Mixon v. United States

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF SOUTH CAROLINA FLORENCE DIVISION Summer Mixon, individually, and on ) Civil Action No.: 4:22-cv-00269-RBH behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) ORDER ) CareSouth Carolina, Inc., ) ) Defendant. ) ____________________________________) This case involves an electronic data breach regarding confidential personal and medical information of patients of Defendant CareSouth Carolina, Inc. (“CareSouth”), a federally funded community health center. Plaintiff Summer Mixon, a patient, filed a proposed class action in state court, and CareSouth removed the action to this Court seeking substitution of the United States as the defendant. The Court grants CareSouth’s Motion to Substitute for the reasons herein. Background Plaintiff was a patient of CareSouth, a federally deemed community health center under the Federally Supported Health Centers Assistance Act (“FSHCAA”), 42 U.S.C. § 233 (g)–(n), that receives federal grant funds under Section 330 of the Public Health Service Act, 42 U.S.C. § 254b. The FSHCAA authorizes the Secretary of the Department of Health and Human Services (“HHS”) to deem an entity that receives federal funds to be an employee of the Public Health Service (“PHS”) for purposes of 42 U.S.C. § 233 . Once the Secretary deems the entity a PHS employee, that “determination shall be final and binding upon the Secretary and the Attorney General and other parties to any civil action or proceeding.” 42 U.S.C. § 233 (g)(1)(F). PHS employees are eligible for coverage under the Federal Tort Claims Act (“FTCA”), 28 U.S.C. § 1346 (b), including “absolute immunity . . . for actions arising out of the performance of medical or related functions within the scope of their employment.” Hui v. Castaneda, 559 U.S. 799, 806 (2010) (citing 42 U.S.C. § 233 (a)). CareSouth was a deemed PHS employee for the time periods relevant to this lawsuit. See ECF No. 1-2 (deeming notices). If a civil action is filed in state court against a health center for damage for personal injury resulting from the performance of medical or related functions, the Attorney General must appear in state court within fifteen days of being notified of the filing and advise the court whether the Secretary has deemed the entity a PHS employee “with respect to the actions or omissions that are the subject of such civil action.” 42 U.S.C. § 233 (a), (g)(4), (l)(1). “If the Attorney General does so, the civil action or proceeding ‘shall be removed without bond at any time before trial . . . to the district court of the United States of the district and division embracing the place wherein it is pending and the proceeding deemed a tort action brought against the United States.’” Agyin v. Razmzan, 986 F.3d 168 , 173 (2d Cir. 2021) (ellipsis in original) (quoting 42 U.S.C. § 233 (c)). However, if the Attorney General fails to appear in state court within fifteen days, “upon petition of any entity . . . , the civil action or proceeding shall be removed to the appropriate United States district court.” 42 U.S.C. § 233 (l)(2). Upon removal under § 233(l)(2), the civil action or proceeding is stayed until the district court “conducts a hearing, and makes a determination, as to the appropriate forum or procedure.” Id. As alleged in the complaint, in December 2020, an unlawful cyberattack was made against CareSouth servers containing unencrypted personal and confidential information linked to Plaintiff and other patients.1 Complaint [ECF No. 1-1 at pp. 4–35] at ¶¶ 1–2, 7, 13–20. Such data included health insurance and banking information, addresses, and Social Security numbers. Id. at ¶ 33. Due to the data 1 CareSouth stores patient data with NetGain Technology, Inc. (“NetGain”). Compl. at ¶ 13. NetGain is not named as a defendant. — 2 — breach, cybercriminals allegedly acquired Plaintiff’s information intending to misuse and sell it; unauthorized persons viewed her information; and nefarious actors attempted to open accounts in Plaintiff’s name, thereby allegedly damaging her reputation and credit worthiness and compromising the security of her identity. Id. at ¶¶ 18–21, 27. In May 2021, CareSouth notified patients of the data breach and offered one year of identity theft protection.2 Id. at ¶¶ 16, 23. Plaintiff claims CareSouth’s response to the data breach was insufficient. Id. at ¶¶ 23–26. She alleges actual identity theft, costs