Attorney General Mayes Sues Trump Administration for Illegally Sharing Arizonans' Private, Personal Health Data

PHOENIX —Attorney General Kris Mayes today joined a multistate coalition in filing a lawsuit challenging the U.S. Department of Health and Human Services’ (HHS) decision to provide unfettered access to individual personal health data to the Department of Homeland Security (DHS), which houses Immigration and Customs Enforcement (ICE). In the seven decades since Congress enacted the Medicaid Act to provide medical assistance to vulnerable populations, federal law, policy, and practice has been clear: the personal healthcare data collected about beneficiaries of the program is confidential, to be shared only in certain narrow circumstances that benefit public health and the integrity of the Medicaid program itself. The Arizona Health Care Cost Containment System (AHCCCS) is Arizona’s Medicaid agency.

In today’s lawsuit filed in the U.S. District Court for the Northern District of California, the attorneys general argue that mass transfer of this data violates the law and ask the court to block any new transfer or use of this data for immigration enforcement purposes. 

"The illegal transfer of Arizonans' private, personally identifiable health data is unacceptable," said Attorney General Mayes. "Arizonans accessing Medicaid services do so with the assurance that their data would be confidential. While administering AHCCCS and other healthcare programs, Arizona has relied on the federal government’s assurances that it will follow the law and protect confidentiality. It appears the federal government has broken their promise." 

Created in 1965, Medicaid is an essential source of health insurance for lower-income individuals and particular underserved population groups, including children, pregnant women, individuals with disabilities, and seniors. The Medicaid program allows each participating state to develop and administer its own unique health plans; states must meet threshold federal statutory criteria, but they can tailor their plans’ eligibility standards and coverage options to residents’ needs. As of January 2025, 78.4 million people were enrolled in Medicaid and the Children’s Health Insurance Program (CHIP) nationwide.  

AHCCCS is Arizona’s Medicaid agency that offers healthcare programs to serve qualifying Arizona residents. AHCCCS is Arizona’s largest insurer, covering more than 2 million individuals. AHCCCS provides health insurance to almost one-in-four Arizona residents and more than 40 percent of Arizonans enrolled in AHCCCS are children. AHCCCS uses federal, state, county, and other funds to provide healthcare coverage to the State’s Medicaid population. Consistent with federal law, AHCCCS provides certain emergency healthcare services to uninsured qualified and nonqualified immigrants through the Federal Emergency Services Program.

A certain amount of personal data is routinely exchanged between the states and the federal government for purposes of administering Medicaid, including verifying eligibility for federal funding. Historically, DHS has acknowledged that the Medicaid Act and other federal healthcare authorities foreclose the use of Medicaid personal information for immigration enforcement purposes. Arizona has shared this protected health information with the understanding that federal agency safeguards data through robust privacy and security protocols and uses this data only as required to administer and further Medicaid’s purpose. Yet now, the federal government appears to have — without formal acknowledgment — adopted a new policy that allows for the wholesale disclosure and use of state residents’ personal Medicaid data for purposes unrelated to Medicaid program administration. 
 
On June 13, 2025, states learned through news reports that HHS has transferred en masse their state’s Medicaid data files, containing personal health records representing millions of individuals, to DHS. Reports indicate that the federal government plans to create a sweeping database for “mass deportations” and other large-scale immigration enforcement purposes. 
 
The federal government claims it gave this data to DHS “to ensure that Medicaid benefits are reserved for individuals who are lawfully entitled to receive them,” But it is Congress that extended coverage and federal funds for emergency Medicaid to all individuals residing in the United States, regardless of immigration status. The states have and will continue to cooperate with federal oversight activities to ensure that the federal government pays only for those Medicaid services that are legally authorized.  

In today’s lawsuit, the coalition highlights that the Trump Administration’s illegal actions are creating fear and confusion that will lead noncitizens and their family members to disenroll, or refuse to enroll, in emergency Medicaid for which they are otherwise eligible, leaving states and their safety net hospitals to foot the bill for federally mandated emergency healthcare services. These individuals may not get the emergency health services they need and will suffer negative health consequences — and even death — as a result. 
 
The coalition asks that the court find the Trump Administration’s actions arbitrary and capricious and rulemaking without proper procedure in violation of the Administrative Procedure Act, contrary to the Social Security Act, Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Modernization Act, and Privacy Act, and in violation of the Spending Clause. The coalition also asks the court to enjoin HHS from transferring personally identifiable Medicaid data to DHS or any other federal agency and enjoin DHS from using this data to conduct immigration enforcement.  

In filing the lawsuit, Attorney General Mayes, joins the attorneys general of California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Massachusetts, Maine, Maryland, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Vermont, and Washington. 

A copy of the complaint is available below.