Court Opinion

ID: 9956245
Source: CourtListenerOpinion
Date Created: 2024-04-01 17:00:53.719149+00
Date Added: 2024-06-11T08:15:03.162526
License: Public Domain

USCA4 Appeal: 22-2268       Doc: 55        Filed: 03/29/2024      Pg: 1 of 20

                                               PUBLISHED

                                UNITED STATES COURT OF APPEALS
                                    FOR THE FOURTH CIRCUIT

                                               No. 22-2268

        JOANN FORD, on behalf of herself and all others similarly situated,

                             Plaintiff - Appellant,

                      and

        UNITED STATES OF AMERICA,

                             Defendant - Appellee,

                      v.

        SANDHILLS MEDICAL FOUNDATION, INC.,

                             Defendant - Appellee.

        Appeal from the United States District Court for the District of South Carolina, at Florence.
        R. Bryan Harwell, Chief District Judge. (4:21-cv-02307-RBH)

        Argued: December 7, 2023                                         Decided: March 29, 2024

        Before THACKER, HARRIS, and RICHARDSON, Circuit Judges.

        Vacated and remanded by published opinion. Judge Thacker wrote the opinion in which
        Judge Harris and Judge Richardson joined.

        ARGUED: John A. Yanchunis, MORGAN & MORGAN, P.A., Tampa, Florida, for
        Appellant. Kevin Joseph Kennedy, UNITED STATES DEPARTMENT OF JUSTICE,
USCA4 Appeal: 22-2268     Doc: 55       Filed: 03/29/2024    Pg: 2 of 20

        Washington, D.C., for Appellee. Matthew Sidney Freedus, FELDESMAN TUCKER
        LEIFER & FIDELL, LLP, Washington, D.C., for Appellee. ON BRIEF: Kenya J. Reddy,
        MORGAN & MORGAN, P.A., Tampa, Florida, for Appellant. Brian M. Boynton,
        Principal Deputy Assistant Attorney General, Mark B. Stern, Dana L. Kaersvang, Civil
        Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; Samuel
        R. Bagenstos, General Counsel, Michael I. Goulding, Associate General Counsel, Robert
        H. Murphy, Sean M. Flaim, General Law Division, UNITED STATES DEPARTMENT
        OF HEALTH AND HUMAN SERVICES, Washington, D.C.; Adair F. Boroughs, United
        States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Columbia, South
        Carolina, for Appellee United States. Rosie Dawn Griffin, FELDESMAN TUCKER
        LEIFER FIDELL, LLP, Washington, D.C.; Michael D. Wright, SAVAGE, ROYALL &
        SHEEHAN, LLP, Camden, South Carolina; Jessica L. Fickling, STROM LAW OFFICE,
        Columbia, South Carolina, for Appellee Sandhills Medical Foundation, Inc.

                                                 2
USCA4 Appeal: 22-2268       Doc: 55          Filed: 03/29/2024      Pg: 3 of 20

        THACKER, Circuit Judge:

               Joann Ford (“Appellant”), on behalf of herself and all others similarly situated, filed

        a complaint in South Carolina state court, alleging claims for negligence, breach of implied

        contract, invasion of privacy, and breach of confidentiality against Sandhills Medical

        Foundation, Inc. (“Sandhills”) for failure to properly maintain her personally identifying

        information (“PII”) and protected health information (“PHI”). Appellant provided this

        information to Sandhills as a condition of her treatment when she was a patient in 2018.

        After Appellant ceased being a patient at Sandhills, Appellant’s PII was stolen from

        Sandhills’ third party computer system in a cyberattack in late 2020. Appellant’s PHI was

        not affected by the cyberattack.

               Sandhills removed the case to federal court for a determination as to whether a

        federal immunity defense shielded it from liability. In order for Sandhills to be immune

        from suit, it had to demonstrate that Appellant’s alleged damages resulted “from the

        performance of medical, surgical, dental, or related functions.” 42 U.S.C. § 233(a). If

        § 233(a) applies, then the case is treated as one brought pursuant to the Federal Tort Claims

        Act (“FTCA”), Sandhills is afforded immunity, and the United States is substituted for

        Sandhills as the defendant.

