity-related care during pregnancy and for two

15 months after delivery.

16 147. MDHHS maintains personal data of Medicaid enrollees through Bridges, MDHHS’

17 integrated eligibility system, and the MDHHS Data Warehouse, a statewide database with

18 information pertinent to the programs administered by MDHHS, including eligibility information.

19 Michigan Medicaid enrollees’ personal data is available to CMS through T-MSIS.

20 Minnesota

21 148. Minnesota’s Medicaid program, Medical Assistance, provides low-income

22 individuals with comprehensive healthcare coverage and access to affordable, integrated, high-

23 quality healthcare at no or low cost. The Minnesota Department of Human Services (MDHS),

24 through its Health Care Administration, is the single state agency responsible for administering

25 Minnesota’s Medicaid program, which is known as Medical Assistance. Today, Medical

26 Assistance provides health coverage for over one million Minnesotans, or approximately one in

27 every five state residents. MDHS administers federally funded emergency Medicaid benefits that

28 provide emergency care and services to individuals regardless of their immigration status.
26
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 28 of 59

1 149. MDHS works to ensure that eligibility determinations are made correctly, including

2 by ensuring that only individuals who are eligible for federally funded Medicaid are billed to the

3 federal government.

4 150. MDHS has an agreement with CMS and DHS to use the federal SAVE database to

5 verify individuals’ citizenship or immigration status to determine eligibility for federally funded

6 Medicaid.

7 151. MDHS routinely shares protected health information concerning Minnesotans and

8 their use of Medicaid healthcare services with CMS. MDHS sends data to T-MSIS each month.

9 This data contains sensitive, personally identifiable information about all MDHS enrollees.

10 MDHS also routinely responds to CMS requests for additional information, including audits,

11 concerning Medicaid claims and the use of federal dollars.

12 152. On June 6, 2025, CMS sent an email to MDHS stating that it was requesting

13 information to confirm Minnesota was not applying federal funding unlawfully for individuals

14 with unsatisfactory immigration statuses. The email did not cite any specific evidence or

15 concerns about improper use of federal dollars. The email requested that MDHS respond with

16 sensitive, personally identifiable information about all MDHS enrollees by July 30, 2025.

17 153. MDHS also administers MinnesotaCare, which provides comprehensive healthcare

18 coverage for uninsured Minnesota residents who are not eligible for Medical Assistance and have

19 income at or below 200% of the Federal Poverty Guidelines. Minnesota has elected to use state-

20 only funds to provide a version of MinnesotaCare coverage to all eligible state residents up to the

21 age of 18, regardless of their immigration status.

22 Nevada

23 154. Nevada’s Division of Health Care Financing and Policy (DHCFP) works in

24 partnership with CMS to assist in providing quality medical care for eligible individuals and

25 families with low incomes and limited resources. The Medicaid program in Nevada is authorized

26 to operate under DHHS and DHCFP per Nevada Revised Statutes (NRS) Chapter 422.

27 155. Nevada’s Medicaid program provides health care coverage for many people including

28 low-income families with children whose family income is at or below 133% percent of poverty,
27
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 29 of 59

1 Supplemental Security Income (SSI) recipients, certain Medicare beneficiaries, and recipients of

2 adoption assistance, foster care and some children aging out of foster care. The DHCFP also

3 operates five Home or Community-Based Services waivers offered to certain persons throughout

4 the state. The Division of Welfare and Supportive Services (DWSS) determines eligibility for the

5 Medicaid program. Nevada Check Up provides health care benefits to uninsured children from

6 low-income families who are not eligible for Medicaid but whose family income is at or below

7 200% of the Federal Poverty Level.

8 156. The Medicaid Services Manual (MSM) along with the Medicaid Operations Manual

9 (MOM) is the codification of regulations adopted by Nevada Medicaid based on the authority of

10 NRS 422.2368, following the procedure at NRS 422.2369.

11 157. MSM Chapter 100.2 provides that “all individuals have the right to a confidential

12 relationship with DHCFP. All information maintained on Medicaid and CHIP applicants and

13 recipients (“recipients”) is confidential and must be safeguarded.” DHCFP, Medicaid Services

14 Manual, p 5. “Disclosures of identifiable information are limited to purposes directly related to

15 State Plan administration.” Id. at p 6. Further, “[e]xcept as otherwise provided in these rules, no

16 person shall obtain, disclose, use, authorize, permit, or acquiesce the use of any client information

17 that is directly or indirectly derived from the records, files, or communications of DHCFP, except

18 for purposes directly connected with the administration of the Plan or as otherwise provided by

19 federal and state law.” Id. at 7.

20 New Jersey

21 158. New Jersey’s Medicaid program is operated by the New Jersey Department of Human

22 Services (NJDHS). NJDHS provides healthcare coverage for approximately 1.9 million residents

23 in New Jersey.

24 159. NJDHS maintains personal data of Medicaid enrollees, including eligibility

25 information. New Jersey Medicaid enrollees’ personal data is available to CMS through the T-

26 MSIS system.

27 160. NJDHS additionally routinely provides CMS with data in response to Medicaid

28 supplemental reviews and audits for federal oversight purposes.

28
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 30 of 59

1 New Mexico

2 161. New Mexico’s Medicaid program provides healthcare coverage for approximately

3 840,000 New Mexicans, over 40% of the state population. In New Mexico, full-scope Medicaid

4 gives beneficiaries access to primary and preventive care, dental health care, inpatient and

5 outpatient hospital treatment, prescription drugs, behavioral health care, home health care, and

6 other vital services.

7 162. In addition, New Mexico funds more limited scope healthcare programs that offer

8 more targeted services to specific populations. For example, New Mexico provides access to

9 family planning services, including contraceptives and reproductive health exams, under the

10 state’s Family Planning Program; and helps low-income New Mexicans who qualify for Medicare

11 with out-of-pocket costs, such as premiums, deductibles, and co-insurance.

12 163. New Mexico also administers federally and state-funded emergency Medicaid

13 benefits that provide emergency care and services to individuals regardless of their immigration

14 status.

15 164. The New Mexico Medicaid program is administered by the New Mexico Health Care

16 Authority (HCA), a state agency.

17 165. New Mexico’s HCA works diligently to ensure that Medicaid eligibility

18 determinations are made correctly and that claims billed to the federal government cover only

19 individuals and services eligible for federally funded Medicaid. The state agency has an

20 agreement with CMS and DHS to use the federal SAVE database to verify individuals’ eligibility

21 for federally funded Medicaid.

22 166. New Mexico’s HCA sends data to T-MSIS each month. This data contains sensitive,

23 personally identifiable information about all Medicaid enrollees.

24 167. New Mexico’s HCA also routinely responds to CMS requests for supplemental

25 review of reports required to determine the amount of FFP to which the State is entitled, and other

26 program audit and oversight functions.

27

28
29
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 31 of 59

1 168. For instance, because New Mexico receives an enhanced FMAP, the state is required

2 by federal law to provide detailed enrollee data that is “necessary for program integrity, program

3 oversight, and administration.” 42 C.F.R. § 438.818.

4 New York

5 169. New York’s Medicaid program provides health coverage to approximately 7 million

6 low-income New Yorkers. New York has elected to use state-only funds to provide Medicaid

7 health coverage to certain New Yorkers aged 65 and over and postpartum care for 12 months to

8 pregnant individuals, regardless of their immigration status. In addition, New York administers

9 federally funded emergency Medicaid benefits that provide emergency care and services to

10 individuals regardless of their immigration status as well as prenatal care up to labor and delivery

11 for pregnant individuals, regardless of their immigration status.

12 170. The New York State Department of Health (NYSDOH) works diligently to ensure

13 that Medicaid eligibility determinations are made correctly, and that claims billed to the federal

14 government cover only individuals and services eligible for federally funded Medicaid.

15 171. NYSDOH routinely shares protected health information concerning New Yorkers and

16 their use of Medicaid healthcare services with CMS. NYSDOH sends data to T-MSIS on a

17 regular basis, and also responds to occasional CMS requests for additional information

18 concerning Medicaid claims and the use of federal dollars.

19 Oregon

20 172. The Oregon Health Authority (OHA) is the designated state agency responsible for

21 administering Oregon’s Medicaid program. ORS 413.032(1)(e). OHA’s mission is to “transform

22 the health care system in Oregon by: improving the lifelong health of people in Oregon;

23 increasing the quality, reliability, and availability of care for all people in Oregon; and lowering

24 or containing the cost of care so it’s affordable to everyone.”

