PUBLISHED

UNITED STATES COURT OF APPEALS

FOR THE FOURTH CIRCUIT

No. 17-1592

CRAIG CUNNINGHAM, on behalf of himself and all others similarly situated,

Plaintiff - Appellant,

v.

GENERAL DYNAMICS INFORMATION TECHNOLOGY, INC.,

Defendant - Appellee.

Appeal from the United States District Court for the Eastern District of Virginia, at 

Alexandria. Liam O’Grady, District Judge. (1:16-cv-00545-LO-TCB) 

Argued: January 24, 2018 Decided: April 24, 2018

Before TRAXLER and FLOYD, Circuit Judges, and SHEDD, Senior Circuit Judge.

Affirmed by published opinion. Judge Floyd wrote the opinion in which Judge Traxler 

and Senior Judge Shedd joined.

ARGUED: Aytan Yehoshua Bellin, BELLIN & ASSOCIATES LLC, White Plains, New 

York, for Appellant. James P. Rouhandeh, DAVIS, POLK & WARDWELL, LLP, New 

York, New York, for Appellee. ON BRIEF: Roger Furman, Los Angeles, California, for 

Appellant. Neil H. MacBride, Washington, D.C., Paul S. Mishkin, DAVIS POLK & 

WARDWELL LLP, New York, New York; Attison L. Barnes, III, Stephen J. Obermeier, 

WILEY REIN LLP, Washington, D.C., for Appellee.
2

FLOYD, Circuit Judge: 

Greg Cunningham alleges that he received an autodialed, prerecorded phone call 

from General Dynamics Information Technology, Inc. (“GDIT”) advertising the 

commercial availability of health insurance, without having given his prior express 

consent, in violation of the Telephone Consumer Protection Act (“TCPA”). The district 

court granted GDIT’s motion to dismiss for lack of subject matter jurisdiction on the 

ground that GDIT is immune from suit under the Yearsley doctrine, which immunizes 

government contractors from suit when the government authorized the contractor’s 

actions and the government validly conferred that authorization. Yearsley v. W. A. Ross 

Constr. Co., 309 U.S. 18, 20–21 (1940). 

On appeal, Cunningham argues that the district court erred in conferring Yearsley 

immunity and consequently dismissing the suit for three distinct reasons. First, he asserts 

that the Yearsley doctrine does not apply as a matter of law to federal claims. Next, he 

asserts that GDIT fails to qualify for Yearsley immunity both because the government did 

not authorize its actions and because the authorization was not validly conferred. Finally, 

he asserts that even if Yearsley immunity applies, Yearsley is a merits defense from 

liability rather than a jurisdictional immunity. We find these arguments unpersuasive, 

and now affirm the district court’s dismissal for lack of subject matter jurisdiction.
3

I.

A.

Pursuant to the doctrine of sovereign immunity, the United States is immune from 

private civil actions absent an express waiver. Kerns v. United States, 585 F.3d 187, 

193–94 (4th Cir. 2009) (citing United States v. Sherwood, 312 U.S. 584, 586 (1941)). 

Under the concept of derivative sovereign immunity, stemming from the Supreme 

Court’s decision in Yearsley, 309 U.S. at 20–21, agents of the sovereign are also 

sometimes protected from liability for carrying out the sovereign’s will. In re KBR, Inc.,

Burn Pit Litig., 744 F.3d 326, 341–42 (4th Cir. 2014) (internal quotation marks omitted)

(interpreting Yearsley as recognizing that private employees should receive immunity 

from suit when they perform the same functions as government employees). This 

immunity derives from “ ‘the government’s unquestioned need to delegate governmental 

functions,’ ” and the acknowledgement that “[i]mposing liability on private agents of the 

government would directly impede the significant governmental interest in the 

completion of its work.” Butters v. Vance Int’l, Inc., 225 F.3d 462, 466 (4th Cir. 2000) 

(quoting Mangold v. Analytic Servs., Inc., 77 F.3d 1442, 1448 (4th Cir. 1996)). “[U]nder 

Yearsley, a government contractor is not subject to suit if (1) the government authorized 

the contractor’s actions and (2) the government ‘validly conferred’ that authorization, 

meaning it acted within its constitutional power.” In re KBR, 744 F.3d at 342 (citing 

Yearsley, 309 U.S. at 20–21). 
4

B.

