Kimberly Somer, Cody Janssen, and Alline Henderson v. Oakbend Medical Center and Oakbend Medical Group

• Court: Court of Appeals of Texas
• Decided: August 26, 2025
• Docket: 01-24-00187-CV
• Status: Published

Opinion

Opinion issued August 26, 2025

In The

Court of Appeals For The

First District of Texas ———————————— NO. 01-24-00187-CV ——————————— KIMBERLY SOMER, CODY JANSSEN, AND ALLINE HENDERSON, Appellants V. OAKBEND MEDICAL CENTER AND OAKBEND MEDICAL GROUP, Appellees

On Appeal from the 434th District Court Fort Bend County, Texas Trial Court Case No. 22-DCV-298770

OPINION

This case arises out of a data breach that occurred when cyber criminals

infiltrated the computer network of a hospital group. Kimberly Somer, Cody Janssen, and Alline Henderson (collectively, “the patients”) sued OakBend Medical

Center and its subsidiary OakBend Medical Group after their personal identifying

information and personal health information (“personal information”) were

potentially stolen in a cyberattack. The two OakBend entities filed pleas to the

jurisdiction, arguing that the claims asserted against them did not fall within a waiver

of governmental immunity. The trial court granted the pleas to the jurisdiction and

dismissed all claims with prejudice.

On appeal, the patients contend that (1) OakBend Medical Group is a private

nonprofit corporation and is not entitled to governmental immunity; (2) the tort

claims fall within the “condition or use of tangible personal property” waiver of

immunity found in the Texas Tort Claims Act; and (3) governmental immunity does

not protect the OakBend entities from the claim for unjust enrichment.

We affirm as to the parent and reverse and remand as to the subsidiary.

Background

In September 2022, cyber criminals launched a ransomware attack against the

computer network and servers of OakBend Medical Center, a hospital authority that

provides medical services to patients primarily in Fort Bend County. Although

OakBend quickly learned of the attack and was able to take some measures to protect

its system, the criminals accessed personal information relating to current and former

patients and employees. This personal information may have included names,

2 mailing addresses, email addresses, phone numbers, Social Security numbers, dates

of birth, and medical information. OakBend reported the attack to law enforcement

authorities. OakBend also mailed letters to all potentially affected patients and

employees, notifying them of the data breach and providing free credit monitoring

for eighteen months.

Kimberly Somer, a former patient of OakBend, sued both OakBend Medical

Center and OakBend Medical Group on her own behalf and on behalf of all others

similarly situated. Somer’s petition referred to OakBend Medical Center and

OakBend Medical Group collectively as “OakBend.” She did not differentiate

between the two OakBend entities when describing the acts and omissions that

allegedly caused her injuries.

Somer asserted a claim for negligence, alleging that OakBend knew of an

increasing risk of cyberattacks on healthcare providers but failed to exercise

reasonable care to safeguard and protect her personal information. As a result of

OakBend’s negligence, Somer suffered harm including a substantially increased risk

of identity theft. She also asserted a claim for negligence per se, alleging that

OakBend’s conduct violated duties established by the Federal Trade Commission

Act and HIPAA, a claim for breach of fiduciary duty, and a claim for breach of an

3 implied contract.1 Finally, she raised a claim for unjust enrichment, alleging that by

paying OakBend for medical services, she also paid for “reasonable data privacy and

security practices and procedures,” but OakBend failed to implement proper data

security procedures and therefore it should not retain the monetary benefit it received

from Somer and other class members. Somer’s lawsuit was assigned to the 434th

District Court of Fort Bend County.

Somer was not the only former patient potentially affected by the data breach

to file suit. Alline Henderson, Cody Janssen, and Janssen’s minor daughter were all

former patients of OakBend, and Janssen was also a former employee. They filed a

class action lawsuit solely against OakBend Medical Center and asserted nearly

identical claims to Somer: negligence, negligence per se, breach of fiduciary duty,

breach of an implied contract, and unjust enrichment.2 Janssen and Henderson’s

lawsuit was assigned to the 240th District Court of Fort Bend County.

1 In later filings, Somer agreed to non-suit her implied contract claim. That claim is therefore no longer at issue in this appeal. 2 Like Somer, Janssen and Henderson later agreed to non-suit their claim for breach of an implied contract, and this claim is not at issue in this appeal. They also asserted a claim for intrusion upon seclusion/invasion of privacy, but they later requested that the trial court dismiss this claim without prejudice to refiling. The trial court did so. This claim is therefore also not at issue in this appeal.

4 OakBend Medical Center filed a plea to the jurisdiction in Somer’s suit,

arguing that its governmental immunity barred Somer’s claims against it.3 OakBend

Medical Center argued that as a hospital authority created by the City of Richmond,

it was a political subdivision of the state and had governmental immunity from suit.

See TEX. HEALTH & SAFETY CODE § 262.003(a) (allowing governing body of

municipality to adopt ordinance creating hospital authority). It further argued that

no waiver of governmental immunity applied to Somer’s claims. It acknowledged

that the Texas Tort Claims Act contains limited waivers of governmental immunity,

including a waiver for personal injury or death “caused by a condition or use of

tangible personal or real property,” but it contended that this waiver did not apply

because personal information—the alleged theft of which formed the crux of all

Somer’s claims—was not tangible personal property. It also argued that no waiver

of immunity applied to Somer’s unjust enrichment claim, which sought monetary

3 In addition to its arguments relating to immunity from suit, OakBend Medical Center—as well as OakBend Medical Group in its plea to the jurisdiction—also challenged Somer’s standing to bring suit. OakBend Medical Center’s plea to the jurisdiction filed in Janssen and Henderson’s suit also challenged standing. When the trial court granted the OakBend entities’ pleas to the jurisdiction, it struck through the portion of the proposed orders relating to standing. Additionally, in separate filings from the pleas to the jurisdiction, the OakBend entities moved to dismiss both suits under Rule of Civil Procedure 91a, arguing that the patients’ claims had no basis in law. See TEX. R. CIV. P. 91a.1. The trial court ruled only on the pleas to the jurisdiction, not on the Rule 91a motions to dismiss. On appeal, the OakBend entities do not argue that these actions by the trial court were erroneous. 5 damages. OakBend Medical Center filed a substantively identical plea to the

jurisdiction in Janssen and Henderson’s suit.

OakBend Medical Group filed a separate plea to the jurisdiction. It also argued

that governmental immunity barred Somer’s suit, but it relied on a slightly different

source for its immunity: although it was not a political subdivision of the state, it

was controlled and funded by OakBend Medical Center. As supporting evidence,

OakBend Medical Group attached the declaration of Joseph Freudenberger, the CEO

of OakBend Medical Center and the president of OakBend Medical Group, who

discussed the ownership and funding of OakBend Medical Group:

OakBend Medical Group is a Texas nonprofit corporation certified by the Texas Medical Board. The sole member of OakBend Medical Group is OakBend Medical Center. As the member, OakBend Medical Center has the power to appoint and remove the Board and management. Additionally, other powers reserved to the member include: approval of all budgets, mergers, acquisitions and sale of real assets; creation of partnerships or joint ventures and dissolution or liquidation, among other powers. OakBend Medical Center provides funding for the operations of OakBend Medical Group.

