Ford v. United States ( 2022 )

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF SOUTH CAROLINA FLORENCE DIVISION Joann Ford, on behalf of herself and all ) Civil Action No.: 4:21-cv-02307-RBH others similarly situated, ) ) Plaintiff, ) ) v. ) ORDER ) Sandhills Medical Foundation, Inc., ) ) Defendant. ) ____________________________________) This case involves an electronic data breach of records containing confidential personal and health information of patients of Defendant Sandhills Medical Foundation, Inc. ("Sandhills"), a federally funded community health center. Plaintiff Joann Ford, a former patient of Sandhills, filed a proposed class action in state court, and Sandhills removed the action to this Court seeking substitution of the United States as the defendant. The Court grants Sandhills’s Motion to Substitute for the reasons herein. Background and Procedural History Plaintiff was a patient of Sandhills,1 a federally deemed community health center under the Federally Supported Health Centers Assistance Act (“FSHCAA”), 42 U.S.C. § 233(g)–(n), that receives federal grant funds under Section 330 of the Public Health Service Act, 42 U.S.C. § 254b. The FSHCAA authorizes the Secretary of the Department of Health and Human Services (“HHS”) to deem an entity that receives federal funds to be an employee of the Public Health Service (“PHS”) for purposes of 42 U.S.C. § 233. Once the Secretary deems the entity a PHS employee, 1 Plaintiff was a patient of Sandhills from 2018 to 2019. Complaint [ECF No. 1-1] at ¶ 51. that “determination shall be final and binding upon the Secretary and the Attorney General and other parties to any civil action or proceeding.” 42 U.S.C. § 233(g)(1)(F). PHS employees are eligible for coverage under the Federal Tort Claims Act (“FTCA”), 28 U.S.C. § 1346(b), including “absolute immunity . . . for actions arising out of the performance of medical or related functions within the scope of their employment.” Hui v. Castaneda, 559 U.S. 799, 806 (2010) (citing 42 U.S.C. § 233(a)). Sandhills was a deemed PHS employee for the time periods relevant to this lawsuit. See ECF No. 1-2 (deeming notices). If a civil action is filed in state court against a health center for damage for personal injury resulting from the performance of medical or related functions, the Attorney General must appear in state court within fifteen days of being notified of the filing and advise the court whether the Secretary has deemed the entity a PHS employee “with respect to the actions or omissions that are the subject of such civil action.” 42 U.S.C. § 233(a), (g)(4), (l)(1). “If the Attorney General does so, the civil action or proceeding ‘shall be removed without bond at any time before trial . . . to the district court of the United States of the district and division embracing the place wherein it is pending and the proceeding deemed a tort action brought against the United States.’” Agyin v. Razmzan, 986 F.3d 168, 173 (2d Cir. 2021) (ellipsis in original) (quoting 42 U.S.C. § 233(c)). However, if the Attorney General fails to appear in state court within fifteen days, “upon petition of any entity . . . , the civil action or proceeding shall be removed to the appropriate United States district court.” 42 U.S.C. § 233(l)(2). Upon removal under § 233(l)(2), the civil action or proceeding is stayed until the district court “conducts a hearing, and makes a determination, as to the appropriate forum or procedure.” Id. 2 As alleged in the complaint, Sandhills contracted with a third party vendor ("the vendor")2 to electronically store patient personally identifiable information (“PII”) and protected health information (“PHI”) in an online data storage platform. Complaint [ECF No. 1-1] at ¶ 23. In March 2021, Sandhills filed a “Notice of Data Breach,” indicating that on or before December 3, 2020, the vendor’s system was unlawfully hacked and the hackers took Sandhills’s data. Id.. Such data included “demographic information such as names, dates of birth, mailing and email addresses, driver’s licenses and state identification cards, . . . Social Security numbers . . . [and] claims information which could be used to determine diagnoses/conditions.” Id. Plaintiff contends that as a result of the data breach, her PII and PHI was “taken by hackers to engage in identity theft . . . and or to sell it to other criminals who will purchase the PII and PHI for that purpose.” Id. at ¶ 44. After the vendor paid a ransom, the hackers returned the data and informed Sandhills the data was deleted and no copies were retained. Id. at ¶ 23. Following the data breach, Sandhills offered