PUBLISHED

UNITED STATES COURT OF APPEALS

FOR THE FOURTH CIRCUIT

No. 22-2268

JOANN FORD, on behalf of herself and all others similarly situated,

Plaintiff - Appellant,

and

UNITED STATES OF AMERICA,

Defendant - Appellee,

v.

SANDHILLS MEDICAL FOUNDATION, INC.,

Defendant - Appellee.

Appeal from the United States District Court for the District of South Carolina, at Florence. 

R. Bryan Harwell, Chief District Judge. (4:21-cv-02307-RBH)

Argued: December 7, 2023 Decided: March 29, 2024

Before THACKER, HARRIS, and RICHARDSON, Circuit Judges.

Vacated and remanded by published opinion. Judge Thacker wrote the opinion in which 

Judge Harris and Judge Richardson joined.

ARGUED: John A. Yanchunis, MORGAN & MORGAN, P.A., Tampa, Florida, for 

Appellant. Kevin Joseph Kennedy, UNITED STATES DEPARTMENT OF JUSTICE, 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 1 of 20
2

Washington, D.C., for Appellee. Matthew Sidney Freedus, FELDESMAN TUCKER 

LEIFER & FIDELL, LLP, Washington, D.C., for Appellee. ON BRIEF: Kenya J. Reddy, 

MORGAN & MORGAN, P.A., Tampa, Florida, for Appellant. Brian M. Boynton, 

Principal Deputy Assistant Attorney General, Mark B. Stern, Dana L. Kaersvang, Civil 

Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; Samuel 

R. Bagenstos, General Counsel, Michael I. Goulding, Associate General Counsel, Robert 

H. Murphy, Sean M. Flaim, General Law Division, UNITED STATES DEPARTMENT 

OF HEALTH AND HUMAN SERVICES, Washington, D.C.; Adair F. Boroughs, United 

States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Columbia, South 

Carolina, for Appellee United States. Rosie Dawn Griffin, FELDESMAN TUCKER 

LEIFER FIDELL, LLP, Washington, D.C.; Michael D. Wright, SAVAGE, ROYALL & 

SHEEHAN, LLP, Camden, South Carolina; Jessica L. Fickling, STROM LAW OFFICE, 

Columbia, South Carolina, for Appellee Sandhills Medical Foundation, Inc.

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 2 of 20
3

THACKER, Circuit Judge:

Joann Ford (“Appellant”), on behalf of herself and all others similarly situated, filed 

a complaint in South Carolina state court, alleging claims for negligence, breach of implied 

contract, invasion of privacy, and breach of confidentiality against Sandhills Medical 

Foundation, Inc. (“Sandhills”) for failure to properly maintain her personally identifying 

information (“PII”) and protected health information (“PHI”). Appellant provided this 

information to Sandhills as a condition of her treatment when she was a patient in 2018. 

After Appellant ceased being a patient at Sandhills, Appellant’s PII was stolen from 

Sandhills’ third party computer system in a cyberattack in late 2020. Appellant’s PHI was 

not affected by the cyberattack. 

Sandhills removed the case to federal court for a determination as to whether a 

federal immunity defense shielded it from liability. In order for Sandhills to be immune 

from suit, it had to demonstrate that Appellant’s alleged damages resulted “from the 

performance of medical, surgical, dental, or related functions.” 42 U.S.C. § 233(a). If

§ 233(a) applies, then the case is treated as one brought pursuant to the Federal Tort Claims 

Act (“FTCA”), Sandhills is afforded immunity, and the United States is substituted for 

Sandhills as the defendant. 

The district court concluded that Sandhills was immune from suit and the United 

States was substituted for Sandhills as the defendant pursuant to § 233(a). In coming to 

this conclusion, the district court reasoned that because Appellant was required to provide 

her PII to Sandhills in order to receive treatment, the theft of her PII arose out of Sandhills’ 

performance of “medical, surgical, dental, or related functions.”