On appeal, we review whether the district court erred in conferring Yearsley 

immunity on GDIT’s phone call to Cunningham.

1 As relevant here, the Affordable Care 

Act (“ACA”) directs the U.S. Department of Health and Human Services, Centers for 

Medicare & Medicaid Services (“CMS”) to establish a system to keep applicants 

informed about their eligibility for enrollment in a qualified health plan. See 42 U.S.C. 

§ 18083(a), (b)(2), (e). CMS maintains the HealthCare.gov website, through which 

individuals may enroll for health coverage under the ACA using an online application. 

The online application requires visitors to provide their name and phone number, and 

accept CMS’s privacy policy by affirmatively clicking an “Accept” box acknowledging, 

inter alia, that CMS may use the phone number provided to contact them with more 

information. 

To carry out their statutorily mandated obligations under the ACA, CMS awarded 

a contract to Vangent, Inc., which subsequently merged into GDIT, for contact center

operations support for CMS programs, including the HealthCare.gov website. Under the 

contract, GDIT was required to make phone calls from January 1, 2015, through May 16, 

2016, to inform individuals about their ability to buy health insurance through the health 

insurance exchanges created by the ACA. In accordance with this instruction, CMS 

authorized GDIT to use an autodialer to make the calls, provided a script for each call, 

 1 Cunningham filed this claim as a putative class action, alleging that GDIT made 

hundreds of thousands of autodialed, prerecorded phone calls in violation of the TCPA. 

For convenience, we refer only to the disputed call to Cunningham. 
5

and provided a list of phone numbers for each call. Section 17 of the CMS-GDIT 

contract also required GDIT to “maintain a corporate compliance program” that included

“[a]n internal monitoring and auditing function to help ensure compliance with statutes 

[and] regulations,” and “[a]n enforcement and disciplinary process to address violations 

of applicable statutes [and] regulations . . . .” J.A. 731–32. 

On December 1, 2015, pursuant to the ACA’s statutory mandate, CMS sent GDIT 

approximately 2.65 million telephone numbers and directed GDIT to call each of those 

numbers over the next five days in accordance with their contract. The numbers were 

divided into seven lists specifying the exact day that GDIT was to call each number and 

which of the scripts CMS provided that GDIT was to use for each call. One of CMS’s 

lists directed GDIT to call Cunningham’s cell phone and approximately 680,000 other 

numbers the next day, December 2, 2015. GDIT made the autodialed, prerecorded call to 

Cunningham’s cell phone on December 2, 2015. When Cunningham did not pick up, the 

prerecorded message left the following approximately 30-second voicemail message:

Hello! This is an important message from HealthCare.gov. The deadline to 

enroll in a 2016 health insurance plan is coming soon. You may be able to 

qualify for financial help to make health insurance more affordable. With 

financial help, most people can find plans for $75 or less per month. Visit 

HealthCare.gov today to see how much you can save. If you have 

questions, you can call the Health Insurance Marketplace to talk to a trained 

enrollment specialist at 1-800-318-2596. That’s 1-800-318-2596. We are 

available 24 hours a day and the call is free. Don’t forget―the deadline to 

enroll is Tuesday, December 15th. If you’ve already taken action and have 

2016 health coverage, please ignore this message. Thank You! Goodbye.

J.A. 28. This message was identical to the script CMS provided GDIT.

Cunningham alleges that he received this autodialed, prerecorded phone call from 
6

GDIT advertising the commercial availability of health insurance without having given 

his prior consent, in violation of the TCPA.2

 As relevant here, the TCPA prohibits any 

person, absent the prior express consent of the recipient, from “mak[ing] any 

call . . . using any automatic telephone dialing system . . . to a paging service [or] cellular 

telephone service . . . .” Telephone Consumer Protection Act, 47 U.S.C. 