OakBend Medical Group argued that due to the relationship between the entities, it

shared OakBend Medical Center’s immunity from suit, which was not waived for

any of Somer’s claims.

Somer responded to both pleas to the jurisdiction. She argued that her tort

claims fell within the Tort Claims Act’s “condition or use of tangible personal

property” waiver. To Somer, whether her personal information constituted tangible

6 personal property was immaterial. The cause of her alleged injury was OakBend

Medical Center’s failure to safeguard its patients’ and employees’ personal

information on its computer network and servers, which does constitute tangible

personal property. The unsecured state of the network and servers was the condition

of tangible personal property that allegedly caused Somer’s injuries. She also argued

that her unjust enrichment claim fell within a recognized waiver of governmental

immunity because by accepting payment from Somer but not providing adequate

data security, OakBend Medical Center was wrongfully withholding funds that

belonged to Somer. Janssen and Henderson filed a substantively identical response

to OakBend Medical Center’s plea to the jurisdiction in their case.

With respect to OakBend Medical Group’s argument that it shared in

OakBend Medical Center’s governmental immunity, Somer argued that OakBend

Medical Group did not have the same governmental immunity because it was a

private entity, not a political subdivision. Even if OakBend Medical Center

“controlled and funded” OakBend Medical Group, OakBend Medical Group did not

present evidence reflecting that it had “no discretion in all of its functions” or that

OakBend Medical Center controlled OakBend Medical Group’s data security

measures.

Given the substantively identical issues raised in Somer’s suit and Janssen and

Henderson’s suit, the patients moved for consolidation of the two suits. The

7 OakBend entities did not oppose this relief, and the 434th District Court granted the

motion and consolidated the cases into Somer’s suit pending before it.

Following hearings on the pleas to the jurisdiction, the trial court granted both

pleas filed by OakBend Medical Center and the plea filed by OakBend Medical

Group. This appeal followed.

Governmental Immunity

Each of the patients’ issues on appeal challenges the rulings granting the pleas

to the jurisdiction. First, Somer argues that OakBend Medical Group is a private

nonprofit corporation, not a political subdivision, and therefore it is not entitled to

share the governmental immunity of its parent company, OakBend Medical Center.

Next, all three patients argue that their claims against both OakBend entities fall

within a waiver of governmental immunity: (1) for the patients’ tort claims, the

tangible personal property waiver of the Tort Claims Act; and (2) for the patients’

unjust enrichment claim, a waiver allowing plaintiffs to sue for recovery of money

or other property wrongfully taken or withheld by the state.

A. Standard of Review

Political subdivisions of the state are immune from suit unless state law

waives the governmental unit’s immunity. City of Austin v. Powell, 704 S.W.3d 437,

448 (Tex. 2024). Because sovereign immunity is a common-law doctrine, the

judiciary has the responsibility to “decide when our State and its political

8 subdivisions have immunity and to define its boundaries.” Nettles v. GTECH Corp.,

606 S.W.3d 726, 731 (Tex. 2020). The Legislature has the responsibility to

determine whether to waive immunity and to what extent. Id.

A party seeking dismissal on immunity grounds bears the burden to establish

that it is a governmental entity entitled to governmental immunity. Lubbock Cnty.

Water Control & Improvement Dist. v. Church & Akin, L.L.C., 442 S.W.3d 297, 305

(Tex. 2014). Once that burden is satisfied, the burden shifts to the party suing a

governmental unit to affirmatively show a waiver of immunity. Powell, 704 S.W.3d

at 447. There is “a presumption against any waiver until the plaintiff establishes

otherwise.” Rattray v. City of Brownsville, 662 S.W.3d 860, 866 (Tex. 2023).

Without a provision of state law establishing a waiver of governmental immunity,

“no court is empowered to hear tort cases against and impose liability on

‘governmental unit[s].’” Id.; EBS Sols., Inc. v. Hegar, 601 S.W.3d 744, 749 (Tex.

2020) (“Sovereign immunity implicates a court’s subject matter jurisdiction.”).

We review a trial court’s ruling on a plea to the jurisdiction de novo. City of

San Antonio v. Maspero, 640 S.W.3d 523, 528 (Tex. 2022). To determine whether

the plaintiff has met her burden to affirmatively show a waiver of immunity, we

consider the facts alleged by the plaintiff and any jurisdictional evidence submitted

by the parties. Id.; Powell, 704 S.W.3d at 447–48. When there is a dispute over

jurisdictional facts, the plaintiff must raise a fact issue concerning the applicability

9 of an immunity waiver. Powell, 704 S.W.3d at 448. In that circumstance, we take as

true all evidence favorable to the nonmovant, and we indulge every reasonable

inference and resolve any doubts in the nonmovant’s favor. Id.

The trial court may not grant a plea to the jurisdiction if the evidence raises a

fact question concerning jurisdiction. Id. If, however, the evidence does not raise a

question concerning the existence of a jurisdictional fact, the trial court must grant

the plea. Id.

B. Whether OakBend Medical Group is Entitled to Governmental Immunity

Somer does not contest that OakBend Medical Center, as a municipal-created

hospital authority, enjoys governmental immunity from suit. OakBend Med. Ctr. v.

Martinez, 515 S.W.3d 536, 541–42 (Tex. App.—Houston [14th Dist.] 2017, no pet.)

(concluding that OakBend Medical Center qualifies as “governmental unit” under

Tort Claims Act because its evidence established “that it is owned by a hospital

authority created by the City of Richmond”); Richmond, Tex., Code of Ordinances,

ch. 2, art. V, §§ 2-274–276 (2015). But she denies that the parent’s immunity passes

down to the subsidiary.

1. Relationship between OakBend Medical Center and OakBend Medical Group

Health and Safety Code chapter 262 allows the governing body of a

municipality to adopt an ordinance creating a hospital authority if the body finds that

10 creation of the authority “is in the best interest of the municipality and its residents.”

TEX. HEALTH & SAFETY CODE § 262.003(a). A hospital authority may then “form

and sponsor a nonprofit corporation under the Texas Nonprofit Corporation

Law . . . to own and operate all or part of one or more ancillary health care facilities

consistent with the purposes of an authority under” chapter 262. Id. § 262.037(a);

see TEX. BUS. ORGS. CODE §§ 22.001–.516 (setting out statutory provisions

specifically applicable to nonprofit corporations).