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 3 of 20
4

But as explained below, we conclude that § 233(a) does not apply to Appellant’s 

claims because Sandhills was not performing a related function when an unnamed third 

party hacked and stole Appellant’s PII. 

Therefore, we vacate and remand. 

I.

A.

Sandhills is a South Carolina nonprofit health center that receives federal funding 

pursuant to the Public Health Service Act, 42 U.S.C. § 254b et seq., (the “PHS Act”) to 

provide primary health care and related services to medically underserved communities in 

South Carolina. This case arises from a cyberattack in late 2020, during which unknown 

bad actors stole the electronically stored PII of Sandhills’ patients, including Appellant. 

Appellant was a Sandhills patient from approximately 2018 to 2019. In order to 

provide her treatment, Sandhills requested, collected, and stored Appellant’s PII. At the 

time, Sandhills did not store its patients’ PII locally, but instead hired a third party vendor 

and utilized the vendor’s online data storage platform to store the information. 

In late 2020, the third party vendor’s computer system was hacked, resulting in the 

disclosure of Appellant’s PII. Sandhills did not learn of the breach until January 8, 2021. 

And on or about March 5, 2021, Sandhills announced the security breach to its current and 

former patients. Thereafter, in a public notice to its patients, Sandhills shared that it had 

“determined that patient medical records, lab results, medications, credit card numbers, and 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 4 of 20
5

bank account numbers were NOT affected.” J.A. 34 (emphasis in original).1

 Rather, the 

impacted data included patient names, dates of birth, mailing and email addresses, driver’s 

licenses and state identification cards, social security numbers, and insurance claims 

information that could be used to identify medical conditions. 

On April 2, 2021, an unknown and unauthorized individual used Appellant’s PII to 

apply for a $500 loan. Appellant asserts that she spent time dealing with this fraudulent 

use of her PII and remains concerned about the potential for further loss of privacy and 

fraud from unauthorized individuals using her stolen information. She also alleges that she 

suffered lost time, annoyance, interference, and inconvenience as a result of the data 

breach. Appellant claims she suffered “imminent and impending injury arising from the 

substantially increased risk of fraud, identity theft, and misuse” resulting from 

unauthorized persons possessing her PII. J.A. 41.

B.

On June 18, 2021, Appellant filed a Complaint in the Court of Common Pleas for 

Chesterfield County, South Carolina, alleging that Sandhills failed to safeguard her PII, 

which resulted in a fraudulent loan application in her name. Appellant styled her 

Complaint as a proposed nationwide class action, to include those current and former 

patients “whose PII or PHI was exposed to an unauthorized party.” J.A. 42. Appellant 

alleged claims for negligence, breach of implied contract, invasion of privacy, and breach 

of confidentiality based on Sandhills’ failure to: (1) adequately protect the PII and PHI of 

1 Citations to the “J.A.” refer to the Joint Appendix filed by the parties in this appeal.

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 5 of 20
6

Appellant and the class; (2) warn Appellant and the class of its inadequate information 

security practices; and (3) avoid sharing the PII and PHI of Appellant and the class without 

adequate safeguards.

After Sandhills was served the complaint, it notified the United States Attorney 

General, claiming that it was “entitled to absolute immunity from this civil action, as it 

resulted from Sandhills’ performance of medical or related functions.”2

 J.A. 65. After the 

time elapsed for the United States to make an appearance, Sandhills removed the action to 

the United States District Court for the District of South Carolina. In its removal, Sandhills 

argued the district court had subject matter jurisdiction over the case for three reasons. 

