Epic's 77-Hospital Expansion Collides With Immigration Enforcement as States Turn Health Data Into Surveillance

Epic Systems added 77 hospitals to its electronic health record client base — a market expansion that arrives as state and federal governments turn healthcare data infrastructure into an immigration enforcement tool, creating a collision between EHR vendor growth strategies and the trust required to make digital health records work .

The timing matters. Epic's growth milestone in 2026 coincides with seven states passing laws requiring public health agencies to flag Medicaid recipients to the Department of Homeland Security if their legal status is questioned . More than 75 million people are enrolled in Medicaid or the Children's Health Insurance Program, and a quarter of U.S. children live with an immigrant . When the infrastructure that powers patient care becomes a surveillance tool, the math for healthcare marketers changes entirely.

"This is an issue that is very much on the political radar right now," said Carmel Shachar, a health policy researcher at Harvard Law School . For healthcare systems deploying Epic or any major EHR platform, the question is no longer just clinical interoperability — it's whether patients will show up at all.

The nut: Healthcare marketers built patient acquisition strategies on trust signals — HIPAA compliance badges, patient portal adoption, care coordination messaging. That playbook assumes patients believe their health data stays within the clinical circle. When state legislatures turn Medicaid enrollment systems into immigration reporting mechanisms, every digital touchpoint becomes a potential deterrent. The 77 hospitals adopting Epic are buying into the most widely deployed EHR ecosystem in U.S. health systems. They are also inheriting a data infrastructure that patients may now fear.

The Market Concentration Behind the Headlines

Epic's 77-hospital expansion extends the vendor's dominance in the acute care EHR market. The Madison, Wisconsin-based company already powers records for more than 305 million patients globally, concentrated in large health systems and academic medical centers .

The expansion means more hospitals joining a network effect: Epic's Care Everywhere platform enables patient data exchange across its client base, creating clinical continuity that smaller EHR vendors cannot match. For healthcare marketers, this matters because interoperability drives patient retention — a patient whose records follow them across facilities is less likely to churn to a competitor.

But market concentration creates vulnerability. When one vendor's infrastructure touches hundreds of millions of patient records, policy changes that affect data sharing hit harder. North Carolina's late April law requiring the state Department of Health and Human Services to flag Medicaid recipients applies to whatever EHR system Medicaid enrollment data touches . Indiana, Louisiana, Montana, and Wyoming passed similar measures, with Oklahoma and Tennessee considering legislation . These states hold Republican trifectas — both legislative chambers and the governor's office controlled by the GOP .

The financial stake is clear. Medicaid represents 16 percent of national health expenditures. For safety-net hospitals and Federally Qualified Health Centers, Medicaid patients constitute the majority of the payer mix. If immigrant families delay care or avoid enrollment due to deportation fears, patient volumes drop, reimbursement shrinks, and the business case for expensive EHR implementations weakens.

What Immigrant Deterrence Does to Patient Acquisition Cost

Healthcare marketers measure patient acquisition cost in dollars per new patient — advertising spend, community outreach, digital campaigns divided by new patient visits. The formula assumes patients respond to outreach. When the cost of seeking care includes potential deportation, demand evaporates regardless of marketing spend.

The White House mandated the use of Medicaid data to help identify and deport people . Seven states went further, requiring public health agencies to proactively flag recipients whose legal status is in question . Tennessee's bill, headed to the governor's desk, would require all state agencies to report people suspected of being in the U.S. without legal status .

Immigrants without legal status are ineligible for Medicaid benefits, but green-card holders, asylees, and refugees qualify . The reporting laws create a chilling effect that extends beyond the undocumented population. A lawful permanent resident whose application paperwork is questioned, an asylee whose case is pending — these patients now face risk when they walk into a clinic.

For pediatric hospitals, the math is worse. A quarter of U.S. children live with an immigrant . Citizen children qualify for Medicaid and CHIP regardless of their parents' status, but parents who fear drawing attention to their household will skip well-child visits, vaccinations, and preventive care. The patient acquisition cost becomes infinite — no amount of marketing spend will bring in a family afraid of deportation.

Emergency departments will see the volume. Federal law requires hospitals to stabilize patients regardless of immigration status. What healthcare systems lose is the higher-margin preventive and primary care that keeps people out of the ED and generates sustainable revenue.

The Compliance Collision No One Planned For

HIPAA permits disclosures to law enforcement under specific circumstances, including compliance with court orders and subpoenas [general knowledge]. The new state laws operate in a gray zone — they mandate reporting by public health agencies, not direct access to clinical records by immigration authorities. But the distinction is lost on patients.