The City of Richmond has enacted ordinances establishing a hospital

authority (OakBend Medical Center), and at some point, the hospital authority

created a nonprofit corporation as authorized by section 262.037—OakBend

Medical Group. See Richmond, Tex., Code of Ordinances, ch. 2, art. V, §§ 2-274–

276 (2015). Joseph Freudenberger, OakBend Medical Center’s CEO and OakBend

Medical Group’s president, described the relationship between the OakBend entities

in a declaration attached to OakBend Medical Group’s plea to the jurisdiction:

OakBend Medical Group is a Texas nonprofit corporation certified by the Texas Medical Board. The sole member of OakBend Medical Group is OakBend Medical Center. As the member, OakBend Medical Center has the power to appoint and remove the Board and management. Additionally, other powers reserved to the member include: approval of all budgets, mergers, acquisitions and sale of real assets; creation of partnerships or joint ventures and dissolution or liquidation, among other powers. OakBend Medical Center provides funding for the operations of OakBend Medical Group.

11 This declaration is the only evidence in the appellate record addressing the

connection between the entities.

The record contains no evidence concerning the functions that the respective

entities perform; how much control OakBend Medical Center exercises over

OakBend Medical Group’s day-to-day activities; any contracts or agreements

between the entities describing their respective responsibilities; or whether OakBend

Medical Group has any sources of funding other than OakBend Medical Center. The

record also contains no evidence relating to whether the OakBend entities maintain

separate computer systems and servers; which servers were compromised during the

ransomware attack; or which entity was responsible for implementing data security

practices and procedures.

2. “Arm of the State” immunity

When determining whether an entity authorized by the Legislature is entitled

to share in the State’s immunity, we consider whether “the governing statutory

authority demonstrates legislative intent to grant an entity the ‘nature, purposes, and

powers’ of an ‘arm of the State government.’” CPS Energy v. Elec. Reliability

Council of Tex., 671 S.W.3d 605, 621 (Tex. 2023) (quoting El Paso Educ. Initiative,

Inc. v. Amex Props., LLC, 602 S.W.3d 521, 527 (Tex. 2020)). We must also consider

whether extending immunity would “satisfy the political, pecuniary, and pragmatic

policies underlying our immunity doctrines.” Id. (quoting Rosenberg Dev. Corp. v.

12 Imperial Performing Arts, Inc., 571 S.W.3d 738, 750 (Tex. 2019)). If both

requirements are met, the entity “is a government unit unto itself” that may assert

immunity “in its own right when it performs a governmental function.” Id. (quoting

Univ. of the Incarnate Word v. Redus, 602 S.W.3d 398, 405 (Tex. 2020)).

The Texas Supreme Court has addressed this form of immunity several times

in recent years. In Rosenberg Development Corporation v. Imperial Performing

Arts, the court considered whether a municipally created economic development

corporation under the Local Government Code’s Development Corporation Act was

a governmental entity in its own right that could assert immunity. See 571 S.W.3d

at 741. The court examined whether “indicia of legislative intent” existed in the

statutes authorizing creation of economic development corporations and found two

statutory provisions particularly relevant. Id. at 748–49. First, the Development

Corporation Act explicitly stated that an economic development corporation was not

a political subdivision. Id. (citing TEX. LOC. GOV’T CODE § 501.055(b)). Second, the

Act prohibited a municipality from delegating to an economic development

corporation “any of [the municipality’s] attributes of sovereignty, including the

power to tax, the power of eminent domain, and the police power.” Id. at 749 (citing

TEX. LOC. GOV’T CODE § 501.010). Additionally, the Development Corporation Act

described the entity as a “private, nonprofit” corporation and gave it the powers that

13 the Business Organizations Code generally bestows upon nonprofit corporations. Id.

(citing TEX. LOC. GOV’T CODE §§ 501.053–.054).

When determining that the economic development corporation at issue was

not a governmental entity entitled to assert its own immunity, the court focused on

these statutory provisions that “expressly denied economic development

corporations significant governmental characteristics.”4 Id. Rather than

demonstrating the Legislature’s intent that an economic development corporation

exist as a distinct governmental entity from the municipality that created it, the

Development Corporation Act instead “evinces clear legislative intent that an

economic development corporation is not an arm of state government.” Id. at 750.

4 The Texas Supreme Court contrasted the Development Corporation Act with two chapters of the Government Code—chapter 2259 (allowing local governments to self-insure) and chapter 791 (allowing local governments to enter interlocal agreements)—which provided “indicia of legislative intent” that a joint self- insurance fund formed by nearly 100 local governmental entities was a discrete governmental unit separate from its governmental-unit members such that it enjoyed governmental immunity in its own right. See Rosenberg Dev. Corp. v. Imperial Performing Arts, Inc., 571 S.W.3d 738, 749 (Tex. 2019) (discussing Ben Bolt-Palito Blanco Consol. Indep. Sch. Dist. v. Tex. Political Subdivisions Prop./Cas. Joint Self- Ins. Fund, 212 S.W.3d 320, 322, 324–26 (Tex. 2006)). For example, chapter 791 expressly authorized “combinations of political subdivisions,” included combinations within the meaning of “local government,” and allowed those combinations “to perform governmental functions and services”; and chapter 2259 stated that expending money to fund self-insurance was a “public purpose of the governmental unit.” Id. (quotations omitted). Although the self-insurance fund’s “nature, purposes, and powers demonstrated the Legislature’s intent that the fund exist as a distinct governmental entity,” such indicia did not exist in the Development Corporation Act. Id. (quotations omitted). 14 The Texas Supreme Court was not persuaded by the argument that economic

development corporations—unlike “ordinary” nonprofit corporations—are subject

to statutory requirements such as the Open Meetings Act and Public Information

Act. Id. “[H]eavily regulating an entity does not equate to conferring governmental-

entity status.” Id. The court found similarly unpersuasive the argument that the

Development Corporation Act described the promotion and development of

businesses—the function of economic development corporations—as “public

purposes” because “merely engaging in an act that serves a public purpose says

nothing about the nature of the entity itself.” Id. Economic development corporations

may pursue projects that “have a governmental flair,” but these projects are “not so

uniquely or so definitively [governmental] that only a governmental entity would

engage in those activities.” Id.

In determining that the economic development corporation did not have

immunity as an “arm of the State,” the court also considered the “nature and purposes

of immunity,” including “political, pecuniary, and pragmatic” rationales for the

immunity doctrine. Id. First, “[g]overnmental immunity benefits the public by

preventing disruption of key governmental services.” Id. Economic development

corporations “are authorized for the limited purpose of promoting and developing

enterprises to encourage employment and the public welfare,” but these are not

“essential services.” Id. at 751.

15 Next, governmental immunity “respects the separateness of the branches of

government,” but the Legislature “expressly chose not to imbue economic

development corporations with indicia of status as a distinct governmental entity.”

Id. The Legislature did not “grant these entities ‘powers of government’ to perform

essential governmental functions or activities.” Id.