§ 227(b)(1)(A)(3). The TCPA also authorizes a private right of action for conduct 

violating the Act. § 227(b)(3). However, “[t]he United States and its agencies, it is 

undisputed, are not subject to the TCPA’s prohibitions because no statute lifts their 

immunity.” Campbell-Ewald Co. v. Gomez, 136 S. Ct. 663, 672 (2016). Thus, GDIT 

would also be immune from liability for making this phone call if derivative sovereign 

immunity applies.

Cunningham commenced this putative class action suit against GDIT on May 16, 

2016, seeking damages and injunctive relief as authorized under the TCPA. See 47 

U.S.C. § 227(b)(1)(A)(iii), (b)(1)(B), (b)(3). GDIT moved to dismiss for lack of subject 

matter jurisdiction on the ground that GDIT is immune from suit under the Yearsley 

 2 GDIT asserts that Cunningham did in fact consent to the phone call by starting 

an application on the HealthCare.gov website on November 18, 2015, providing his cell 

phone number, and affirmatively accepting the privacy policy that stated applicants may 

be contacted with more information. However, the merits of whether Cunningham gave 

consent are not before the Court; we are solely considering the applicability of the 

Yearsley doctrine, and this disputed fact is inconsequential to our analysis. See Holloway 

v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 453 (4th Cir. 2012) (holding that 

disputes over whether plaintiff would be able to prove the elements of his cause of action 

“must be resolved either by a Rule 56 motion or by trial,” and were not relevant to 

whether the court had jurisdiction). 
7

doctrine.3

 See Fed. R. Civ. P. 12(b)(1). On October 18, 2016, the district court issued an 

interim order concluding that GDIT was entitled to Yearsley immunity, and granted 

limited jurisdictional discovery for Cunningham to contest this determination. The 

district court issued this order, in part, because it concluded that CMS had “authorized 

and instructed GDIT to do exactly what it did.” J.A. 259. Discovery lasted 75 days and 

included six subpoenas, four Touhy requests, numerous document requests, six 

depositions of GDIT and CMS employees, and supplemental briefing on the issue. On 

May 1, 2017, the district court granted GDIT’s motion to dismiss for lack of subject 

matter jurisdiction on the ground that GDIT was immune from suit under the Yearsley 

doctrine. This appeal followed. 

II.

In reviewing a district court’s order dismissing an action for lack of subject matter 

jurisdiction, this Court reviews conclusions of law de novo and findings of fact for clear 

error. Velasco v. Gov’t of Indon., 370 F.3d 392, 398 (4th Cir. 2004). To conclude that a 

district court’s factual finding is clearly erroneous, the reviewing court must be “left with 

the definite and firm conviction that a mistake has been committed.” HSBC Bank USA v. 

F & M Bank N. Va., 246 F.3d 335, 338 (4th Cir. 2001) (quoting Anderson v. City of 

Bessemer City, 470 U.S. 564, 573 (1985)).

 3 GDIT also filed motions to dismiss for failure to state a claim and failure to join 

CMS as a necessary party. Fed. R. Civ. P. 12(b)(6), (7). 
8

III.

In his first claim on appeal, Cunningham asserts that the Yearsley doctrine does 

not apply as a matter of law to federal claims. Instead, he claims that Yearsley only 

applies when a federal contract or federal directive displaces state law to absolve 

government contractors from state law liability. Finding nothing in Yearsley or its 

progeny that limits its application solely to state law liability, we disagree. 

We begin our analysis with the language in Yearsley itself. In describing the 

immunity, we find no language indicating that the Supreme Court intended to limit its 

holding to claims arising under state law. See Yearsley, 309 U.S. at 20–21 (“[I]t is clear 

that if this authority to carry out the project was validly conferred, that is, if what was 

done was within the constitutional power of Congress, there is no liability on the part of 

the contractor for executing its will.” (citations omitted)). Additionally, the Supreme 

Court identified instances when government contractors were not immune from liability, 

and notably did not mention federal law claims. See id. at 21 (“Where an agent or officer 

of the Government purporting to act on its behalf has been held to be liable for his 

conduct causing injury to another, the ground of liability has been found to be either that 

he exceeded his authority or that it was not validly conferred.” (citations omitted)). The 

test the Supreme Court outlined for conferring Yearsley immunity, therefore, omitted any 

requirement that the claim arise under state law and omitted any reference to exempting

federal law liability from its reach. Yearsley’s progeny have also failed to make any such 

distinction. See, e.g., Campbell-Ewald, 136 S. Ct. at 672–73 (reaffirming the basic 

requirements of Yearsley applicability without implying that its grant of immunity was 
9

limited to state law liability). 