               The district court concluded that Sandhills was immune from suit and the United

        States was substituted for Sandhills as the defendant pursuant to § 233(a). In coming to

        this conclusion, the district court reasoned that because Appellant was required to provide

        her PII to Sandhills in order to receive treatment, the theft of her PII arose out of Sandhills’

        performance of “medical, surgical, dental, or related functions.”

                                                       3
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 4 of 20

               But as explained below, we conclude that § 233(a) does not apply to Appellant’s

        claims because Sandhills was not performing a related function when an unnamed third

        party hacked and stole Appellant’s PII.

               Therefore, we vacate and remand.

                                                      I.

                                                      A.

               Sandhills is a South Carolina nonprofit health center that receives federal funding

        pursuant to the Public Health Service Act, 42 U.S.C. § 254b et seq., (the “PHS Act”) to

        provide primary health care and related services to medically underserved communities in

        South Carolina. This case arises from a cyberattack in late 2020, during which unknown

        bad actors stole the electronically stored PII of Sandhills’ patients, including Appellant.

               Appellant was a Sandhills patient from approximately 2018 to 2019. In order to

        provide her treatment, Sandhills requested, collected, and stored Appellant’s PII. At the

        time, Sandhills did not store its patients’ PII locally, but instead hired a third party vendor

        and utilized the vendor’s online data storage platform to store the information.

               In late 2020, the third party vendor’s computer system was hacked, resulting in the

        disclosure of Appellant’s PII. Sandhills did not learn of the breach until January 8, 2021.

        And on or about March 5, 2021, Sandhills announced the security breach to its current and

        former patients. Thereafter, in a public notice to its patients, Sandhills shared that it had

        “determined that patient medical records, lab results, medications, credit card numbers, and

                                                      4
USCA4 Appeal: 22-2268         Doc: 55          Filed: 03/29/2024      Pg: 5 of 20

        bank account numbers were NOT affected.” J.A. 34 (emphasis in original). 1 Rather, the

        impacted data included patient names, dates of birth, mailing and email addresses, driver’s

        licenses and state identification cards, social security numbers, and insurance claims

        information that could be used to identify medical conditions.

               On April 2, 2021, an unknown and unauthorized individual used Appellant’s PII to

        apply for a $500 loan. Appellant asserts that she spent time dealing with this fraudulent

        use of her PII and remains concerned about the potential for further loss of privacy and

        fraud from unauthorized individuals using her stolen information. She also alleges that she

        suffered lost time, annoyance, interference, and inconvenience as a result of the data

        breach. Appellant claims she suffered “imminent and impending injury arising from the

        substantially increased risk of fraud, identity theft, and misuse” resulting from

        unauthorized persons possessing her PII. J.A. 41.

                                                         B.

               On June 18, 2021, Appellant filed a Complaint in the Court of Common Pleas for

        Chesterfield County, South Carolina, alleging that Sandhills failed to safeguard her PII,

        which resulted in a fraudulent loan application in her name.                Appellant styled her

        Complaint as a proposed nationwide class action, to include those current and former

        patients “whose PII or PHI was exposed to an unauthorized party.” J.A. 42. Appellant

        alleged claims for negligence, breach of implied contract, invasion of privacy, and breach

        of confidentiality based on Sandhills’ failure to: (1) adequately protect the PII and PHI of

               1
                   Citations to the “J.A.” refer to the Joint Appendix filed by the parties in this appeal.

                                                         5
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 6 of 20

        Appellant and the class; (2) warn Appellant and the class of its inadequate information

        security practices; and (3) avoid sharing the PII and PHI of Appellant and the class without

        adequate safeguards.

               After Sandhills was served the complaint, it notified the United States Attorney

        General, claiming that it was “entitled to absolute immunity from this civil action, as it

        resulted from Sandhills’ performance of medical or related functions.” 2 J.A. 65. After the

        time elapsed for the United States to make an appearance, Sandhills removed the action to

        the United States District Court for the District of South Carolina. In its removal, Sandhills

        argued the district court had subject matter jurisdiction over the case for three reasons.