Finally, concerns over public fiscal matters do not justify extending immunity

to economic development corporations. Id. A major purpose of immunity doctrines

is to act as a safeguard against unforeseen expenditures that occur when a

governmental entity must defend lawsuits and pay judgments. Id. But the activities

of an economic development corporation “center on specific ‘projects’ that have

been designated in advance and memorialized by performance agreements.” Id.

Additionally, the Development Corporation Act “contains provisions limiting

liability and financial exposure.” Id. Therefore, the court did not perceive a “genuine

risk of unforeseen expenditures to be visited on the government.” Id.

Ultimately, when considering the Legislature’s intent as expressed in the

Development Corporation Act and the purposes of governmental immunity, the

Texas Supreme Court concluded that although economic development corporations

16 fulfill public purposes, they “do not exist quite like an arm of the state government,

imbued with aspects of sovereignty such as immunity from suit.”5 Id. at 752.

The court reached the opposite conclusion in two recent cases involving an

open-enrollment charter school and the Electric Reliability Council of Texas

(“ERCOT”). In El Paso Education Initiative v. Amex Properties, the court concluded

that open-enrollment charter schools “act as an arm of the State government.” 602

S.W.3d at 529. The Legislature expressly made open-enrollment charter schools

“part of the public school system of this state.” Id. at 528 (quoting TEX. EDUC. CODE

§ 12.105). Under their charters with the Texas Commissioner of Education, these

schools must meet certain financial, governing, educational, and operational

standards. Id. (quotations omitted). Typically private, nonprofit organizations hold

the charters, but the holder risks revocation of its charter if it does not follow state

law and Commissioner regulations applicable to public schools. Id. at 528–29. Open-

5 The following year, the Texas Supreme Court reached a similar conclusion and refused to hold that a private university that had formed its own campus police department—as authorized by the Legislature—was an arm of the State government such that it was entitled to governmental immunity. See Univ. of the Incarnate Word v. Redus, 602 S.W.3d 398, 406–13 (Tex. 2020). The court emphasized that the university was a private entity; the police department answered to university—not State—leadership and management; the university’s “primary mission is private education, not law enforcement”; the police department did not receive state funding, nor was the State involved in setting policies and procedures or making personnel decisions; the State exercised no control over the police department; no public tax dollars were at stake in the lawsuit; the Legislature authorized but did not mandate the creation of campus police departments; and any judgments that might arise from the police department’s actions would be paid by the university, not the State. Id. at 406–10. 17 enrollment charter schools are “largely publicly-funded.” Id. at 529. The Legislature

has also provided that “[i]n matters related to operation of an open-enrollment

charter school, an open-enrollment charter school or charter holder is immune from

liability and suit to the same extent as a school district . . . .” Id. (quoting TEX. EDUC.

CODE § 12.1056(a)).

Extending immunity to these schools also satisfies the purposes of the

immunity doctrines because using school funds to defend lawsuits and pay

judgments “affects the State’s provision of public education and reallocates taxpayer

dollars from the legislature’s designated purpose.” Id. at 530. Allowing immunity

also “respects the legislature’s decision to fulfill its constitutional obligation to

provide a free, public education through charter schools, its allocation of tax dollars

to meet that objective, and its directive that charter schools and charter-holders have

immunity from suit and liability to the same extent as public schools.” Id. The court

therefore held that open-enrollment charter schools are entitled to governmental

immunity. Id.

In considering ERCOT’s immunity in CPS Energy v. Electric Reliability

Council of Texas, the Texas Supreme Court emphasized that the State—primarily

through the Public Utilities Commission (“PUC”)—exercises a high level of control

and authority over ERCOT: “the state has complete authority over everything

ERCOT does to perform its statutory functions.” 671 S.W.3d at 623. The PUC has

18 “authority over ERCOT’s governance” and “complete authority over ERCOT’s

finances and budget.” Id. at 623–24 (quotations omitted). The Legislature expressly

provided that ERCOT “is directly responsible and accountable” to the PUC, and if

ERCOT does not adequately perform its functions, the PUC can “take appropriate

action,” including decertifying ERCOT as the independent system operator. Id. at

624 (quoting TEX. UTIL. CODE § 39.151(d)). Although ERCOT’s role is not “clearly

analogous to a public entity like a police department or a public school,” as the

independent system operator in charge of Texas’ power grid, “it provides an

essential governmental service.” Id. at 623. ERCOT is also subject to sunset review

and the Open Meetings Act, “requirements typically reserved for state entities,”

although these requirements alone are not dispositive. Id. at 624–25.

The court also concluded that recognizing ERCOT’s immunity “satisfies the

political, pecuniary, and pragmatic policies underlying our immunity doctrines.” Id.

at 627 (quotations omitted). While tax dollars do not fund ERCOT, “any damages

payments would nevertheless come from the state and the public” because ERCOT

would need to raise a system administration fee—the primary source of its funding—

to pay a judgment, “resulting in higher costs for electricity for consumers.” Id.

Additionally, “the Legislature appears to consider ERCOT’s money and assets to be

state assets,” as the PUC has authority over how ERCOT raises and spends money,

and the Utilities Code requires ERCOT to transfer its assets to its successor if the

19 PUC decertifies it. Id. (quoting TEX. UTIL. CODE § 39.151(d)). Imposing a damages

award on ERCOT “would run afoul of the Legislature’s determination that the PUC

alone has ‘complete authority’ over ERCOT’s finances,” so recognizing ERCOT’s

immunity respects separation of powers principles. Id. Because “clear legislative

intent” exists that ERCOT should have the “nature, purposes, and powers” of an arm

of the State government and the purposes underlying the immunity doctrines would

be satisfied, the court held that ERCOT was entitled to governmental immunity as

an arm of the State. Id. at 628.

No court has addressed whether the Legislature has demonstrated intent to

grant a nonprofit corporation created by a hospital authority under Health and Safety

Code section 262.037 “the ‘nature, purposes, and powers’ of an ‘arm of the State

government.’” Id. at 621. Based on the relevant provisions of the Health and Safety

Code, caselaw, and the state of the record, we conclude that OakBend Medical

Group most closely resembles the economic development corporation at issue in

Rosenberg Development—rather than open-enrollment charter schools and

ERCOT—and therefore does not have immunity as an arm of the State government.

As discussed above, a hospital authority may form a nonprofit corporation “to

own and operate all or part of one or more ancillary health care facilities consistent

with the purposes of an authority under this chapter.” TEX. HEALTH & SAFETY CODE

§ 262.037(a). The hospital authority’s board of directors “shall appoint the board of

20 directors of a nonprofit corporation formed under this section.” Id. § 262.037(b). The

hospital authority “may contribute money” to the nonprofit corporation, and if it

does so, it “shall establish procedures and controls sufficient to ensure that the

money is used by the corporation for public purposes.” Id. § 262.037(c). While a

hospital authority “is a body politic and corporate,” id. § 262.003(d), the Legislature

did not grant that designation to a nonprofit corporation created by a hospital

authority. See id. § 262.037.