25 173. OHA operates the Oregon Health Plan (OHP), Oregon’s Medicaid program regulated

26 by the U.S. Department of Health and Human Services. This program is jointly funded by both

27 state and federal dollars, though at different rates.

28
30
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 32 of 59

1 174. Oregon has also elected to use state-only funds to extend OHP coverage to all state

2 residents who meet income and other criteria regardless of their immigration status.

3 175. Oregon has significantly invested in outreach and enrollment for OHP. For example,

4 OHP certifies a network of community partners that includes approximately 300 organizations

5 and around 1,500 application assisters across Oregon. Among other things, community partners

6 provide culturally and linguistically responsive outreach and health coverage application

7 assistance.

8 176. OHA works to ensure that eligibility determinations are made correctly, including by

9 ensuring that only individuals who are eligible for federally funded Medicaid are billed to the

10 federal government.

11 177. OHA has an agreement with CMS and DHS to use the federal SAVE database to

12 verify individuals’ eligibility for federally funded Medicaid.

13 178. OHA sends data to T-MSIS each month. This data contains sensitive, personally

14 identifiable information about all OHP enrollees.

15 179. OHA also routinely responds to CMS requests for supplemental review of reports

16 required to determine the amount of FFP to which the State is entitled as well as other program

17 audit and oversight functions.

18 180. On June 6, 2025, CMS sent an email to OHA stating that it would be “reviewing

19 claims for FFP submitted by the state to ensure that only claims for FFP that meet all applicable

20 statutory requirements for individuals without a satisfactory immigration status are included

21 within the state’s Form CMS-64 submissions.” The email did not cite any new evidence or new

22 concerns about improper use of federal dollars. The email requested that OHA respond with

23 certain specified data by July 30, 2025.

24 181. On June 26, 2025, OHA staff met with CMS staff to discuss the information CMS

25 requested and the purpose of its review. In that meeting, CMS staff confirmed that they intend to

26 combine any data OHA provides in response to the June 6, 2025 request with data OHA has

27 already submitted through T-MSIS. Combining these data sources will make it easier to

28 determine both the identity and immigration status of OHP members. When asked whether CMS
31
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 33 of 59

1 would transfer these data to DHS, CMS staff indicated they would confer with their leadership

2 and provide an answer in a subsequent communication. As of the date of this Complaint, CMS

3 has not provided a response.

4 Rhode Island

5 182. Rhode Island’s Medicaid program provides health coverage to more than 300,000

6 Rhode Islanders. Rhode Island has elected to use state-only funds to provide Medicaid coverage

7 to all children (individuals up to nineteen (19) years of age), regardless of their immigration

8 status. Rhode Island also extends Medicaid coverage to pregnant people who otherwise meet

9 requirements for Medicaid, regardless of their immigration status. In addition, Rhode Island

10 administers federally funded Medicaid benefits that provide coverage for individuals that require

11 treatment for an emergency health condition regardless of their immigration status.

12 183. The Rhode Island Executive Office of Health & Human Services (RI EOHHS) serves

13 as the Single State Agency for Medicaid. RI EOHHS has delegated authority to the Rhode Island

14 Department of Human Services (RI DHS) to determine Medicaid eligibility. RI EOHHS and RI

15 DHS work to ensure that Medicaid eligibility determinations are made correctly, and that claims

16 billed to the federal government cover only individuals and services eligible for federally funded

17 Medicaid.

18 184. RI DHS uses an integrated eligibility system known as RIBridges to determine

19 eligibility for various benefit programs, including Medicaid. RI EOHHS routinely shares

20 Medicaid data containing personally identifiable, protected health information with CMS. RI

21 EOHHS sends data to T-MSIS on a routine basis and routinely responds to CMS requests for

22 additional information concerning Medicaid claims and the use of federal funds.

23 Vermont

24 185. Vermont’s Medicaid program is operated by the Department of Vermont Health

25 Access (DVHA) within the Vermont Agency of Human Services. The mission of DVHA is “to

26 improve Vermonters’ health and well-being by providing access to high-quality, cost-effective

27 health care.”

28
32
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 34 of 59

1 186. In limited circumstances and consistent with federal law, undocumented noncitizens

2 who live in Vermont are eligible for Medicaid coverage. For example, Vermont residents—

3 regardless of immigration status—are eligible for Emergency Services Only Medicaid, which

4 covers emergency medical services. Vermont also provides coverage to legal resident non-citizen

5 children and teenagers under age 19 and pregnant women through the Dr. Dynasaur program.

6 187. Vermont regularly shares protected health information concerning Vermonters and

7 their use of Medicaid healthcare services with CMS. DVHA sends data to T-MSIS and also

8 routinely responds to CMS requests for additional information concerning Medicaid claims and

9 the use of federal dollars.

10 188. Vermont shares this protected health information with the understanding that it is

11 being safeguarded by CMS rules and procedures designed to protect data privacy and security,

12 and that this data is only being used to administer Medicaid benefits and to further the healthcare

13 goals and priorities of the Medicaid program.

14 Washington

15 189. In Washington State, the Health Care Authority (“Washington HCA”) administers the

16 Medicaid program, the Children’s Health Insurance Program, and other healthcare programs

17 under the umbrella term “Apple Health.” The Washington Legislature designated Washington

18 HCA as the “single state agency” for purposes of the Medicaid program. See Wash. Rev. Code

19 § 74.09.530(1)(a). HCA is responsible for assuring the federal Centers for Medicare and

20 Medicaid Services (“CMS”) that the state will comply with federal Medicaid law.

21 190. There are more than 1.9 million Apple Health clients in Washington, including about

22 49,000 whose immigration status makes them ineligible for federal programs. Apple Health

23 covers a range of healthcare services, including inpatient and outpatient hospital care, primary

24 and preventative care, long-term services and supports, and behavioral health. Each year,

25 Washington HCA receives nearly $70 million from CMS for emergency medical services

26 provided to clients who are “not qualified” noncitizens.

27 191. In 2023, the Washington Legislature directed Washington HCA to create a new

28 program for certain individuals who are not eligible for Medicaid because of their immigration
33
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 35 of 59

1 status. See Engrossed Substitute Senate Bill (“ESSB”) 5187, § 211(83). The Legislature

2 appropriated about $45.6 million of state funds to Washington HCA for the program for state

3 fiscal year (“SFY”) 2025. HCA named the program “Apple Health Expansion.” The Legislature

4 directed that the program provide services comparable to the “categorically needy” Medicaid

5 program. In 2024, the Legislature increased the budget for the program to about $71 million for

6 SFY 2025. See ESSB 5950, § 211(82). In 2025, the Legislature appropriated about $71.3 million

7 for the program for SFY 2026 and about $70.9 million for SFY 2027. See ESSB 5167, § 211(52).

8 192. In creating Apple Health Expansion, Washington HCA adopted a managed care

9 delivery system, for the purpose of facilitating whole-person care to enrollees and for ease of

10 administration. Washington HCA entered into contracts with four managed care organizations

11 (“MCOs”), also called “health plans,” who are responsible for ensuring the provision of

12 healthcare services to Apple Health Expansion enrollees. Washington HCA also includes

13 emergency services funded by CMS in this managed care model, again to facilitate whole-person

14 care and for ease of administration.

15 193. The Apple Health Expansion program began offering services to enrollees as of July

16 1, 2024, through the MCO contracts. This was preceded by many months of meetings with

17 advocacy groups and other stakeholders, for the purpose of helping to define the parameters of

18 the program, encouraging outreach to potential enrollees, and creating rules under the

19 Washington Administrative Code.

20 194. Washington HCA, through a contractor known as Acentra, sends data to the federal

21 government’s T-MSIS system each month, using a secure portal. This data contains sensitive,

22 personally identifiable information about all Apple Health enrollees. Washington HCA’s most

23 recent submission of T-MSIS data occurred on or around May 27, 2025.

24 195. Washington HCA routinely responds to CMS requests for supplemental review of

25 reports required to determine the amount of FFP to which the State is entitled, and other program

26 audit and oversight functions.