Yearsley immunity has also been applied to federal causes of action and, most 

recently, the Supreme Court even addressed Yearsley in relation to the TCPA―the same 

federal law at issue here. See, e.g., id. at 672 (concluding that Yearsley may immunize 

violations of the TCPA); Yearsley, 309 U.S. at 22–23 (applying Yearsley immunity to a 

claim arising under the Takings Clause of the Constitution); Tozer v. LTV Corp., 792 

F.2d 403, 405 (4th Cir. 1986), cert. denied, 487 U.S. 1233 (1988) (concluding that a 

military contractor could assert a Yearsley defense to a federal cause of action).4

 

Consequently, we hold that the Yearsley doctrine applies to claims arising under federal 

law. 

IV.

Next, Cunningham attacks the merits of the district court’s decision by asserting

that GDIT fails to satisfy either prong required under Yearsley. We disagree. 

“[U]nder Yearsley, a government contractor is not subject to suit if (1) the 

government authorized the contractor’s actions and (2) the government ‘validly

 4 Cunningham also argues that even if Yearsley, standing alone, could be 

interpreted to apply to claims arising under federal law, Boyle v. United Techs. Corp., 

487 U.S. 500 (1988), limited Yearsley’s applicability to state law claims. The Supreme 

Court implicitly rejected this argument in Campbell-Ewald when it analyzed whether a 

federal contractor was immune from suit under Yearsley for violations of the TCPA―a 

federal law. 136 S. Ct. at 672–74. Additionally, as we stated in In re KBR, Boyle is 

inapposite to determining the applicability of derivative sovereign immunity. In re KBR, 

744 F.3d at 342 n.6 (distinguishing between the Boyle preemption analysis and the 

Yearsley immunity analysis). Therefore, we decline to address Cunningham’s arguments 

related to Boyle. 
10

conferred’ that authorization, meaning it acted within its constitutional power.” In re 

KBR, 744 F.3d at 342 (citing Yearsley, 309 U.S. at 20–21). Recently, the Supreme Court 

reaffirmed this test and expressly stated that as long as the authorization was validly 

conferred, “ ‘there is no liability on the part of the contractor’ who simply performed as 

the Government directed.” Campbell-Ewald, 136 S. Ct. at 673 (quoting Yearsley, 309 

U.S. at 20–21). Authorization is “validly conferred” on a contractor if Congress 

authorized the government agency to perform a task and empowered the agency to 

delegate that task to the contractor, provided it was within the power of Congress to grant 

the authorization. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at 342, 344 n.7. 

Conversely, “[w]hen a contractor violates both federal law and the Government’s 

explicit instructions, . . . no ‘derivative immunity’ shields the contractor from suit by 

persons adversely affected by the violation.” Campbell-Ewald, 136 S. Ct. at 672; see 

also Yearsley, 309 U.S. at 21; In re KBR, 744 F.3d at 345 (“[Yearsley] suggests that the 

contractor must adhere to the government’s instructions to enjoy derivative sovereign 

immunity; staying within the thematic umbrella of the work that the government 

authorized is not enough to render the contractor’s activities ‘the act[s] of the 

government.’ ” (alteration in original) (quoting Yearsley, 309 U.S. at 22)); Myers v. 

United States, 323 F.2d 580, 583 (9th Cir. 1963) (stating that a government contractor is 

not liable under Yearsley if the work was done under the contract and in conformity with 

the contract terms, but may be liable for damages from acts “over and beyond acts 

required to be performed” or acts “not in conformity” with the contract).
11

A.