The Legislature also provided that a nonprofit corporation created under

section 262.037 “has the same powers as a development corporation under [Health

and Safety Code] Section 221.030.”6 Id. § 262.037(d). That section grants a

development corporation powers including, for example, the ability to acquire land,

sell property, and appoint agents. Id. § 221.030(a)(1), (9), (10). But section 221.030

contains an important restriction on a development corporation’s powers, a

restriction that mattered in Rosenberg Development: a municipality, county, or

district that creates a development corporation—a “sponsoring entity”—“may not

delegate to a development corporation the power of taxation or eminent domain,

police power, or an equivalent sovereign power of the state or the sponsoring entity.”

6 Health and Safety Code Chapter 221 grants authority to a municipality, county, or district to create “one or more nonmember, nonstock development corporations for the sole public purpose of acquiring, constructing, providing, improving, financing, and refinancing a health facility to assist the maintenance of public health.” TEX. HEALTH & SAFETY CODE § 221.011(a). 21 Id. § 221.030(c); Rosenberg Dev. Corp., 571 S.W.3d at 749–50 (concluding that

Legislature had “expressly denied economic development corporations significant

governmental characteristics—political-subdivision-status and attributes of

sovereignty” evincing “clear legislative intent that an economic development

corporation is not an arm of state government”).

Section 262.037 contemplates some governmental oversight of a nonprofit

corporation, as the hospital authority’s board must appoint the nonprofit

corporation’s board of directors, and the hospital authority “shall establish

procedures and controls sufficient to ensure that the money is used by the corporation

for public purposes” if the authority contributes money to the nonprofit corporation.

TEX. HEALTH & SAFETY CODE § 262.037(b)–(c). This amount of oversight, however,

is limited compared to the regulations imposed upon an open-enrollment charter

school, which must meet the Commissioner of Education’s “financial, governing,

educational, and operational standards” and must follow the Commissioner’s

regulations applying to public schools or risk revocation of its charter. See El Paso

Educ. Initiative, 602 S.W.3d at 528–29. And it falls far short of the oversight

statutorily imposed on ERCOT, which is subject to a high degree of control and

authority over it exercised by the PUC. See CPS Energy, 671 S.W.3d at 623–24. The

provisions in section 262.037 providing for hospital authority oversight do not

“overcome the Legislature’s clear and express directives” that the nonprofit

22 corporation does not have sovereign powers. See Rosenberg Dev. Corp., 571 S.W.3d

at 750; TEX. HEALTH & SAFETY CODE § 221.030(c).

The OakBend entities argue that “the undisputed facts demonstrate that

OakBend [Medical Center] controls OakBend [Medical Group’s] operations and

governance,” pointing to Freudenberger’s declaration that OakBend Medical Center

is OakBend Medical Group’s sole member, and listing powers reserved to OakBend

Medical Center in this capacity, including composition of OakBend Medical

Group’s board and management; approval of budgets, mergers, acquisitions, and

sale of real assets; creation of partnerships or joint ventures; and dissolution or

liquidation. OakBend Medical Center also provides funding to OakBend Medical

Group.

Freudenberger’s declaration, however, says nothing about the day-to-day

operations of the entities, such as who hires and fires medical personnel or makes

operational decisions concerning hospitals or other healthcare facilities. It

establishes that OakBend Medical Center has some authority and control over

OakBend Medical Group, but it is silent on the level of control relating to the purpose

for which OakBend Medical Group was ostensibly created: “to own and operate all

or part of one of more ancillary health care facilities.” See TEX. HEALTH & SAFETY

CODE § 262.037(a); see also id. § 262.022(d) (providing that if nonprofit corporation

uses, operates, or acquires hospital, “the [hospital] authority may delegate to the

23 nonprofit corporation . . . the duty to establish the procedures and policies” for

hospital’s operation).

We must also address whether extending immunity to a nonprofit corporation

created under section 262.037 is “necessary to satisfy the political, pecuniary, and

pragmatic policies underlying [the] immunity doctrines.” See Rosenberg Dev. Corp.,

571 S.W.3d at 750. In arguing that it is, the OakBend entities focus on two policy

goals: protecting the public treasury and preserving separation of government

powers.

The OakBend entities first argue that it is undisputed that OakBend Medical

Center controls OakBend Medical Group’s budget and provides funding for

OakBend Medical Group. Thus, if OakBend Medical Group must pay a judgment,

those funds would come from increased fees charged to the public or funds provided

by OakBend Medical Center, which is immune from suit. The OakBend entities also

argue that extending immunity to OakBend Medical Group recognizes “the

separation of powers principle inherent in OakBend [Medical Center’s] control over

OakBend [Medical Group’s] finances,” pointing out that OakBend Medical Center

has the sole power to sell OakBend Medical Group’s assets or dissolve OakBend

Medical Group.

As the patients point out, however, the record says little about the OakBend

entities’ finances. Freudenberger declared only that OakBend Medical Center

24 retained the power to approve OakBend Medical Group’s budgets and that OakBend

Medical Center “provides funding for the operations of OakBend Medical Group.”

He did not state that OakBend Medical Center provides all funding for OakBend

Medical Group. We note that a hospital authority that creates a nonprofit corporation

“may contribute money to or solicit money for the nonprofit corporation,” but it is

not required to do so. TEX. HEALTH & SAFETY CODE § 262.037(c) (emphasis added).

This leaves open the possibility that OakBend Medical Group receives funding from

other sources such that if it is required to pay any judgments, those funds might not

necessarily come from increased charges to the public or funds contributed by

OakBend Medical Center. Based on this record, we do not agree that a judgment

against OakBend Medical Group is effectively a judgment against OakBend Medical

Center, an entity that has immunity from suit.

“Governmental immunity does not extend like ripples from a pebble tossed

into a pond but, instead, is limited to those entities acting as an arm of state

government.” Rosenberg Dev. Corp., 571 S.W.3d at 752. We conclude that although

a nonprofit corporation like OakBend Medical Group fulfills a public purpose by

providing healthcare, the Legislature has not demonstrated clear legislative intent

that such an entity should be considered an arm of the State government. See id. at

750. Additionally, we conclude on this record that extending immunity to OakBend

Medical Group does not further the purposes underlying the immunity doctrines. We

25 therefore hold that OakBend Medical Group is not entitled to governmental

immunity as an arm of the State government.

3. Derivative immunity

We turn now to whether OakBend Medical Group enjoys derivate immunity

based on the immunity of its parent and sole member OakBend Medical Center.

