Moser v. East Central Missouri Behavioral Health Services, Inc.

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MISSOURI NORTHERN DIVISION MILDRED MOSER, individually and ) on behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) No. 2:25CV20 HEA ) EAST CENTRAL MISSOURI ) BEHAVIORAL HEALTH SERVICES, ) INC. d/b/a ARTHUR COMMUNITY ) HEALTH, ) ) Defendant. ) OPINION, MEMORANDUM AND ORDER This matter is before the Court on Plaintiff Mildred Moser’s Motion to Remand. [ECF No. 8]. Defendant East Central Missouri Behavioral Health Services, Inc. d/b/a Arthur Center Community Health opposes the motion. For the reasons set forth below, the motion is granted. I. Facts and Background Plaintiff filed this class action in the Circuit Court for Audrain County, Missouri on behalf of herself and other similarly situated patients. [ECF No. 2]. She alleges that Defendant failed to properly secure its patients’ protected health information (“PHI”) and personally identifying information (“PII”), which resulted in a data breach of Defendant’s electronic health record system and the theft of Defendant’s patients’ PHI and PII by unknown bad actors. Id. at 1-3. She brings claims of negligence and negligence per se (Count I), breach of implied contract (Count II), unjust enrichment (Count III), breach of bailment (Count IV), and invasion of privacy (Count V). Defendant was served on January 16, 2025. Id. at 24-31. On February 17, 2025, Defendant filed a notice of removal, invoking the Federally Supported Health Centers Assistance Act (“FSHCAA”), 42 U.S.C. § 233 , and the federal officer removal statute, 28 U.S.C. § 1442 (a)(1). [ECF No. 1 at 1]. Defendant is a nonprofit community health center that receives federal funding under the Public Health Service Act, 42 U.S.C. § 254b. Id. Defendant asserts that it is entitled to immunity under the FSHCAA because it is deemed to be a Public Health Service (“PHS”) employee, and Plaintiff’s claims arise from Defendant’s performance of a medical or related function. Id. at 2, 22-23. In the notice of removal, Defendant states that it “delivered the summons and complaint to the HHS Secretary’s designated point of contact . . . via the agency’s designated email address . . . on or about February 10, 2025,” and that “[t]o date, the Attorney General has not appeared in or otherwise advised the state that the Secretary granted Defendant[’s] deeming applications (under § 233(g) and (h)) for the period in which the events giving rise to this action occurred.” Id. at 20. Plaintiff timely moved to remand this case to state court. [ECF No. 8]. She argues that removal under § 233(l)(2) is premature and substantively improper. [ECF No. 9 at 10-14]. Plaintiff also contends that Defendant cannot rely on its status as a deemed PHS employee to remove the case under § 1442(a)(1). Id. at 14-19. Finally, Plaintiff asks the Court to award her attorney’s fees she incurred as a result of the removal of this case pursuant to 28 U.S.C. § 1447 (c) based on her assertion that Defendant lacked an objectively reasonable basis for seeking removal. Id. at 19 . Along with the Motion to Remand, Plaintiff has submitted a Notice of the United States under 42 U.S.C. § 233 (l)(1) that was filed in the state court proceeding on March 7, 2025, [ECF No. 8-1], and a letter from the United States Attorney’s Office (“USAO”) that was sent to counsel for Defendant on the same day, [ECF No. 8-2]. In the Notice, the United States explained that the USAO received notice of the state court action from the Department of Health and Human Services (“HHS”) on February 24, 2025. [ECF No. 8-1 at 2]. The United States then advised the state court that, while HHS had deemed Defendant to be a PHS employee for the relevant time period, the United States would “not intervene in this case or remove it to federal court” because “Plaintiff’s Complaint does not arise out of any conduct by [Defendant] for which § 233(a) makes the remedy against the United States exclusive.” Id. at 2-3. In the March 7, 2025 letter, the United States denied Defendant’s request to intervene and substitute itself in Defendant’s place because the state court “action is not one ‘for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions’” under § 233(a). [ECF No. 8-2]. II. Legal Standard “Federal courts are courts of limited jurisdiction.” Myers