27 196. On March 31, 2025, CMS sent Washington HCA an email requesting information the

28 agency stated was necessary to confirm Washington was not applying federal funding unlawfully
34
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 36 of 59

1 for individuals with unsatisfactory immigration statuses. This request was represented to

2 Washington HCA as a routine audit in line with previous requests for information made to

3 Washington HCA from CMS. Nothing in the request indicated that CMS would share this

4 information outside HHS.

5 197. Washington HCA responded to CMS’s information request, as it would for other

6 routine audits of Washington HCA. Nothing indicated that CMS planned to use this information

7 for anything other than routine auditing consistent with the agency’s statutory authority to

8 administer the Medicaid program.

9 198. Washington HCA learned through media reporting on June 13, 2025, that CMS had

10 apparently, and improperly, transferred confidential data regarding its Apple Health clients to the

11 Department of Homeland Security (“DHS”). On June 24, 2025, Washington HCA sent a letter to

12 CMS seeking information on this reported data transfer. As of the date of this filing, Washington

13 HCA has not received a response.

14 All Plaintiff States

15 199. In all of the sharing of protected health information described above, the States have

16 relied upon CMS rules, procedures, and practices designed to protect data privacy and security,

17 and the understanding that this data is only being used to administer Medicaid benefits and to

18 further the healthcare goals and priorities of the Medicaid program.

19 200. This policy and practice has been communicated to the public as well. For example,

20 in its online privacy policy statement, CMS promises Medicaid enrollees and their family

21 members that the agency is “committed to keeping your personal information safe with the

22 highest level of privacy protections possible,” including “only sharing information with people

23 who need to know.” CMS further assures the public that it will “tell you before we collect any

24 personal information we need to run our health care programs, and only use it for that purpose.” 4

25

26

27
4
CMS Privacy Home Page (last checked June 26, 2025), https://www.cms.gov/about-
28 cms/information-systems/privacy.
35
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 37 of 59

1
II. Federal Actions Undermining Privacy, Security, and Confidentiality of Medicaid
2 Data
3 201. Through a series of federal executive actions, the federal government has—without
4 formal acknowledgment—dramatically changed its policy and practice of keeping personal
5 Medicaid data private and refraining from weaponizing healthcare data and systems for
6 immigration and other federal policy purposes.
7 202. In early February, CMS confirmed reports in the Wall Street Journal that DOGE
8 representatives were accessing CMS systems and technology. 5
9 203. On February 19, 2025, President Trump signed an Executive Order titled “Ending
10 Taxpayer Subsidization of Open Borders.” Exec. Order No. 14,218, 90 Fed. Reg. 10,581 (Feb.
11 19, 2025) (hereinafter the “Borders EO”). It purported to give DOGE new authority to “enhance
12 eligibility verification systems” for public benefits.
13 204. On February 28, 2025, HHS announced it was abandoning a long-time memorandum,
14 referred to as the “Richardson Waiver,” pursuant to which HHS had previously committed to
15 (1) follow the notice-and-comment rulemaking procedures in the Administrative Procedure Act
16 (APA) for most rules issued by HHS; and (2) invoke the APA’s good-cause exception to public
17 rulemaking only “sparingly.” HHS, Policy on Adhering to the Text of the Administrative
18 Procedure Act, 90 Fed. Reg. 11,029 (Mar. 3, 2025).
19 205. On March 20, 2025, President Trump signed an Executive Order titled “Stopping
20 Waste, Fraud, and Abuse by Eliminating Information Silos,” which calls on agencies to
21 “remov[e] unnecessary barriers,” including rescission or modification of existing agency
22 guidance, to ensure “unfettered access to comprehensive data from all State programs” in
23

24 5
See Anna Wild Mathews & Liz Essley Whyte, DOGE Aides Search Medicare Agency Payment
Systems for Fraud, (Feb. 5, 2025), https://www.wsj.com/politics/elon-musk-doge-
25 medicaremedicaid-fraud-e697b162; CMS, CMS Statement on Collaboration with DOGE,
https://www.cms.gov/newsroom/press-releases/cms-statement-collaboration-doge (Feb. 5, 2025);
26 Riley Griffin & Madison Muller, Musk’s DOGE Team Mines for Fraud at Medicare, Medicaid,
(Feb. 5, 2025), https://www.bloomberg.com/news/articles/2025-02-05/musk-s-dogeteam-mines-
27 for-fraud-at-medicare-and-medicaid-agency; Alan Condon, DOGE Sets Sights on Medicaid, New
York Times (Feb. 3, 2025) (noting that DOGE has been provided access to key payment and
28 contracting systems at CMS).
36
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 38 of 59

1 furtherance of the Administration’s goals. Exec. Order No. 14243, 90 Fed. Reg. 13,681 (Mar. 20,

2 2025) (hereinafter the “Information Silos EO”). The Executive Order does not—and cannot—

3 excuse agencies from acting “consistent with law.” Id.

4 206. In a May 27, 2025, announcement to California and other states, CMS stated that it

5 was reviewing state Medicaid enrollees to ensure that federal funds had not been used to pay for

6 coverage of people with “unsatisfactory immigration status” (UIS). This letter was purportedly

7 an implementation of the February 19 Borders EO. Nothing in the letter mentioned interagency

8 data sharing.

9 207. Around this same time, multiple media outlets reported that DOGE had enlisted the

10 technology company Palantir to build a massive repository of data pulled from multiple federal

11 agencies, including the IRS, SSA, and HHS, among others, for the purpose of immigration

12 enforcement. 6 It has also been reported that DHS and HHS have already adopted a key Palantir

13 product called Foundry, which would streamline the implementation of such a project. 7

14 208. On June 13, 2025, the Plaintiffs learned that HHS has transferred en masse California,

15 Illinois, and Washington’s Medicaid data files, containing personal health records representing

16 millions of individuals, to DHS. 8 According to a news report, senior HHS political appointees

17 ordered that the data be shared immediately, over the objections of career staff who advised that

18 such a transfer of information would violate federal law, and CMS officials were given just 54

19 minutes to comply with the directive. This data was personally identifiable, not anonymized or

20 hashed, and it included Medicaid beneficiaries’ immigration status and addresses, among other

21 details.

22
6
See Priscilla Alvarez, et al., DOGE is Building a Master Database for Immigration
23 Enforcement, Sources Say, CNN (April 25, 2025),
https://www.cnn.com/2025/04/25/politics/doge-building-master-database-immigration; Makena
24 Kelly & Vittoria Elliott, DOGE Is Building a Master Database to Surveil and Track Immigrants
(April 18, 2025), https://www.wired.com/story/doge-collecting-immigrant-data-surveil-track/
25 7
See Sheera Frenkel & Aaron Krolic, Trump Taps Palantir to Compile Data on Americans, New
York Times (May 30, 2025), https://www.nytimes.com/2025/05/30/technology/trump-palantir-
26 data-americans.html
8
See Kimberly Kindy & Amanda Seitz, Trump Administration Gives Personal Data of Immigrant
27 Medicaid Enrollees to Deportation Officials, AP News (June 14, 2025),
https://apnews.com/article/medicaid-deportation-immigrants-trump-
28 4e0f979e4290a4d10a067da0acca8e22?utm_source=copy&utm_medium=share.
37
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 39 of 59

1 209. CMS recently sent to some Plaintiff States additional requests for data concerning the

2 use of federal and state funds to provide Medicaid services to immigrant communities. In light of

3 recent news reports, these Plaintiff states are concerned that HHS is preparing to transfer a similar

4 collection of those states’ Medicaid data files to DHS for the purpose of mass surveillance and

5 immigration enforcement.

6 210. HHS provided no warning or notice to California, Illinois, or Washington, or to the

7 Medicaid beneficiaries whose data was transferred. HHS has not identified the legal authority

8 under which it transferred this personal Medicaid data.

9 211. To date, HHS has not responded to inquiries from state Medicaid agencies requesting

10 confirmation of the data transfer and details about its scope or purpose.

11 212. An HHS spokesperson acknowledged to the Associated Press that the mass data

12 transfer had indeed occurred. HHS claimed that “HHS acted entirely within its legal authority—

13 and in full compliance with applicable laws,” but without identifying any such authority. HHS

14 stated that the purpose of the data transfer was “to ensure that Medicaid benefits are reserved for

15 individuals who are lawfully entitled to receive them.”