Whether a non-governmental entity can share a political subdivision’s

immunity derivatively “is a distinct analytical inquiry” from whether the entity

effectively acts as an arm of state government. Id. at 752. The Texas Supreme Court

has never adopted the derivative-immunity doctrine or standards to use when

determining the scope of that doctrine. Nettles, 606 S.W.3d at 733. The

circumstances under which derivate immunity exists are “ill-defined,” but the court

has held that the absence of governmental control over the entity’s work

“affirmatively precludes it.” Rosenberg Dev. Corp., 571 S.W.3d at 751–52 (citing

Brown & Gay Eng’g v. Olivares, 461 S.W.3d 117, 126 (Tex. 2015)); see also Nettles,

606 S.W.3d 733–37 (declining to adopt derivate immunity doctrine but noting that

even if doctrine was recognized, private contractor would not be entitled to it

because contractor retained discretion and governmental unit did not control

contractor’s work).

The inquiry focuses on whether the governmental entity had sufficient control

over the actions of the entity seeking derivative immunity such that the actions were

26 “effectively attributable” to the governmental entity or whether the other entity had

some discretion. See Nettles, 606 S.W.3d at 733. We look at the “complained-of

conduct” to consider whether “the alleged cause of the injury was not the

independent action of the [entity seeking derivative immunity], but the action taken

by the government through the [entity].” Brown & Gay Eng’g, 461 S.W.3d at 125.

For example, in Brown & Gay Engineering, a case that arose out of a fatal car

accident on the Westpark Tollway, the Texas Supreme Court focused on the fact that

the plaintiffs alleged Brown & Gay—a private contractor—was independently

negligent in how it designed road signs and traffic layouts, an action that the toll

road authority had delegated to the contractor under their contract. Id. at 126.

Because Brown & Gay “was an independent contractor with discretion to design the

Tollway’s signage and road layouts,” the toll road authority’s lack of control over

those actions was “determinative,” and the contractor could not rely on derivative

immunity.7 Id.; see Nettles, 606 S.W.3d at 736–37 (concluding that contractor could

7 The Texas Supreme Court first considered this doctrine over thirty years ago in K.D.F. v. Rex, a mandamus proceeding in which three Kansas entities—the Kansas Public Employees’ Retirement System (“KPERS”); Kansas Debt Fund (“K.D.F.”), a bank-created partnership that held securities on behalf of KPERS; and Pacholder Associates, KPERS’ independent investment adviser—argued that under principles of interstate comity, Texas courts had to recognize their sovereign immunity under Kansas law and decline to exercise jurisdiction over them. See 878 S.W.2d 589, 591 (Tex. 1994) (orig. proceeding). KPERS was a Kansas governmental entity entitled to sovereign immunity, but K.D.F. and Pacholder were not governmental entities, and the question was whether they were entitled to share in KPERS’ immunity. Id. at 596.

27 not rely on derivative immunity through Texas Lottery Commission because

contractor “had discretion regarding the conduct at issue: choosing the wording of

the game instructions”).

Our Court has also addressed this doctrine. Lenoir v. U.T. Physicians involved

a malpractice claim against doctors, a nurse, and U.T. Physicians, a subsidiary entity

of a governmental entity with immunity from suit: the University of Texas Health

Science Center at Houston (“UTHSCH”). 491 S.W.3d 68, 77 (Tex. App.—Houston

[1st Dist.] 2016, pet. denied). The plaintiffs alleged that U.T. Physicians employed

a nurse who acted negligently, and U.T. Physicians was liable for the nurse’s

negligence. Id. U.T. Physicians argued that it was entitled to derivative immunity

through UTHSCH. Id. at 82.

The jurisdictional evidence presented by the parties included the contract

between UTHSCH and U.T. Physicians. The contract required U.T. Physicians to

provide UTHSCH with “the non-physician personnel reasonably necessary” for the

In holding that K.D.F. could but Pacholder could not, the court focused on whether the entities performed “essentially ministerial functions under the control and direction of KPERS.” Id. at 597. K.D.F. operated “solely upon the direction of KPERS” and exercised no discretion in its activities. Id. K.D.F. and KPERS were therefore “not distinguishable from one another; a lawsuit against one is a lawsuit against the other.” Id. Pacholder, on the other hand, was an investment adviser and its actions “necessarily involve[d] considerable discretion.” Id. Rather than acting on KPERS’ direction and control, its role was “more in the nature of advising KPERS how to proceed.” Id. Pacholder was therefore not entitled to immunity protection “unless it can demonstrate its actions were actions of the Kansas government, executed subject to the control of KPERS.” Id. 28 practice, granted U.T. Physicians the sole right to hire and fire such personnel, and

required U.T. Physicians to determine the compensation of such personnel and

procure professional liability insurance for such personnel. Id. at 86. This contract

established that U.T. Physicians had discretion with respect to conduct that formed

the basis of the plaintiffs’ complaint, the provision of medical services:

The contract evinces UTP’s right to direct the nursing staff, control its compensation, and insure against professional liability for its acts. In doing so, UTP was granted discretion. It acted for the government— assisting it in its provision of medical services and education—not as the government without discretion or diversion.

Id. Immunity therefore did not extend to U.T. Physicians. Id.

U.T. Physicians’ argument that it was entitled to derivative immunity because

UTHSCH exerted control over it—UTHSCH created U.T. Physicians, chose its

board of directors, retained authority to amend its bylaws, and would recover U.T.

Physicians’ property should it cease to exist—did not persuade us that immunity

should be extended. Id. at 88. The pertinent question was not whether the

governmental entity had any control over the entity seeking immunity, but “whether

the entity that is seeking to benefit from another’s immunity had discretion as it

relates to the activities underlying the plaintiff’s claims.” Id. (emphasis added).

UTHSCH might have retained the ability to dissolve U.T. Physicians, but that did

not necessarily mean that UTHSCH had “withheld all discretion from UTP in its

operations or, more specifically, in the management of UTP’s nursing staff.” Id.

29 Here, Somer complains about the OakBend entities’ actions and omissions in

allegedly allowing their computer network to be breached in a ransomware attack.

Somer’s petition does not differentiate between the actions and omissions of

OakBend Medical Center and OakBend Medical Group, instead referring to both

entities collectively as “OakBend.” The OakBend entities argue that Somer’s claims

“arise out of a single Cybercriminal Attack on OakBend [Medical Center’s]

computer network—not separate, discretionary actions taken by OakBend [Medical

Group].” The record, however, does not support that assertion.8

The only evidence submitted in connection with the pleas to the jurisdiction

is Freudenberger’s declaration, quoted above, which generally describes powers that

OakBend Medical Center retains over OakBend Medical Group, powers that do not

relate to the complained-of conduct here. This declaration is silent about whether

OakBend Medical Group has a separate computer network or servers from OakBend

8 As support for this assertion, the OakBend entities cite three pages of the record. They first cite the second page of Somer’s petition, in which she alleged that “[o]n or about September 1, 2022, OakBend [defined earlier in the petition as referring collectively to both OakBend entities] determined that unauthorized individuals had gained access to its network systems and encrypted and removed the [personal information] of Plaintiff and Class members.” The OakBend entities then cite the first page of Janssen and Henderson’s petition, in which they asserted that the data breach was “perpetrated against Defendant OakBend,” which in their petition only refers to OakBend Medical Center, the only entity they asserted claims against. Finally, the OakBend entities cite the “Notice of Data Breach” that Janssen and Henderson received and attached to their petition, which stated that “OakBend Medical Center’s computer network experienced a ransomware attack” and did not mention OakBend Medical Group. None of these documents were attached as evidence to the OakBend entities’ pleas to the jurisdiction. 30 Medical Center, which entity is responsible for data security practices and

procedures, whether OakBend Medical Group has its own information technology

department, and—assuming the OakBend entities have separate networks and

servers—which entity’s network was compromised during the ransomware attack.