Turning to the first step, we analyze whether the government authorized GDIT’s 

actions. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. The ACA 

directs CMS to establish a system to keep applicants informed about their eligibility for 

enrollment in a qualified health plan. See 42 U.S.C. § 18083(a), (b)(2), (e). CMS 

contracted with GDIT to carry out this statutory mandate, and the contract required GDIT 

to call individuals about health insurance options. On December 1, 2016, CMS provided 

GDIT with a list of approximately 680,000 phone numbers, including Cunningham’s cell 

phone number, and instructed GDIT to call the numbers on December 2, 2016, and leave 

a prerecorded message. The contract also permitted GDIT to use an autodialer to make 

the call. On December 2, 2016, GDIT used an autodialer to call Cunningham’s cell 

phone number and left a voicemail with the exact script CMS had provided to GDIT. 

Quite plainly, GDIT performed exactly as CMS directed: GDIT called the number CMS 

instructed GDIT to call, on the prescribed day, and followed CMS’s provided script when 

leaving the message.

Without contesting these facts, Cunningham nonetheless asserts that GDIT did not

perform as CMS directed. Cunningham argues that Section 17 of the CMS-GDIT 

contract required GDIT to follow applicable laws, and that by failing to independently 

obtain prior consent from each name on the list provided by CMS to ensure compliance 

with the TCPA, GDIT violated the contract, requiring this Court to find that CMS did not 

authorize GDIT’s actions. This argument is unavailing. There is no indication that GDIT 

was authorized to contact these individuals other than to place the automated call, and 
12

GDIT was not permitted to deviate from the script provided. Deposition testimony from 

Naomi Johnson, the CMS Contracting Officer Representative, confirmed that CMS did 

not direct GDIT to obtain consent from the individuals on the call lists CMS provided, 

did not direct GDIT to investigate the numbers provided, and did not expect GDIT to 

obtain consent before making the calls. Therefore, we conclude that GDIT did not 

violate the contract by failing to independently obtain consent to make the phone call

CMS instructed it to make. 

Notably, this scenario is vastly distinguishable from the facts of Campbell-Ewald. 

In that case, plaintiffs similarly alleged that a government contractor violated the TCPA 

by failing to get prior consent to send text messages as part of a recruiting campaign for 

the United States Navy. Campbell-Ewald, 136 S. Ct. at 667. There, however, the 

contract expressly provided that it was the contractor’s responsibility to generate a list of 

the phone numbers of those who had opted in to receive the marketing, and the 

government’s approval of sending the message was conditioned on this consent. Id. at 

673–74. The contractor, therefore, failed to adhere to the contract by not obtaining prior 

consent to send these messages and, by failing to obtain prior consent, had also violated 

the TCPA. Id. at 672–74. As a result of violating “both federal law and the 

Government’s explicit instructions,” the Supreme Court held that the contractor was not 

entitled to derivative sovereign immunity. Id. at 672.

Consequently, because GDIT adhered to the terms of its contract with CMS, we 

conclude that the government authorized GDIT’s actions, satisfying step one of the

Yearsley analysis.
13

B.

In analyzing the second step of the Yearsley immunity analysis, we consider 

whether the government “validly conferred” the authorization for GDIT to make this 

phone call. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. GDIT 

made this call pursuant to CMS’s statutory mandate to administer the ACA and keep 

applicants informed about their eligibility for enrollment in a qualified health plan. See 

42 U.S.C. § 18083(a), (b)(2), (e). There does not seem to be any dispute that the

government can delegate the authority to make this automated phone call to GDIT. 

Instead, Cunningham argues that the government cannot “validly confer” the authority to 

engage in conduct that violates the law, and thus that CMS did not validly confer 

authority to GDIT to call him because making the phone call without prior consent 

violated the TCPA.

5

 With this argument, Cunningham misinterprets the scope of 

 5 In response, GDIT argues that even if the government directed GDIT to make 

this phone call without obtaining prior consent, the federal government and its common 

law agents are not subject to the TCPA, and therefore the government could not have 

directed the phone calls be made in violation of the TCPA because they were not required 

to comply with the TCPA. For this argument, GDIT points to a 2016 declaratory ruling 

issued by the Federal Communications Commission (“FCC”) whereby the FCC 

interpreted § 227(b)(1)’s prohibition of calls made by any “person” as “not includ[ing]

the federal government or agents acting within the scope of their agency under commonlaw principles of agency.” In re Rules & Regulations Implementing the Tel. Consumer 

