They're unsure because a lot depends on the legal status of children born to non-citizen parents in the US after a executive order tried to revoke birthright citizenship: https://www.bmj.com/content/390/bmj.r1538

If that EO was legal, then sharing the data is, too. If it wasn't, then it's probably a privacy violation, but the CMS isn't allowed to make that call themselves, they have to rely on court decisions for it. And challenging EOs is not trivial.