First, Sandhills relied on 42 U.S.C. § 233(l)(2), a federal removal statute that 

permits a community health center recipient of federal grant funds to remove a case to 

federal court to determine the applicability of 42 U.S.C. § 233(a) -- a federal immunity 

defense for qualifying private health centers that receive federal grant money. Section 

233(a) shields qualifying health centers from damages arising “from the performance of 

medical, surgical, dental, or related functions, including the conduct of clinical studies or 

2 If a suit covered by § 233(a) is brought in state court, the PHS defendant may 

notify the Attorney General. 42 U.S.C. § 233(l)(1). The Attorney General then has fifteen 

days to make an appearance in the state court and advise the court whether the defendant 

“is deemed to be an employee of the Public Health Services for purposes of this section 

with respect to the actions or omissions that are the subject of” the action. Id. This operates 

as the Attorney General certifying that the PHS defendant was acting in scope of 

employment. Id.; § 233(c). If fifteen days pass with no response from the Attorney 

General, “the civil action or proceeding shall be removed to the appropriate United States 

district court.” § 233(l)(2). Once removed to federal court, the merits of the action “shall 

be stayed in such court until such court conducts a hearing, and makes a determination, as 

to” whether the claim falls within § 233(a). Id.

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 6 of 20
7

investigation.” Sandhills argued that § 233(a) should apply to its data security functions, 

making it immune from suit, because it collects patient PII as a condition of providing 

treatment. Therefore, Sandhills contended that its maintenance of patient PII was 

inextricably woven into its provision of health care and thus qualified its data security as a 

“related” function of medical care. 

Second, in support of removal, Sandhills cited 28 U.S.C. § 1442(a)(1), which 

permits any officer of the United States or of any federal agency -- or any person acting 

under that officer -- to remove a case against them in their official or individual capacity 

to federal court, even when the underlying federal question arises only as a defense to a 

state law claim. See Jefferson Cnty., Ala. v. Acker, 527 U.S. 423, 431 (1999). Sandhills 

argued that, as “an officer, or a person acting under a federal officer” as a Public Health 

Service (“PHS”) employee, it had a right to remove the case pursuant to § 1442(a)(1). J.A. 

9. 

And finally, Sandhills argued that federal question jurisdiction existed pursuant to 

42 U.S.C. § 1331 because the substance of Appellant’s action hinges on § 233(a). 

Sandhills also requested that the district court substitute the United States for 

Sandhills as the defendant pursuant to § 233(a). Agyin v. Razmzan, 986 F.3d 168, 184 (2d 

Cir. 2021) (citing 42 U.S.C. § 233(a)) (stating that a defendant “is entitled to immunity 

from suit and to substitution of the United States as the defendant if this suit concerns 

actions [a federal employee] took within the scope of his employment as a deemed federal 

employee”). 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 7 of 20
8

Pursuant to § 233(1)(2), the case was automatically stayed until the district court 

could resolve the removal issue. And the district court ordered Sandhills to file a motion 

to substitute the United States and to “confer with government counsel regarding whether 

Sandhills is entitled to immunity from suit and to substitution of the United States as the 

defendant.” J.A. 4. Sandhills filed the motion to substitute, arguing that it should be 

immune from suit and the United States must be substituted for it as the defendant pursuant 

to 42 U.S.C. § 233(a). Thereafter, the United States filed a statement of interest expressing 

its position that Sandhills was not entitled to immunity because collecting and storing its 

patients’ PII was not inextricably woven into the performance of medical, surgical, or 

dental functions such that Sandhills’ data security should qualify as a “related” function 

within the meaning of § 233(a). The district court held a hearing on the motion, at which 

Sandhills, the United States, and Appellant were all heard.

Ultimately, the district court concluded that Sandhills was entitled to remove the 

case to federal court and to immunity and substitution of the United States. The district 

court reasoned that because Sandhills required Appellant to provide her PII as a condition 

of being a patient and receiving medical services, the breach of its systems containing such 

information arose out of Sandhills’ performance of medical or “related functions” within 

the meaning of § 233(a). And the district court supported this conclusion by pointing to 

Sandhills’ “statutory requirement of confidentiality,” which the district court believed was 

“inextricably woven” into Sandhills’ provision of health care such that it amounts to a 

“related” function. J.A. 267. 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 8 of 20
9

Once substituted as the defendant, the United States filed a motion to dismiss for 

lack of subject matter jurisdiction asserting that Appellant had failed to exhaust her 

administrative remedies with Health and Human Services before filing suit as required by 

the FTCA. Appellant conceded that she had not exhausted her administrative remedies, 

but she maintained that § 233(a) did not shield Sandhills from suit as the storage of her PII 

with a third party vendor was not a not a “medical, surgical, dental, or related function[].” 