associated with preventing further identity theft, anxiety, emotional distress, loss of privacy, and other economic and noneconomic damages. See, e.g., id. at ¶¶ 94–95, 135, 143. On November 9, 2021, Plaintiff filed a proposed class-action complaint in state court asserting seven claims: negligence, wrongful intrusion/invasion of privacy, breach of express contract, breach of implied contract, breach of S.C. Code § 39–1–90, unjust enrichment, and breach of fiduciary duty. ECF No. 1-1. On November 16, 2021, Plaintiff served CareSouth with the complaint. ECF No. 1-1 at pp. 41, 44. On January 12, 2022, CareSouth delivered copies of the summons and complaint to HHS and the U.S. Attorney for this District. ECF Nos. 1-4 & 1-5. On January 20, the U.S. Attorney filed a notice in state court pursuant to 42 U.S.C. § 233 (l)(1), asserting that it was first notified of the action on January 13, that whether CareSouth was deemed a PHS employee regarding the action was under consideration, and that the decision whether the United States would intervene was under consideration. ECF No. 1-1 at p. 47. Thus, the Attorney General appeared within fifteen days of being notified. However, on January 28, CareSouth removed the case here invoking, inter alia, both 42 U.S.C. 2 NetGain paid the cybercriminals a ransom to delete the stolen information and promise not to publish, sell, or otherwise share the data. Compl. at ¶ 24. Plaintiff alleges the risk of fraud or identity is not reduced by such “hollow promises.” Id. at ¶¶ 25–26. — 3 — § 233(l)(2) and 28 U.S.C. § 1442 (a)(1) seeking substitution of the United States as the defendant. ECF No. 1. Thereafter, CareSouth filed the instant motion to substitute;3 the United States filed a statement of interest opposing substitution; Plaintiff filed a response in opposition to CareSouth’s motion; and CareSouth filed a response to the statement of interest and reply in support of its motion to substitute. ECF Nos. 9, 12, 13, & 16. The Court held a hearing on the motion to substitute on April 26. ECF Nos. 17 & 21. Discussion I. Propriety of Removal Initially, the Court notes the Government contends CareSouth’s removal of this case was improper. ECF No. 12 at pp. 20–26. As mentioned above, CareSouth premised removal on several statutes, including 28 U.S.C. § 1442 (a)(1), the federal officer removal statute. Section 1442(a)(1) authorizes the “United States or any agency thereof or any officer (or any person acting under that officer) of the United States or of any agency thereof” to remove a civil action from state court “for or relating to any act under color of such office.” 28 U.S.C. § 1442 (a)(1) (emphasis added). The Supreme Court has held that the phrase “acting under” is broad—though not limitless—and that a court must liberally construe the statute. Watson v. Philip Morris Cos., 551 U.S. 142, 147 (2007). “Under the statute, private actors can remove a case to federal court when they show that they: (1) acted under the direction of a federal officer; (2) possess a colorable federal defense; and (3) engaged in government-directed conduct that was causally related to the plaintiff’s claims.” Cnty. Bd. of Arlington Cnty., Virginia v. Express Scripts Pharmacy, Inc., 996 F.3d 243, 247 (4th Cir. 2021). 3 CareSouth filed the motion after the Court entered an order noting CareSouth sought substitution in its notice of removal but had not filed a formal motion. ECF No. 7. — 4 — “In imposing these requirements, the statute aims to protect the Federal Government from interference with its operations, primarily by providing a federal forum for a federal defense.” Sawyer v. Foster Wheeler LLC, 860 F.3d 249, 254 (4th Cir. 2017) (cleaned up). CareSouth satisfies these three requirements. First, it was a “person acting under” the Public Health Service when the alleged data breach occurred. See W. Virginia State Univ. Bd. of Governors v. Dow Chem. Co., 23 F.4th 288, 298, 304 (4th Cir. 2022) (“clarify[ing] what it means for a private actor to ‘act under’ the control and guidance of a federal officer” and recognizing the “archetype case” includes “providing community medical health centers”); id. at 300 n.8 (citing Agyin, supra, wherein the Second Circuit pointed out “a federally supported community health center . . . is subject to detailed requirements and oversight by the federal government,” 986 F.3d at 177). Second, CareSouth has asserted a colorable federal