               First, Sandhills relied on 42 U.S.C. § 233(l)(2), a federal removal statute that

        permits a community health center recipient of federal grant funds to remove a case to

        federal court to determine the applicability of 42 U.S.C. § 233(a) -- a federal immunity

        defense for qualifying private health centers that receive federal grant money. Section

        233(a) shields qualifying health centers from damages arising “from the performance of

        medical, surgical, dental, or related functions, including the conduct of clinical studies or

               2
                  If a suit covered by § 233(a) is brought in state court, the PHS defendant may
        notify the Attorney General. 42 U.S.C. § 233(l)(1). The Attorney General then has fifteen
        days to make an appearance in the state court and advise the court whether the defendant
        “is deemed to be an employee of the Public Health Services for purposes of this section
        with respect to the actions or omissions that are the subject of” the action. Id. This operates
        as the Attorney General certifying that the PHS defendant was acting in scope of
        employment. Id.; § 233(c). If fifteen days pass with no response from the Attorney
        General, “the civil action or proceeding shall be removed to the appropriate United States
        district court.” § 233(l)(2). Once removed to federal court, the merits of the action “shall
        be stayed in such court until such court conducts a hearing, and makes a determination, as
        to” whether the claim falls within § 233(a). Id.

                                                      6
USCA4 Appeal: 22-2268      Doc: 55            Filed: 03/29/2024   Pg: 7 of 20

        investigation.” Sandhills argued that § 233(a) should apply to its data security functions,

        making it immune from suit, because it collects patient PII as a condition of providing

        treatment.    Therefore, Sandhills contended that its maintenance of patient PII was

        inextricably woven into its provision of health care and thus qualified its data security as a

        “related” function of medical care.

               Second, in support of removal, Sandhills cited 28 U.S.C. § 1442(a)(1), which

        permits any officer of the United States or of any federal agency -- or any person acting

        under that officer -- to remove a case against them in their official or individual capacity

        to federal court, even when the underlying federal question arises only as a defense to a

        state law claim. See Jefferson Cnty., Ala. v. Acker, 527 U.S. 423, 431 (1999). Sandhills

        argued that, as “an officer, or a person acting under a federal officer” as a Public Health

        Service (“PHS”) employee, it had a right to remove the case pursuant to § 1442(a)(1). J.A.

        9.

               And finally, Sandhills argued that federal question jurisdiction existed pursuant to

        42 U.S.C. § 1331 because the substance of Appellant’s action hinges on § 233(a).

               Sandhills also requested that the district court substitute the United States for

        Sandhills as the defendant pursuant to § 233(a). Agyin v. Razmzan, 986 F.3d 168, 184 (2d

        Cir. 2021) (citing 42 U.S.C. § 233(a)) (stating that a defendant “is entitled to immunity

        from suit and to substitution of the United States as the defendant if this suit concerns

        actions [a federal employee] took within the scope of his employment as a deemed federal

        employee”).

                                                       7
USCA4 Appeal: 22-2268      Doc: 55         Filed: 03/29/2024      Pg: 8 of 20

               Pursuant to § 233(1)(2), the case was automatically stayed until the district court

        could resolve the removal issue. And the district court ordered Sandhills to file a motion

        to substitute the United States and to “confer with government counsel regarding whether

        Sandhills is entitled to immunity from suit and to substitution of the United States as the

        defendant.” J.A. 4. Sandhills filed the motion to substitute, arguing that it should be

        immune from suit and the United States must be substituted for it as the defendant pursuant

        to 42 U.S.C. § 233(a). Thereafter, the United States filed a statement of interest expressing

        its position that Sandhills was not entitled to immunity because collecting and storing its

        patients’ PII was not inextricably woven into the performance of medical, surgical, or

        dental functions such that Sandhills’ data security should qualify as a “related” function

        within the meaning of § 233(a). The district court held a hearing on the motion, at which

        Sandhills, the United States, and Appellant were all heard.

               Ultimately, the district court concluded that Sandhills was entitled to remove the

        case to federal court and to immunity and substitution of the United States. The district

        court reasoned that because Sandhills required Appellant to provide her PII as a condition

        of being a patient and receiving medical services, the breach of its systems containing such

        information arose out of Sandhills’ performance of medical or “related functions” within

        the meaning of § 233(a). And the district court supported this conclusion by pointing to

        Sandhills’ “statutory requirement of confidentiality,” which the district court believed was

        “inextricably woven” into Sandhills’ provision of health care such that it amounts to a

        “related” function. J.A. 267.

