ICE Requested Medicaid Data, States Had No Law Stopping Them

In 2024, federal court documents revealed that Immigration and Customs Enforcement had obtained Medicaid beneficiary records—health data on some of the country's most vulnerable people—and shared that information with Palantir Technologies without any agency's explicit knowledge.

The framing has been consistent. It involved a breach, unauthorized access, and data misuse that violated the trust patients placed in a public health system. But the court filings contain something far stranger—ICE did not sneak into state databases, it requested the data. No statute stopped the states from handing it over.

This rests on an unstated assumption. Someone, somewhere, had the legal authority to prevent ICE from asking for Medicaid records in the first place. That assumption is false. Section 1902 of the Social Security Act does contain privacy protections for Medicaid beneficiaries—requiring data be used only for purposes related to eligibility and administration.

But the statute never created a prohibition on states responding to ICE's requests. It created an obligation to reject them for those specific purposes—the distinction matters entirely. What happened with Palantir was data integration without disclosure, a systems design choice that violated procedural accountability. What happened with ICE's initial requests was something less visible and more durable.

No one needed to break a rule. The rule simply did not exist.

This distinction determines what the litigation can actually fix. A court can order Palantir to stop integrating databases, impose penalties, require notice and approval processes—but those are all measures applied after the fact, to behavior that has already occurred, by a company that violated an existing restriction. None of that addresses whether ICE should have access to Medicaid data in the first place. The real question is whether the outcome matters more than the permission structure itself.

A person reviewing a delegation decision understands this instinctively. You can hold someone accountable for misusing authority they were granted. You cannot hold them accountable for having the authority at all. That requires not punishment but redesign.

The question now is whether the states and the court system see immigration enforcement as ICE's legitimate function. If so, whether health data serves it. Everything else flows from that answer.