Seattle community health clinics prepare, seek answers after Medicaid data release

SEATTLE – In the weeks since federal deportation officials were granted access to millions of Medicaid enrollees’ personal and medical data, Washington state’s community health clinics and providers have hunted for answers.

How did this happen? What does this mean for patient privacy going forward? They’ve largely been met with silence.

An order to release the information came from the U.S. Department of Health and Human Services, hospital and clinic leaders learned, though many say they first heard the news through media reports or local partners.

Many still don’t know what sensitive patient information was given to the Department of Homeland Security, or what federal officials plan to do with it. They fear the data will be used for immigration enforcement, as part of the Trump administration’s nationwide effort to locate and deport undocumented residents.

Local health providers and civil rights groups say the data release – and the lack of information from the state about how it happened – is a serious violation of privacy that potentially puts tens of thousands of immigrants at risk.

“This has been incredibly troubling,” Esther Lucero, president and CEO of the Seattle Indian Health Board, said last week. “I’m so disappointed the state hasn’t issued a statement about this. We’re really lacking leadership and direction.”

On Tuesday, a multistate lawsuit filed in Northern California federal court, which Washington joined, alleged the data transfer was illegal and aims to block its use for deportation purposes.

Washington is one of at least seven states whose Medicaid patient data was handed over to DHS, which oversees Immigration and Customs Enforcement, without providers’ knowledge or consent, according to the Associated Press. The Centers for Medicare and Medicaid Services was ordered to share similar datasets with DHS from California, New York, Oregon, Illinois, Minnesota and Colorado – all states that, like Washington, allow non-U.S. citizens to enroll in Medicaid-like programs.

States already were sharing most of this information with CMS, as a longtime requirement to receive federal funding, but didn’t realize it would be passed along to other nonhealth agencies.

The data release sparked further outrage in Washington when state officials noted they also shared more medical information, such as visits to health clinics, than required.

“I’m angry,” said Abigail Echo-Hawk, executive vice president of the Seattle Indian Health Board, which has taken a number of steps in recent weeks to increase patient security at its clinics and to instruct staffers on what to do should federal officers show up. These measures have come with financial cost, Echo-Hawk said.

Other Seattle-area clinics have rolled out similar employee trainings and fielded a growing number of questions from patients. SIHB leaders wrote to the governor’s office last month to ask for guidance but haven’t received answers, Echo-Hawk said.

“They have placed the burden on us for their mistake, and they should be ashamed of themselves,” Echo-Hawk said.

What happened

States have long been required to submit data to the federal government on Medicaid enrollees in order to receive funding, according to the state Health Care Authority, which administers Apple Health in Washington.

Since August , the state has also been sharing data from its Apple Health Expansion program, a Medicaid-like program launched last summer to cover health services for low-income residents regardless of immigration status. All services provided through that program are paid for with state taxpayer dollars, except emergency care, which is federally reimbursed.

The Health Care Authority told clients in an online resource page around that time that data would remain confidential. “Absent a court order or other legal requirement,” HCA wrote, it would not share their information with any immigration agency, including ICE.

Because the state gets a slice of federal funding for the program for emergency care, HCA must share names, addresses and phone numbers of all Apple Health Expansion enrollees, as well as personal information and claims data of Medicaid members, HCA said in a 10-page FAQ document last week.

HCA also reports details from Apple Health Expansion emergency visits to the Centers for Medicare and Medicaid Services, but says it did not know the data would be sent to other federal agencies.

That’s what now seems to be happening on a federal level.

“It is our understanding that historically and by law, this information had never been shared before the Trump administration ordered CMS to turn it over,” the state Health Care Authority wrote in the FAQ document.

Washington officials did not have to share information about nonemergency medical visits covered under Apple Health Expansion, according to HCA. That includes data on noncitizens who received health services like pregnancy care.

HCA realized this and stopped sharing that clinical data in May, the agency said.

Gov. Bob Ferguson’s office did not respond this week to requests for further information.

It’s unclear how many immigrants in Washington had their personal information turned over to immigration authorities, but health advocates said tens of thousands of people could have been affected.

Washington for years has footed the bill for pregnancy-related coverage and health care for children in low- to mid-income households regardless of immigration status. In May, the state covered more than 54,000 children and nearly 10,000 pregnant people whose immigration status made them ineligible for Apple Health coverage, according to HCA data.