16 213. A DHS spokesperson also confirmed receipt of the mass personal Medicaid data

17 transfer from HHS. In its statement to the Associated Press, DHS claimed that “Joe Biden

18 flooded our country with tens of millions of illegal aliens,” and that therefore “CMS and DHS are

19 exploring an initiative to ensure that illegal aliens are not receiving Medicaid benefits that are

20 meant for law-abiding Americans.”

21 214. The DHS spokesperson’s narrative that the number of persons residing unlawfully in

22 the United States increased by “tens of millions” during the Biden administration is not supported

23 by any evidence, nor is there evidence to support the implication that unauthorized residents are

24 engaged in some sort of theft of Medicaid benefits for which they are ineligible.

25 215. Despite Defendants’ program integrity justifications, transfer of large amounts of

26 personal Medicaid information to DHS is unnecessary for administration of the Medicaid

27 program. HHS’s disclosure of Medicaid personal data to DHS was far broader than would be

28 needed for the identification and prevention of waste, fraud, and abuse, and inconsistent with best
38
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 40 of 59

1 practices for such activities. HHS has never before enlisted DHS’s participation in “oversight” of

2 the Medicaid program in such a manner.

3 216. To the extent that the federal government claims that DOGE needs vast quantities of

4 personal Medicaid data to upgrade technology or improve detection of waste, fraud, and abuse,

5 that justification is also not credible. Program integrity investigations typically start with access

6 to high-level, anonymized data based on the least amount of data the analyst or auditor would

7 need to know, and only if suspicious entries appear do auditors gain access to a limited amount of

8 more granular, non-anonymized data. This is consistent with FISMA’s requirement as

9 promulgated by NIST that agencies “[e]mploy the principle of least privilege, allowing only

10 authorized accesses for users … that are necessary to accomplish assigned organizational tasks.”

11 NIST Special Publication 800-53 Revision 5 at 36.

12 217. Instead, upon information and belief, the federal government has adopted a new

13 policy that purports to allow for wholesale re-disclosure and use of State residents’ personal

14 Medicaid data to pursue aims that are unrelated to Medicaid program administration, including

15 immigration enforcement. Put a different way, circumstantial evidence strongly suggests that the

16 federal government intends to punish individuals who receive emergency medical care for

17 themselves or their children using Medicaid, as those individuals are legally permitted to do, by

18 using the data collected from their hospital visit to locate and deport them.

19 218. Upon information and belief, the federal government has additional plans for this

20 data. DHS, with the assistance of DOGE and external entities, such as ICE contractor Palantir,

21 are combining federal, state, and local databases of information into a single interoperable

22 database for the purpose of “mass deportations” and other large-scale immigration enforcement

23 and mass surveillance purposes. 9 This effort reportedly includes databases of personal

24 information that have never before been used for immigration enforcement or other purposes

25 unrelated to the agencies’ primary missions. In addition to CMS, impacted federal agencies

26 reportedly include the Internal Revenue Service, the Supplemental Nutrition Assistance Program,

27 9
See Muzaffar Chishti & Colleen Putzel-Kavanaugh, Seeking to Ramp Up Deportations, the
Trump Administration Quietly Expands a Vast Web of Data, Migration Policy Institute (May 29,
28 2025), https://www.migrationpolicy.org/article/trump-ice-data-surveillance.
39
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 41 of 59

1 the Social Security Administration, the U.S. Department of Housing and Urban Development, the

2 U.S. Department of Veterans Affairs, the U.S. Education Department, and the U.S. Postal

3 Service. 10

4 219. Upon information and belief, DOGE engineers responsible for implementing these

5 plans are handling sensitive HHS data, including data provided by Plaintiff States, “in a manner

6 that disregards important cybersecurity and privacy considerations, potentially in violation of the

7 law.” 11 For example, a letter sent by the ranking member of the House Oversight and

8 Government Reform Committee to the Social Security Administration (SSA) included

9 whistleblower allegations that “DOGE engineers have tried to create specialized computers for

10 themselves that simultaneously give full access to networks and databases across different

11 agencies. Such a system would pose unprecedented operational security risks and undermine the

12 zero-trust cybersecurity architecture that prevents a breach at one agency from spreading across

13 the government. Information obtained by the Committee also indicates that individuals

14 associated with DOGE have assembled backpacks full of laptops, each with access to different

15 agency systems, that DOGE staff is using to combine databases that are currently maintained

16 separately by multiple federal agencies.” If true, these allegations represent a shocking misuse of

17 data provided by the Plaintiff States that illegally puts the security and integrity of that data at

18 risk. Plaintiff States’ concerns about the security of their data are well-founded given other

19 whistleblower testimony reporting that DOGE’s databases are being targeted for infiltration by

20 foreign hackers. 12

21

22
10
Id.
23 11
Letter from Ranking Member Gerald E. Connolly, House Committee on Oversight and
Government Reform, to SSA Assistant Inspector General for Audit Michelle L. Anderson (Apr.
24 17, 2025), https://oversightdemocrats.house.gov/sites/evo-subsites/democrats-
oversight.house.gov/files/evo-media-document/2025-04-17.gec-to-ssa-oig-master-data.pdf; see
25 also Natalie Alms, DOGE is Building a “Master Database” of Sensitive Information, Top
Oversight Democrat Says, NextGov/FCW (Apr. 18, 2025), https://www.nextgov.com/digital-
26 government/2025/04/doge-building-master-database-sensitive-information-top-oversight-
democrat-says/404693/.
27 12
See Letter from Whistleblower Aid Chief Legal Counsel Andrew P. Bakaj to Senate Select
Committee on Intelligence Chairman Tom Cotton (Apr. 14, 2025), 2025_0414_Berulis-
28 Disclosure-with-Exhibits.s.pdf.
40
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 42 of 59

1 220. Defendants initiated the personal Medicaid data transfer “just as the Trump

2 administration was ramping up its immigration enforcement efforts in Southern California.”

3 Order Granting TRO, ECF No. 64, Newsom v. Trump, No. 25-cv-04870 (N.D. Cal., June 12,

4 2025).

5 221. Defendants have not published a new SORN or other notice in the Federal Register

6 relating to this change in practice, depriving Plaintiffs, and members of the public of information

7 such as planned routine uses of this system of records, and the opportunity for comment.

8 222. Defendants have not withdrawn or revised any of their statements and policies to the

9 States and members of the public advising that Medicaid data containing personal and protected

10 information shall only be used for purposes of administration of the Medicaid program.

11 223. Upon information and belief, Defendants’ rushed transfer of this data from HHS to

12 DHS over the objections of career staff, who reportedly questioned whether the transfer violated

13 federal law and ethics, raises concerns that Defendants failed to comply with FISMA’s

14 requirements concerning controls and limitations on access to and transfer of secure information,

15 as well as CMS policies and procedures promulgated to comply with FISMA and protect the

16 privacy, security and integrity of sensitive government data.

17 224. Even if Defendants had published a SORN describing immigration enforcement and

18 mass surveillance as intended uses for the collected Medicaid data, the Privacy Act would

19 nonetheless prohibit them from using the data for such purposes, because immigration

20 enforcement and mass surveillance are not compatible with the purpose for which the data was

21 collected—to administer the Medicaid program.

22 225. Upon information and belief, in making their decision to change longstanding policy

23 and transfer mass quantities of personal Medicaid data from HHS to DHS, Defendants have failed

24 to consider or grapple with the clear negative ramifications (described in paragraphs 226-254

25 below) of allowing DHS unfettered access to sensitive health records.

26

27

28
41
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 43 of 59

1 III. Defendants’ Actions Will Cause Harm

2 a. Defendants Actions Will Interfere with State Medicaid Programs

3 226. In the absence of the requested relief, Defendants’ actions will cause serious,

4 irreparable harm to Plaintiff States and their Medicaid programs.

5 227. Defendants’ actions imminently and irreparably threaten Plaintiffs’ sovereign

6 interests by interfering with State authority to administer the Medicaid program, and reducing the

7 State’s ability to access federal support for that program as Congress has authorized.

8 228. As California’s state legislature has explained, “[a] relationship of trust between

9 California’s immigrant community and state and local agencies is central to the public safety of

10 the people of California,” and this “trust is threatened when state and local agencies are entangled

11 with federal immigration enforcement, with the result that immigrant community members fear

12 […] seeking basic health services […] to the detriment of public safety and the well-being of all

13 Californians.” Cal. Gov’t. Code § 7284.2(c).

14 229. In administering their Medicaid and other healthcare programs, the States have relied

15 on the federal government’s assurances that it will follow the law and protect confidentiality.