to provide patients with one year of “single bureau” credit monitoring and identity theft protection, which Plaintiff claims is inadequate. Id. at ¶¶ 23 & 49. On April 2, 2021, Plaintiff received a Fair Credit Reporting and Equal Credit Opportunity Act Notice informing her that an unknown and unauthorized individual used her PII to apply for a $500 loan with Security Finance Corporation of South Carolina. Id. at ¶ 53. On June 18, 2021, Plaintiff filed a proposed class-action complaint in state court asserting four claims: negligence, breach of implied contract, invasion of privacy, and breach of confidence. See Compl. Plaintiff cites injuries including the following: (i) lost or diminished value of PII and PHI; (ii) out-of-pocket expenses 2 The vendor is not named as a defendant in this action. 3 associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII and PHI; (iii) lost opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach, including but not limited to lost time, and significantly (iv) the continued and certainly an increased risk to their PII and PHI, which: (a) remains unencrypted and available for unauthorized third parties to access and abuse; and (b) may remain backed up in Defendant's possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the PII and PHI. Id. at ¶ 10. Plaintiff further alleges she suffers from anxiety, emotional distress, loss of privacy, and other non-economic losses. Id. at ¶ ¶ 58, 109, 117, & 143. Sandhills accepted service of Plaintiff’s summons and complaint on July 7, 2021, and delivered copies to HHS and the United States Attorney for this district via letters dated July 7, 2021, and July 9, 2021. ECF Nos. 1-3, 1-4 & 1-5. The Attorney General did not appear within fifteen days after being notified of the filing, and on July 26, 2021, Sandhills removed the case to this Court invoking, inter alia, both 42 U.S.C. § 233(l)(2) and 28 U.S.C. § 1442(a)(1) seeking substitution of the United States as the defendant. ECF No. 1. On August 12, 2022, HHS informed Sandhills that its request for representation by the United States under § 233 was denied. ECF No. 22-1. At the direction of this court, Plaintiff and Sandhills each submitted briefing regarding whether the United States should be substituted as a party defendant and this action deemed as one brought under the FTCA. See ECF Nos. 13, 15, & 16. As there was not a formal motion for substitution for this Court's consideration, by text order dated February 23, 2022, this Court indicated that to the extent Sandhills sought substitution, Sandhills should file a motion to substitute and the United States should file a statement of interest in response to any such motion. See ECF 4 No. 20. Sandhills subsequently filed the instant motion to substitute, the United States filed a statement of interest in opposition to substitution, and Sandhills filed a response to the statement of interest.3 ECF Nos. 22, 25, & 28. The Court held a hearing on the motion to substitute on April 26, 2022, and counsel for Plaintiff, Sandhills, and the Government were present. ECF No. 33. Discussion I. Removal and the Court’s Ability to Substitute Initially, the Court notes that the Government contends Sandhills cannot move for substitution under the FSHCAA. ECF No. 25 at pp. 4–12. This Court disagrees. In this case, the Attorney General did not appear in state court within fifteen days of receiving notice of the state court action against Sandhills. Thus, Sandhills properly removed this action pursuant to § 233(l)(2) for this Court to make a "determination, as to the appropriate forum or procedure.” See 42 U.S.C. § 233(l). Section 233(l)(2) provides the district court with jurisdiction to "decide whether to remand the case or to substitute the United States as a party and deem the action as one brought under the FTCA. [Because] [f]or section 233(l)(2) to have any effect, a district court must at least have jurisdiction to substitute the United States when it is appropriate to do so.” Est. of Campbell by Campbell v. S. Jersey Med. Ctr., 732 F. App'x 113, 117 (3d Cir. 2018). Although the Government contends that upon removal substitution is premised on the Attorney General’s advice, once an action is properly removed, § 233(a) is the substantive provision providing for Sandhills’s immunity, and by implication, substitution of the United States. See Agyin, 986 F.3d at 184 (citing § 233(a) and stating a defendant “is entitled to immunity from suit 3 Plaintiff did not file a response in opposition to the motion to substitute. However, Plaintiff previously filed a brief arguing the United States should not be substituted, so this Court refers to that brief for Plaintiff’s position on the matter. See ECF No. 16. 