The appellate record is therefore silent about whether OakBend Medical Group

retains any discretion related to data security—the focus of Somer’s allegations—or

whether it is subject to OakBend Medical Center’s control in this regard.

It may very well be that OakBend Medical Group has no control over data

security, that OakBend Medical Center is the only OakBend entity that exercises

control over such matters, or that OakBend Medical Group does not have its own

computer network or servers and instead relies entirely on those of OakBend

Medical Center. But we cannot determine that based on this record. When there is a

dispute over jurisdictional facts, we must indulge every reasonable inference and

resolve any doubts in the nonmovant’s favor. Powell, 704 S.W.3d at 448.

On this record, even assuming that derivative immunity is a doctrine that

exists in Texas, we conclude that OakBend Medical Group has not established that

it is entitled to derivative immunity based on OakBend Medical Center’s immunity

from suit. See Lenoir, 491 S.W.3d at 90 (holding that in light of plaintiff’s negligence

allegations, evidence of U.T. Physicians’ discretion in managing nursing staff, and

other contractual requirements, U.T. Physicians had not established “that

31 UTHSCH’s immunity from suit extends to it as a creation of UTHSCH, either as an

agent or a wholly-owned subsidiary”). We hold that the trial court erred by granting

OakBend Medical Group’s plea to the jurisdiction.

We therefore sustain Somer’s first issue.

C. Waiver of Governmental Immunity

Having concluded that OakBend Medical Group has not established that it is

entitled to governmental immunity, we now address whether the patients’ claims

against OakBend Medical Center—an entity that undisputedly enjoys governmental

immunity—fall within a waiver of that immunity. We turn first to whether the

patients’ tort claims fall within the tangible personal property waiver of the Tort

Claims Act.

1. The Tort Claims Act’s condition or use of tangible personal property waiver

The Tort Claims Act waives immunity for certain torts. Powell, 704 S.W.3d

at 448. Relevant here, the Act waives immunity for “personal injury and death so

caused by a condition or use of tangible personal or real property if the governmental

unit would, were it a private person, be liable to the claimant according to Texas

law.” TEX. CIV. PRAC. & REM. CODE § 101.021(2).

32 The Tort Claims Act does not define “personal injury.”9 Few Texas courts

have addressed what qualifies as “personal injury” in this context, but this Court is

one of them. In Hencerling v. Texas A&M University, a local business owner in the

Bryan-College Station area sued after the university opened a new fitness center on

campus, which allegedly led to decreased revenues and closure of the owner’s own

health clubs. 986 S.W.2d 373, 374 (Tex. App.—Houston [1st Dist.] 1999, pet.

denied). We held that section 101.021(2) did not waive immunity because the

owner’s alleged injuries were business and financial losses. Id. at 375. “Financial

losses are not personal injury damages,” and the owner’s financial losses were

“neither dependent on, nor the result of, personal injury or death.” Id.; Tex. Dep’t of

Transp. v. City of Floresville Elec. Power & Light Sys., 53 S.W.3d 447, 455–56

(Tex. App.—San Antonio 2001, no pet.) (concluding immunity was not waived

under section 101.021(2) because plaintiff was “seeking to be indemnified for

money it paid to settle claims,” and financial losses are not property or personal

injury damages).

9 The Tort Claims Act includes limitations on the amount of liability of the state government, a unit of local government, a municipality, and an emergency service organization. TEX. CIV. PRAC. & REM. CODE § 101.023. For example, section 101.023(a) limits the state government’s liability to “money damages in a maximum amount of $250,000 for each person and $500,000 for each single occurrence for bodily injury or death and $100,000 for each single occurrence for injury to or destruction of property.” Id. § 101.023(a) (emphasis added). None of the four subsections of this statute use the phrase “personal injury”; instead, they all use the phrase “bodily injury.” See id. § 101.023(a)–(d). The Tort Claims Act does not define “bodily injury.” 33 Somer alleged the following injuries and damages with respect to her tort

claims:

• “a substantially increased risk of identity theft and medical identity theft—risks justifying expenditures for protective and remedial services for which they are entitled to compensation”; • “improper disclosure of their PII/PHI [personal identifying information/personal health information]”; • “breach of the confidentiality of their PII/PHI”; • “deprivation of the value of their PII/PHI, for which there is a well- established national and international market”; • “lost time and money incurred to mitigate and remediate the effects of the Data Breach, including the increased risks of identity theft and medical identity theft they face and will continue to face”; and • “overpayment for the services that were received without adequate data security.”10

Janssen and Henderson alleged substantially similar injuries:

10 Although Somer alleged slightly different injuries with respect to her breach of fiduciary duty claim, we note that breach of fiduciary duty is an intentional tort, and the Tort Claims Act does not waive immunity for intentional torts. See id. § 101.057(2) (providing that Tort Claims Act does not apply to claim “arising out of assault, battery, false imprisonment, or any other intentional tort”); City of Watauga v. Gordon, 434 S.W.3d 586, 589 (Tex. 2014) (stating that limited waiver in section 101.021(2) “does not apply to intentional torts”); Wren v. Midwestern State Univ., No. 05-22-00207-CV, 2023 WL 6139452, at *2 (Tex. App.—Dallas Sept. 20, 2023, no pet.) (mem. op.) (“Due to their status as intentional torts, fraud and breach of fiduciary duty do not fall within this waiver.”); Moorhead v. E. Chambers Indep. Sch. Dist., No. 01-03-01234-CV, 2004 WL 1470787, at *4 n.4 (Tex. App.—Houston [1st Dist.] July 1, 2004, pet. denied) (mem. op.) (“Claims for breach of fiduciary duty do not fall under the Tort Claims Act.”). Somer therefore has not demonstrated that a waiver of immunity under the Tort Claims Act applies to her breach of fiduciary duty claim. 34 • “out-of-pocket costs for, e.g., purchasing credit monitoring services, credit freezes, credit reports, or other protective measures to deter and detect identity theft”; • “time dealing with the effects of the Data Breach”; • “substantial risk of out-of-pocket fraud losses such as loans opened in their names, medical services billed in their names, tax return fraud, utility bills opened in their names, credit card fraud, and similar identity theft”; • “substantial risk of being targeted for future phishing, data intrusion, and other illegal schemes”; and • “out-of-pocket expenses and the value of their time reasonably incurred to remedy or mitigate the effects of the Data Breach.”

