Krandle v. Refuah Health Center, Inc.

Background

Rebecca Krandle, Dawn Esposito, and Paola Cortazar brought two related class actions against Refuah Health Center, Inc. They alleged that Refuah’s systems were breached between May 31 and June 1, 2021, allowing third parties to access and extract personal identifying information and personal health information. The information allegedly included Social Security numbers, financial information, medical treatment and diagnosis information, and health insurance policy numbers. Among other claims, the plaintiffs alleged that Refuah negligently failed to protect their information.

Refuah was a health center that had been treated as an employee of the federal Public Health Service for purposes of 42 U.S.C. § 233(a). Refuah moved to substitute the United States as the only defendant. The court described the motion as both a request for dismissal based on official immunity and a request for substitution. The United States opposed substitution and argued that additional procedures were required before it could become a party.

Legal standard and statutory interpretation

Section 233(a) makes the Federal Tort Claims Act the exclusive remedy for certain claims arising from medical, surgical, dental, or related functions performed by Public Health Service employees acting within the scope of their employment. The Supreme Court has described this protection as absolute immunity, meaning that covered defendants are protected from suit as well as from liability.

The court held that “related functions” are activities with an established relationship to the practice of treating or diagnosing patients. The court rejected the argument that the statute covers only medical malpractice or only conduct occurring during direct medical treatment. It also rejected the argument that a function is covered merely because it is part of a person’s position at a Public Health Service entity. The function must have a real relationship to medical practice.

Application to the data breach

The court held that protecting patient records from unauthorized access and disclosure is a medical or related function under Section 233(a). Refuah was required by federal law to maintain the confidentiality of patient records and to protect health information from reasonably anticipated security threats. The court reasoned that patient privacy is essential to effective medical care because accurate diagnosis and treatment depend on patients providing detailed health information and trusting that it will be protected.

The court therefore concluded that the plaintiffs’ allegations concerning Refuah’s failure to safeguard their information arose from conduct covered by Section 233(a). This conclusion addressed the scope of immunity; the court did not decide whether the United States would ultimately be liable under the Federal Tort Claims Act. The court noted that the Act’s separate liability requirements, including the applicable state-law rules, would control that question later.

Substitution of the United States

The court also held that it had authority to substitute the United States for Refuah. It relied on the Supreme Court’s explanation that the Federal Tort Claims Act’s certification procedure is not the only way to establish immunity or accomplish substitution under Section 233(a). The court reasoned that Section 233 would not work as intended if Refuah could obtain immunity but no party could ensure that the United States would defend the action.

Disposition

The court granted Refuah’s motion. It ordered the United States substituted as the party defendant in both actions. It further ordered Refuah to serve the Attorney General under Section 233(b) within 30 days if Refuah had not already done so. The clerk was directed to terminate the pending motion entries.