v. Richland Cnty., 429 F.3d 740 , 745 (8th Cir. 2005) (citing Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994)). A claim may be removed to federal court only if it could have been brought there originally. Peters v. Union Pac. R. Co., 80 F.3d 257, 260 (8th Cir. 1996). “If at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” 28 U.S.C. § 1447 (c); In re Prempro Prods. Liab. Litig., 591 F.3d 613, 620 (8th Cir. 2010). “The [removing] defendant bears the burden of establishing federal jurisdiction by a preponderance of the evidence.” In re Prempro Prods. Liab. Litig., 591 F.3d at 620 . “All doubts about federal jurisdiction should be resolved in favor of remand to state court.” Id. (citing Wilkinson v. Shackelford, 478 F.3d 957, 963 (8th Cir. 2007)). III. Discussion Under the FSHCAA, “private health centers that receive federal funds may be considered PHS employees if certain conditions are met.” Ford v. Sandhills Med. Found., Inc., 97 F.4th 252, 257 (4th Cir. 2024) (citing Friedenberg v. Lane Cnty., 68 F.4th 1113, 1118 (9th Cir. 2023)). “If an entity receives PHS employee status, then § 233(a) provides the entity immunity from ‘damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigation, by any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment.’” Id. (quoting 42 U.S.C. § 233 (a)). “If a claim is subject to § 233(a), then the claim is treated as one brought against the United States within the purview of the FTCA.” Id. (citing Hui v. Castaneda, 559 U.S. 799, 802 (2010)). “If the FTCA applies, the United States is substituted as a defendant.” Id. (citing 42 U.S.C. § 233 (a)); see also Agyin v. Razmzan, 986 F.3d 168 , 184 (2d Cir. 2021) (“[A PHS employee] is entitled to immunity from suit and to substitution of the United States as the defendant if this suit concerns actions he took within the scope of his employment as a deemed federal employee.”). “Thus, the FSHCAA ‘essentially makes the U.S. government the medical malpractice insurer for qualifying . . . health centers, their officers, employees, and contractors, allowing these ‘deemed’ health centers to forgo obtaining private malpractice insurance.’” Id. (quoting Dedrick v. Youngblood, 200 F.3d 744 , 745 (11th Cir. 2000)). A. Removal under 42 U.S.C. § 233 (l)(2) The FSHCAA “authorizes removal in only two circumstances. . . .” Allen v. Christenberry, 327 F.3d 1290, 1294-95 (11th Cir. 2003). First, under § 233(l)(1), “the government may remove a case to federal court at ‘any time before trial’ if the Attorney General appears in the state-court proceeding within fifteen days of being notified and makes an affirmative determination that the defendant is entitled to coverage under the [FSHCAA].” Doe v. Centerville Clinics Inc., No. 23-2738, 2024 WL 3666164 , at *1 (3d Cir. Aug. 6, 2024) (unpublished) (citing 42 U.S.C. § 233 (c), (l)(1)).1 Second, under § 233(l)(2), “the defendant may remove the case itself if the Attorney General fails to appear in the state-court proceeding within fifteen days of being notified.” Id. (citing 42 U.S.C. § 233 (l)(2)). Defendant contends that it properly removed the case under § 233(l)(2), but that provision does not support removal because the Attorney General timely appeared in the state court proceeding. See 42 U.S.C. § 233 (l)(2) (providing that a defendant may remove an action to federal court “[i]f the Attorney General fails to appear in State court within the [15-day] time period prescribed under paragraph (1).”); Allen, 327 F.3d at 1295 (holding that § 233(l)(2) “does not permit” removal 1Section 233(l)(1) does not provide a basis for removal in this case, and Defendant does not rely on it, because the Attorney General determined that Defendant was not entitled to coverage under the FSHCAA. See Centerville Clinics Inc., 2024 WL 3666164 , at *1 (citing 42 U.S.C. § 233 (c), (l)(1)). where the “Attorney General did appear through the United States Attorney within four days of being notified” and advised the state court “that no [coverage] decision had been made but one was forthcoming”). Thus, removal under § 233(l)(2) is procedurally improper. See Barnes v. Sea Mar Cmty. Health Ctrs., No. 2:22-181-RSL-TLF, 2022 WL 1541927 , at *3 (W.D. Wash. Apr. 27, 2022) (“Because the United States appeared in state court within 15 days after receiving notice of the litigation, removal