5 and to substitution of the United States as the defendant if this suit concerns actions he took within the scope of his employment as a deemed federal employee”); see also Hui, 559 USS. at 811 (explaining that “to effect substitution of the United States,” “PHS personnel [can] invoke the official immunity provided by § 233(a)”); id. (explaining scope certification by the Attorney General is not a prerequisite to immunity under § 233(a), and it is “not necessary to effect substitution of the United States.”) (emphasis added); id. (“[I]Jmmunity under § 233(a) .. . is contingent upon the alleged misconduct having occurred in the course of the PHS defendant's duties, [and] a defendant may make that proof pursuant to the ordinary rules of evidence and procedure.”);* C. K. v. United States, 2020 WL 6684921, at *4 (S.D. Cal. Nov. 12, 2020) (“find[ing] Hui to be controlling on the issue of the [c]ourt’s ability to determine the applicability of Section 233(a)’s immunity protections and, if necessary, to ‘effect substitution of the United States.’ 559 U.S. at 811.”). Thus, because § 233(/)(2) properly provides for removal to this Court, Sandhills can properly seek substitution of the United States as the defendant pursuant to § 233(a).° ‘ The alleged misconduct in this case is outlined in Plaintiff's complaint. Sandhills represents in its motion to substitute that the material facts pertaining to the immunity determination are not in dispute. ECF No. 22 at p. 19. On August 12, 2021, HHS informed Sandhills, via e-mail, that its request for representation by the United States under 42 U.S.C. § 233 was denied. See ECF No. 22-1. As that notice occurred more than fifteen days after the Attorney General received notice of the filing, and there is no indication that either HHS or the Attorney General ever appeared in state court, this Court finds § 233()(2) was properly invoked to remove this action to this Court for a determination of the appropriate forum or procedure. However, even if HHS’s e-mail would have affected Sandhills’s ability to remove this action under § 233(/(2), the federal officer removal statute, 28 U.S.C. § 1442(a)(1), would provide a vehicle for removal of this action. Section 1442(a)(1) authorizes the “United States or any agency thereof or any officer (or any person acting under that officer) of the United States or of any agency thereof’ to remove a civil action from state court “for or relating to any act under color of such office.” 28 U.S.C. § 1442(a)(1) (emphasis added). The Supreme Court has held that the phrase “acting under” is broad—though not limitless—and that a court must liberally construe the statute. Watson v. Philip Morris Cos., 551 U.S. 142, 147 (2007). “Under the statute, private actors can remove a case to federal court when they show that they: (1) acted under the direction of a federal officer; (2) possess a colorable federal defense; and (3) engaged in government-directed conduct that was causally related to the plaintiff's claims.” Cnty. Bd. of Arlington Cnty., Virginia v. Express Scripts Pharmacy, Inc., 996 F.3d 243, II. Immunity and Substitution A. Sandhills’s Motion Sandhills argues it is entitled to absolute immunity and substitution of the United States. ECF No. 22 at pp. 1–2. The Court agrees. Sandhills “is entitled to immunity from suit and to substitution of the United States as the defendant if this suit concerns actions [or omissions] within the scope of [its] employment as a deemed federal employee. See 42 U.S.C. § 233(a).” Agyin, 986 F.3d at 184. Section 233(a) provides: The remedy against the United States provided by sections 1346(b) 247 (4th Cir. 2021). “In imposing these requirements, the statute aims to protect the Federal Government from interference with its operations, primarily by providing a federal forum for a federal defense.” Sawyer v. Foster Wheeler LLC, 860 F.3d 249, 254 (4th Cir. 2017) (cleaned up). Sandhills satisfies these three requirements. First, it was a “person acting under” the Public Health Service when the alleged data breach occurred. See W. Virginia State Univ. Bd. of Governors v. Dow Chem. Co., 23 F.4th 288, 298, 304 (4th Cir. 2022) (“clarify[ing] what it means for a private actor to ‘act under’ the control and guidance of a federal officer” and recognizing the “archetype case” includes “providing community medical health centers.”); id. at 300 n. 8 (citing Agyin, supra, wherein the Second Circuit pointed out “a federally supported community health center . . . is subject to detailed