Before the creation of Apple Health Expansion, medical providers often had patients who appeared to be undocumented, said Justin Gill, president of the Washington State Nurses Association and an urgent care nurse practitioner in Everett. Many opted not to receive care because they couldn’t afford it, or they feared immigration consequences, he said.

The launch of Apple Health Expansion was a major step toward getting vital health services to more noncitizens, Gill said. The program hit its enrollment cap in the first year, registering about 13,000 people, according to HCA.

Gill recalled one patient last year, a mother with an infection and who was likely undocumented. Her medical team recommended she go to the emergency department, but she was worried about the cost because she didn’t have health insurance, and feared her information being collected.

With the help of an interpreter, Gill walked her through the program online in Spanish. He assured her enrolling would not affect her immigration status.

The Everett nurse practitioner now fears that in steering patients toward the program, he might have put them or their families at risk.

“It makes me question as a health care provider, ‘Did I do the right thing for them? Did I potentially harm them and their loved ones?’ ” Gill said.

Changes underway

At the Seattle Indian Health Board, the data release already has prompted changes.

A week after hearing federal immigration authorities had accessed Medicaid records, the organization closed its clinic for two hours to train about 150 staffers, said Lucero, clinic president and CEO. They walked employees through different types of warrants, reviewed de-escalation tactics, and introduced a new “Code White.”

In 2024, about 58% of the board’s patients were covered by Apple Health.

Patrick Henry, the organization’s associate medical officer, would be one of the responders to a “Code White” incident, which will now be called if any state, federal law enforcement or military agency arrives.

“We just want to understand why they’re here,” Henry said. “It’s important we understand exactly what they’re asking. Do they have a warrant? Subpoena? What kind is it?”

In addition, new posters at the clinic mark private patient areas, and there are plans to add an extra security feature to a number of doors, so only staffers with badges can open them. They’re still calculating how much those changes will cost, Henry said.

Seattle Indian Health Board and other local health clinics have not reported seeing ICE agents at medical facilities, but their staffers are preparing for the potential interaction.

At Neighborcare Health, which runs more than 30 medical, dental and school clinics in the Seattle area, staffers carried out drills to review which executive leaders to call if need be, said CEO Rashad Collins.

Seattle-based nonprofit Asian Counseling and Referral Service also has a handful of “designated authorized personnel” who are the only people allowed to interact with enforcement agencies, a protocol established during the first Trump administration, said Deputy Director G. Castro.

Castro has also wrestled with feelings of broken patient trust, thinking back to how ACRS ensured clients their data would be safe from ICE. “We told them it’s safe and now it’s not,” he said.

Kelli Nomura, CEO of International Community Health Services, said the release of private medical information to nonhealth agencies is an issue everyone should take seriously.

“It sets a precedent that everyone should be aware of,” Nomura said. “Not just Medicaid or immigrant patients.”

Stronger response

As the federal government intensifies immigration threats throughout the country, the region’s health clinics have looked for state support.

On June 19, Lucero and Echo-Hawk of the Seattle Indian Health Board penned a letter to Ferguson’s office, asking him to “take accountability” for the mistaken release of some data to the federal government.

Sattie Zapata-Nyachwaya, health policy program director for the ACLU of Washington, added this week the state “must right this wrong” and that it “owes its people a full accounting of what happened and how it intends to protect this vulnerable community going forward.”

State Attorney General Nick Brown’s joining of the multistate lawsuit this week marked an encouraging step in a statewide response, Echo-Hawk said.

In a statement from Brown announcing the complaint, Ferguson was quoted briefly to call the sharing of data with ICE a “violation of trust for everyone whose data was inappropriately shared, but especially our immigrant communities and mixed-status families.”

“We will stand up for the dignity and right to privacy of all Washingtonians,” Ferguson wrote in the statement.

Even with the filing of the lawsuit, Echo-Hawk said she was still “disheartened” at the lack of direct communication from the governor’s office – which she also attributed to former Gov. Jay Inslee, who was in office when the additional state data was shared last summer.

The Seattle Indian Health Board has yet to receive a response from Ferguson’s office to its June letter, outside confirmation that it was received, she said.

Collins, of Neighborcare, also hopes to hear more from state officials as his clinic staffers try to reassure community members they’re doing everything they can to keep patients safe.

“It’s been a challenge to us a bit, in terms of having to get out and begin responding on our own,” Collins said last week. “We have to educate patients about what happened. They’re asking.”