under Section 233(l)(2) is procedurally improper.”). Even if the Attorney General had not timely appeared, removal under § 233(l)(2) “would still be premature because [D]efendant removed this action . . . before the expiration of the government’s 15-day period to appear in the action.” Id.; see also Babbitt v. Health, No. 18-56576, 2023 WL 1281668 , at *2 (9th Cir. 2023) (affirming the district court’s decision to remand “the § 233 removal on the basis that it was too early” where the defendant “removed the case eleven days after giving notice of it to the Attorney General”); Sherman ex rel. Sherman v. Sinha, 843 F. App’x 870 , 873 (9th Cir. 2021) (“[T]he premature removal of the case to the district court would bypass the Attorney General’s initial determination of whether a defendant public health worker should be deemed a federal officer. Providing the Attorney General with the opportunity to consider the issue is a prerequisite to federal jurisdiction.”); Allen, 327 F.3d at 1295 (holding that § 233(l)(2) “does not permit” removal where the “Attorney General did appear through the United States Attorney within four days of being notified” and advised the state court “that no [coverage] decision had been made but one was forthcoming”). In any event, Defendant’s reliance on the FSHCAA is misplaced because data security does not constitute a “related” function under § 233(a). While the Eighth Circuit has not issued a decision addressing this specific issue, the Fourth Circuit’s opinion in Ford v. Sandhills Med. Found., Inc., 97 F.4th 252 (4th Cir. 2024), is persuasive and directly on point. Like Plaintiff here, the plaintiff in Ford brought state law tort claims against a community health center, alleging that the health center had failed to properly secure its patients’ electronically-stored PHI and PII, which led to a cyberattack by unknown bad actors. Id. at 254 . The health center removed the case to federal court for a determination as to whether § 233(a) shielded it from liability. Id. The Fourth Circuit explained that “in order to trigger immunity, alleged damages giving rise to a lawsuit must arise from the provision of healthcare” and concluded that data security was not a related function based on the plain language of § 233(a). Id. at 260 (stating that there was “little support for the notion that data security, which is more akin to an administrative function, should be included within the meaning of § 233(a)”). “In sum, the focus is on the function that caused the injury, and, here, [plaintiff] was not injured by any health care provided by [defendant].” Id. at 261. Like Ford, because Plaintiff’s “injury did not arise from [Defendant’s] provision of health care, § 233(a) does not shield [Defendant] from [Plaintiff’s] claims” or provide a basis for removal. See id. at 262; see also Lockhart v. El Centro del Barrio, 779 F. Supp. 3d 895 , 906 (W.D. Tex. Apr. 21, 2025) (“[D]ata protection is not an activity the medical field in which Defendant operates is ‘particularly fitted to’ execute, nor is any ‘related’ field of health care.” (citation modified)); Hale v. ARcare, Inc., No. 3:22-CV-00117-BSM, 2024 WL 1016361 , at *3 (E.D. Ark. Mar. 8, 2024) (“The nexus between protecting private information from cyberattacks and the provision of medical care is not sufficient to render ARcare’s failure to protect that information a ‘related function’ under section 233(a). Therefore, section 233(a) immunity does not apply.”); In re Cmty. Clinic of Maui Data Breach Litig., No. 25-CV-00030, 2025 WL 1863106 , at *11 (D. Haw. July 7, 2025) (concluding “that the claims for the data breach alleged in the complaints do not arise out of the performance of medical, surgical, dental, or related functions that fall within the ambit of § 233(a)”). B. Removal under 28 U.S.C. § 1442 (a)(1) “The federal officer removal statute ‘grants independent jurisdictional grounds over cases involving federal officers where a district court otherwise would not have jurisdiction.’” Buljic v. Tyson Foods, Inc., 22 F.4th 730, 738 (8th Cir. 2021) (quoting Jacks v. Meridian Res. Co., LLC, 701 F.3d 1224, 1230 (8th Cir. 2012)). “The statute authorizes removal of any civil action commenced in state court that is brought against an ‘officer (or any person acting under that officer) of the United States or of any