Therefore, in Appellant’s view, substituting the United States was improper as the claims

did not fall within the purview of § 233(a) and therefore the FTCA did not apply. And if 

the FTCA did not apply, then Appellant was not required to exhaust her administrative 

remedies prior to suit. 

The district court, finding no grounds to overturn its prior decision, granted the 

motion to dismiss for lack of subject matter jurisdiction. This appeal followed. 

On appeal, Appellant argues that Sandhill’s data storage practice, including the 

maintenance of her PII, is too removed from the provision of health care to amount to a 

“related” function such that Sandhills cannot receive § 233(a) immunity and, therefore, the 

case should not be treated as one brought pursuant to the FTCA. We agree with Appellant. 

II.

Because the application of § 233(a) is a question of law, we review de novo the 

district court’s conclusion that § 233(a) shields Sandhills from suit, as well as the 

substitution of the United States. S.C. Wildlife Fed’n v. Limehouse, 549 F.3d 324, 332 (4th 

Cir. 2008) (“[T]he existence of sovereign immunity is a question of law that we review de 

novo.” (alterations in original) (internal quotation marks omitted)); Gutierrez de Martinez 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 9 of 20
10 

v. Drug Enf’t Admin., 111 F.3d 1148, 1152 (4th Cir. 1997). And we also review de novo 

the district court’s dismissal of Appellant’s claims. Pledger v. Lynch, 5 F.4th 511, 517 (4th 

Cir. 2021). 

III. 

Whether Data Security Amounts to a “Related” Function Within the Purview of § 233(a) 

A. 

The Federally Supported Health Centers Assistance Act 

Pursuant to the Federally Supported Health Centers Assistance Act (“FSHCAA”), 

private health centers that receive federal funds may be considered PHS employees if 

certain conditions are met. Friedenberg v. Lane Cnty., 68 F.4th 1113, 1118 (9th Cir. 2023) 

(citing 42 U.S.C. § 233(g)). Appellant does not challenge Sandhills’ status as a PHS 

employee. If an entity receives PHS employee status, then § 233(a) provides the entity 

immunity from “damage for personal injury, including death, resulting from the 

performance of medical, surgical, dental, or related functions, including the conduct of 

clinical studies or investigation, by any commissioned officer or employee of the Public 

Health Service while acting within the scope of his office or employment.” 42 U.S.C. 

§ 233(a) (emphasis supplied). 

 If a claim is subject to § 233(a), then the claim is treated as one brought against the 

United States within the purview of the FTCA. Hui v. Castaneda, 559 U.S. 799, 802 (2010) 

(“Section 233(a) makes the FTCA remedy against the United States exclusive of any other 

civil action or proceeding for any personal injury caused by a PHS officer or employee 

performing a medical or related function while acting within the scope of his office or 

employment.” (internal quotation marks omitted)). If the FTCA applies, the United States 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 10 of 20
11 

is substituted as a defendant. See 42 U.S.C. § 233(a); Hui, 559 U.S. at 801–02 (“When 

federal employees are sued for damages for harms caused in the course of their 

employment, the . . . FTCA . . . generally authorizes substitution of the United States as the 

defendant.”); see also Agyin v. Razmzan, 986 F.3d 168, 184 (2d Cir. 2021) (“[A PHS 

employee] is entitled to immunity from suit and to substitution of the United States as the 

defendant if this suit concerns actions he took within the scope of his employment as a 

deemed federal employee.”). 

