Greg Hale v. ARcare, Inc

• Court: Court of Appeals for the Eighth Circuit
• Decided: February 13, 2026
• Docket: 24-1726
• Status: Published

Opinion

United States Court of Appeals For the Eighth Circuit ___________________________

No. 24-1726 ___________________________

Greg Hale, on behalf of himself and all others similarly situated; Melissa Johnson, Individually and on Behalf of All Others Similarly Situated; Alicia Gilmore, on Behalf of Herself and All Others Similarly Situated; Michael Whitkanack, on Behalf of Himself and All Others Similarly Situated; Jessica White, on Behalf of Herself and All Others Similarly Situated; Jacquita Engles, on behalf of herself, and as parent and guarding of minor Marshall Engles and Ana Molina, individually and on behalf of all others similarly situated; Jeffery Engles, on behalf of himself, and as parent and guardian of minor Marshall Engles and Ana Molina, individually, and on behalf of all others similarly situated

lllllllllllllllllllllPlaintiffs - Appellees

v.

ARcare, Inc, originally named as ARcare

lllllllllllllllllllllDefendant - Appellant

------------------------------

United States of America

lllllllllllllllllllllAmicus on Behalf of Appellee(s) ____________

Appeal from United States District Court for the Eastern District of Arkansas - Northern ____________

Submitted: April 16, 2025 Filed: February 13, 2026 ____________ Before LOKEN, GRUENDER, and GRASZ, Circuit Judges. ____________

LOKEN, Circuit Judge.

ARcare, Inc. (“ARcare”) is a nonprofit community health center with facilities across Arkansas, Kentucky, and Mississippi. ARcare receives funding under the federal Public Health Service Act (“PHSA”) to provide primary care and related services to communities designated as “medically underserved” by the Department of Health and Human Services. See 42 U.S.C. § 254b. In the Federally Supported Health Centers Assistance Act (“FSHCAA”), Congress granted absolute immunity to health centers receiving PHSA funding “for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions.” 42 U.S.C. § 233(a) (emphasis added). Congress determined that federally funded health centers were spending too much of their PHSA grants on medical malpractice insurance premiums and sought to “essentially make[] the U.S. government the medical malpractice insurer for qualifying § 245(b) health centers” and their employees. Dedrick v. Youngblood, 200 F.3d 744, 745 (11th Cir. 2000); see H.R. Rep. No. 102-823, pt. 1, at 3-5, pt. 2, at 4 (House Judiciary Committee 1992); H.R. Rep. No. 104-398, at 6 (House Commerce Committee 1995).

The issue in this case is whether this absolute statutory immunity extends to patient damage actions for losses caused when an unauthorized third party breached ARcare’s data network and gained access to patients’ confidential information. The district court1 concluded that ARcare is not immune from these suits because protecting confidential patient information is not “the performance of medical, surgical, dental, or related functions” under § 233(a). ARcare appeals. Reviewing the issue of statutory immunity de novo, we conclude the district court correctly

1 The Honorable Brian S. Miller, United States District Judge for the Eastern District of Arkansas.

-2- interpreted the FSHCAA provisions at issue and therefore affirm. See Letterman v. Does, 859 F.3d 1120, 1125 (8th Cir. 2017) (standard of review).

I. Background

In January and February 2022, an unauthorized third party breached ARcare’s data network and gained access to patients’ confidential information, including names, dates of birth, social security numbers, and medical treatment and diagnosis information. After learning of the network breach, ARcare notified current and former patients that their confidential information had been accessed without authorization. Many affected patients sued. ARcare removed the actions to federal court. After the district court consolidated six pending class action cases on March 1, 2023, Plaintiffs filed a Consolidated Complaint alleging ARcare failed to safeguard class members’ personal information as required by the federal Health Insurance Portability and Accountability Act (“HIPAA”) and its implementing regulations. Plaintiffs allege they received invoices for medical services never rendered and discovered their confidential information available for sale on the dark web.