agency thereof, in an official or individual capacity, for or relating to any act under color of such office.’” Id. (quoting 28 U.S.C. § 1442 (a)(1)). “This is an exception to the ‘well-pleaded complaint rule, under which (absent diversity) a defendant may not remove a case to federal court unless the plaintiff’s complaint establishes that the case arises under federal law.’” Id. (quoting Graves v. 3M Co., 17 F.4th 764, 768 (8th Cir. 2021)). “The federal officer removal statute is to be liberally construed, and thus the typical presumption against removal does not apply.” Id. (citing Cnty. Bd. of Arlington Cnty. v. Express Scripts Pharmacy, Inc., 996 F.3d 243, 250-51 (4th Cir. 2021)). But the statute’s “broad language is not limitless.” Watson v. Philip Morris Cos., Inc., 551 U.S. 142, 147 (2007). “When the removing party is not itself a federal officer or agency, it may remove a case only if it shows that it was ‘acting under’ a federal officer or agency in carrying out the acts that underlie the plaintiff’s complaint.” Buljic, 22 F.4th at 738 (citing Watson, 551 U.S. at 147 ). This threshold showing requires the removing party to show that: “(1) it is a ‘person’ under the statute, (2) it ‘acted under the direction of a federal officer,’ (3) a ‘causal connection’ exists between its complained-of conduct and official federal authority, and (4) it has a ‘colorable federal defense’ to the claim or claims against it.” Doe v. BJC Health Sys., 89 F.4th 1037, 1041 (8th Cir. 2023) (quoting Buljic, 22 F.4th at 738 ). Here, immunity under § 233(a) is the only federal defense Defendant raises, and, as the Court explained above, that defense is not colorable because § 233(a) immunity does not extend to the data breach claims raised in the Complaint. Centerville Clinics, 2024 WL 3666164 , at *3 (concluding that the defendant had not met its burden of establishing that it was entitled to removal under § 1442(a)(1) where “§ 233 immunity was the sole basis [the defendant] provided to satisfy § 1442(a)(1)’s federal-defense requirement,” and the defendant “could not properly remove this action under § 233”); Lockhart, 779 F. Supp. 3d at 909 (“To permit Defendant to raise § 233 as a defense for purposes of § 1442 when it didn’t abide by the removal procedures of § 233 would sidestep the framework of § 233.” (citation modified)); In re Cmty. Clinic of Maui Data Breach Litig., 2025 WL 1863106 , at *12 (rejecting the § 1442 removal where § “233 immunity [wa]s the only federal defense that [defendant] raise[d], and that defense [wa]s not colorable . . . because § 233(a) immunity does not extend to the data breach claims asserted in the complaint” (citing Lockhart, 2025 WL 1161464 , at *9)). “That alone is reason enough to reject the § 1442 removal.” In re Cmty. Clinic of Maui Data Breach Litig., 2025 WL 1863106 , at *12. Additionally, Defendant’s cybersecurity activities were not taken pursuant to a federal officer’s directions. While “healthcare providers . . . engage in business activities that are important and in which the federal government and the public are deeply interested, . . . this importance and interest do not bring . . . them within the scope of the federal officer removal statute.” BJC Health Sys., 89 F.4th at 1046 (citing 28 U.S.C. § 1442 (a)(1)). “Importantly, acting ‘pursuant to’ a federal officer’s directive does not include simply complying with the law, even if the law involves intense governmental regulations.” Martin LCMC Health Holdings, Inc., 101 F.4th 410, 415 (5th Cir. 2024) (quoting Watson, 551 U.S. at 153 ). “Parties must show that the federal government delegated its own duties to them—duties that are essentially governmental.” BJC Health Sys., 89 F.4th at 1046 (citing Watson, 551 U.S. at 152, 153 ); Martin, 101 F.4th at 414-15 (“To satisfy the ‘pursuant to’ requirement, a private actor must go beyond mere compliance with the law and instead help the government ‘fulfill other basic governmental tasks.’” (quoting Watson, 551 U.S. at 153 )). In other words, the “party does the business of the federal government and not merely its own.” BJC Health Sys., 89 F.4th at 1043 . Relying on Agyin v. Razmzan, 986 F.3d 168 , 175-80 (2d Cir. 2021), Defendant contends that it was acting under a federal officer because it received federal funding to provide medical care, is a deemed PHS