Mixon v. CareSouth Carolina Inc.

• Decision Date: 02 June 2022
• Docket Number: Civil Action 4:22-cv-00269-RBH
• Parties: Summer Mixon, individually, and on behalf of all others similarly situated, Plaintiff, v. CareSouth Carolina, Inc., Defendant.
• Court: U.S. District Court — District of South Carolina

Summer Mixon, individually, and on behalf of all others similarly situated, Plaintiff,
v.
CareSouth Carolina, Inc., Defendant.

Civil Action No. 4:22-cv-00269-RBH

United States District Court, D. South Carolina, Florence Division

June 2, 2022

ORDER

R. BRYAN HARWELL, CHIEF UNITED STATES DISTRICT JUDGE.

This case involves an electronic data breach regarding confidential personal and medical information of patients of Defendant CareSouth Carolina, Inc. (“CareSouth”), a federally funded community health center. Plaintiff Summer Mixon, a patient, filed a proposed class action in state court, and CareSouth removed the action to this Court seeking substitution of the United States as the defendant. The Court grants CareSouth's Motion to Substitute for the reasons herein.

Background

Plaintiff was a patient of CareSouth, a federally deemed community health center under the Federally Supported Health Centers Assistance Act (“FSHCAA”), 42 U.S.C. § 233(g)-(n), that receives federal grant funds under Section 330 of the Public Health Service Act, 42 U.S.C. § 254b. The FSHCAA authorizes the Secretary of the Department of Health and Human Services (“HHS”) to deem an entity that receives federal funds to be an employee of the Public Health Service (“PHS”) for purposes of 42 U.S.C. § 233. Once the Secretary deems the entity a PHS employee, that “determination shall be final and binding upon the Secretary and the Attorney General and other parties to any civil action or proceeding.” 42 U.S.C. § 233(g)(1)(F). PHS employees are eligible for coverage under the Federal Tort Claims Act (“FTCA”), 28 U.S.C. § 1346(b), including “absolute immunity . . . for actions

1

arising out of the performance of medical or related functions within the scope of their employment.” Hui v. Castaneda, 559 U.S. 799, 806 (2010) (citing 42 U.S.C. § 233(a)). CareSouth was a deemed PHS employee for the time periods relevant to this lawsuit. See ECF No. 1-2 (deeming notices).

If a civil action is filed in state court against a health center for damage for personal injury resulting from the performance of medical or related functions, the Attorney General must appear in state court within fifteen days of being notified of the filing and advise the court whether the Secretary has deemed the entity a PHS employee “with respect to the actions or omissions that are the subject of such civil action.” 42 U.S.C. § 233(a), (g)(4), (l)(1). “If the Attorney General does so, the civil action or proceeding ‘shall be removed without bond at any time before trial . . . to the district court of the United States of the district and division embracing the place wherein it is pending and the proceeding deemed a tort action brought against the United States.'” Agyin v. Razmzan, 986 F.3d 168, 173 (2d Cir. 2021) (ellipsis in original) (quoting 42 U.S.C. § 233(c)). However, if the Attorney General fails to appear in state court within fifteen days, “upon petition of any entity . . ., the civil action or proceeding shall be removed to the appropriate United States district court.” 42 U.S.C. § 233(l)(2). Upon removal under § 233(l)(2), the civil action or proceeding is stayed until the district court “conducts a hearing, and makes a determination, as to the appropriate forum or procedure.” Id.

As alleged in the complaint, in December 2020, an unlawful cyberattack was made against CareSouth servers containing unencrypted personal and confidential information linked to Plaintiff and other patients.^[1] Complaint [ECF No. 1-1 at pp. 4-35] at ¶¶ 1-2, 7, 13-20. Such data included health insurance and banking information, addresses, and Social Security numbers. Id. at ¶ 33. Due to the data

2

breach, cybercriminals allegedly acquired Plaintiff's information intending to misuse and sell it; unauthorized persons viewed her information; and nefarious actors attempted to open accounts in Plaintiff's name, thereby allegedly damaging her reputation and credit worthiness and compromising the security of her identity. Id. at ¶¶ 18-21, 27. In May 2021, CareSouth notified patients of the data breach and offered one year of identity theft protection.^[2] Id. at ¶¶ 16, 23. Plaintiff claims CareSouth's response to the data breach was insufficient. Id. at ¶¶ 23-26. She alleges actual identity theft, costs associated with preventing further identity theft, anxiety, emotional distress, loss of privacy, and other economic and noneconomic damages. See, e.g., id. at ¶¶ 94-95, 135, 143.

On November 9, 2021, Plaintiff filed a proposed class-action complaint in state court asserting seven claims: negligence, wrongful intrusion/invasion of privacy, breach of express contract, breach of implied contract, breach of S.C. Code § 39-1-90, unjust enrichment, and breach of fiduciary duty. ECF No. 1-1. On November 16, 2021, Plaintiff served CareSouth with the complaint. ECF No. 1-1 at pp. 41, 44.

On January 12, 2022, CareSouth delivered copies of the summons and complaint to HHS and the U.S. Attorney for this District. ECF Nos. 1-4 & 1-5. On January 20, the U.S. Attorney filed a notice in state court pursuant to 42 U.S.C. § 233(l)(1), asserting that it was first notified of the action on January 13, that whether CareSouth was deemed a PHS employee regarding the action was under consideration, and that the decision whether the United States would intervene was under consideration. ECF No. 1-1 at p. 47. Thus, the Attorney General appeared within fifteen days of being notified.

However, on January 28, CareSouth removed the case here invoking, inter alia, both 42 U.S.C. § 233(l)(2) and 28 U.S.C. § 1442(a)(1)

3

seeking substitution of the United States as the defendant. ECF No. 1. Thereafter, CareSouth filed the instant motion to substitute;^[3] the United States filed a statement of interest opposing substitution; Plaintiff filed a response in opposition to CareSouth's motion; and CareSouth filed a response to the statement of interest and reply in support of its motion to substitute. ECF Nos. 9, 12, 13, & 16. The Court held a hearing on the motion to substitute on April 26. ECF Nos. 17 & 21.

Discussion

I. Propriety of Removal

Initially, the Court notes the Government contends CareSouth's removal of this case was improper. ECF No. 12 at pp. 20-26. As mentioned above, CareSouth premised removal on several statutes, including 28 U.S.C. § 1442(a)(1), the federal officer removal statute.

Section 1442(a)(1) authorizes the “United States or any agency thereof or any officer (or any person acting under that officer) of the United States or of any agency thereof” to remove a civil action from state court “for or relating to any act under color of such office.” 28 U.S.C. § 1442(a)(1) (emphasis added). The Supreme Court has held that the phrase “acting under” is broad-though not limitless-and that a court must liberally construe the statute. Watson v. Philip Morris Cos., 551 U.S. 142, 147 (2007). “Under the statute, private actors can remove a case to federal court when they show that they: (1) acted under the direction of a federal officer; (2) possess a colorable federal defense; and (3) engaged in government-directed conduct that was causally related to the plaintiff's claims.” Cnty. Bd. of Arlington Cnty., Virginia v. Express Scripts Pharmacy, Inc., 996 F.3d 243, 247 (4th Cir. 2021).

4

“In imposing these requirements, the statute aims to protect the Federal Government from interference with its operations...