ARcare claims absolute immunity from these claims under § 233(a) of the FSHCAA. Section 233(g) provides that health centers receiving federal funding under § 330 of the PHSA may be deemed Public Health Service (“PHS”) employees and are granted immunity from, inter alia, claims that result from the PHS employee’s “performance of medical, surgical, dental, or related functions.” It is undisputed that ARcare was a deemed PHS employee during the relevant time period. For entities deemed PHS employees, “Section 233(a) makes the FTCA remedy against the United States ‘exclusive of any other civil action or proceeding’ for any personal injury caused by a PHS officer or employee performing a medical or related function ‘while acting within the scope of his office or employment.’” Hui v. Castaneda, 559 U.S. 799, 802 (2010). Accordingly, ARcare moved to substitute the United States as defendant under the Federal Tort Claims Act. The United States had previously declined ARcare’s request to intervene and opposed the motion to substitute.

-3- The district court initially held that § 233 permits a court to order substitution of the United States over its objection, citing district court decisions from other circuits on an issue we have not addressed. Without moving to intervene and filing a cross-appeal, the United States filed a Brief for the United States as Amicus Curiae in support of appellees in which it argues, at the end of the brief, that “Section 233 Does Not Provide Authority to Compel Substitution of the United States,” citing no supporting judicial authority on this FSHCAA issue. ARcare argues the issue is not properly before us, noting the established rule that even an appellee may not attack a decree to enlarge its own rights absent a cross-appeal. We agree and therefore decline to consider the issue, which in any event would not affect the disposition of this appeal.

On the merits of the motion to substitute, the district court surveyed judicial decisions applying § 233(a) and concluded (i) that the data breach did not occur “during the course of medical treatment within the context of the provider-patient relationship,” and (ii) that the nexus between protecting patient information from cyber attacks and the provision of patient care was not close enough to render ARcare’s failure to protect patient information from this cyber attack a “related function.” Therefore, ARcare is not entitled to the claimed statutory immunity. We have jurisdiction over this interlocutory appeal. See Hui, 559 U.S. at 804 n.4. The United States appears as amicus curiae on behalf of plaintiff-appellees in support of the district court’s denial of immunity. The merits of Plaintiffs’ claims against ARcare are not before us.

II. Discussion

On appeal, ARcare does not contend that safeguarding patient information is itself a medical, surgical, or dental function, so the applicability of § 233(a) absolute immunity turns on whether ARcare’s data security practices are “related functions.” ARcare argues that the “broad” and “unqualified” language of § 233(a) provides “comprehensive” immunity for deemed employees that is not limited to acts and

-4- omissions occurring during medical treatment. ARcare argues Krandle v. Refuah Health Center, Inc., No. 22-CV-4977, 2024 WL 1075359 (S.D.N.Y. Mar. 12, 2024), published a few days after the district court’s Order being appealed, and Friedenberg v. Lane Cnty., 68 F.4th 1113 (9th Cir. 2023), which the district court distinguished, are persuasive authority for its interpretation of “related functions.” Appellees urge us to follow the Fourth Circuit’s more recent decision in Ford v. Sandhills Med. Found., Inc., which held that § 233(a) immunity did not shield a nonprofit health center from liability following a cyber attack similar to the one that ARcare sustained. 97 F.4th 252, 254 (4th Cir. 2024), cert. denied, 145 S. Ct. 1308 (2025).

In Krandle, the court concluded that § 233(a) covered a data breach of a New York nonprofit health center’s systems. “Medical,” “surgical,” and “dental” are “adjectives that pertain or relate to treatment,” but “they are not exclusively defined by treatment.” 2024 WL 1075359 at *4. The broad term “related” requires only “a real relationship to the practice of medicine,” and the health center’s “responsibility to secure data from internal and external threats . . . is essential to the practice of medicine.” Id. at *5, 9. Friedenberg involved a damage claim for the failure by a community health center’s employees to report a patient’s violations of his court- ordered treatment plan. The Ninth Circuit held that the employees were entitled to § 233(a) immunity because “[t]he statutory text clearly shows that immunity is not tied to whether the tort transpired in caring for the patient. Rather . . . as long as a claim is derived from providing services to subjects of the health care provider, the deemed PHS employee is immune from suit.” 68 F.4th at 1127 (emphasis removed). The employees’ failure to report was sufficiently “intertwined with their provision of medical services” to qualify as a “related function.” Id. at 1130.2

2 The district court noted that Friedenberg, like other cases applying § 233(a) immunity to claims for failure to protect private information, “involve[d] conduct that occurred during the course of medical treatment within the context of the provider- patient relationship.”

