The article notes that a former information security lead from the VA says the SORN needs to be updated for this specific ICE/CMS agreement and has not been. Clearly that fact is a disputed.
The ACLU argues that the sharing is only allowed if it contributes to the accuracy of Medicare or Medicaid, administers a federal health benefits program, or is necessary to implement a federally funded health benefits program. Im not sure if this it true (sharing only allowed in these cases) but if so it seems reasonable that detecting fraud would contribute to the accuracy and integrity of Medicaid. Furthermore, ICE does administer a federal health benefits program (IHSC [1]), so the basis for the ACLU's objection really seems unfounded, although the administration doesnt cite this basis and is quite upfront that its about identifying illegal aliens.