The patients alleged that they have incurred financial losses, expended time,

and face an increased risk of future identity theft. These injuries are not “personal

injuries” such that the Tort Claims Act’s tangible personal property waiver applies

to waive OakBend Medical Center’s governmental immunity. See Hencerling, 986

S.W.2d at 375. The trial court therefore properly granted OakBend Medical Center’s

plea to the jurisdiction on the patients’ tort claims.

2. The unjust enrichment claims

Finally, we address whether the patients’ claims for unjust enrichment fall

within a waiver of immunity.

“Unjust enrichment occurs when a person has wrongfully secured a benefit or

has passively received one which it would be unconscionable to retain.” Eun Bok

Lee v. Ho Chang Lee, 411 S.W.3d 95, 111 (Tex. App.—Houston [1st Dist.] 2013,

35 no pet.). A party may recover under an unjust enrichment theory when one person

has obtained a benefit from another by fraud, duress, or through taking undue

advantage. Heldenfels Bros., Inc. v. City of Corpus Christi, 832 S.W.2d 39, 41 (Tex.

1992). Unjust enrichment is an equitable doctrine. Eun Bok Lee, 411 S.W.3d at 111.

Among the purposes of governmental immunity from suit is the protection of

state agencies and their officials from lawsuits for damages. Richardson Hosp. Auth.

v. Duru, 387 S.W.3d 109, 114 (Tex. App.—Dallas 2012, no pet.). Regardless of the

nature of an equitable claim, governmental immunity bars the claim if the plaintiff

seeks money damages as her remedy. Id. The patients, however, argue that their

unjust enrichment claims fall within a waiver of OakBend Medical Center’s

immunity because the law recognizes an exception to immunity when someone’s

money or property has been improperly “withheld” by state officials: “suits to

recover money or other property wrongfully taken or withheld by state officials from

their rightful owners do not implicate sovereign immunity because, in concept, the

disputed property never belongs to the state.” City of Round Rock v. Whiteaker, 241

S.W.3d 609, 634–35 (Tex. App.—Austin 2007, pet. denied).

Based on this legal premise from City of Round Rock, the patients argue that

they allege OakBend Medical Center is “wrongfully withholding funds that

rightfully belong to each” patient because the patients “conferred a benefit upon

[OakBend Medical Center] in the form of monies paid for healthcare services or

36 other services provided by OakBend Defendants.” This premise could give rise to a

doctrinal discussion about whether unjust enrichment constitutes a claim or merely

a remedy. See George P. Roach, Unjust Enrichment in Texas: Is It a Floor Wax or a

Dessert Topping?, 65 BAYLOR L. REV. 153, 203–40 (2013) (exploring “the ongoing

dispute of whether unjust enrichment is a cause of action”).11 But we need not

address that issue in this case.

The pleadings here do not allege any such “withholding.” Indeed, the

pleadings never even mention withholding. Somer’s petition largely alleges

negligence, with allegations of breach of fiduciary duty and negligence per se based

on duties imposed by HIPAA and the Federal Trade Commission Act. When Somer

states her count alleging an unjust enrichment claim, she realleges and incorporates

her prior allegations before pleading:

87. Plaintiff and Class members conferred a monetary benefit upon OakBend in the form of monies paid for healthcare services or other services or through their employment with OakBend. .... 89. As a result of OakBend’s conduct, Plaintiff and Class members suffered actual damages in an amount equal to the difference in value between their payments made with reasonable data privacy and security

11 Compare Tex. State Libr. & Archives Comm’n v. Westmoreland, 703 S.W.3d 805, 811 (Tex. App.—Austin 2024, no pet.) (“Unjust enrichment on its own cannot support a waiver of governmental immunity”), and Richardson Hosp. Auth. v. Duru, 387 S.W.3d 109, 114 (Tex. App.—Dallas 2012, no pet.) (“This Court has held that unjust enrichment is not an independent cause of action.”), with Pepi Corp. v. Galliford, 254 S.W.3d 457, 460 (Tex. App.—Houston [1st Dist.] 2007, pet. denied) (“Unjust enrichment is an independent cause of action.”). 37 practices and procedures that Plaintiff and Class members paid for, and those payments without reasonable data privacy and security practices and procedures that they received. 90. OakBend should not be permitted to retain the money belonging to Plaintiff and Class members because OakBend failed to adequately implement the data privacy and security procedures for itself that Plaintiff and Class members paid for and that were otherwise mandated by federal, state, and local laws and industry standards. 91. OakBend should be compelled to provide for the benefit of Plaintiff and Class members all unlawful proceeds received by it as a result of the conduct and Data Breach alleged herein.

Nothing in Somer’s petition alleged any withholding of property that otherwise

belonged to her. The same can be said of the allegations in Janssen and Henderson’s

petition.12 Fairly construed, the pleadings do not allege the kind of withholding that

would put City of Round Rock into play.

As a result, the unjust enrichment allegations come within the normal rule that

“regardless of the nature of the equitable claim, if money damages are the remedy

sought, then the claim is barred by governmental immunity.” Richardson Hosp.

Auth., 387 S.W.3d at 114. The Legislature “has not created a waiver of governmental

12 Janssen and Henderson alleged that OakBend Medical Center “funds its data security measures entirely from its general revenue, including payments made by or on behalf of Plaintiff(s) and the Class Members,” and therefore “a portion of the payments made by or on behalf of Plaintiff(s) and the Class Members is to be used to provide a reasonable level of data security.” Instead, OakBend Medical Center “enriched itself by saving the costs it reasonably should have expended on data security measures to secure Plaintiff’s and Class Members’ Personal Information.” Rather than “providing a reasonable level of security that would have prevented the hacking incident, Defendant instead calculated to increase its own profits at the expense of Plaintiff(s) and Class Members by utilizing cheaper, ineffective security measures.” 38 immunity for equitable claims that seek money damages.” Id. We conclude that the

trial court did not err by granting OakBend Medical Center’s plea to the jurisdiction

on the patients’ unjust enrichment claims.

We overrule the patients’ second issue.

Conclusion

The parent has shown an entitlement to immunity, but the subsidiary has not.

We reverse the trial court’s order granting OakBend Medical Group’s plea to the

jurisdiction, and we remand Somer’s claims against OakBend Medical Group for

further proceedings. We affirm the trial court’s orders granting OakBend Medical

Center’s pleas to the jurisdiction.

David Gunn Justice

Panel consists of Justices Guerra, Gunn, and Dokupil.