McKenzie v. Robeson Health Care Corporation ( 2024 )

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA SOUTHERN DIVISION NO. 7:23-CV-979-FL JULIANA LAURA MCKENZIE, on behalf ) of herself and all others similarly situated, ) ) Plaintiff, ) ) v. ) ORDER ) ROBESON HEALTH CARE ) CORPORATION, ) ) Defendant. ) This matter is before the court on defendant’s motion to dismiss and substitute the United States as defendant. (DE 14). The motion has been briefed fully, and the issues raised are ripe for ruling. For the reasons that follow, defendant’s motion is denied. STATEMENT OF THE CASE Plaintiff commenced this tort and putative class action with complaint filed May 15, 2023, asserting claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and declaratory and injunctive relief, on behalf of herself and those similarly situated, arising out of defendant’s alleged failure to keep plaintiff’s personal information secure. After obtaining two extensions of time, defendant moved to dismiss and to substitute the United States as defendant. Plaintiff filed her response after obtaining an additional extension of time, and defendant replied. The United States, an interested party, filed February 21, 2024, both a motion for leave to file a statement of interest regarding defendant’s motion to dismiss and to substitute the United States as defendant and said statement of interest, relying on an excerpt from a grant application allegedly filed by defendant. Later that day, defendant filed a motion for the court to reserve ruling until the United States Court of Appeals for the Fourth Circuit issued its decision in a related case, Ford v. Sandhills Medical Foundation, Inc., No. 22-2268 (hereinafter, “Ford”), on which plaintiff took no position. Defendant responded to the United States’s statement of interest, the United States replied, and defendant filed surreply. The court granted the United States’s motion for leave to file a statement of interest March 26, 2024, and it granted defendant’s motion to reserve ruling March 27, 2024. On April 2, 2024, Plaintiff filed notice of subsequently decided controlling authority, noticing this court that the Fourth Circuit had issued its decision in Ford. See Ford v. Sandhills Medical Foundation, Inc., 97 F.4th 252, 257 (4th Cir. 2024). STATEMENT OF FACTS The relevant facts alleged in the complaint may be summarized as follows. On February 21, 2023, defendant “became aware that its computer network was affected by malware,” and determined thereafter that “an unauthorized third party gained access to its systems.” (Compl. ¶ 3). The unauthorized third party had access to patient names, addresses, social security numbers, and health information, (see id.), including plaintiff’s. (Id. ¶ 26). This information has “been listed for sale on the internet.” (Id. ¶ 28). COURT’S DISCUSSION A. Standard of Review A Rule 12(b)(1) motion challenges the court’s subject matter jurisdiction, and the plaintiff bears the burden of showing that federal jurisdiction is appropriate when challenged by the defendant. See McNutt v. Gen. Motors Acceptance Corp., 298 U.S. 178, 189 (1936); Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982).1 Such a motion may either 1) assert the complaint fails to state facts upon which subject matter jurisdiction may be based, or 2) attack the existence of subject matter jurisdiction in fact, apart from the complaint. Bain, 697 F.2d at 1219. Where a defendant raises a “facial challenge[] to standing that do[es] not dispute the jurisdictional facts alleged in the complaint,” the court accepts “the facts of the complaint as true as [the court] would in context of a Rule 12(b)(6) challenge.” Kenny v. Wilson, 885 F.3d 280, 287 (4th Cir. 2018). B. Analysis Defendant argues that the Federally Support Health Centers Assistance Act (“FSHCAA”), § 42 U.S.C. 233(a), immunizes it from liability for the claims asserted and requires substitution of the United States in defendant’s place. Defendant’s argument is foreclosed by the Fourth Circuit’s decision in Ford. The FSHCAA does not immunize defendant from liability for damages caused by the instant data breach. Under the FSHCAA, “private health centers that receive federal funds,” such as defendant, “may be considered [Public Health Service (“PHS”)] employees if certain conditions are met.” Ford, 97 F.4th at 257. The FSHCAA “grants absolute immunity to PHS . . . employees for actions arising out of the performance of medical or related functions within the scope of their employment,” Hui v. Casteneda, 559 U.S. 799, 809 (2010), and “authorizes substitution of the United States as the defendant” in such actions. Id. at 802. But immunity may only extend to damages “resulting from the performance of medical, surgical, dental, or related functions.” 42 U.S.C. § 233(a). The Fourth Circuit decided in Ford that “data security, which is more akin to an administrative function” than to a medical function, is not “included within the meaning of § 1 Throughout this order, all internal citations and quotation marks are omitted unless otherwise specified. 233(a).” 97 F.4th at 260. There, the plaintiffs personally identifying information allegedly was stolen from defendant’s third party computer system in a cyberattack. See id. at 254. Holding that that § 233(a) did not apply where plaintiffs asserted “injury did not occur because of any provision of health care,” id. at 261, the Fourth Circuit determined that the “United States [could not] be substituted for” the defendant. Id. at 262. This case is on all fours with Ford. Here, “an unauthorized third party” (compl. 26) allegedly accessed plaintiff's private information, which thereafter was “listed for sale on the internet.” (Id. § 28). Where the instant plaintiffs injury did not occur because of the provision of healthcare, Fourth Circuit precedent dictates that the United States may not be substituted for defendant. CONCLUSION Based on the foregoing, defendant’s motion to dismiss and substitute the United States as defendant (DE 14) is DENIED. Defendant is directed to file answer within 14 days of entry of this order. SO ORDERED, this the 17th day of June, 2024. LOUISE W. FLANAGAN United States District Judge