Thus, the FSHCAA “essentially makes the U.S. government the medical 

malpractice insurer for qualifying . . . health centers, their officers, employees, and 

contractors, allowing these ‘deemed’ health centers to forgo obtaining private malpractice 

insurance.” Dedrick v. Youngblood, 200 F.3d 744, 745 (11th Cir. 2000). “This designation 

enables centers caring for underserved populations to spend their money on patient care 

rather than malpractice premiums.” Chronis v. United States, 932 F.3d 544, 546 n.1 (7th 

Cir. 2019). 

B. 

Data Security Does Not Amount to a “Related” Function Within § 233(a) 

We now turn to whether § 233(a) shields Sandhills from Appellant’s suit, which 

arose out of Sandhills’ allegedly negligent storage of her PII with a third party vendor. In 

this regard, the question we face is whether data security is a “medical, surgical, dental, or 

related function[]” that qualifies for § 233(a) immunity. In this instance, it is not. 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 11 of 20
12

1.

Based on the plain language of § 233(a), data security is not a related function within the 

meaning of the statute

Clearly, the storage of patient PII is not in and of itself a medical, surgical, or dental

function. Therefore, to fall within the purview of § 233(a), it must be a “related” function.

In assessing what may be a “related” function, we first look to the plain language of 

the statute. See Lynch v. Jackson, 853 F.3d 116, 121 (4th Cir. 2017) (“We start as we must 

with the plain language of the statute because when the statute’s language is plain, the sole 

function of the courts—at least where the disposition required by the text is not absurd—

is to enforce it according to its terms.” (internal quotation marks omitted)). 

Appellant contends that the plain language of the statute supports that a general term 

like “related functions” must be construed to embrace only the words that come before it -

- medical, surgical, and dental. Appellant therefore argues that the collection and storage 

of PII does not amount to a “related” function of medical, surgical, or dental services where 

“[c]ollecting such information does not depend on a medical, surgical, or dental 

professional’s skill, knowledge, or judgment.” Appellant’s Opening Br. at 17–18. In 

response, Sandhills argues that the word “related” must be broadly interpreted such that 

the statute covers “ancillary functions” to medical services. Sandhills Resp. at 15. We 

agree with Appellant that a more limited interpretation of “related functions” is proper. 

We begin with the meaning of the words “related” and “function.” Related is 

defined as “connected by relation,” “having close harmonic connection.” Webster’s 

Seventh New Collegiate Dictionary 723 (1969), and “having mutual . . . connection,” 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 12 of 20
13

Oxford English Dictionary (compact ed. 1971).3

 And “function” is defined not as any 

given activity, but as “the action for which one is particularly fitted or employed,” 

Webster’s, supra at 338, and “[t]he nature and proper action of anything; activity 

appropriate to any business or profession,” Black’s Law Dictionary (4th ed. 1968). Thus, 

a “related function[]” is an activity particularly fitted to whatever is connected to whatever 

proceeds the phrase. In other words, its meaning depends on the words that come before 

it. 

Within § 233(a), the language “related functions” acts as a general catchall for

specific functions -- “the performance of medical, surgical, [or] dental” functions. 42 

U.S.C. § 233(a). “[W]here general words follow specific words in a statutory enumeration, 

the general words are construed to embrace only objects similar in nature to those objects 

enumerated by the preceding specific words.” Cir. City Stores, Inc. v. Adams, 532 U.S. 

105, 114–15 (2001) (internal quotation marks omitted); see also Robinson v. Shell Oil Co., 

519 U.S. 337, 341 (1997) (“The plainness or ambiguity of statutory language is determined 

by reference to the language itself, the specific context in which that language is used, and 

the broader context of the statute as a whole.”). We therefore construe a general term like 

“related” as sharing the attributes of the specific words in the list. See Yates v. United 

States, 574 U.S. 528, 544 (2015) (applying the principle of noscitur a sociis to limit 

3 Because § 233(a) was originally added to the PHS Act in 1970, see PL 91-623, 84 

Stat. 1868 (1970), we employ definitions from that time to interpret Congress’ intent. Wisc. 