requirements and oversight by the federal government,” 986 F.3d at 177). Second, Sandhills has asserted a colorable federal defense—immunity under 42 U.S.C. § 233(a)—as detailed below. Finally, Sandhills engaged in government-directed conduct—“maintain[ing] the confidentiality of patient records,” 42 U.S.C. § 254b(k)(3)(C)—causally related to Plaintiff’s data breach claim. Sandhills was therefore entitled to remove this case under § 1442(a)(1). The Court rejects the Government’s argument that “[r]emoval under 28 U.S.C. § 1442 was improper because 42 U.S.C. § 233(l)(2) specifically governs removal by entities or individuals covered by the FSHCAA.” ECF No. 25 at p. 22. Although § 1442 and § 233(l)(2) substantially overlap, they are distinct and provide different rights to the removing party. Agyin, 986 F.3d at 179–80; cf. Jamison v. Wiley, 14 F.3d 222, 237–38 (4th Cir. 1994) (recognizing there can be “two separate and alternative removal statutes,” “though often overlapping, [but] not identical,” “both of which authorize removal of cases to federal court even though they could not have been brought there originally”). Finally, the Government argues the Court should reject Defendant’s purported removal under the Westfall Act, 28 U.S.C. § 2679(d). ECF No. 25 at p. 25. The Court agrees removal under § 2679(d) is improper because § 2679(d) provides for removal by the Attorney General, not the defendant. See Osborn v. Haley, 549 U.S. 225, 252 n.17 (“[T]he Westfall Act gives the named defendant no right to remove an uncertified case. That right is accorded to the Attorney General only.”) (internal citation omitted). However, this case was properly removed under 42 U.S.C. § 233(l)(2) and 28 U.S.C. § 1442(a)(1), and “the procedure authorized by § 2679(d) is not necessary to effect substitution of the United States.” Hui, 559 U.S. at 811. 7 and 2672 of Title 28 . . . for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigation, by any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment, shall be exclusive of any other civil action or proceeding by reason of the same subject-matter against the officer or employee (or his estate) whose act or omission gave rise to the claim. 42 U.S.C. § 233(a). “Section 233(a) grants absolute immunity to PHS officers and employees for actions arising out of the performance of medical or related functions within the scope of their employment by barring all actions against them for such conduct.” Hui, 559 U.S. at 806. “By its terms, § 233(a) limits recovery for such conduct to suits against the United States.” Jd. “To determine a defendant’s amenability to suit, [a court] consider[s] whether he or she may claim the benefits of official immunity for the alleged misconduct.” /d. at 808. Turning to “the alleged misconduct,” id., Plaintiff alleges that Sandhills “fail[ed] to properly secure and safeguard personally identifiable information,” which Sandhills required Plaintiff and the Nationwide Class Members “to provide and entrust... as a condition of being patients of [Sandhills].” Compl. at ¥§ 1, 113 (emphasis added). Plaintiff contends Sandhills “had a duty to exercise reasonable care in safeguarding, securing, and protecting such information from being compromised, lost, stolen, misused, and/or disclosed to unauthorized parties,” and that as a result of Sandhills’s failure to “use reasonable security procedures and practices appropriate to the nature of the sensitive, unencrypted information it was maintaining for Plaintiff and Class Members . . . their PII and PHI [were] exposed,” and were taken by hackers. /d. at □ 27, 44, 82. Thus, patients like Plaintiff had to provide Sandhills with their personal information to receive medical services, and patients expected Sandhills to maintain the confidentiality of that information. The alleged data breach of such information arose out of Sandhills’s performance of medical or related functions within the scope of its employment as a deemed PHS employee. Cf., e.g., Cuoco v. Moritsugu, 222 F.3d 99, 107 (2d Cir. 2000) (evaluating the plaintiff’s allegations and concluding “[t]he complained of behavior of these defendants thus occurred within the scope of their offices or employment and during the course of their ‘performance of medical . . . or related functions,’ 42 U.S.C. § 233(a)”). Under § 233(a), Plaintiff’s exclusive remedy for her alleged damage lies against the United States, and Sandhills is entitled to immunity. The applicability of substitution of the United States and § 233(a) immunity is strengthened by Sandhills’s statutory duty to maintain the confidentiality of patient records. To be eligible for deemed status and receive federal funds, Sandhills must show it “will have an ongoing quality improvement system that includes clinical services and management, and that maintains the confidentiality of patient records.” 