                                                     8
USCA4 Appeal: 22-2268       Doc: 55        Filed: 03/29/2024      Pg: 9 of 20

               Once substituted as the defendant, the United States filed a motion to dismiss for

        lack of subject matter jurisdiction asserting that Appellant had failed to exhaust her

        administrative remedies with Health and Human Services before filing suit as required by

        the FTCA. Appellant conceded that she had not exhausted her administrative remedies,

        but she maintained that § 233(a) did not shield Sandhills from suit as the storage of her PII

        with a third party vendor was not a not a “medical, surgical, dental, or related function[].”

        Therefore, in Appellant’s view, substituting the United States was improper as the claims

        did not fall within the purview of § 233(a) and therefore the FTCA did not apply. And if

        the FTCA did not apply, then Appellant was not required to exhaust her administrative

        remedies prior to suit.

               The district court, finding no grounds to overturn its prior decision, granted the

        motion to dismiss for lack of subject matter jurisdiction. This appeal followed.

               On appeal, Appellant argues that Sandhill’s data storage practice, including the

        maintenance of her PII, is too removed from the provision of health care to amount to a

        “related” function such that Sandhills cannot receive § 233(a) immunity and, therefore, the

        case should not be treated as one brought pursuant to the FTCA. We agree with Appellant.

                                                     II.

               Because the application of § 233(a) is a question of law, we review de novo the

        district court’s conclusion that § 233(a) shields Sandhills from suit, as well as the

        substitution of the United States. S.C. Wildlife Fed’n v. Limehouse, 549 F.3d 324, 332 (4th

        Cir. 2008) (“[T]he existence of sovereign immunity is a question of law that we review de

        novo.” (alterations in original) (internal quotation marks omitted)); Gutierrez de Martinez

                                                     9
USCA4 Appeal: 22-2268      Doc: 55          Filed: 03/29/2024     Pg: 10 of 20

        v. Drug Enf’t Admin., 111 F.3d 1148, 1152 (4th Cir. 1997). And we also review de novo

        the district court’s dismissal of Appellant’s claims. Pledger v. Lynch, 5 F.4th 511, 517 (4th

        Cir. 2021).

                                                III.
        Whether Data Security Amounts to a “Related” Function Within the Purview of § 233(a)

                                                  A.
                         The Federally Supported Health Centers Assistance Act

               Pursuant to the Federally Supported Health Centers Assistance Act (“FSHCAA”),

        private health centers that receive federal funds may be considered PHS employees if

        certain conditions are met. Friedenberg v. Lane Cnty., 68 F.4th 1113, 1118 (9th Cir. 2023)

        (citing 42 U.S.C. § 233(g)). Appellant does not challenge Sandhills’ status as a PHS

        employee. If an entity receives PHS employee status, then § 233(a) provides the entity

        immunity from “damage for personal injury, including death, resulting from the

        performance of medical, surgical, dental, or related functions, including the conduct of

        clinical studies or investigation, by any commissioned officer or employee of the Public

        Health Service while acting within the scope of his office or employment.” 42 U.S.C.

        § 233(a) (emphasis supplied).

               If a claim is subject to § 233(a), then the claim is treated as one brought against the

        United States within the purview of the FTCA. Hui v. Castaneda, 559 U.S. 799, 802 (2010)

        (“Section 233(a) makes the FTCA remedy against the United States exclusive of any other

        civil action or proceeding for any personal injury caused by a PHS officer or employee

        performing a medical or related function while acting within the scope of his office or

        employment.” (internal quotation marks omitted)). If the FTCA applies, the United States

                                                     10
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 11 of 20

        is substituted as a defendant. See 42 U.S.C. § 233(a); Hui, 559 U.S. at 801–02 (“When

        federal employees are sued for damages for harms caused in the course of their

        employment, the . . . FTCA . . . generally authorizes substitution of the United States as the

        defendant.”); see also Agyin v. Razmzan, 986 F.3d 168, 184 (2d Cir. 2021) (“[A PHS

        employee] is entitled to immunity from suit and to substitution of the United States as the

        defendant if this suit concerns actions he took within the scope of his employment as a

        deemed federal employee.”).