defense—immunity under 42 U.S.C. § 233 (a)—as detailed below. Finally, CareSouth engaged in government-directed conduct—“maintain[ing] the confidentiality of patient records,” 42 U.S.C. § 254b(k)(3)(C)—causally related to Plaintiff’s data breach claim. CareSouth was therefore entitled to remove this case under § 1442(a)(1).4 4 The Government and Plaintiff both argue CareSouth’s § 1442 removal was untimely. ECF No. 23 at pp. 23–24; ECF No. 13 at pp. 8–9; see 28 U.S.C. § 1446 (b) (requiring a defendant to file a notice of removal within thirty days of receiving the initial pleading). However, they waived this objection by not filing a timely motion to remand. See Cades v. H & R Block, Inc., 43 F.3d 869, 873 (4th Cir. 1994) (“A motion to remand the case because of a defect in removal procedure must be made within 30 days after filing the notice of removal. 28 U.S.C. § 1447 (c). An untimely removal is a defect in removal procedure.”); Ellenburg v. Spartan Motors Chassis, Inc., 519 F.3d 192, 197 (4th Cir. 2008) (same). The Court does agree with the Government that removal was improper under 42 U.S.C. § 233 (l)(2) because the U.S. Attorney appeared in state court within fifteen days. See Allen v. Christenberry, 327 F.3d 1290, 1295 (11th Cir. 2003) (recognizing § 233(l)(2) does not provide for removal if the Attorney General appears in state court within fifteen days); Sherman v. Dignity Health, 2019 WL 2242071 , at *2 (C.D. Cal. May 23, 2019) (“[C]ourts in this and other federal districts have determined that under the plain text of § 233(l)(2), removal was improper because the Attorney General did not ‘fail to appear’ within ‘15 days after being notified’ of the state court action.” (cleaned up)), aff’d in part and dismissed in part, 843 F. App’x 870 (9th Cir. 2021). However, the Court rejects the Government’s argument that “[r]emoval under 28 U.S.C. § 1442 was improper because 42 U.S.C. § 233 (l)(2) specifically governs removal by entities or individuals covered by the FSHCAA.” ECF No. 12 at p. 22. Although § 1442 and § 233(l)(2) substantially overlap, they are distinct and provide different rights to the removing party. Agyin, 986 F.3d at 179–80; cf. Jamison v. Wiley, 14 F.3d 222 , 237–38 — 5 — II. Immunity and Substitution A. CareSouth’s Motion CareSouth argues it is entitled to absolute immunity and substitution of the United States. ECF No. 9 at pp. 1–2. The Court agrees. CareSouth “is entitled to immunity from suit and to substitution of the United States as the defendant if this suit concerns actions [or omissions] within the scope of [its] employment as a deemed federal employee. See 42 U.S.C. § 233 (a).” Agyin, 986 F.3d at 184. Section 233(a) provides: The remedy against the United States provided by sections 1346(b) and 2672 of Title 28 . . . for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigation, by any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment, shall be exclusive of any other civil action or proceeding by reason of the same subject-matter against the officer or employee (or his estate) whose act or omission gave rise to the claim. 42 U.S.C. § 233 (a). “Section 233(a) grants absolute immunity to PHS officers and employees for actions arising out of the performance of medical or related functions within the scope of their employment by barring all actions against them for such conduct.” Hui, 559 U.S. at 806 . “By its terms, § 233(a) limits recovery for such conduct to suits against the United States.” Id. “To determine a defendant’s amenability to suit, [a court] consider[s] whether he or she may claim the benefits of official (4th Cir. 1994) (recognizing there can be “two separate and alternative removal statutes,” “though often overlapping [but] not identical,” “both of which authorize removal of cases to federal court even though they could not have been brought there originally”). Finally, the Government argues the Court should reject CareSouth’s purported removal under the Westfall Act, 28 U.S.C. § 2679 (d). ECF No. 12 at p. 26. The Court agrees removal under § 2679(d) is improper because § 2679(d) provides for removal by the Attorney General, not the defendant. See Osborn v. Haley, 549 U.S. 225 , 252 n.17 (“[T]he Westfall Act gives the named defendant no right to remove an uncertified case. That right is accorded to the Attorney General only.” (internal citation omitted)). However, this case was properly removed under 28 U.S.C. § 1442 (a)(1), and “the procedure authorized by § 2679(d) is not necessary to effect substitution of the United States.” Hui, 559 U.S. at 811 . — 6 — immunity for the alleged misconduct.” Id. at 808 . Turning to “the alleged misconduct,” id., Plaintiff alleges that CareSouth “fail[ed] to properly secure and safeguard personal identifiable information and protected health information [CareSouth] acquired from or created for its patients,” that CareSouth “required this information from its patients or created this information for its patients as a condition or result of medical treatment,” that CareSouth “by nature of [its] business[] required its patients to provide their personal and medical information to [it] in exchange for services provided,” and that “cybercriminals conducting the Data Breach were able to obtain personal and medical information which was unencrypted and unprotected by [CareSouth].” Compl. at ¶¶ 1–2, 17, 31 (emphases added). Thus, patients like Plaintiff had to provide CareSouth their personal information to receive medical services, and patients expected CareSouth to maintain the confidentiality of that information. The alleged data breach of such information arose out of CareSouth’s performance of medical or related functions within the scope of its employment as a deemed PHS employee. Cf., e.g., Cuoco v. Moritsugu, 222 F.3d 99, 107 (2d Cir. 2000) (evaluating the plaintiff’s allegations and concluding “[t]he complained of behavior of these defendants thus occurred within the scope of their offices or employment and during the course of their ‘performance of medical . . . or related functions,’ 42 U.S.C. § 233 (a)”). Under § 233(a), Plaintiff’s exclusive remedy for her alleged damage lies against the United States, and CareSouth is entitled to immunity. The applicability of substitution of the United States and § 233(a) immunity is strengthened by CareSouth’s statutory duty to maintain the confidentiality of patient records. To be eligible for deemed status and receive federal funds, CareSouth must show it “will have an ongoing quality improvement system that includes clinical services and management, and that maintains the confidentiality of patient records.” 42 U.S.C. § 254b(k)(3)(C) (emphasis added); see 42 U.S.C. § 233 (g)(1), (4) (providing that — 7 — to be a deemed PHS employee, a health center must be “a public or non-profit private entity receiving Federal funds under section 254b”).5 Thus, CareSouth’s federally deemed status hinges in part on maintaining the confidentiality of patient records, such as those of Plaintiff. Courts have found § 233(a) immunity where “job functions . . . are ‘interwoven’ with providing medical care.” Goss v. United States, 353 F. Supp. 3d 878, 886 (D. Ariz. 2018) (collecting cases). This is particularly true where a statutory duty exists. See, e.g., Houck v. United States, 2020 WL 7769772 , at *3 (D.S.C. Dec. 30, 2020) (finding a health center’s statutory duty under § 233(h) “of continually vetting its physicians is ‘inextricably woven’ into [the] provision of medical care”); Brignac v. United States, 239 F. Supp. 3d 1367, 1377 (N.D. Ga. 2017) (same); Teresa T. v. Ragaglia, 154 F. Supp. 2d 290, 300 (D. Conn. 2001) (concluding the statutory duty under Connecticut law for doctors to report suspected child abuse was a “related function” under § 233(a)). Likewise, § 254b(k)(3)(C) imposes a statutory requirement of confidentiality that is “interwoven” with the provision of medical services at CareSouth. See, e.g., Brignac, 239 F. Supp. 3d at 1377 (“42 U.S.C. § 233(h) . . . can be viewed as ‘adding a required element’ to the provision of medical care by Family Health Centers.” (brackets 5 Similarly, an implementing regulation for Section 330 of the Public Health Service Act mandates confidentiality of patient records. See 42 C.F.R. § 51c.110 (entitled “Confidentiality” and providing “[a]ll information as to personal facts and circumstances obtained by the project staff about recipients of services shall be held confidential, and shall not be divulged without the individual’s consent except as may be required by law or as may be necessary to provide service to the individual or to provide for medical audits by the Secretary or his designee with appropriate safeguards for confidentiality of patient records. Otherwise, information may be disclosed only in summary, statistical, or other form which does not identify particular