Healthcare marketers spent two decades building trust signals around HIPAA compliance. Patient portals, telehealth platforms, and digital intake forms all carry privacy assurances. Those assurances now compete with news coverage of Medicaid data being used for deportation.

The compliance risk for health systems is dual. First, they must comply with state reporting laws where applicable, or face legal penalties. Second, they must maintain patient trust, or lose volume and revenue. There is no marketing message that threads that needle. A hospital cannot simultaneously assure patients their data is protected and comply with a law requiring it to flag patients to federal immigration authorities.

For the 77 hospitals adopting Epic, the vendor provides the infrastructure — the EHR, the patient portal, the interoperability layer. Epic does not control state policy. But patients do not distinguish between the health system, the EHR vendor, and the state Medicaid agency. They see one system, and they see risk.

What the Data Sharing Playbook Missed

Healthcare marketing strategy over the past decade prioritized data activation — using EHR data to personalize outreach, segment populations, and automate care reminders. The assumption was that more data sharing, faster interoperability, and broader network effects would improve outcomes and grow market share.

The assumption held as long as patients believed data sharing served clinical purposes. When data sharing serves deportation, the model breaks.

Health systems in the seven states with reporting laws face an immediate choice: message transparently about what data gets shared and when, or stay silent and hope patients do not notice. Transparency risks deterring patients. Silence risks a trust collapse when the reporting becomes public.

Neither option is good. The better play is to audit every patient-facing communication for unintended signals. A marketing email promoting Medicaid enrollment for children may now be read as an invitation to self-report for deportation. A patient portal message reminding a family to update insurance information could be perceived as a data collection trap.

The 1ness Take

Healthcare marketers must separate what they can control from what they cannot, and act accordingly. You cannot change state immigration reporting laws. You cannot change federal Medicaid data mandates. You can change how your health system signals safety, segments outreach, and designs the patient experience to reduce fear.

First, segment messaging by immigration sensitivity. If your market includes counties with high immigrant populations, your messaging cannot be one-size-fits-all. A general Medicaid enrollment campaign may work in some zip codes and backfire in others. Use geographic and demographic data to tailor campaigns, and test messages with community-based organizations before launching.

Second, shift patient acquisition dollars toward community trust-building, not digital advertising. Paid search and Facebook ads will not overcome deportation fears. Partnerships with trusted community organizations, faith leaders, and schools will. Allocate budget to sponsorships, free health screenings in safe locations, and multilingual health education programs that do not require data collection.

Third, redesign intake to minimize perceived risk. If your patient registration process asks for Social Security numbers, immigration status, or detailed household information upfront, you are losing patients before they see a provider. Collect only what is clinically necessary at first contact. Push insurance verification and billing questions downstream, after trust is established.

Fourth, train front-line staff on what they can and cannot promise. A registration clerk who assures a patient that their information will never be shared is creating legal liability. A clerk who says nothing about data sharing is confirming fears. Develop scripting that is legally accurate and emotionally intelligent: "We collect only the information we need to care for you. We follow all privacy laws, and we are here to help you stay healthy."

Fifth, monitor patient volume by payer mix and ethnicity in real time. If you see Medicaid volumes dropping or no-show rates rising among immigrant communities, that is your early warning system. Waiting for quarterly financials to show the damage is too late. Build dashboards that flag volume declines by demographic segment, and trigger rapid response from community outreach teams.

Epic's 77-hospital expansion is a bet that interoperability and scale will continue to drive value in healthcare. That bet is sound, but only if patients keep showing up. The health systems adopting Epic in 2026 must recognize that the same data infrastructure that enables clinical coordination can also enable immigration enforcement, and patients will respond accordingly. Marketing strategy must adapt faster than policy does.

The Takeaway

• Conduct a trust audit of all patient-facing communications. Remove language that could signal data sharing risk.
• Partner with community-based organizations to deliver care in trusted locations, outside the traditional clinical setting.
• Build real-time dashboards tracking patient volume, no-show rates, and payer mix by demographic segment. Respond to declines within weeks, not quarters.

• Redesign patient intake to minimize upfront data collection. Push non-clinical questions downstream.
• Train front-line staff on accurate, empathetic messaging about data privacy and legal obligations.
• Shift patient acquisition budgets from digital advertising to community trust-building where immigrant populations are significant.

The EHR consolidation trend will continue. The political trend toward using healthcare data for non-clinical purposes will also continue. The health systems that succeed will be those that recognize patient trust is not a fixed asset, but a variable that must be earned repeatedly in every political climate.