               Thus, the FSHCAA “essentially makes the U.S. government the medical

        malpractice insurer for qualifying . . . health centers, their officers, employees, and

        contractors, allowing these ‘deemed’ health centers to forgo obtaining private malpractice

        insurance.” Dedrick v. Youngblood, 200 F.3d 744, 745 (11th Cir. 2000). “This designation

        enables centers caring for underserved populations to spend their money on patient care

        rather than malpractice premiums.” Chronis v. United States, 932 F.3d 544, 546 n.1 (7th

        Cir. 2019).

                                                 B.
                Data Security Does Not Amount to a “Related” Function Within § 233(a)

               We now turn to whether § 233(a) shields Sandhills from Appellant’s suit, which

        arose out of Sandhills’ allegedly negligent storage of her PII with a third party vendor. In

        this regard, the question we face is whether data security is a “medical, surgical, dental, or

        related function[]” that qualifies for § 233(a) immunity. In this instance, it is not.

                                                      11
USCA4 Appeal: 22-2268       Doc: 55          Filed: 03/29/2024      Pg: 12 of 20

                                                   1.
        Based on the plain language of § 233(a), data security is not a related function within the
                                         meaning of the statute

               Clearly, the storage of patient PII is not in and of itself a medical, surgical, or dental

        function. Therefore, to fall within the purview of § 233(a), it must be a “related” function.

               In assessing what may be a “related” function, we first look to the plain language of

        the statute. See Lynch v. Jackson, 853 F.3d 116, 121 (4th Cir. 2017) (“We start as we must

        with the plain language of the statute because when the statute’s language is plain, the sole

        function of the courts—at least where the disposition required by the text is not absurd—

        is to enforce it according to its terms.” (internal quotation marks omitted)).

               Appellant contends that the plain language of the statute supports that a general term

        like “related functions” must be construed to embrace only the words that come before it -

        - medical, surgical, and dental. Appellant therefore argues that the collection and storage

        of PII does not amount to a “related” function of medical, surgical, or dental services where

        “[c]ollecting such information does not depend on a medical, surgical, or dental

        professional’s skill, knowledge, or judgment.” Appellant’s Opening Br. at 17–18. In

        response, Sandhills argues that the word “related” must be broadly interpreted such that

        the statute covers “ancillary functions” to medical services. Sandhills Resp. at 15. We

        agree with Appellant that a more limited interpretation of “related functions” is proper.

               We begin with the meaning of the words “related” and “function.” Related is

        defined as “connected by relation,” “having close harmonic connection.” Webster’s

        Seventh New Collegiate Dictionary 723 (1969), and “having mutual . . . connection,”

                                                      12
USCA4 Appeal: 22-2268      Doc: 55          Filed: 03/29/2024     Pg: 13 of 20

        Oxford English Dictionary (compact ed. 1971). 3 And “function” is defined not as any

        given activity, but as “the action for which one is particularly fitted or employed,”

        Webster’s, supra at 338, and “[t]he nature and proper action of anything; activity

        appropriate to any business or profession,” Black’s Law Dictionary (4th ed. 1968). Thus,

        a “related function[]” is an activity particularly fitted to whatever is connected to whatever

        proceeds the phrase. In other words, its meaning depends on the words that come before

        it.

               Within § 233(a), the language “related functions” acts as a general catchall for

        specific functions -- “the performance of medical, surgical, [or] dental” functions. 42

        U.S.C. § 233(a). “[W]here general words follow specific words in a statutory enumeration,

        the general words are construed to embrace only objects similar in nature to those objects

        enumerated by the preceding specific words.” Cir. City Stores, Inc. v. Adams, 532 U.S.

        105, 114–15 (2001) (internal quotation marks omitted); see also Robinson v. Shell Oil Co.,

        519 U.S. 337, 341 (1997) (“The plainness or ambiguity of statutory language is determined

        by reference to the language itself, the specific context in which that language is used, and

        the broader context of the statute as a whole.”). We therefore construe a general term like

        “related” as sharing the attributes of the specific words in the list. See Yates v. United

        States, 574 U.S. 528, 544 (2015) (applying the principle of noscitur a sociis to limit

               3
                 Because § 233(a) was originally added to the PHS Act in 1970, see PL 91-623, 84
        Stat. 1868 (1970), we employ definitions from that time to interpret Congress’ intent. Wisc.
        Cent. Ltd. v. United States, 585 U.S. 274, 277 (2018) (“[O]our job is to interpret the words
        consistent with their ordinary meaning . . . at the time Congress enacted the statute.”
        (internal quotation marks omitted)).