16 This includes the States’ provision of federally funded Medicaid for health emergencies and

17 childbirth to millions of patients who would otherwise not be Medicaid eligible. Defendants’

18 actions undermine those reliance interests and interfere with the terms and conditions under

19 which the States have agreed to operate their Medicaid programs.

20 230. Patients, in turn, have also relied on the government’s representations of

21 confidentiality. Individuals provide the most sensitive data to the States through the Medicaid

22 program, because they trust that neither the State nor the federal government will use that

23 protected health information for any purpose other than the administration of the program, as

24 required by federal law. See 42 U.S.C. § 1306(a); 42 C.F.R. § 401.101(b).

25 231. If CMS is permitted to transfer participants’ Medicaid data to DHS for general

26 immigration enforcement purposes, that trust will likely be irreparably damaged, especially for

27 the families (including U.S. citizens) of undocumented immigrants, who risk deportation as a

28 result of lawfully seeking Medicaid coverage for emergency medical treatment.

42
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 44 of 59

1 232. As a result, Defendants’ mass transfer of sensitive Medicaid data will cause a

2 predictable chilling effect on individuals’ willingness to enroll in Medicaid programs for which

3 they are legally eligible. This chilling effect will be most acute among marginalized groups, such

4 as: immigrants, transgender individuals, people with mental illness, and those seeking of

5 reproductive and gender affirming care.

6 233. Already, advocates who advise noncitizens are recommending that individuals and

7 families balance the value of seeking healthcare against the possible risks that their information

8 may be shared with ICE for immigration enforcement purposes.

9 234. Many residents of the States are likely to avoid enrolling in healthcare programs for

10 which they are eligible as a result of CMS’s data sharing with DHS, fearing their data will be

11 used to initiate immigration enforcement actions against them or their family members. This

12 includes both undocumented immigrants, who are legally entitled to Medicaid coverage for

13 emergency medical services including childbirth, and legal residents, who reasonably fear that

14 DHS will initiate immigration enforcement actions against them, given this administration’s track

15 record of haphazard and error-prone immigration enforcement. 13

16 235. As a result of CMS sharing personal information with DHS, uninsured immigrants

17 will be more likely to avoid going to the emergency room or calling an ambulance to seek life-

18 saving treatment—for themselves or for their children—for fear that doing so will make them a

19 target for deportation.

20 236. Indeed, the public reporting of data sharing between CMS and DHS has already

21 caused widespread confusion and fear that Medicaid data will be used to locate and target

22 immigrants for deportation.

23 237. This fear is well-founded. DHS has rescinded a longstanding directive that had

24 prohibited ICE from conducting immigration enforcement operations at “sensitive locations” such

25 as hospitals and clinics. The administration has been outspoken about its goal of aggressive

26

27 13
See, e.g., Kyle Cheney, Trump Administration Acknowledges Another Error in a High Profile
Deportation, Politico (May 16, 2025), https://www.politico.com/news/2025/05/16/trump-
28 administration-another-error-high-profile-deportation-00355377.
43
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 45 of 59

1 immigration enforcement, promising “millions and millions of deportations.” 14 Between January

2 and April of this year, ICE has deported over 142,000 U.S. residents, at least 25% of whom had

3 no convictions or pending criminal charges. 15 Despite this aggressive enforcement campaign,

4 news outlets have reported that the administration is still unhappy with the pace of deportation

5 numbers, and ICE is under pressure from the President to arrest 1,200-3,000 people per day. 16

6 238. Exacerbating the fear of deportation among immigrants is the fact that, under this

7 administration, “deportation” no longer necessarily means being sent back to one’s home country.

8 For example, DHS has “deported” nearly 300 U.S. residents to a Centre for Terrorism

9 Confinement (CECOT) prison in El Salvador, 17 including at least one individual who was

10 mistakenly “deported,” despite being legally present in the United States. 18 This has prompted

11 the United Nations High Commissioner to call for changes in U.S. policy to avoid serious human

12 rights concerns, including the risk of “torture or other irreparable harm” that may be suffered at

13 CECOT. 19 The administration has also announced that an undisclosed number of U.S. residents

14 are now being detained at Guantanamo Bay due to immigration enforcement efforts. 20

15 239. Healthcare providers, including the California Medical Association, warn that the

16 federal government’s failure to adhere to patient privacy protections and misuse of Medicaid data

17 for immigration enforcement purposes will make people less likely to seek medically necessary

18 healthcare. 21

19 14
See, e.g., Rebecca Santana et al., Trump Rolls Out His Blueprint on Border Security, But His Orders
Will Face Challenges, AP NEWS (Jan. 20, 2025), https://apnews.com/article/trump-deportation-
20 immigration-homan-asylum-inauguration-ac10480dc636b758ab3c435b974aeb19.
15
Dep’t of Homeland Security Press Release, “100 Days of Making America Safe Again (April 29, 2025)
21
https://www.dhs.gov/news/2025/04/29/100-days-making-america-safe-again.
22
16
See Welker, Kristen et al., Trump is ‘Angry’ that Deportation Numbers are not Higher, (Feb. 7 , 2025),
https://www.nbcnews.com/politics/national-security/trump-angry-deportation-numbers-are-not-higher-
23 rcna191273.
17
See Dep’t of Homeland Security Press Release, supra, n. 15.
24 18
See Id.; Bustillo, Ximena, Trump Administration Admits Maryland Man Sent to El Salvador Prison By
Mistake, NPR (April 1, 2025) https://www.npr.org/2025/04/01/nx-s1-5347427/maryland-el-salvador-error.
25 19
UN News, US Deportations Raise Serious Human Rights Concerns, (May 13, 2025)
https://news.un.org/en/story/2025/05/1163181#:~:text=13%20May%202025%20Human%20Rights,to%20
26 El%20Salvador%20remain%20unclear.
20
See Dep’t of Homeland Security Press Release, supra, n. 15.
27 21
See Kristen Hwang, Gov. Newsom Lambasts Trump for Giving Immigrants’ Health Data to Deportation
Officials, CalMatters (June 13, 2025), https://calmatters.org/health/2025/06/newsom-trump-immigrant-
28 data-deportation-medicaid/.
44
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 46 of 59

1
b. Chilling Effects on Public Health Program Participation Will Cause Further
2 Harm
3 240. The chilling effects caused by Defendants’ actions will, in turn, harm both State
4 finances, operation of State programs, and the public health.
5 241. Individuals who are eligible for federally funded Medicaid but choose not to apply
6 due to concerns about data security and privacy will reduce the amount of federal funding with
7 which the State can provide healthcare to its residents. This will cause direct financial harm to
8 the States, which otherwise receive 50 percent or more in federal matching funds for qualified
9 Medicaid expenditures, including emergency Medicaid.
10 242. Instead of securing federal funding for providing healthcare services to otherwise
11 Medicaid-eligible individuals, Plaintiffs will incur increased uncompensated costs for hospital
12 care in which a treatment or service is not paid for by an insurer or patient, yet is still mandated to
13 be provided by EMTALA.
14 243. This economic harm will be particularly acute for those hospitals and other healthcare
15 facilities that serve a disproportionate share of low-income individuals and noncitizens. Such
16 facilities already operate on thin margins. If public funding drops, and uncompensated care rises,
17 these hospitals will be less able to serve all patients in need.
18 244. In the absence of requested relief, State healthcare providers (including those
19 facilities owned and operated by the State and its political subdivisions) will also face increased
20 administrative costs and burdens, as they will need to devote considerable time and resources to
21 educating frontline and clinical staff regarding new patient privacy risks and rebuilding trust and
22 overcoming objections resulting from confusion and fear.
23 245. To the extent Defendants’ actions chill noncitizens and individuals in mixed-status
24 families from accessing publicly funded health insurance options for which they are eligible, this
25 will result in their being more likely to defer primary or preventive healthcare. Deferred care
26 leads to more complex medical conditions in the future that are more expensive to treat.
27

28
45
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 47 of 59

1 246. This chilling effect will have dire health consequences. Not seeking emergency

2 medical care when it is needed is likely to cause serious health consequences, and even death, not

3 only for undocumented immigrants but also for their children, regardless of immigration status.

