Ford v. Sandhills Med. Found.

1

Joann Ford, on behalf of herself and all others similarly situated, Plaintiff, v. Sandhills Medical Foundation, Inc., Defendant.

Civil Action No. 4:21-cv-02307-RBH

United States District Court, D. South Carolina, Florence Division

June 2, 2022

ORDER

R Bryan Harwell Chief United States District Judge

This case involves an electronic data breach of records containing confidential personal and health information of patients of Defendant Sandhills Medical Foundation, Inc. ("Sandhills"), a federally funded community health center. Plaintiff Joann Ford, a former patient of Sandhills filed a proposed class action in state court, and Sandhills removed the action to this Court seeking substitution of the United States as the defendant. The Court grants Sandhills's Motion to Substitute for the reasons herein.

Background and Procedural History

Plaintiff was a patient of Sandhills, ^[1] a federally deemed community health center under the Federally Supported Health Centers Assistance Act (“FSHCAA”), 42 U.S.C. § 233(g)-(n), that receives federal grant funds under Section 330 of the Public Health Service Act, 42 U.S.C. § 254b. The FSHCAA authorizes the Secretary of the Department of Health and Human Services (“HHS”) to deem an entity that receives federal funds to be an employee of the Public Health Service (“PHS”) for purposes of 42 U.S.C. § 233. Once the Secretary deems the entity a PHS employee that “determination shall be final and binding upon the Secretary and the Attorney General and other parties to any civil action or proceeding.” 42 U.S.C. § 233(g)(1)(F). PHS employees are eligible for coverage under the Federal Tort Claims Act (“FTCA”), 28 U.S.C. § 1346(b), including “absolute immunity . . . for actions arising out of the performance of medical or related functions within the scope of their employment.” Hui v. Castaneda, 559 U.S. 799, 806 (2010) (citing 42 U.S.C. § 233(a)). Sandhills was a deemed PHS employee for the time periods relevant to this lawsuit. See ECF No. 1-2 (deeming notices).

If a civil action is filed in state court against a health center for damage for personal injury resulting from the performance of medical or related functions, the Attorney General must appear in state court within fifteen days of being notified of the filing and advise the court whether the Secretary has deemed the entity a PHS employee “with respect to the actions or omissions that are the subject of such civil action.” 42 U.S.C. § 233(a), (g)(4), (l)(1). “If the Attorney General does so, the civil action or proceeding ‘shall be removed without bond at any time before trial . . . to the district court of the United States of the district and division embracing the place wherein it is pending and the proceeding deemed a tort action brought against the United States.'” Agyin v. Razmzan, 986 F.3d 168, 173 (2d Cir. 2021) (ellipsis in original) (quoting 42 U.S.C. § 233(c)). However, if the Attorney General fails to appear in state court within fifteen days, “upon petition of any entity . . ., the civil action or proceeding shall be removed to the appropriate United States district court.” 42 U.S.C. § 233(l)(2). Upon removal under § 233(l)(2), the civil action or proceeding is stayed until the district court “conducts a hearing, and makes a determination, as to the appropriate forum or procedure.” Id.

As alleged in the complaint, Sandhills contracted with a third party vendor ("the vendor")^[2] to electronically store patient personally identifiable information (“PII”) and protected health information (“PHI”) in an online data storage platform. Complaint [ECF No. 1-1] at ¶ 23. In March 2021, Sandhills filed a “Notice of Data Breach, ” indicating that on or before December 3, 2020, the vendor's system was unlawfully hacked and the hackers took Sandhills's data. Id.. Such data included “demographic information such as names, dates of birth, mailing and email addresses, driver's licenses and state identification cards, . . . Social Security numbers . . . [and] claims information which could be used to determine diagnoses/conditions.” Id. Plaintiff contends that as a result of the data breach, her PII and PHI was “taken by hackers to engage in identity theft . . . and or to sell it to other criminals who will purchase the PII and PHI for that purpose.” Id. at ¶ 44. After the vendor paid a ransom, the hackers returned the data and informed Sandhills the data was deleted and no copies were retained. Id. at ¶ 23. Following the data breach, Sandhills offered to provide patients with one year of “single bureau” credit monitoring and identity theft protection, which Plaintiff claims is inadequate. Id. at ¶¶ 23 & 49. On April 2, 2021, Plaintiff received a Fair Credit Reporting and Equal Credit Opportunity Act Notice informing her that an unknown and unauthorized individual used her PII to apply for a $500 loan with Security Finance Corporation of South Carolina. Id. at ¶ 53.