                                                     13
USCA4 Appeal: 22-2268        Doc: 55        Filed: 03/29/2024      Pg: 14 of 20

        “tangible object” to those items similar to “record” or “document” as opposed to the fish

        at issue in the investigation). As a matter of plain meaning, medical, surgical, and dental

        all fit into one category – they are adjectives that describe various fields of health care. 4

        Staying true to Congress’ intent, we read a “related” function as fitting within that category,

        or in other words, a field of health care outside of medicine, surgery, or dentistry. See

        Wikimedia Found. v. Nat’l Sec. Agency, 14 F.4th 276, 297 (4th Cir. 2021) (applying

        noscitur a sociis as limiting the phrase “such other material” to the two preceding

        conditions in a list).

               The words immediately following “related functions” also cabin its contextual

        meaning. The statute exemplifies “related functions” as “including the conduct of clinical

        studies or investigation.” 42 U.S.C. § 233(a). This provides further support for the position

               4
                 One might jump to the thought that surgery is merely a subset of medicine. And
        in some sense that is true. But this generalization misses the long-standing distinctions
        between medicine and surgery. Surgery involves bodily invasion while medicine is
        generally non-invasive. See Ankur Aggarwal, The Evolving Relationship Between Surgery
        and Medicine, 12 AMA J Ethics 119, 119 (2010) (“Medicine’s two branches—the less
        invasive medical methods and the more invasive surgical methods—have been around
        since before the existence of written language. Surgery, however, was not viewed as
        belonging to the same sphere as medical treatments until relatively recently, and, even now,
        a sharp distinction exists between surgeons and other medical doctors. Analyzing the
        history of surgery can help explain the separation between medical and surgical treatments
        and why the two fields, although viewed quite differently, fit under the umbrella of
        medicine.”); Connor T.A. Brenna & Sunit Das, Divides of Identity in Medicine and
        Surgery: A Review of the Duty-Hour Policy Preference, 57 Annals of Medicine and
        Surgery 1, 2 (2020) (noting the known and intuitive differences between Medicine and
        Surgery, including their historical origins); Fitzhugh Mullan, Big Doctoring in America 36
        (2002) (“The philosophical difference between ‘medicine’ and ‘surgery’ is a time-honored
        one.”); Dorland’s Illustrated Medical Dictionary 785 (26th ed. 1985) (defining “medical”
        in part as “pertaining to medicine as opposed to surgery”).

                                                      14
USCA4 Appeal: 22-2268      Doc: 55         Filed: 03/29/2024      Pg: 15 of 20

        that “related functions” explicitly encompasses only the provision of health care. Both the

        Supreme Court and this court have held that the word “including” “connotes simply an

        illustrative application of [a] general principle.” United States v. Hawley, 919 F.3d 252,

        256 (4th Cir. 2019) (quoting Fed. Land Bank of St. Paul v. Bismarck Lumber Co., 314 U.S.

        95, 100 (1941)). Insofar as “related functions” include providing treatment or diagnoses

        in a clinical study, there is little support for the notion that data security, which is more

        akin to an administrative function, should be included within the meaning of § 233(a).

               Defining § 233(a)’s scope to extend only to the provision of health care also makes

        sense because the subsection provides that the United States will be substituted as

        defendant solely for claims “for damage for personal injury, including death.” Misfeasance

        in the provision of health care would most likely lead to personal injury or death. A wider

        definition of “related functions” may improperly broaden § 233(a) to encompass

        misfeasance that results in other types of damages, such as contract damages.

               When employing the canons of construction and considering the plain meaning of

        the words in § 233(a), we discern no ambiguity in the phrase “related functions.” As such,

        in order to trigger immunity, alleged damages giving rise to a lawsuit must arise from the

        provision of health care. See 42 U.S.C. § 233(a). As explained below, Appellant’s alleged

        damages do not.