-5- In Ford, on which Appellees rely, the Fourth Circuit held that a nonprofit health center was not immune from liability under § 233(a) following a cyber attack similar to the one at issue. The plain meaning of “related functions,” the court concluded, is a category in the field of health care outside of medicine, surgery, or dentistry, the terms that precede “related functions” in § 233(a). 97 F.4th at 259. Therefore, “to trigger immunity, alleged damages giving rise to a lawsuit must arise from the provision of health care.” Id. at 260. Data protection is not the performance of an action taken in the course of rendering treatment; the health center retains the relevant data even after the patient relationship ends. Therefore, the health center’s argument that § 233(a) applies to any action patients take to obtain medical care, such as providing confidential health information, “would shield [the center] from any and all claims despite their lack of relation to their treatment.” Id. at 260-61.

We conclude the Fourth Circuit’s interpretation of § 233(a) in Ford is more persuasive than the authorities on which ARcare relies. The FSHCAA does not define “related functions” or any of the terms at issue, so we begin with the text of § 233(a), interpreting the words “consistent with their ordinary meaning at the time Congress enacted the statute.” Wisconsin Cent. Ltd v. United States, 585 U.S. 274, 277 (2018) (cleaned up). We first “determine whether the language at issue has a plain and unambiguous meaning with regard to the particular dispute . . . by reference to the language itself, the specific context in which that language is used, and the broader context of the statute as a whole.” LaCurtis v. Express Med. Transporters, Inc., 856 F.3d 571, 578 (8th Cir. 2017), quoting Robinson v. Shell Oil Co., 519 U.S. 337, 340-41 (1997). “If the intent of Congress can be clearly discerned from the statute’s language, the judicial inquiry must end.” United States v. Lester, 92 F.4th 740, 742 (8th Cir. 2024) (cleaned up). But when a provision “is susceptible to more than one interpretation, we examine other authorities to determine legislative intent.” Stanley v. Cottrell, Inc., 784 F.3d 454, 466 (8th Cir. 2015).

When the words in a phrase are broad and indeterminate, such as “relating to,” “context ‘may tug in favor of a narrower reading.’” Barcomb v. Gen. Motors LLC,

-6- 978 F.3d 545, 550 (8th Cir. 2020) (quotation omitted). The context here is the use of general language following a list of three specific functions. As the Supreme Court recently explained:

One way to discern the reach of [such a] clause is to look for guidance from whatever examples come before it. Two general principles are relevant. First, the canon of noscitur a sociis teaches that a word is given more precise content by the neighboring words with which it is associated. . . . And under the related canon of ejusdem generis, a general or collective term at the end of a list of specific items is typically controlled and defined by reference to the specific classes that precede it.

Fischer v. United States, 603 U.S. 480, 487 (2024) (cleaned up); see Christopherson v. Cinema Enter. Corp., 161 F.4th 525, 528 (8th Cir. 2025).

Related is generally defined as “connected by reason of an established or discoverable relation,” Webster’s Third New International Dictionary (1968), or “associated; connected” and “allied by nature,” The American College Dictionary (1970). Function is defined as “the action for which a person or thing is specially fitted, used, or responsible or for which a thing exists,” Webster’s, and as “the kind of action or activity proper to a person, thing, or institution,” The American College Dictionary. Thus, in the context of § 233(a), related functions are activities having similar characteristics or that are specially fitted to the preceding enumerated categories of medical, surgical, or dental functions.

We agree with the court in Ford that the adjectives medical, surgical, and dental each describe a branch of health care. Therefore, applying the relevant canons of statutory construction, a related function is “a field of health care outside of medicine, surgery, or dentistry.” 97 F.4th at 259. Although data security is now integrated into the modern practice of medicine with the transition to electronic medical records, it is not itself a field of health care. Data storage and security are standard modern

-7- business practices and are therefore activities proper for a federally funded health center, but they are neither specific to the medical field nor “specially fitted” to the performance of medical, surgical, or dental practices.