On June 18, 2021, Plaintiff filed a proposed class-action complaint in state court asserting four claims: negligence, breach of implied contract, invasion of privacy, and breach of confidence. See Compl. Plaintiff cites injuries including the following:

(i) lost or diminished value of PII and PHI; (ii) out-of-pocket expenses associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII and PHI; (iii) lost opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach, including but not limited to lost time, and significantly (iv) the continued and certainly an increased risk to their PII and PHI, which: (a) remains unencrypted and available for unauthorized third parties to access and abuse; and (b) may remain backed up in Defendant's possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the PII and PHI.

Id. at ¶ 10. Plaintiff further alleges she suffers from anxiety, emotional distress, loss of privacy, and other non-economic losses. Id. at ¶ ¶ 58, 109, 117, & 143.

Sandhills accepted service of Plaintiff's summons and complaint on July 7, 2021, and delivered copies to HHS and the United States Attorney for this district via letters dated July 7, 2021, and July 9, 2021. ECF Nos. 1-3, 1-4 & 1-5.

The Attorney General did not appear within fifteen days after being notified of the filing, and on July 26, 2021, Sandhills removed the case to this Court invoking, inter alia, both 42 U.S.C. § 233(l)(2) and 28 U.S.C. § 1442(a)(1) seeking substitution of the United States as the defendant. ECF No. 1. On August 12, 2022, HHS informed Sandhills that its request for representation by the

United States under § 233 was denied. ECF No. 22-1.

At the direction of this court, Plaintiff and Sandhills each submitted briefing regarding whether the United States should be substituted as a party defendant and this action deemed as one brought under the FTCA. See ECF Nos. 13, 15, & 16. As there was not a formal motion for substitution for this Court's consideration, by text order dated February 23, 2022, this Court indicated that to the extent Sandhills sought substitution, Sandhills should file a motion to substitute and the United States should file a statement of interest in response to any such motion. See ECF No. 20.

Sandhills subsequently filed the instant motion to substitute, the United States filed a statement of interest in opposition to substitution, and Sandhills filed a response to the statement of interest.^[3] ECF Nos. 22, 25, & 28. The Court held a hearing on the motion to substitute on April 26, 2022, and counsel for Plaintiff, Sandhills, and the Government were present. ECF No. 33.

Discussion

I. Removal and the Court's Ability to Substitute

Initially, the Court notes that the Government contends Sandhills cannot move for substitution under the FSHCAA. ECF No. 25 at pp. 4-12. This Court disagrees.

In this case, the Attorney General did not appear in state court within fifteen days of receiving notice of the state court action against Sandhills. Thus, Sandhills properly removed this action pursuant to § 233(l)(2) for this Court to make a "determination, as to the appropriate forum or procedure.” See 42 U.S.C. § 233(l). Section 233(l)(2) provides the district court with jurisdiction to "decide whether to remand the case or to substitute the United States as a party and deem the action as one brought under the FTCA. [Because] [f]or section 233(l)(2) to have any effect, a district court must at least have jurisdiction to substitute the United States when it is appropriate to do so.” Est. of Campbell by Campbell v. S. Jersey Med. Ctr., 732 Fed.Appx. 113, 117 (3d Cir. 2018).

Although the Government contends that upon removal substitution is premised on the Attorney General's advice, once an action is properly removed, § 233(a) is the substantive provision providing for Sandhills's immunity, and by implication, substitution of the United States. See Agyin, 986 F.3d at 184 (citing § 233(a) and stating a defendant “is entitled to immunity from suit and to substitution of the United States as the defendant if this suit concerns actions he took within the scope of his employment as a deemed federal employee”); see also Hui, 559 U.S. at 811 (explaining that “to effect substitution of the United States, ” “PHS personnel [can] invoke the official immunity provided by § 233(a)”); id. (explaining scope certification by the Attorney General is not a prerequisite to immunity under § 233(a), and it is “not necessary to effect substitution of the United States.”) (emphasis added); id. (“[I]mmunity under § 233(a) . . . is contingent upon the alleged misconduct having occurred in the course of the...