42 U.S.C. § 254b(k)(3)(C) (emphasis added); see 42 U.S.C. § 233(g)(1), (4) (providing that to be a deemed PHS employee, a health center must be a “public or non-profit entity receiving Federal funds under section 254b”).6 Thus, Sandhills’s federally deemed status hinges in part on maintaining the confidentiality of patient records, such as those of Plaintiff. Courts have found § 233(a) immunity where “job functions . . . are ‘interwoven’ with 6 Similarly, an implementing regulation for Section 330 of the Public Health Service Act mandates confidentiality of patient records. See 42 C.F.R. § 51c.110 (entitled “Confidentiality” and providing “[a]ll information as to personal facts and circumstances obtained by the project staff about recipients of services shall be held confidential, and shall not be divulged without the individual’s consent except as may be required by law or as may be necessary to provide service to the individual or to provide for medical audits by the Secretary or his designee with appropriate safeguards for confidentiality of patient records. Otherwise, information may be disclosed only in summary, statistical, or other form which does not identify particular individuals.”). Also, the deeming application submitted to the HHS Secretary requires an “attest[ation] that [the] health center has implemented systems and procedures for protecting the confidentiality of patient information and safeguarding this information against loss, destruction, or unauthorized use, consistent with federal and state requirements.” Application for Health Center Program Award Recipients for Deemed Public Health Service Employment with Liability Protections Under the Federal Tort Claims Act, available at https://bphc.hrsa.gov/sites/default/files/bphc/ftca/pdf/pal-2021-01.pdf. 9 providing medical care.” Goss v. United States, 353 F. Supp. 3d 878, 886 (D. Ariz. 2018) (collecting cases). This is particularly true where a statutory duty exists. See, e.g., Houck v. United States, 2020 WL 7769772, at *3 (D.S.C. Dec. 30, 2020) (finding a health center’s statutory duty under § 233(h) “of continually vetting its physicians is ‘inextricably woven’ into [the] provision of medical care”); Brignac v. United States, 239 F. Supp. 3d 1367, 1377 (N.D. Ga. 2017) (same); Teresa T. v. Ragaglia, 154 F. Supp. 2d 290, 300 (D. Conn. 2001) (concluding the statutory duty under Connecticut law for doctors to report suspected child abuse was a “related function” under § 233(a)). Likewise, § 254b(k)(3)(C) imposes a statutory requirement of confidentiality that is “interwoven” with the provision of medical services at Sandhills. See, e.g., Brignac, 239 F. Supp. 3d at 1377 (“42 U.S.C. § 233(h) ... can be viewed as ‘adding a required element’ to the provision of medical care by Family Health Centers.” (brackets omitted) (quoting Teresa T., 154 F. Supp. 2d at 300)).’ Finally, other courts have recognized the failure to maintain the confidentiality of patient information is a medical or related function under § 233(a). In Mele v. Hill Health Center, the court found § 233(a) applied where a nurse “improperly disclosed [the plaintiff's] medical information to a hospital and a substance abuse foundation” because the claim concerned “the related function of ensuring the privacy of patient medical information.” 2008 WL 160226, at *3 (D. Conn. Jan. 8, 7 The Government contends Congress attaching conditions, such as requiring health centers to maintain the confidentiality of patient records, to the receipt of federal funds does not mean actions related to such conditions are covered under § 233(a). ECF No. 25 at pp. 18-19. Although not all requirements for receiving federal funds may be covered under § 233(a), this case concerns the maintenance of the confidentiality of patient records, which is “inextricably woven” into the provision of medical care such that it is a medical or related function. Importantly, South Carolina substantive law recognizes the duty of confidentiality. See 28 U.S.C. § 1346(b) (providing the Government’s liability under the FTCA is determined “in accordance with the law of the place where the act or omission occurred.”); S.C. Code Ann. Regs. 81-60(D) (“A physician shall .. . safeguard patient confidence within the constraints of the law.”); McCormick v. England, 494 S.E.2d 431, 436, 439 (S.C. Ct. App. 1997) (finding South Carolina “recognize[s] the common law tort of breach of a physician’s duty of confidentiality.”’). 