individuals.”). Also, the deeming application submitted to the HHS Secretary requires an “attest[ation] that [the] health center has implemented systems and procedures for protecting the confidentiality of patient information and safeguarding this information against loss, destruction, or unauthorized use, consistent with federal and state requirements.” Application for Health Center Program Award Recipients for Deemed Public Health Service Employment with Liability Protections Under the Federal Tort Claims Act, available at https://bphc.hrsa.gov/sites/default/files/bphc/ftca/pdf/pal-2021-01.pdf. — 8 — omitted) (quoting Teresa T., 154 F. Supp. 2d at 300 )).6 Finally, other courts have recognized the failure to maintain the confidentiality of patient information constitutes a medical or related function under § 233(a). In Mele v. Hill Health Center, the court found § 233(a) applied where a nurse “improperly disclosed [the plaintiff’s] medical information to a hospital and a substance abuse foundation” because the claim concerned “the related function of ensuring the privacy of patient medical information.” 2008 WL 160226 , at *3 (D. Conn. Jan. 8, 2008). In Kezer v. Penobscot Community Health Center, the court found § 233(a) applied where various clinic employees “gained access to [the plaintiff’s] confidential counseling records” and “improperly accessed” them “without her authorization.” No. 1:15-cv-00225-JAW, 2019 BL 141566, at *2 (D. Me. Mar. 21, 2019).7, 8 Based on the foregoing, the alleged data breach arose out of CareSouth’s performance of medical or related functions within the scope of its employment as a deemed PHS employee. The Court will grant CareSouth’s motion to substitute. 6 The Government contends Congress attaching conditions, such as requiring health centers to maintain the confidentiality of patient records, to the receipt of federal funds does not mean actions related to such conditions are covered under § 233(a). ECF No. 12 at pp. 17–18. Although not all requirements for receiving federal funds may be covered under § 233(a), this case concerns the maintenance of the confidentiality of patient records, which is “inextricably woven” into the provision of medical care such that it is a medical or related function. Importantly, South Carolina substantive law recognizes the duty of confidentiality. See 28 U.S.C. § 1346 (b) (providing the Government’s liability under the FTCA is determined “in accordance with the law of the place where the act or omission occurred”); S.C. Code Ann. Regs. 81–60(D) (“A physician shall . . . safeguard patient confidence within the constraints of the law.”); McCormick v. England, 494 S.E.2d 431, 436, 439 (S.C. Ct. App. 1997) (finding South Carolina “recognize[s] the common law tort of breach of a physician’s duty of confidentiality”). 7 Notably, the Government in Kezer “conced[ed] . . . that the ‘maintenance of the confidentiality of [the plaintiff’s] mental health medical records constituted a covered medical or related function’ under the language of § 233(a).” 2019 BL 141566, at *6 (quoting the Government’s brief). 8 As the Government points out, both Mele and Kezer dealt with a failure to maintain confidentiality premised on conduct of health center employees, not that of a third-party hacker as in this case. However, the statutory duty of the health center remains the same—to ensure confidential patient information is not disclosed, regardless of the method or mechanism causing the unauthorized disclosure. — 9 — B. The Government’s and Plaintiff’s Arguments Opposing Substitution The Government contends CareSouth cannot move for substitution under the FSHCAA. ECF No. 12 at pp. 3–11. The Government devotes the majority of this argument to discussing 42 U.S.C. § 233 (l)(2).9 However, as discussed above, § 233(l)(2) is a removal provision (that was improperly invoked by CareSouth after the U.S. Attorney timely appeared in state court). See Footnote Four, supra. Section 233(a) is the substantive provision providing for CareSouth’s immunity, and by implication, substitution of the United States. See Agyin, 986 F.3d at 184 (citing § 233(a) and stating a defendant “is entitled to immunity from suit and to substitution of the United States as the defendant if this suit concerns actions he took within the scope of his employment as a deemed federal employee”); see also Hui, 559 U.S. at 811 (explaining that “to effect substitution