Protection Act of 1991, CG Docket No. 02-278, 31 F.C.C. Rcd. 7394, 7398 (2016); see 

id. at 7394 (“[T]he TCPA does not apply to calls made by or on behalf of the federal 

government in the conduct of official government business, except when a call made by a 

contractor does not comply with the government’s instructions.”). Because we conclude 

that Cunningham’s claim fails even if the government is subject to the TCPA, we decline 

to address this argument. 
14

Yearsley’s second step. The question is not whether informing applicants of their 

enrollment eligibility violated the law, but rather whether Congress had the authority to 

assign GDIT to complete that task. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at 

342, 344 n.7. The purpose of Yearsley immunity is to prevent a government contractor 

from facing liability for an alleged violation of law, and thus, it cannot be that an alleged 

violation of law per se precludes Yearsley immunity. Consequently, we reject 

Cunningham’s overinclusive interpretation of what constitutes a “valid conferral” of 

authority under this prong. We conclude that the government validly conferred the 

authorization for GDIT to make this phone call, satisfying step two of the Yearsley 

immunity analysis. 

Therefore, because the government authorized GDIT’s actions and that 

authorization was validly conferred, we hold that the district court did not err in 

concluding that GDIT was entitled to derivative sovereign immunity for this claim.

V.

Finally, Cunningham asserts that even if the district court properly conferred 

Yearsley immunity on GDIT, the district court nonetheless erred in treating the Yearsley

doctrine as immunity from suit and dismissing the case for lack of subject matter 

jurisdiction, rather than treating the doctrine as a merits defense to liability. See Fed. R. 

Civ. P. 12(b)(1). In advancing this argument, Cunningham asserts that neither the 

Supreme Court nor this Court has squarely addressed the issue of whether the Yearsley

defense is jurisdictional, and that the “immunity” provided by Yearsley is not necessarily 
15

a jurisdictional immunity. We again disagree. 

As an initial matter, it is clear that “[i]f the basis for dismissing a Yearsley claim is 

sovereign immunity, then a Yearsley defense would be jurisdictional” because “sovereign 

immunity deprives federal courts of jurisdiction to hear claims, and a court finding that a 

party is entitled to sovereign immunity must dismiss the action for lack of subject-matter 

jurisdiction.” Ackerson v. Bean Dredging LLC, 589 F.3d 196, 207 (5th Cir. 2009) 

(emphasis added) (ultimately concluding that Yearsley immunity does not deprive the 

court of subject matter jurisdiction); see also Fed. R. Civ. P. 12(h)(3) (“If the court 

determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the 

action.”). 

Recently, in In re KBR, this Court reaffirmed that we treat the Yearsley doctrine as 

derivative sovereign immunity that confers jurisdictional immunity from suit. There, as 

here, the district court had dismissed the claim for lack of subject matter jurisdiction 

based on Yearsley immunity. In re KBR, 744 F.3d at 343. We stated that “[t]he concept 

of derivative sovereign immunity stems from the Supreme Court’s decision in 

[Yearsley],” and that when the Yearsley doctrine applies, “a government contractor is not 

subject to suit.” Id. at 342 (emphases added); see also id. at 344 (“Yearsley recognizes 

that private employees can perform the same functions as government employees and 

concludes that they should receive immunity from suit when they perform these 

functions.” (emphasis added)). Ultimately, this Court concluded that the record did not 

contain enough evidence to determine whether the contractor was entitled to derivative 

sovereign immunity, and vacated the district court’s decision and remanded for further 
16

fact finding. Id. at 345. See also Butters, 225 F.3d at 466 (acknowledging the “wellsettled law that contractors and common law agents acting within the scope of their 

employment for the United States have derivative sovereign immunity” and describing

Yearsley as derivatively extending sovereign immunity to a private contractor acting 

pursuant to a contract with the United States (emphasis added)); id. (favorably

referencing the Fifth Circuit’s affirmance that a private individual “was immune from 

suit” when it followed the sovereign’s orders (emphasis added) (citing Alicog v. Kingdom 

of Saudi Arabia, 860 F. Supp. 379, 384–84 (S.D. Tex. 1994), aff’d, 79 F.3d 1145 (5th 

Cir. 1996) (table decision))).