                                                  2.
           Appellant’s alleged damages did not occur because of the provision of health care

               Appellant’s claims arose when unknown bad actors hacked Sandhills’ third party

        vendor’s computer system and stole Appellant’s PII at least a year after she had ended her

                                                     15
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 16 of 20

        treatment at Sandhills. Here, Appellant’s PII was not released as a result of the provision

        of health care. Appellant’s PII was not inappropriately divulged as a result of Sandhills

        providing health care to Appellant. In comparison, in Mele v. Hill Health Center, which

        Sandhills argues supports its position, the alleged injury arose when the patient’s sensitive

        information was “improperly disclosed” to another provider at the direction of a medical

        professional in relation to the patient’s treatment. See 2008 WL 160226, at *3 (D. Conn.

        Jan. 8, 2008). The plaintiff’s injury in Mele, unlike Appellant’s, “concern[ed] the medical

        functions of providing treatment.” Id.

               But here, the allegedly improper release of Appellant’s PII did not occur because of

        Sandhills’ performance of the provision of health care. Therefore, Appellant’s damages

        did not arise from any action taken by Sandhills “in [its] capacity as a doctor responsible

        for, [or] in the course of rendering medical treatment for” Appellant. See Cuoco, 222 F.3d

        at 109 (applying § 233(a) immunity to constitutional violation claim arising out of denial

        of gender affirming care for pre-trial detainee). This is especially true in this case where,

        at the time of the unexpected cyberattack, Appellant was no longer receiving any treatment

        at Sandhills and had not been a Sandhills patient for at least a year.

               Nonetheless, Sandhills argues that its storage and maintenance of Appellant’s PII

        was “related” to her health care treatment because Appellant was required to provide this

        information in order to receive treatment from Sandhills. Sandhills’ interpretation misses

        the mark. Sandhills is shielded only from those damages that arise from its performance

        of “related functions” within the meaning of § 233(a). Data protection is not an activity

        the medical field in which Sandhills operates is “particularly fitted to” execute, nor is any

                                                     16
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 17 of 20

        “related” field of health care. Webster’s, supra at 338. This is highlighted by the fact that

        Appellant alleges that Sandhills retains the relevant data “even after the [patient]

        relationship ends.” J.A. 30 (emphasis added). Therefore, the fact that Appellant was

        required to provide her billing information prior to receiving treatment cannot shield

        Sandhills when the injury did not occur because of any provision of health care.

               There is no limiting principle to Sandhills’ position. If § 233(a) applied to any

        action that a patient must take in order to receive health care, it would shield Sandhills from

        any and all claims despite their lack of relation to their treatment. Consider a scenario

        where, in anticipation of receiving health care, Appellant provided her PII and billing

        information to Sandhills but never showed up for her appointment. In that instance,

        Appellant would have suffered the same injury she alleges here from the data breach

        without ever even receiving treatment. Similarly, Appellant’s alleged injury could have

        resulted from a data breach at a host of businesses to which she likely discloses her PII,

        none of which are involved in the provision of health care, including an employer, an entity

        involved in a banking, financial, or real estate transaction, or an insurance company. In

        sum, the focus is on the function that caused the injury, and, here, Appellant was not injured

        by any health care provided by Sandhills.

                                                    3.
         Sandhills’ statutory duty to maintain patient confidentiality cannot override § 233(a)’s
         mandate that alleged damages arise during the performance of a medical or “related”
                                                 function

               Sandhills also argues that based on its statutory and ethical duty to maintain the

        confidentiality of patient information, it should be accorded immunity pursuant to § 233(a).

                                                      17
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 18 of 20

        Sandhills relies on its statutory duty pursuant to the FSHCAA to “have an ongoing quality

        improvement system . . . that maintains the confidentiality of patient records” to argue that

        its patient record systems should qualify as “related functions.”             See 42 U.S.C.

        § 254b(k)(3)(C). Sandhills posits that because it must show that it maintains these systems

        in order to receive grant money, then data security is included in the provision of health

        care.

                But the requirements to receive federal grant money on which Sandhills relies are

        separate and apart from § 233(a) immunity. In fact, a health center that qualifies to receive

        federal grant money need not even apply to be considered a PHS employee. See 42 U.S.C.