4 247. For example, those chilled from accessing federally funded emergency Medicaid for

5 prenatal care will be more likely to experience adverse health effects during pregnancy and

6 childbirth. Decreased access to prenatal care will lead to increased rates of premature births, low

7 birth weight infants, and congenital defects, all of which produce considerable harm to Plaintiffs,

8 in addition to worse health outcomes for the child and parent. The average medical cost to

9 Plaintiffs in the first year of life of a premature or low birth weight baby is up to 10 times higher

10 than the cost of a full-term baby.

11 248. Overall, Defendants’ actions will push more people into the ranks of the uninsured,

12 straining the budgets of state, local, and private health systems and programs.

13 249. As the primary funder for all their low-income residents’ healthcare services,

14 Plaintiffs’ publicly funded healthcare programs will ultimately bear the cost of both financial

15 pressure on safety net providers and the increased public health harms.

16 250. In addition, to the extent Defendants’ actions make noncitizens and other individuals

17 more reluctant to enroll in federally-funded health care programs, Plaintiffs will incur greater

18 costs and burdens to conduct statutorily-required outreach efforts to enroll families and children

19 in those federally-funded programs. See, e.g., 42 U.S.C. § 1397bb.

20 251. Defendants’ actions will also make noncitizens and other individuals more reluctant

21 to enroll in fully state-funded public health insurance programs, undermining the efficacy of those

22 programs.

23 252. Moreover, the States also have a quasi-sovereign interest in protecting the safety and

24 well-being of their residents. This interest is particularly strong when it comes to emergency

25 Medicaid, which includes childbirth.

26 253. Defendants’ actions will undermine the progress the States have made as a result of

27 Medicaid expansion, which has helped in reducing rates of individuals without health insurance

28
46
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 48 of 59

1 to historic lows. For example, in California, 96 percent of children now have private or public

2 health insurance.

3 254. While Plaintiffs do not seek to assert the States’ residents’ own interests in this

4 litigation, those interests are considerable. All residents have a right to access emergency medical

5 care. Those who already received federally funded emergency Medicaid face irreparable harm to

6 their privacy interests if Medicaid information and other PII is improperly accessed or

7 disseminated. Going forward, individuals and families will be forced to choose between those

8 privacy interests and accessing emergency healthcare services for which they are eligible under

9 both federal and state law.

10 CLAIMS

11 FIRST CAUSE OF ACTION

12 Violation of the APA – Arbitrary and Capricious
255. Plaintiffs reallege and incorporate by reference the foregoing allegations as fully set
13
forth herein.
14
256. The Administrative Procedure Act directs courts to hold unlawful and set aside
15
agency actions that are found to be arbitrary, capricious, an abuse of discretion, or otherwise not
16
in accordance with law. 5 U.S.C. § 706(2)(A).
17
257. HHS’s decision to transfer Medicaid data containing protected health information to
18
other federal agencies, and DOGE and DHS’s collection of that data, are “final agency action[s]
19
for which there is no other adequate remedy in a court,” within the meaning of the APA. 5
20
U.S.C. § 704.
21
258. An agency action is arbitrary and capricious if the agency has “relied on factors
22
which Congress has not intended it to consider, entirely failed to consider an important aspect of
23
the problem, offered an explanation for its decision that runs counter to the evidence before the
24
agency, or is so implausible that it could not be ascribed to a difference in view or the product of
25
agency expertise.” Motor Vehicle Mfrs. Ass’n of the U.S., Inc. v. State Farm Mut. Auto. Ins. Co.,
26
463 U.S. 29, 43 (1983).
27

28
47
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 49 of 59

1 259. Defendants failed to engage in reasoned decision-making as required by the APA.

2 Among other deficiencies, Defendants failed to consider the important privacy and public health

3 consequences of their unprecedented transfer and use of state Medicaid data. Defendants have

4 failed to consider the impact their actions will have on their ability to fulfill the Medicaid Act’s

5 purpose of providing medical assistance to those in need.

6 260. Defendants additionally ignored substantial reliance interests in the federal

7 government’s well-established rules and policies regarding the privacy, security, and

8 confidentiality of personal Medicaid healthcare data.

9 261. Although Defendants may change their policies within statutory limits, the agency

10 must “provide a reasoned explanation for the change.” Encino Motorcars, LLC v. Navarro, 579

11 U.S. 211, 221 (2016). Defendants have not even provided notice of their change in policy, much

12 less the necessary “satisfactory explanation” for their about-face on Medicaid confidentiality

13 rules. See State Farm, 463 U.S. at 43.

14 262. Defendants’ actions are arbitrary and capricious in violation of § 706(2)(A) of the

15 APA.

16 SECOND CAUSE OF ACTION

17 Violation of the APA, Contrary to Law
263. Plaintiffs reallege and incorporate by reference the foregoing allegations as fully set
18
forth herein.
19
264. HHS’s transfer of Medicaid data containing personal health information to other
20
federal agencies, and DOGE and DHS’s collection of that data, are “final agency action[s] for
21
which there is no other adequate remedy in a court,” within the meaning of the APA. See 5 U.S.C.
22
§ 704.
23
265. These final agency actions are unlawful, and should be set aside by the court, because
24
they are not in accordance with law, id. § 706(2)(A); were taken “in excess of statutory
25
jurisdiction, authority, or limitations, or short of statutory right,” id. § 706(2)(C); and fail to
26
observe “procedure required by law,” id. § 706(2)(D).
27

28
48
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 50 of 59

1 266. As set forth in paragraphs 56-66, supra, the Social Security Act provides, “[n]o

2 disclosure ... of any file, record, report, or other paper, or any information […] shall be made

3 except as the head of the applicable agency may by regulations prescribe and except as otherwise

4 provided by Federal law.” 42 U.S.C. § 1306 (a)(1) (emphasis added); see also 42 U.S.C.

5 § 1306(a)(2) (applying this privacy provision to both HHS and the Social Security

6 Administration).

7 267. Far from authorizing this transfer of data, federal regulations caution that Medicaid

8 records should only be disclosed for “purposes directly connected with the administration” of the

9 State’s Medicaid plan. 42 C.F.R. § 431.300(a).

10 268. Immigration enforcement, population surveillance, or other similar federal policy

11 objectives are not permissible grounds for disclosure of Medicaid data.

12 269. Defendants’ actions contravene the Social Security Act and are therefore not in

13 accordance with law in violation of the APA.

14 270. Defendants’ actions also trespass federal statutes enacted to protect the privacy,

15 integrity, and security of data held by the government.

16 271. As set forth in paragraphs 67-78, supra, the Privacy Act sets strict procedural

17 requirements before an agency can create or revise a system of records and collect individuals’

18 data. 5 U.S.C. § 552a(e).

19 272. By collecting and transferring personal Medicaid data, without publishing a notice

20 required by 5 U.S.C. § 552a(e), Defendants failed to comply with the Privacy Act’s informational

21 and procedural requirements.

22 273. Additionally, Section 552a(b) of the Privacy Act further prohibits disclosure of

23 records from systems of records absent certain conditions.

24 274. Disclosure from HHS systems of records to DOGE or DHS employees would not

25 meet any of the conditions enumerated in 5 U.S.C. § 552a(b), and is therefore inconsistent with

26 the Privacy Act.

27 275. Specifically, disclosure of personal Medicaid data to agencies outside HHS for the

28 purpose of immigration enforcement is not “a purpose which is compatible with the purpose for
49
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 51 of 59

1 which [the data] was collected.” Id. § 552a(a)(7). Therefore, even if CMS and DHS have

2 published a SORN describing immigration enforcement as a “routine use,” the agencies would

3 nevertheless be in violation of the Privacy Act. Id. § 552a(b)(3); 5 U.S.C. § 552a(a)(7).

4 276. Defendants’ actions contravene the Privacy Act and are therefore not in accordance

5 with law in violation of the APA.

6 277. As set forth in paragraphs 79-82, supra, HIPAA limits the use and disclosure of

7 individuals’ protected health information, including information transferred from CMS, which is

8 covered entity under HIPAA, to DHS.

9 278. Upon information and belief, none of the impacted individuals consented to the

10 transfer of their Medicaid data, and CMS is neither expressly permitted nor required to transfer

11 records to DHS.

