Yes, but law enforcement agencies can typically be granted access for investigations, so long as the information is used only for such investigations. This is how CSAM distributors are hunted down. They don't literally need to amass evidence for each and every suspect and then get a warrant: they have a legally recognized enforcement directive, and so can perform surveillance of information sources where that people breaking those laws can be caught. Or in this case, they may have imperfect information on a variety of actual suspects, but not enough to find them or build a case. Medicaid data may provide those clues.