Cent. Ltd. v. United States, 585 U.S. 274, 277 (2018) (“[O]our job is to interpret the words 

consistent with their ordinary meaning . . . at the time Congress enacted the statute.”

(internal quotation marks omitted)). 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 13 of 20
14

“tangible object” to those items similar to “record” or “document” as opposed to the fish 

at issue in the investigation). As a matter of plain meaning, medical, surgical, and dental 

all fit into one category – they are adjectives that describe various fields of health care.4

 

Staying true to Congress’ intent, we read a “related” function as fitting within that category, 

or in other words, a field of health care outside of medicine, surgery, or dentistry. See 

Wikimedia Found. v. Nat’l Sec. Agency, 14 F.4th 276, 297 (4th Cir. 2021) (applying 

noscitur a sociis as limiting the phrase “such other material” to the two preceding 

conditions in a list). 

The words immediately following “related functions” also cabin its contextual 

meaning. The statute exemplifies “related functions” as “including the conduct of clinical 

studies or investigation.” 42 U.S.C. § 233(a). This provides further support for the position 

4 One might jump to the thought that surgery is merely a subset of medicine. And 

in some sense that is true. But this generalization misses the long-standing distinctions 

between medicine and surgery. Surgery involves bodily invasion while medicine is 

generally non-invasive. See Ankur Aggarwal, The Evolving Relationship Between Surgery 

and Medicine, 12 AMA J Ethics 119, 119 (2010) (“Medicine’s two branches—the less 

invasive medical methods and the more invasive surgical methods—have been around 

since before the existence of written language. Surgery, however, was not viewed as 

belonging to the same sphere as medical treatments until relatively recently, and, even now, 

a sharp distinction exists between surgeons and other medical doctors. Analyzing the 

history of surgery can help explain the separation between medical and surgical treatments 

and why the two fields, although viewed quite differently, fit under the umbrella of 

medicine.”); Connor T.A. Brenna & Sunit Das, Divides of Identity in Medicine and 

Surgery: A Review of the Duty-Hour Policy Preference, 57 Annals of Medicine and 

Surgery 1, 2 (2020) (noting the known and intuitive differences between Medicine and 

Surgery, including their historical origins); Fitzhugh Mullan, Big Doctoring in America 36 

(2002) (“The philosophical difference between ‘medicine’ and ‘surgery’ is a time-honored 

one.”); Dorland’s Illustrated Medical Dictionary 785 (26th ed. 1985) (defining “medical” 

in part as “pertaining to medicine as opposed to surgery”).

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 14 of 20
15

that “related functions” explicitly encompasses only the provision of health care. Both the 

Supreme Court and this court have held that the word “including” “connotes simply an 

illustrative application of [a] general principle.” United States v. Hawley, 919 F.3d 252, 

256 (4th Cir. 2019) (quoting Fed. Land Bank of St. Paul v. Bismarck Lumber Co., 314 U.S. 

95, 100 (1941)). Insofar as “related functions” include providing treatment or diagnoses 

in a clinical study, there is little support for the notion that data security, which is more 

akin to an administrative function, should be included within the meaning of § 233(a).

Defining § 233(a)’s scope to extend only to the provision of health care also makes 

sense because the subsection provides that the United States will be substituted as 

defendant solely for claims “for damage for personal injury, including death.” Misfeasance 

in the provision of health care would most likely lead to personal injury or death. A wider 

definition of “related functions” may improperly broaden § 233(a) to encompass 

misfeasance that results in other types of damages, such as contract damages.

When employing the canons of construction and considering the plain meaning of 

the words in § 233(a), we discern no ambiguity in the phrase “related functions.” As such, 

in order to trigger immunity, alleged damages giving rise to a lawsuit must arise from the 

provision of health care. See 42 U.S.C. § 233(a). As explained below, Appellant’s alleged 

damages do not. 

2.