12 279. To the extent DHS provided a written request for the data, that request was not

13 sufficiently specific and limited in scope to qualify for HIPAA’s law enforcement exception.

14 280. Defendants’ actions contravene HIPAA and are therefore not in accordance with law

15 in violation of the APA.

16 281. As set forth in paragraphs 83-90, supra, to comply with FISMA, CMS has developed,

17 documented, and implemented an agency-wide program to provide information security for the

18 information and systems that support the operations and assets of the agency, including those

19 provided or managed by another agency, contractor, or other sources. CMS was required to do so to

20 comply with standards implementing FISMA set out by NIST.

21 282. Upon information and belief, by transferring Plaintiff States’ Medicaid data files to

22 DHS in a rushed manner and over the objections of career staff, Defendants likely failed to

23 comply with CMS’s own policies for complying with FISMA, and for sharing and protecting

24 sensitive data in a manner that ensures the security and integrity of that data.

25 283. Defendants’ actions violate privacy and data security law and are therefore in

26 violation of the APA because they are not in accordance with law, 5 U.S.C. § 706(2)(A), in

27 excess of statutory authority, limitations, and right, 5 U.S.C. § 706(2)(C) and without observance

28 of procedure required by law, 5 U.S.C. § 706(2)(D).

50
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 52 of 59

1
THIRD CAUSE OF ACTION
2 Violation of the APA – Rulemaking Without Proper Procedure
3 (Against HHS)
284. Plaintiffs reallege and incorporate by reference the foregoing allegations as fully set
4
forth herein.
5
285. Under the APA, an agency must provide the public with notice of a proposed rule, 5
6
U.S.C. § 553(b), and give “interested persons an opportunity to participate in the rule making
7
through submission of written data, views, or arguments.” Id. § 553(c). Agencies cannot evade
8
the APA’s requirements merely by declining to publish a rule for comment.
9
286. Upon information and belief, as alleged in the First and Second Causes of Action
10
above, HHS has abandoned or substantially amended well-established confidentiality
11
requirements that limit transfer of data via policy and regulation, which may be released only
12
under identified and limited circumstances.
13
287. HHS did so without the opportunity for notice and comment, without amending any
14
otherwise applicable Medicaid rules and agreements with the States, and without any prior notice
15
to the public whatsoever.
16
288. HHS’s rescission of the Richardson Waiver does not excuse HHS from compliance
17
with the APA as applied to this kind of substantive change in policy.
18
289. Defendants’ actions are not in accordance with law because they violate the APA’s
19
procedural requirements.
20

21 FOURTH CAUSE OF ACTION

Spending Clause: Lack of Clear Notice
22 U.S. Const. art. I, § 8, cl. 1
23 290. Plaintiffs reallege and incorporate by reference the foregoing allegations as fully set

24 forth herein.

25 291. As explained in the prior Causes of Action above, to the extent that Defendants intend

26 to create a novel expansion of the scope of allowable sharing of Medicaid data, their conduct is

27 unlawful. Their conduct is also unconstitutional because Plaintiff States did not have clear notice

28 that this was a condition of federal Medicaid funding.

51
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 53 of 59

1 292. Article I of the U.S. Constitution specifically grants Congress the power “to pay the

2 Debts and provide for the common Defense and general Welfare of the United States.” U.S.

3 Const., art. I, § 8, cl. 1.

4 293. Incident to the spending power, “Congress may attach conditions on the receipt of

5 federal funds.” South Dakota v. Dole, 483 U.S. 203, 206 (1987). However, any conditions must

6 be imposed “‘unambiguously’” to enable “‘States to exercise their choice knowingly, cognizant

7 of the consequences of their participation.’” Id. at 207 (quoting Pennhurst State Sch. & Hosp. v.

8 Halderman, 451 U.S. 1, 17 (1981)).

9 294. There is no statute that clearly states that Medicaid funds provided by Defendants are

10 conditioned on consent for unfettered transfer of that Medicaid data to agencies other than HHS

11 for purposes of immigration enforcement, or any other purposes unrelated to the Medicaid

12 program.

13 295. Therefore, conditioning federal Medicaid funding on unfettered access to state and

14 residents’ personal healthcare data would violate this limitation on the spending power, because,

15 inter alia, Plaintiffs did not have “clear notice” of such a condition. See Arlington Cent. Sch. Dist.

16 Bd. of Educ. v. Murphy, 548 U.S. 291, 296 (2006).

17 296. Moreover, conditions on federal grants must be related to the national program for

18 which the grant monies are provided. Dole at 207 (citing Massachusetts v. United States, 435

19 U.S. 444, 461 (1978)). Defendants’ efforts to mine sensitive and protected beneficiary data for

20 purposes like immigration enforcement is not related to Medicaid’s programmatic goals of

21 “provid[ing] health coverage to millions of Americans, including eligible low-income adults,

22 children, pregnant women, elderly adults and people with disabilities” and “provid[ing] an

23 important foundation for maintaining the health of our nation.” Medicaid,

24 https://www.medicaid.gov/medicaid and https://www.medicaid.gov/about-us (last visited Jun. 25,

25 2015). Nor is there any connection between this type of sharing of beneficiary data and the sound

26 administration of the Medicaid program. Conditioning Medicaid funds on States’ sharing of

27 sensitive beneficiary data is therefore inconsistent with the Spending Clause.

28
52
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 54 of 59

1 297. Additionally, to the extent that Defendants are attempting to create a new Medicaid

2 data sharing condition on federal Medicaid funding, such a condition is unlawful because it was

3 issued after Plaintiffs accepted federal funds, and Defendants cannot “surpris[e] participating

4 States with post acceptance or ‘retroactive’ conditions.” Pennhurst, 451 U.S. at 25.

5 298. Pursuant to 28 U.S.C. § 2201(a), Plaintiffs are entitled to a declaration that their

6 receipt of federal Medicaid funds is not conditioned on consent to unfettered waiver of Medicaid

7 beneficiaries’ privacy and confidentiality rights.

8 299. Plaintiffs are also entitled to a preliminary and permanent injunction barring

9 Defendants from suspending funds or otherwise taking enforcement action against Plaintiffs on

10 the basis of such a purported consent to waiver.

FIFTH CAUSE OF ACTION
11 Ultra Vires
12 300. Plaintiffs reallege and incorporate by reference the foregoing allegations as fully set
13 forth herein.
14 301. No administrative agency can take any action that exceeds their statutory authority.
15 302. Defendants have acted ultra vires in disclosing the States’ Medicaid data files,
16 including records containing millions of individuals’ personal health information, to DHS. Such
17 disclosure is prohibited by statute and not within any exception permitting disclosure.
18 303. Defendants have acted ultra vires in using the States’ Medicaid data files for
19 immigration enforcement and other purposes other than those expressly provided by statute.
20 304. Defendants have acted in excess of their legal authority contrary to specific
21 prohibitions present in law and regulations governing the treatment and protection of the States’
22 Medicaid data files obtained and maintained by the federal government.
23 305. For these reasons, Plaintiffs are also entitled to a declaration that Defendants’ actions
24 are unlawful, and the Court should preliminarily and permanently enjoin Defendants from the
25 unlawful disclosure and use of this data except as provided by law and as necessary for the
26 administration of the Medicaid program.
27

28
53
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 55 of 59

1 PRAYER FOR RELIEF

2 Wherefore, Plaintiffs respectfully request that the Court enter a judgment against

3 Defendants and award the following relief:

4 1. A declaration that HHS’s transfer of Medicaid data containing personally identifiable,

5 protected health information to DHS was unauthorized and contrary to the laws of

6 the United States;

7 2. A declaration that any actions implementing the Information Silos EO are contrary to

8 the laws of the United States to the extent they are applied to interagency transfers of

9 Medicaid data containing personally identifiable, protected health information;

10 3. Preliminarily and permanently enjoin HHS from further transferring Medicaid data

11 containing personally identifiable, protected health information to DOGE, DHS, or

12 any other federal agency, except as allowed under federal law;

13 4. Preliminarily and permanently enjoin DOGE, DHS, or any other federal agency from

14 using Medicaid data containing personally identifiable, protected health information

15 for purposes of immigration enforcement, population surveillance, or other similar

16 purposes;

17 5. Ordering the impoundment, disgorgement, and destruction of all copies of any

18 Medicaid data containing personally identifiable, protected health information that

19 has already been unlawfully disclosed to DHS and DOGE;

20 6. Award the Plaintiffs costs and reasonable attorneys’ fees; and

21 7. Grant such additional relief as the Court deems proper and the interests of justice may

22 require.