Although Cunningham argues that In re KBR cannot stand for the proposition that 

Yearsley immunity is jurisdictional because we did not affirm the jurisdiction-based 

dismissal of the claim, we reject this contention. This Court’s express statements 

regarding Yearsley immunity and its implicit approval of using a Rule 12(b)(1) motion to 

dismiss to dispose of a case when the Yearsley doctrine applied compel us to conclude, 

once again, that the Yearsley doctrine operates as a jurisdictional bar to suit and not as a 

merits defense to liability. See also Adkisson v. Jacobs Eng’g Grp., Inc., 790 F.3d 641,

646 (6th Cir. 2015) (acknowledging that the Fourth Circuit has held that Yearsley

immunity is jurisdictional).

Cunningham’s argument that the Supreme Court’s recent decision in Lewis v. 

Clarke undermines this precedent is also unavailing. 137 S. Ct. 1285, 1291 (2017). 

Cunningham argues that Lewis confirms that incanting the word “immunity” does not 

necessarily result in immunity from suit, and that “sovereign immunity” is implicated 
17

only where “the sovereign is the real party in interest,” i.e., “whe[re] the remedy sought is 

truly against the sovereign.” Id. at 1290–92 (holding that the Indian tribe’s sovereign 

immunity did not bar a tort suit against a tribal employee to recover for his personal 

actions when he was operating a vehicle within the scope of his employment on state 

lands). Cunningham’s reliance on Lewis is misplaced. In Lewis, the Supreme Court 

distinguished between suits against individual employees and suits against governmental

instrumentalities, and expressly stated that “a suit against an arm or instrumentality of the 

State is treated as one against the State itself.” Id. at 1293 (favorably referencing cases 

extending sovereign immunity to private healthcare insurance companies that were 

“essentially state instrumentalities,” including Pani v. Empire Blue Cross Blue Shield, 

152 F.3d 67, 71–71 (2d Cir. 1998)); see also Regents of the Univ. of Cal. v. Doe, 519 

U.S. 425, 429 (1997) (stating that sovereign immunity from suit extends to “certain 

actions against state agents and state instrumentalities”). Because GDIT is an entity 

rather than an individual employee, and was fulfilling CMS’s statutory mandate under the 

ACA by making this phone call to Cunningham, Lewis is inapplicable. See Pani, 152 

F.3d at 71–72 (stating that a government agent that “acts on behalf of the [government] in 

carrying out certain administrative responsibilities that the law imposes” can be entitled 

to sovereign immunity, and citing cases holding the same). Thus, under these facts,

Lewis does not undermine this Court’s precedents holding that Yearsley immunity is a 

jurisdictional bar to suit, nor does it undermine our affirmance that derivative sovereign 

immunity be conferred on GDIT in this case.

Notwithstanding that Yearsley immunity operates as a jurisdictional bar to suit, we 
18

recognize that discovery may be appropriate before granting a Rule 12(b)(1) motion to 

dismiss on this basis. See Kerns, 585 F.3d at 193 (describing appropriate evidentiary 

proceedings when a court is considering a claim under Rule 12(b)(1)). When, as here, a 

party “challenges the veracity of the facts underpinning subject matter jurisdiction, the 

trial court may go beyond the complaint, conduct evidentiary proceedings, and resolve 

the disputed jurisdictional facts.” Id.; see also United States ex rel. Vuyyuru v. Jadhav, 

555 F.3d 337, 348 (4th Cir. 2009). Here, the parties participated in 75 days of limited 

discovery on the applicability of Yearsley, which included six subpoenas, four Touhy 

requests, numerous other document requests, six depositions of GDIT and CMS 

employees, and supplemental briefing on the issue. We are satisfied that this discovery 

provided Cunningham with appropriate procedural safeguards and provided sufficient 

information for the district court to rule on GDIT’s motion. 

Consequently, we hold that the district court did not err in treating Yearsley 

applicability as a jurisdictional bar to suit and granting GDIT’s Rule 12(b)(1) motion to 

dismiss on the basis that GDIT is immune from suit under the Yearsley doctrine. 

VI.

For the foregoing reasons, the judgment of the district court is hereby

AFFIRMED.