Appellant’s alleged damages did not occur because of the provision of health care

Appellant’s claims arose when unknown bad actors hacked Sandhills’ third party 

vendor’s computer system and stole Appellant’s PII at least a year after she had ended her 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 15 of 20
16

treatment at Sandhills. Here, Appellant’s PII was not released as a result of the provision 

of health care. Appellant’s PII was not inappropriately divulged as a result of Sandhills

providing health care to Appellant. In comparison, in Mele v. Hill Health Center, which 

Sandhills argues supports its position, the alleged injury arose when the patient’s sensitive 

information was “improperly disclosed” to another provider at the direction of a medical 

professional in relation to the patient’s treatment. See 2008 WL 160226, at *3 (D. Conn. 

Jan. 8, 2008). The plaintiff’s injury in Mele, unlike Appellant’s, “concern[ed] the medical 

functions of providing treatment.” Id. 

But here, the allegedly improper release of Appellant’s PII did not occur because of 

Sandhills’ performance of the provision of health care. Therefore, Appellant’s damages

did not arise from any action taken by Sandhills “in [its] capacity as a doctor responsible 

for, [or] in the course of rendering medical treatment for” Appellant. See Cuoco, 222 F.3d 

at 109 (applying § 233(a) immunity to constitutional violation claim arising out of denial 

of gender affirming care for pre-trial detainee). This is especially true in this case where, 

at the time of the unexpected cyberattack, Appellant was no longer receiving any treatment 

at Sandhills and had not been a Sandhills patient for at least a year. 

Nonetheless, Sandhills argues that its storage and maintenance of Appellant’s PII 

was “related” to her health care treatment because Appellant was required to provide this 

information in order to receive treatment from Sandhills. Sandhills’ interpretation misses

the mark. Sandhills is shielded only from those damages that arise from its performance

of “related functions” within the meaning of § 233(a). Data protection is not an activity 

the medical field in which Sandhills operates is “particularly fitted to” execute, nor is any 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 16 of 20
17

“related” field of health care. Webster’s, supra at 338. This is highlighted by the fact that 

Appellant alleges that Sandhills retains the relevant data “even after the [patient] 

relationship ends.” J.A. 30 (emphasis added). Therefore, the fact that Appellant was 

required to provide her billing information prior to receiving treatment cannot shield 

Sandhills when the injury did not occur because of any provision of health care.

There is no limiting principle to Sandhills’ position. If § 233(a) applied to any 

action that a patient must take in order to receive health care, it would shield Sandhills from 

any and all claims despite their lack of relation to their treatment. Consider a scenario 

where, in anticipation of receiving health care, Appellant provided her PII and billing 

information to Sandhills but never showed up for her appointment. In that instance, 

Appellant would have suffered the same injury she alleges here from the data breach

without ever even receiving treatment. Similarly, Appellant’s alleged injury could have 

resulted from a data breach at a host of businesses to which she likely discloses her PII, 

none of which are involved in the provision of health care, including an employer, an entity 

involved in a banking, financial, or real estate transaction, or an insurance company. In 

sum, the focus is on the function that caused the injury, and, here, Appellant was not injured 

by any health care provided by Sandhills. 

3.

Sandhills’ statutory duty to maintain patient confidentiality cannot override § 233(a)’s 

mandate that alleged damages arise during the performance of a medical or “related”

function

Sandhills also argues that based on its statutory and ethical duty to maintain the 

confidentiality of patient information, it should be accorded immunity pursuant to § 233(a). 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 17 of 20
18

Sandhills relies on its statutory duty pursuant to the FSHCAA to “have an ongoing quality 

improvement system . . . that maintains the confidentiality of patient records” to argue that 

its patient record systems should qualify as “related functions.” See 42 U.S.C. 

§ 254b(k)(3)(C). Sandhills posits that because it must show that it maintains these systems 

in order to receive grant money, then data security is included in the provision of health 

care. 

But the requirements to receive federal grant money on which Sandhills relies are 

separate and apart from § 233(a) immunity. In fact, a health center that qualifies to receive 

federal grant money need not even apply to be considered a PHS employee. See 42 U.S.C. 

