Krandle v. Refuah Health Ctr.

1

REBECCA KRANDLE, individually, and on behalf of all others similarly situated, Plaintiffs, v. REFUAH HEALTH CENTER, INC., Defendant. v. REFUAH HEALTH CENTER, INC., Defendant.

Nos. 22-CV-4977 (KMK), 22-CV-5039 (KMK)

United States District Court, S.D. New York

March 12, 2024

Michael Milton Liskow, Esq. George Feldman McDonald, PLLC New York, NY Counsel for Plaintiff Krandle

Anthony Parkhill, Esq. Barnow and Associates, P.C. Chicago IL Counsel for Plaintiff Krandle

Todd Seth Garber, Esq. Andrew Charles White, Esq. Finkelstein Blankinship, Frei-Pearson & Garber LLP White Plains, NY Counsel for Plaintiffs Esposito and Cortazar

Matthew S. Freedus, Esq. Feldesman Leifer LLP Washington, DC Counsel for Defendant

Brian Gilbert Cesaratto, Esq., Stewart Michael Gerson, Esq., James Patrick Flynn, Esq. Epstein Becker & Green, P.C. New York, NY Counsel for Defendant

Brandon H. Cowart, Esq. United States Attorney's Office for the Southern District of New York New York, NY Counsel for the United States of America

OPINION & ORDER

KENNETH M. KARAS, United States District Judge

Rebecca Krandle (“Krandle”), Dawn Esposito (“Esposito”), and Paola Cortazar (“Cortazar”; collectively, “Plaintiffs”) bring two Actions on behalf of themselves and all others similarly situated against Refuah Health Center, Inc. (“RHC” or “Defendant”) alleging various claims arising out of a 2021 data breach of RHC's systems. (See generally Not. of Removal, Ex. A (“Krandle Compl.”) (Dkt. No. 1-1, 22-CV-4977 Dkt.); Not. of Removal, Ex. A (“Esposito Compl.”) (Dkt. No. 1-1, 22-CV-5039 Dkt.).) Before the Court is RHC's Motion to Substitute the United States as the sole Defendant. (Not. of Mot. (Dkt. No. 50).)^[1]For the foregoing reasons, RHC's Motion is granted.

I. Background

A. Factual Background

The Court assumes the Parties' familiarity with the facts and procedural history described in its remand opinion. See Krandle v. Refuah Health Ctr., Inc., No. 22-CV-4977, 2023 WL 2662811, at *1 (S.D.N.Y. Mar. 28, 2023).

To recap, RHC is a New York-based non-for-profit company that provides a full suite of healthcare services at its four service sites and through its fleet of mobile medical units. (Krandle Compl. ¶¶ 2, 8, 11; Esposito Compl. ¶¶ 1-2, 9.) RHC collects personal identifying information (“PII”) and personal health information (“PHI”) in the course, and as a condition, of providing care. (Krandle Compl. ¶ 2; Esposito Compl. ¶ 2). That information includes, among other things, Social Security numbers, bank account information, credit and debit card information, medical treatment and diagnosis information, and health insurance policy numbers. (Krandle Compl. ¶ 1; Esposito Compl. ¶ 2.)

RHC suffered a data breach between May 31 and June 1, 2021. (Krandle Compl. ¶¶ 1516; see also Esposito Compl. ¶ 32 (alleging that RHC began to notify Plaintiffs of the breach on April 29, 2022).) After an investigation, RHC found that third parties accessed its systems and extracted PII and PHI, resulting in the exposure of each named Plaintiff's information. (Krandle Compl. ¶ 7; Esposito Compl. ¶¶ 35, 36.) Among other claims, Plaintiffs allege that RHC acted negligently by failing to safeguard Plaintiffs' PHI and PII. That obligation, they say, arises out of the “special relationship” between RHC and its patients and a variety of regulations, including HIPAA, rules that task RHC with protecting confidential data from “any intentional or unintentional use or disclosure.” (Esposito Compl. ¶¶ 67-68 (citing 45 C.F.R. § 164.530(c)(1)); see also Krandle Compl. ¶ 59 (alleging similar duties).)

B. Procedural History

Because the Krandle and Esposito Actions are related, and because of the similar questions presented in each one, the Parties and the United States have engaged in parallel motion practice. See Krandle, 2023 WL 2662811, at *1 n.1. RHC proposed the instant Motion in a letter dated June 20, 2023, (Letter from Brian Cesaratto, Esq. to Court (June 20, 2023) (Dkt. No. 47)), after which the Court adopted a briefing schedule, (Memo Endorsement (Dkt. No. 48)). Pursuant to that schedule, RHC filed the instant Motion on July 26, 2023. (Not. of Mot.; Mem. of Law in Supp. of Mot. (“Def's Mem.”) (Dkt. No. 51).) After an extension, (see Dkt. No. 57), Krandle and Esposito filed their Oppositions on September 14, 2023, (Mem. of Law in Opp. (“Krandle Mem.”) (Dkt. No. 59); Mem. of Law in Opp. (“Esposito Mem.”) (Dkt. No. 53, 22-CV-5039 Dkt.)).^[2]The Government, which also received an extension, (see Dkt. No. 52), filed its Opposition the same day. (See Mem. of Law in Opp. to Mot. (“Govt. Mem.”) (Dkt. No. 60).)^[3]RHC filed its reply on November 1, 2023. (Reply Mem. of Law (“Def's Reply”) (Dkt. No. 64); Decl. of Leora Perl, Esq. in Supp. of Mot. (“Perl Decl.”) (Dkt. No. 63).)