23

24

25

26

27

28
54
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 56 of 59

1 Dated: July 1, 2025 Respectfully submitted,

2
KRISTIN K. MAYES ROB BONTA
3 Attorney General for the State of Arizona Attorney General for the State of California
NELI PALMA
4 Senior Assistant Attorney General
/s/__ Alexa G. Salas_________________ KATHLEEN BOERGERS
5 ALEXA G. SALAS* Supervising Deputy Attorney General
Assistant Attorney General MARIA F. BUXTON
6 2005 North Central Avenue KATHERINE MILTON
Phoenix, Arizona 85004 KEVIN G. REYES
7 (602) 542-3333
[email protected]
8 [email protected] /s/_Anna Rich______________________
Attorneys for the State of Arizona ANNA RICH
9 *Pro hac vice forthcoming Deputy Attorneys General
Attorneys for Plaintiff State of California
10

11 PHILIP J. WEISER WILLIAM TONG

Attorney General for the State of Colorado Attorney General of Connecticut
12

13 /s/_Ryan Lorch__________________ /s/_Janelle Medeiros_________________

RYAN LORCH JANELLE MEDEIROS*
14 Senior Assistant Attorney General Special Counsel for Civil Rights
SAM WOLTER 165 Capitol Ave
15 Assistant Attorney General Hartford, CT 06106
1300 Broadway, #10 (860) 808-5450
16 Denver, CO 80203 [email protected]
(720) 508-6000 *Pro hac vice forthcoming
17 [email protected] Attorneys for Plaintiff State of Connecticut
[email protected]
18 Attorneys for Plaintiff State of Colorado

19 KWAME RAOUL KATHLEEN JENNINGS

Attorney General for the State of Illinois Attorney General for the State of Delaware
20

21 /s/__Harpreet Khera________________ /s/__Vanessa L. Kassab_________________

HARPREET KHERA* IAN R. LISTON
22 Bureau Chief, Special Litigation Director of Impact Litigation
SHERIEF GABER* JENNIFER KATE AARONSON
23 Assistant Attorney General VANESSA L. KASSAB
Office of the Illinois Attorney General Deputy Attorney General
24 115 S. LaSalle St. Delaware Department of Justice
Chicago, IL 60603 820 N. French Street
25 (773) 590-7127 Wilmington, DE 19801
[email protected] (302) 683-8899
26 [email protected] [email protected]
Attorneys for Plaintiff State of Illinois Attorneys for Plaintiff State of Delaware
27

28
55
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 57 of 59

1 AARON M. FREY ANNE E. LOPEZ

Attorney General for the State of Maine Attorney General for the State of Hawaiʻi
2

3 /s/__Brendan Kreckel________________ /s/__ Kalikoʻonālani D. Fernandes______

BRENDAN KRECKEL DAVID D. DAY
4 Assistant Attorney General Special Assistant to the Attorney General
Office of the Attorney General KALIKOʻONĀLANI D. FERNANDES
5 6 State House Station Solicitor General
Augusta, ME 04333-0006 425 Queen Street
6 Tel.: 207-626-8800 Honolulu, HI 96813
[email protected] (808) 586-1360
7 Attorneys for Plaintiff State of Maine [email protected]
[email protected]
8 Attorneys for Plaintiff State of Hawaiʻi

9 ANTHONY G. BROWN KEITH ELLISON

Attorney General for the State of Maryland Attorney General for the State of Minnesota
10

11 /s/__Michael Drenzer_______________ /s/__Katherine J. Bies______________

MICHAEL DREZNER* KATHERINE J. BIES (CA Bar No. 316749)
12 Senior Assistant Attorney General Special Counsel, Rule of Law
Office of the Attorney General 445 Minnesota Street, Suite 600
13 200 Saint Paul Place, 20th Floor St. Paul, Minnesota, 55101
Baltimore, Maryland 21202 (651) 300-0917
14 410-576-6959 [email protected]
[email protected] Attorneys for Plaintiff State of Minnesota
15 Attorneys for Plaintiff State of Maryland

16
ANDREA JOY CAMPBELL AARON D. FORD
17 Attorney General for the State of Massachusetts Attorney General for the State of Nevada

18
/s/__Katherine Dirks_____________ /s/__Heidi Parry Stern_____________
19 KATHERINE DIRKS HEIDI PARRY STERN (Bar. No. 8873)
Chief State Trial Counsel Solicitor General
20 Office of the Massachusetts Attorney General Office of the Nevada Attorney General
1 Ashburton Place Boston, MA 02108 555 E. Washington Ave., Ste. 3900
21 (617) 963-2277 Las Vegas, NV 89101
[email protected] [email protected]
22 Attorneys for Plaintiff Commonwealth of Attorneys for Plaintiff State of Nevada
Massachusetts
23

24 DANA NESSEL MATTHEW J. PLATKIN

Attorney General for the State of Michigan Attorney General for the State of New
25 Jersey

26 /s/__Neil Giovanatti___________ /s/__Elizabeth R. Walsh_____________

NEIL GIOVANATTI* ELIZABETH R. WALSH*
27 BRYAN BEACH* ESTEFANIA PUGLIESE-SAVILLE*
Assistant Attorneys General Deputy Attorneys General
28 Michigan Department of Attorney General Office of the Attorney General
56
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 58 of 59

1 525 W. Ottawa 25 Market Street

Lansing, MI 48909 Trenton, NJ 08625
2 (517) 335-7603 (609) 696-5289
[email protected] [email protected]
3 [email protected] Attorneys for Plaintiff State of New Jersey
Attorneys for Plaintiff State of Michigan
4

5 LETITIA JAMES RAUL TORREZ

Attorney General for the State of New York Attorney General of New Mexico
6

7 /s/__Mark Ladov__________ /s/_Amy Senier__________

MARK LADOV* AMY SENIER
8 Special Counsel Senior Litigation Counsel
RABIA MUQADDAM* New Mexico Department of Justice
9 Special Counsel for Federal Initiatives P.O. Drawer 1508
ZOE LEVINE* Santa Fe, NM 87504-1508
10 Special Counsel for Immigrant Justice (505) 490-4060
NATASHA KORGAONKAR* [email protected]
11 Special Counsel Attorneys for Plaintiff State of New Mexico
28 Liberty St. New York, NY 10005
12 (212) 416-8240
[email protected]
13 Attorneys for Plaintiff State of New York

14
PETER F. NERONHA CHARITY R. CLARK
15 Attorney General for the State of Rhode Island Attorney General for the State of Vermont

16
/s/_Lee Staley__________ /s/__Ryan P. Kane__________
17 LEE B. STALEY* RYAN P. KANE
Chief, Health Care Unit Deputy Solicitor General
18 150 South Main Street 109 State Street
Providence, RI 02903 Montpelier, VT 05609
19 Phone: (401) 274-4400 (802)828-3171
Fax: (401) 222-2995 [email protected]
20 [email protected] Attorneys for Plaintiff State of Vermont
Attorneys for Plaintiff State of Rhode Island
21

22 DAN RAYFIELD NICHOLAS W. BROWN

Attorney General State of Oregon Attorney General of Washington
23

24 /S/__BRIAN SIMMONDS MARSHALL__________ /s/__Zane Muller__________

BRIAN SIMMONDS MARSHALL ZANE MULLER, WSBA 63777
25 Senior Assistant Attorney General WILLIAM MCGINTY, WSBA #41868
Oregon Department of Justice Assistant Attorneys General
26 100 SW Market Street 800 Fifth Avenue, Suite 2000
Portland, OR 97201 Seattle, WA 98104-3188
27 Tel (971) 673-1880 206-464-7744
Fax (971) 673-5000 Attorneys for Plaintiff State of Washington
28 [email protected]
57
Complaint for Declaratory and Injunctive Relief
 Case 3:25-cv-05536 Document 1 Filed 07/01/25 Page 59 of 59

1 Attorneys for Plaintiff State of Oregon

5 OK2025900292
CA v. HHS Medicaid Data Complaint Final 3 pm
6

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28
58
Complaint for Declaratory and Injunctive Relief