10 2008). In Kezer v. Penobscot Community Health Center, the court found § 233(a) applied where various clinic employees “gained access to [the plaintiff’s] confidential counseling records” and “improperly accessed” them “without her authorization.” No. 1:15-cv-00225-JAW, 2019 BL 141566, at *2 (D. Me. Mar. 21, 2019).8, 9 Based on the foregoing, the alleged data breach arose out of Sandhills’s performance of medical or related functions within the scope of its employment as a deemed PHS employee. Thus, the Court will grant Sandhills’s motion to substitute. B. The Government’s and Plaintiff’s Arguments in Opposition to Substitution 1. Personal Injury Plaintiff and the Government argue Plaintiff’s alleged damages are not for “personal injury, including death” within the meaning of § 233(a). ECF No. 16 at pp. 5–6 ; ECF No. 25 at pp. 12–14. “Under the Federal Tort Claims Act, damages are determined by the law of the State where the tortious act was committed[.]” Hatahley v. United States, 351 U.S. 173, 182 (1956) (citing 28 U.S.C. § 1346(b)); 42 U.S.C. § 233(a) (incorporating “[t]he remedy against the United States provided by section[] 1346(b)”). South Carolina law defines “personal injury” as “injuries to the person including, but not limited to, bodily injuries, mental distress or suffering, loss of wages, loss of services, loss of consortium, wrongful death, survival, and other noneconomic damages and 8 Notably, the Government in Kezer “conced[ed] . . . that the ‘maintenance of the confidentiality of [the plaintiff’s] mental health medical records constituted a covered medical or related function’ under the language of § 233(a).” 2019 BL 141566, at *6 (quoting the Government’s brief). 9 As the Government points out, both Mele and Kezer dealt with a failure to maintain confidentiality premised on conduct of health center employees, not that of a third-party hacker as in this case. ECF No. 25 at p. 25, n 8. However, the duty of the health center remains the same—to ensure confidential patient information is not disclosed, regardless of the method or mechanism causing the unauthorized disclosure. 11 actual economic damages.” S.C. Code Ann. § 15-32-210(11)." Plaintiff alleges damages/injuries from anxiety, loss of privacy, emotional distress, and other noneconomic and economic losses (including the inconvenience of taking steps to mitigate her identity theft). See, e.g., Compl. at 4 58, 109, 117, & 143. Certainly some of the alleged damages/injuries fall within the meaning of “damage for personal injury” under § 233(a).'! 2. Scope of 42 U.S.C. § 233(a) Immunity The Government asserts that the FSHCAA affords protection only for medical malpractice claims and that Sandhills’s claim to immunity misinterprets § 233(a). ECF No. 25 at pp. □□□□□□ These assertions directly contradict Hui, where the Supreme Court held “§ 233(a) plainly precludes a Bivens'"”! action” against PHS personnel. 559 U.S. at 813. Just as § 233(a) precludes an action or claim for constitutional violations, it bars other claims such as those asserted by Plaintiff. See id. at 806 (“Section 233(a) grants absolute immunity to PHS officers and employees for actions arising out of the performance of medical or related functions within the scope of their employment by barring all actions against them for such conduct.” (emphasis added)); id. (“Language that broad 0 See S.C. Code Ann. § 15—32—210(9) (“‘Noneconomic damages’ means nonpecuniary damages arising from pain, suffering, inconvenience, physical impairment, disfigurement, mental anguish, emotional distress, loss of society and companionship, loss of consortium, injury to reputation, humiliation, other nonpecuniary damages, and any other theory of damages including, but not limited to, fear of loss, illness, or injury.” (emphases added)); id. § 15—32-210(3) (“‘Economic damages’ means pecuniary damages arising from medical expenses and medical care, rehabilitation services, costs associated with education, custodial care, loss of earnings and earning capacity, loss of income, burial costs, loss of use of property, costs of repair or replacement of property, costs of obtaining substitute domestic services, a claim for loss of spousal services, loss of employment, loss of business or employment opportunities, loss of retirement income, and other monetary losses.”’). u The Government contends Plaintiffs briefing declared that her claims were not for personal injury. ECF No. 25 at pp. 12-14. However, the Government misreads Plaintiff’s brief. Plaintiff alleges multiple types of damages/injuries, and Plaintiff's argument was that § 233(a) does not cover the claims for damages that are not for personal injury. ECF No. 16 at pp. 4-6. Regardless, as explained below, “the remedy against the United States ... Shall be exclusive of any other civil action or proceeding by reason of the same subject-matter.” 