of the United States,” “PHS personnel [can] invoke the official immunity provided by § 233(a)”); id. (explaining scope certification by the Attorney General is not a prerequisite to immunity under § 233(a), and it is “not necessary to effect substitution of the United States” (emphasis added)); id. (“[I]mmunity under § 233(a) . . . is contingent upon the alleged misconduct having occurred in the course of the PHS defendant’s duties, [and] a defendant may make that proof pursuant to the ordinary rules of evidence and procedure.”);10 C.K. v. United States, 2020 WL 6684921 , at *4 (S.D. Cal. Nov. 12, 2020) (“find[ing] Hui to be controlling on the issue of the [c]ourt’s ability to determine the applicability of Section 233(a)’s immunity protections and, if necessary, to ‘effect substitution of the United States.’ 559 U.S. at 811 .”). CareSouth can properly seek substitution of the United States as the defendant. 9 The Government also mentions 42 U.S.C. § 233 (c), which of course is inapplicable because the Attorney General did not remove this action. 10 The alleged misconduct in this case is outlined in Plaintiff’s complaint. CareSouth represents in its motion to substitute that the material facts pertaining to the immunity determination are not in dispute. ECF No. 9 at p. 20. — 10 — The Government and Plaintiff both argue Plaintiff’s alleged damages are not for “personal injury, including death” within the meaning of § 233(a). ECF No. 12 at pp. 12–13; ECF No. 13 at pp. 3–4. “Under the Federal Tort Claims Act, damages are determined by the law of the State where the tortious act was committed[.]” Hatahley v. United States, 351 U.S. 173, 182 (1956) (citing 28 U.S.C. § 1346 (b)); see 42 U.S.C. § 233 (a) (incorporating “[t]he remedy against the United States provided by section[] 1346(b)”). South Carolina law defines “personal injury” as “injuries to the person including, but not limited to, bodily injuries, mental distress or suffering, loss of wages, loss of services, loss of consortium, wrongful death, survival, and other noneconomic damages and actual economic damages.” S.C. Code Ann. § 15–32–210(11).11 Plaintiff alleges injury or damages from anxiety, emotional distress, and loss of privacy, among other noneconomic and economic losses (including inconvenience from taking steps to mitigate her identity theft). See, e.g., Compl. at ¶¶ 94–95, 135, 143. Certainly some of the alleged damages/injuries fall within the meaning of “damage for personal injury” under § 233(a).12 The Government and Plaintiff both assert that the FSHCAA affords protection only for medical malpractice claims and that CareSouth’s claim to immunity misinterprets § 233(a). ECF No. 12 at pp. 13–20; ECF No. 13 at pp. 6–8. These assertions directly contradict Hui, where the Supreme Court held 11 See S.C. Code Ann. § 15–32–210(9) (“‘Noneconomic damages’ means nonpecuniary damages arising from pain, suffering, inconvenience, physical impairment, disfigurement, mental anguish, emotional distress, loss of society and companionship, loss of consortium, injury to reputation, humiliation, other nonpecuniary damages, and any other theory of damages including, but not limited to, fear of loss, illness, or injury.” (emphases added)); id. § 15–32–210(3) (“‘Economic damages’ means pecuniary damages arising from medical expenses and medical care, rehabilitation services, costs associated with education, custodial care, loss of earnings and earning capacity, loss of income, burial costs, loss of use of property, costs of repair or replacement of property, costs of obtaining substitute domestic services, a claim for loss of spousal services, loss of employment, loss of business or employment opportunities, loss of retirement income, and other monetary losses.”). 12 At the hearing, Plaintiff’s counsel acknowledged that the complaint alleges both economic and noneconomic damages and that the alleged emotional distress and anxiety are personal injury damages. — 11 — “§ 233(a) plainly precludes a Bivens[13] action” against PHS personnel. 