employee, and is subject to the same federal requirements as the defendant in Agyin. But “compliance (or noncompliance) with federal laws, rules, and regulations does not by itself fall within the scope of the statutory phrase ‘acting under’ a federal ‘official,’” Watson, 551 U.S. at 143 . Additionally, the plaintiff in Agyin sued the defendant for medical malpractice related to the delivery of her stillborn child. Agyin, 986 F.3d at 171. As such, the defendant’s provision of medical care at issue in Agyin is materially different than the conduct at issue in this case—namely, Defendant’s alleged failure to properly store and secure its patients’ PHI and PII. Consistent with many other courts, this Court finds that Defendant’s cybersecurity activities were not taken pursuant to the direction of a federal official for the purposes of § 1442(a)(1). See, e.g., BJC Health Sys., 89 F.4th at 1047 (“In sum, the creation and operation of an online patient portal is not a basic governmental task. . . . [Defendant] made a private website and received a federal subsidy. This is insufficient for removing a case under 28 U.S.C. § 1442 (a)(1).”); Doe v. Cedars-Sinai Health Sys., 106 F.4th 907, 916 (9th Cir. 2024) (explaining that the defendant did not assist the government “with delegated ‘basic governmental tasks’ when it built its patient portal and website using tracking technology” and that “§ 1442(a)(1) does not permit removal just because ‘a federal regulatory agency directs, supervises, and monitors a company’s activities in considerable detail’” (quoting Watson, 551 U.S. at 145 )); Lockhart, 779 F. Supp. 3d at 907, 909-10 (concluding, in a “data breach action that d[id] not invoke application of § 233(a),” that “this is not a case ‘where the government has delegated legal authority to the private entity’ such that § 1442 removal is supported”); Johnson v. Petaluma Health Ctr., Inc., No. 23-cv-03777 VC, 2025 WL 1539853 , at *6 (N.D. Cal. May 30, 2025) (“This does not involve ‘acting under’ a federal officer within the meaning of section 1442. In particular, the conduct complained of in this lawsuit—the storage of patients’ medical information—was not done ‘acting under’ a federal officer.” (citing Cedars-Sinai Health Sys., 106 F.4th at 914-18 )); In re Cmty. Clinic of Maui Data Breach Litig., 2025 WL 1863106 , at *13 (concluding that while the defendant “has a statutory duty to maintain the confidentiality of patient data,” “merely complying with federal laws, policies or regulations, without more, does not constitute ‘acting under’ a federal official for the purposes of federal officer removal” (citation modified)). Thus, Defendant has not met its burden of showing that it was acting under a federal officer or agency in carrying out the acts that underlie Plaintiff’s Complaint. See Buljic, 22 F.4th at 742 (“[W]e need not reach the remaining elements of the statute.”). Based on the Court’s determination that neither of Defendant’s proffered grounds for removal are sufficient, this case must be remanded to state court. See 28 U.S.C. § 1447 (c); In re Prempro Prods. Liab. Litig., 591 F.3d at 620 . With respect to Plaintiff’s request for attorney’s fees, while Defendant has not met its burden to establish federal jurisdiction, the Court cannot say that it lacked an objectively reasonable basis for seeking removal. See Martin v. Franklin Capital Corp., 546 U.S. 132, 141 (2005) (“Absent unusual circumstances, courts may award such fees only where the removing party lacked an objectively reasonable basis for seeking removal.”). Thus, Plaintiff’s request for attorney’s fees will be denied. IV. Conclusion Based on the foregoing analysis, the Court finds that neither § 233(l)(2) nor § 1442(a)(1) provides a valid basis for removal. As such, the Court must remand this case to state court. See 28 U.S.C. § 1447 (c); In re Prempro Prods. Liab. Litig., 591 F.3d at 620 . Accordingly, IT IS HEREBY ORDERED that Plaintiff’s Motion to Remand, [ECF No. 8], is GRANTED. IT IS FURTHER ORDERED that this matter is remanded to the Circuit Court for Audrain County, Missouri. IT IS FURTHER ORDERED that Plaintiff’s request for attorney’s fees is denied. A separate Order of Remand will accompany this Opinion, Memorandum and Order. Dated this 9" day of September, 2025. ~ HENRY EDWARD UNITED STATES DISTRICT JUDGE — 16 —