§ 233(g)(1)(D) (the Secretary may not “deem an entity . . . to be an employee of the Public 

Health Service for purposes of this section, . . . unless the entity has submitted an 

application”); id. § 233(g)(1)(G)(ii) (allowing federal grant recipients “that ha[ve] not 

submitted an application . . . to purchase medical malpractice liability insurance coverage 

with Federal funds”). And as previously discussed, without PHS employee status, § 233(a) 

does not apply. Of note, there is no mention of data security or systems in § 233. 

Therefore, Sandhills’ argument that Congress intended data security to be a “related”

function lacks credence. 

Nor does Sandhills’ duty to keep patient information confidential mean that 

Appellant’s claims arose from a “medical, surgical, dental, or related functions.” 42 U.S.C. 

§ 233(a). Sandhills points to Krandle v. Refuah Health Center, Inc. to support its argument 

that its duty to protect patient information makes data security a “function . . . essential to 

the practice of medicine.” See No. 22cv4977, 2024 WL 1075359, at *9 (S.D.N.Y. Mar. 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 18 of 20
19

12, 2024). Not only is Krandle not binding precedent on this court, but it fails to focus on 

whether the alleged damages arose as a result of the provision of health care to the injured 

party. See id. In the case of this data breach, they did not.5

 Simply because Sandhills has 

a duty to keep Appellant’s information confidential does not mean that the release of her 

PII resulted from Sandhills’ provision of health care. 

The same applies to Sandhills’ maintenance of any medical billing codes. In her 

complaint, Appellant alleges that Sandhills failed to properly secure its billing codes which 

could reveal her medical diagnoses. But again, § 233(a) requires that cause of Appellant’s 

injury be the provision of health care. And even so, the development and protection of the 

codes is not part of the provision of health care. Instead, medical coding is typically a byproduct, separate and apart from the provision of heath care, performed by coders who 

review documentation of a patient’s visit to assign it the appropriate billing code. These 

are not categories within the provision of health care. Rather, they are administrative 

operations. 

Again, to determine whether § 233(a) immunity applies, the focus is on the function 

-- not the duty. See Cuoco, 222 F.3d at 109 (emphasizing that it is the conduct, not the 

style of the claim, that determines whether § 233(a) immunity applies). Appellant does not 

allege that Sandhills provided deficient health care or improperly collected her information 

5 Similarly, Hale v. ARcare, Inc., also provided by Sandhills, is not binding on this 

court. See No. 3:22cv117, 2024 WL 1016361, at *3 (E.D. Ark. Mar. 8, 2024). But Hale’s

conclusion that damages arising from a data security breach do not “occur[] during the 

course of medical treatment within the context of the provider-patient relationship” more 

closely aligns with the language of § 233(a). 

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 19 of 20
20

as a part of her treatment. Indeed, Appellant’s alleged damages arose from a data security 

breach that occurred at least a year after she ceased being a patient at Sandhills. Because 

Appellant’s injury did not arise from Sandhills’ provision of health care, § 233(a) does not 

shield Sandhills from Appellant’s claims. Id. 

And because § 233(a) does not apply, the United States cannot be substituted for 

Sandhills as the defendant. Section 233(a) allows the United States to be substituted only 

if the action falls within the scope of immunity. Hui, 559 U.S. at 801. Because § 233(a) 

does not apply, Appellant’s claims cannot be treated as ones brought pursuant to the FTCA,

and thus, the substitution of the United States for Sandhills was in error. It then necessarily 

follows that the district court erred when it required Appellant to have exhausted her 

administrative remedies pursuant to the FTCA in order to maintain her suit. 

IV.

For these reasons, the district court’s order applying immunity pursuant to § 233(a) 

and substituting the United States for Sandhills as the defendant is vacated. We remand 

for further proceedings consistent with this opinion. 

VACATED AND REMANDED

USCA4 Appeal: 22-2268 Doc: 55 Filed: 03/29/2024 Pg: 20 of 20