559 U.S. at 813 . Just as § 233(a) precludes an action or claim for constitutional violations, it bars other claims such as those asserted by Plaintiff. See id. at 806 (“Section 233(a) grants absolute immunity to PHS officers and employees for actions arising out of the performance of medical or related functions within the scope of their employment by barring all actions against them for such conduct.” (emphasis added)); id. (“Language that broad easily accommodates both known and unknown causes of action.”). Other courts have likewise rejected the notion that § 233(a) is limited to medical malpractice claims. See, e.g., Cuoco, 222 F.3d at 108 ; Pomeroy v. United States, 2018 WL 1093501 , at *3 (D. Mass. Feb. 27, 2018); Mele, 2008 WL 160226 , at *3; Logan v. St. Charles Health Council, Inc., 2006 WL 1149214 , at *2 (W.D. Va. May 1, 2006); Teresa T., 154 F. Supp. 2d at 299 . In any event, § 233(a) makes the FTCA the exclusive remedy for harms resulting from medical or related functions; “the FTCA permits the United States to be held liable in tort only to the extent that a private party defendant would be liable under state law,” Pledger v. Lynch, 5 F.4th 511, 522 (4th Cir. 2021) (citing 28 U.S.C. § 1346 (b)(1)); and South Carolina “recognize[s] the common law tort of breach of a physician’s duty of confidentiality,” McCormick v. England, 494 S.E.2d 431, 440 (S.C. Ct. App. 1997);14 see id. at 436 (“The jurisdictions that recognize the duty of confidentiality have relied on various theories for the cause of action, including invasion of privacy, breach of implied contract, 13 Bivens v. Six Unknown Named Agents, 403 U.S. 388 (1971). 14 Cf., e.g., Simms v. United States, 839 F.3d 364, 367 (4th Cir. 2016) (“Because Valley Health is a federally-supported health center, Simms sought relief under the FTCA. Because this case arises under the FTCA, the law of West Virginia—the state where Valley Health’s negligent act took place—governs. We therefore apply the law of West Virginia in evaluating the . . . claims.” (internal citations omitted)). Notably, Simms involved a cause of action for wrongful birth—not medical malpractice—and the Government did not challenge the district court’s liability determination on appeal. Id. at 367–68. — 12 — medical malpractice, and breach of a fiduciary duty or a duty of confidentiality.” (emphasis added)).15 C. Plaintiff’s Alternative Position Plaintiff alternatively argues the United States should not be substituted as to her claim for breach of implied contract. However, that claim arises out of the same subject matter—the alleged data breach—and therefore cannot be maintained against CareSouth. See Hui, 559 U.S. at 806 (“The breadth of the words ‘exclusive’ and ‘any’ supports this reading [of § 233(a)], as does the provision’s inclusive reference to all civil proceedings arising out of ‘the same subject-matter.’ . . . Language that broad easily accommodates both known and unknown causes of action.”); Jarrett v. United States, 874 F.2d 201, 203 (4th Cir. 1989) (noting “the remedy under FTCA shall be exclusive of any other action or proceeding” under § 233(a)); Robles v. Beaufort Mem’l Hosp., 482 F. Supp. 2d 700, 703 (D.S.C. 2007) (“[O]nce the community health center is deemed a Public Health Service employee, it enjoys immunity from those acts that relate to its employment, and any actions against it are treated as actions against the United States.” (internal quotation marks omitted) (emphasis added)); Celestine v. Mount Vernon Neighborhood Health Ctr., 289 F. Supp. 2d 392, 395 (S.D.N.Y. 2003) (“Once deemed a PHS employee, a community health center enjoys immunity from those acts that relate to its employment, and any actions against it are treated as actions against the United States.” (emphasis added)); see, e.g., Hui, 559 U.S. at 812 (holding “the immunity provided by § 233(a) precludes Bivens actions against individual PHS officers or employees for harms arising out of conduct described in that section”); Cuoco, 222 F.3d at 107–09 (same). In sum, none of the Government’s or Plaintiff’s arguments alter the Court’s conclusion 15 As mentioned above, Plaintiff asserts claims for invasion of privacy, breach of implied contract, and breach of fiduciary duty. Compl. at ¶¶ 98–112, 137–43, 167–73. — 13 — regarding substitution of the United States and resulting immunity of CareSouth. Conclusion CareSouth was entitled to remove this case pursuant to 28 U.S.C. § 1442 (a)(1), and it is entitled to immunity from suit and substitution of the United States as the proper defendant. The Court GRANTS CareSouth’s motion to substitute [ECF No. 9] and SUBSTITUTES the United States as the defendant in this action. IT IS SO ORDERED. Florence, South Carolina s/ R. Bryan Harwell June 2, 2022 R. Bryan Harwell Chief United States District Judge — 14 —