        § 233(g)(1)(D) (the Secretary may not “deem an entity . . . to be an employee of the Public

        Health Service for purposes of this section, . . . unless the entity has submitted an

        application”); id. § 233(g)(1)(G)(ii) (allowing federal grant recipients “that ha[ve] not

        submitted an application . . . to purchase medical malpractice liability insurance coverage

        with Federal funds”). And as previously discussed, without PHS employee status, § 233(a)

        does not apply. Of note, there is no mention of data security or systems in § 233.

        Therefore, Sandhills’ argument that Congress intended data security to be a “related”

        function lacks credence.

                Nor does Sandhills’ duty to keep patient information confidential mean that

        Appellant’s claims arose from a “medical, surgical, dental, or related functions.” 42 U.S.C.

        § 233(a). Sandhills points to Krandle v. Refuah Health Center, Inc. to support its argument

        that its duty to protect patient information makes data security a “function . . . essential to

        the practice of medicine.” See No. 22cv4977, 2024 WL 1075359, at *9 (S.D.N.Y. Mar.

                                                      18
USCA4 Appeal: 22-2268      Doc: 55         Filed: 03/29/2024      Pg: 19 of 20

        12, 2024). Not only is Krandle not binding precedent on this court, but it fails to focus on

        whether the alleged damages arose as a result of the provision of health care to the injured

        party. See id. In the case of this data breach, they did not. 5 Simply because Sandhills has

        a duty to keep Appellant’s information confidential does not mean that the release of her

        PII resulted from Sandhills’ provision of health care.

               The same applies to Sandhills’ maintenance of any medical billing codes. In her

        complaint, Appellant alleges that Sandhills failed to properly secure its billing codes which

        could reveal her medical diagnoses. But again, § 233(a) requires that cause of Appellant’s

        injury be the provision of health care. And even so, the development and protection of the

        codes is not part of the provision of health care. Instead, medical coding is typically a by-

        product, separate and apart from the provision of heath care, performed by coders who

        review documentation of a patient’s visit to assign it the appropriate billing code. These

        are not categories within the provision of health care. Rather, they are administrative

        operations.

               Again, to determine whether § 233(a) immunity applies, the focus is on the function

        -- not the duty. See Cuoco, 222 F.3d at 109 (emphasizing that it is the conduct, not the

        style of the claim, that determines whether § 233(a) immunity applies). Appellant does not

        allege that Sandhills provided deficient health care or improperly collected her information

               5
                 Similarly, Hale v. ARcare, Inc., also provided by Sandhills, is not binding on this
        court. See No. 3:22cv117, 2024 WL 1016361, at *3 (E.D. Ark. Mar. 8, 2024). But Hale’s
        conclusion that damages arising from a data security breach do not “occur[] during the
        course of medical treatment within the context of the provider-patient relationship” more
        closely aligns with the language of § 233(a).

                                                     19
USCA4 Appeal: 22-2268       Doc: 55         Filed: 03/29/2024      Pg: 20 of 20

        as a part of her treatment. Indeed, Appellant’s alleged damages arose from a data security

        breach that occurred at least a year after she ceased being a patient at Sandhills. Because

        Appellant’s injury did not arise from Sandhills’ provision of health care, § 233(a) does not

        shield Sandhills from Appellant’s claims. Id.

               And because § 233(a) does not apply, the United States cannot be substituted for

        Sandhills as the defendant. Section 233(a) allows the United States to be substituted only

        if the action falls within the scope of immunity. Hui, 559 U.S. at 801. Because § 233(a)

        does not apply, Appellant’s claims cannot be treated as ones brought pursuant to the FTCA,

        and thus, the substitution of the United States for Sandhills was in error. It then necessarily

        follows that the district court erred when it required Appellant to have exhausted her

        administrative remedies pursuant to the FTCA in order to maintain her suit.

                                                     IV.

               For these reasons, the district court’s order applying immunity pursuant to § 233(a)

        and substituting the United States for Sandhills as the defendant is vacated. We remand

        for further proceedings consistent with this opinion.

                                                                      VACATED AND REMANDED

                                                      20