On January 25, 2024, the Court requested supplemental briefing regarding whether RHC's confidentiality obligations, assuming they are “medical . . . or related function[s]” for the purposes of 42 U.S.C. § 233(a), encompass protection against both unauthorized disclosure and unauthorized access by third parties. (See Order (Dkt. No. 65).) After an extension, (Dkt. No. 66), the Parties filed supplemental memoranda on February 16, 2024, (Supp. Mem. of Law (“Krandle Supp. Mem.”) (Dkt. No. 69); Supp. Br. (“Def's Supp. Mem.”) (Dkt. No. 70); Supp. Mem. of Law (“Esposito Supp. Mem.”) (Dkt. No. 60, 22-CV-5039 Dkt.), and the United States filed the next day, on February 17, 2024, (Supp. Mem. of Law (“Govt. Supp. Mem.”) (Dkt. No. 71)).^[4]

II. Discussion

A. Standard of Review

RHC styles its submission as a Motion to Substitute, but its request is best thought of as a motion to dismiss and a request to substitute the United States. If RHC is entitled to official immunity, it is protected “not just from liability but also from suit . . ., thereby sparing [it] the necessity of defending by submitting to discovery on the merits or undergoing a trial.” See X-Men Sec., Inc. v. Pataki, 196 F.3d 56, 65 (2d Cir. 1999); see also Hui v. Castaneda, 559 U.S. 799, 806 (2010) (describing 42 U.S.C. § 233(a) immunity as a form of “absolute immunity” that “bar[s] all actions” against deemed entities for covered conduct). It is also “well established that an affirmative defense of official immunity may be resolved by Rule 12(b)(6) if clearly established by the allegations within the complaint[.]” Liberian Cmty. Ass'n of Conn. V. Lamont, 970 F.3d 174, 186 (2d Cir. 2020) (alteration adopted) (quoting Pani v. Empire Blue Cross Blue Shield, 152 F.3d 67, 75 (2d Cir. 1998)).

The Supreme Court has held that although a complaint “does not need detailed factual allegations” to survive a Rule 12(b)(6) motion to dismiss, “a plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (alteration and quotation marks omitted). “[W]hen ruling on a defendant's motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (per curiam), and “draw all reasonable inferences in the plaintiff's favor,” Division 1181 Amalgamated Transit Union-New York Emps. Pension Fund v. N.Y.C. Dep't of Educ., 9 F.4^th 91, 94 (2d Cir. 2021) (citation omitted). Additionally, “when ruling on a Rule 12(b)(6) motion to dismiss,” district courts are directed to confine their consideration to “the complaint in its entirety, . . . documents incorporated into the complaint by reference, and matters of which a court may take judicial notice.” Bellin v. Zucker, 6 F.4^th 463, 473 (2d Cir. 2021) (quotation marks omitted); see also Dashnau v. Unilever Mfg. (US), Inc., 529 F.Supp.3d 235, 240 (S.D.N.Y. 2021) (same).

B. Analysis

1. Section 233(a)

The Federal Tort Claims Act (“FTCA”) waives the United States's sovereign immunity for certain tort claims based on the acts or omissions of a Government employee “acting within the scope of his office or employment.” Celestine v. Mount Vernon Neighborhood Health Ctr., 403 F.3d 76, 80 (2d Cir. 2005) (quoting 28 U.S.C. § 1346(b)(1)). Occasionally, Congress makes the FTCA the exclusive remedy for claims against certain officers, in effect granting those officers immunity from suit. See Carlson v. Green, 446 U.S. 14, 20 (1980) (collecting examples of exclusive remedy provisions). One such provision is 42 U.S.C. § 233(a), which “makes the [FCTA] the exclusive remedy for specified actions against members of the Public Health Service [‘PHS'].” Cuoco v. Moritsugu, 222 F.3d 99, 107 (2d Cir. 2000). That provision also applies to health centers, like RHC, that receive funding under the Public Health Service Act, 42 U.S.C. § 254b, and that are “deemed” to be PHS employees for the purposes of 233(a), see id. § 233(g).^[5] Relevant here, there is no dispute that RHC was a “deemed” PHS employee when the alleged conduct occurred. (See Def's Mem. 14; see also Govt Mem. 5 (“[RHC] [was] also ‘deemed' an employee of the Public Health Service with respect to [its] funded health care services.”).)

This case centers on § 233(a)'s text. The statute provides in relevant part that:

The remedy against the United States provided by [the FTCA] . . . for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigation, by any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment, shall be exclusive of any other civil action or proceeding by reason of the same subjectmatter against the officer or employee (or

...