The text preceding and following “related functions” in § 233(a) provides additional support for this interpretation. The statutory immunity applies only to claims “for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions.” Personal injury is “an injury affecting one’s physical and mental person as contrasted with one causing damage to one’s property.” Webster’s Third New International Dictionary (1968). In this context, the terms are most naturally read to encompass damages resulting from substandard performance in the provision of health care. Interpreting a claim for damages from wrongful disclosure of patient information as a personal injury claim “may improperly broaden § 233(a) to encompass misfeasance that results in other types of damages, such as contract damages.” Ford, 97 F.4th at 260.

ARcare argues that the statute’s application to claims “resulting from the performance of medical . . . or related functions” requires only “that the action in some way originates in, stems from, or is a consequence of the deemed defendant’s performance of medical or related functions.” But the term “related functions” serves to clarify the scope of an immunity whose meaning is cabined by the preceding adjectives medical, surgical, and dental. Section 233(a) does not broadly cover claims originating from the performance of any hospital function, only from performance of some activity specially fitted to the performance of health care. ARcare’s reading offers no limiting principle. Almost any task a hospital employee completes could be characterized as stemming or originating from a hospital function. Here, plaintiffs did not even allege they remained patients of ARcare at the time of the data breach. Some of their claims may loosely relate to past treatment but they did not arise from any actions taken by ARcare in the course of medical treatment.

-8- As a second contextual clue, Congress in § 233(a) clarified that related functions include “the conduct of clinical studies or investigation.” The word “clinical,” which is defined as “concerned with observation and treatment of disease in the patient,” The American College Dictionary (1970), further reflects a focus on the provision of health care. By contrast, the meaning of “related functions” urged by ARcare includes any duties that are merely “interwoven” with medical care, such as administrative and operational ones. ARcare suggests that this reference to clinical studies and investigation calls for a broader interpretation of “related functions” because 42 U.S.C. § 241, which governs PHS research and investigations, also references non-medical categories -- “water purification, sewage treatment, and pollution of lakes and streams.” However, § 233(a) does not reference § 241 in delineating what qualifies as “clinical studies or investigation.” In context, clinical studies and investigation exemplify what is included in the limited subset of “medical, surgical, dental, or related functions.”

ARcare looks to other statutory language to support its interpretation of § 233(a). Because § 233(a) applies to “any other civil action or proceeding” and extends immunity to “any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment,” ARcare argues its scope cannot be limited to claims arising from the provision of health care services. But the reference to “any other civil action or proceeding” reflects the broad scope of the grant of immunity when § 233 does in fact apply, which is limited by the meaning of the phrase “medical . . . or related functions.” ARcare rightly notes that “any commissioned officer or employee” means the related function need not be performed by a physician, surgeon, or dentist, and that § 233(g)(1)(A) grants immunity to federally funded health center entities and “any officer . . . or employee.” However, Congress anticipated that persons involved in providing health care who are not physicians, surgeons, or dentists, and board members and administrators overseeing the provision of health care in a hospital, are named in medical malpractice suits and warrant this grant of immunity.

-9- ARcare also argues that reading § 233(a) to cover actions resulting from the provision of health care renders the “related functions” language superfluous, contrary to proper statutory interpretation. See, e.g., Ysleta Del Sur Pueblo v. Texas, 596 U.S. 685, 698-99 (2022). But appellees and the United States as amicus curiae note functions that are not medical, surgical, or dental but are sensibly characterized as related to those categories, such as physical therapy and pharmacy. Under our reading of the plain language, the term “related functions” is not superfluous.

Based on the plain meaning of the statutory text, confirmed by the statutory context reflected in the legislative history of the PHSA and the FSHCAA, we agree with Appellees that § 233(a) does not confer immunity for claims concerning ARcare’s data security practices. Congress did not intend that the government (i.e., taxpayers) bear the cost of subsidizing health centers for types of insurable business expenses that are not part of “a field of health care outside of medicine, surgery, or dentistry,” like the damage claims at issue in this case. For the foregoing reasons, we affirm the district court’s denial of ARcare’s motion to substitute the United States. ______________________________

-10-