42 U.S.C. § 233(a). Bivens v. Six Unknown Named Agents, 403 U.S. 388 (1971). 12 easily accommodates both known and unknown causes of action.”). Other courts have likewise rejected the notion that § 233(a) is limited to medical malpractice claims. See, e.g., Cuoco, 222 F.3d at 108; Pomeroy v. United States, 2018 WL 1093501, at *3 (D. Mass. Feb. 27, 2018); Mele, 2008 WL 160226, at *3; Logan v. St. Charles Health Council, Inc., 2006 WL 1149214, at *2 (W.D. Va. May 1, 2006); Teresa T, 154 F. Supp. 2d at 299. In any event, § 233(a) makes the FTCA the exclusive remedy for harms resulting from medical or related functions; “the FTCA permits the United States to be held liable in tort only to the extent that a private party defendant would be liable under state law,” Pledger v. Lynch, 5 F.4th 511, 522 (4th Cir. 2021) (citing 28 U.S.C. § 1346(b)(1)); and South Carolina “recognize[s] the common law tort of breach of a physician’s duty of confidentiality,” McCormick, 494 S.E.2d 431, 440 (S.C. Ct. App. 1997);13 see id. at 436 (“The jurisdictions that recognize the duty of confidentiality have relied on various theories for the cause of action, including invasion of privacy, breach of implied contract, medical malpractice, and breach of a fiduciary duty or a duty of confidentiality.”) (emphasis added).14 3. Plaintiff’s Alternative Position Plaintiff alternatively argues the United States should not be substituted as to her claim for breach of implied contract. However, that claim arises out of the same subject matter—the alleged 13 Cf., e.g., Simms v. United States, 839 F.3d 364, 367 (4th Cir. 2016) (“Because Valley Health is a federally-supported health center, Simms sought relief under the FTCA. Because this case arises under the FTCA, the law of West Virginia—the state where Valley Health’s negligent act took place—governs. We therefore apply the law of West Virginia in evaluating the . . . claims.” (internal citations omitted)). Notably, Simms involved a cause of action for wrongful birth—not medical malpractice—and the Government did not challenge the district court’s liability determination on appeal. Id. at 367–68. 14 As mentioned above, Plaintiff asserts claims for breach of implied contract and invasion of privacy. Compl. at ¶¶ 112–118, 119–131. 13 data breach—and therefore cannot be maintained against Sandhills. See Hui, 559 U.S. at 806 (“The breadth of the words ‘exclusive’ and ‘any’ supports this reading [of § 233(a)], as does the provision’s inclusive reference to all civil proceedings arising out of ‘the same subject-matter.’ . . . Language that broad easily accommodates both known and unknown causes of action.”); Jarrett v. United States, 874 F.2d 201, 203 (4th Cir. 1989) (noting “the remedy under FTCA shall be exclusive of any other action or proceeding” under § 233(a)); Robles v. Beaufort Mem’l Hosp., 482 F. Supp. 2d 700, 703 (D.S.C. 2007) (“[O]nce the community health center is deemed a Public Health Service employee, it enjoys immunity from those acts that relate to its employment, and any actions against it are treated as actions against the United States.” (internal quotation marks omitted) (emphasis added)); Celestine v. Mount Vernon Neighborhood Health Ctr., 289 F. Supp. 2d 392, 395 (S.D.N.Y. 2003) (“Once deemed a PHS employee, a community health center enjoys immunity from those acts that relate to its employment, and any actions against it are treated as actions against the United States.” (emphasis added)); see, e.g., Hui, 559 U.S. at 812 (holding “the immunity provided by § 233(a) precludes Bivens actions against individual PHS officers or employees for harms arising out of conduct described in that section”); Cuoco, 222 F.3d at 107–09 (same). In sum, none of the Government’s or Plaintiff’s arguments alter the Court’s conclusion regarding the substitution of the United States and the resulting immunity of Sandhills. Conclusion Sandhills was entitled to remove this case, and it is entitled to immunity from suit and substitution of the United States as the proper defendant. The Court GRANTS Sandhills’s motion to substitute [ECF No. 22] and SUBSTITUTES the United States as the defendant in this action. 14 IT IS SO ORDERED. Florence, South Carolina s/ R. Bryan Harwell June 2, 2022 R. Bryan Harwell Chief United States District Judge 15