Krandle v. Refuah Health Center, Inc.

• Court: District Court, S.D. New York
• Decided: March 12, 2024
• Docket: 7:22-cv-04977
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

REBECCA KRANDLE, individually, and on behalf of all others similarly situated,

Plaintiffs,

v.

REFUAH HEALTH CENTER, INC.,

Defendant.

No. 22-CV-4977 (KMK),

No. 22-CV-5039 (KMK) DAWN ESPOSITO and PAOLA OPINION & ORDER CORTAZAR, individually, and on behalf of all others similarly situated,

Appearances:

Michael Milton Liskow, Esq. George Feldman McDonald, PLLC New York, NY Counsel for Plaintiff Krandle

Anthony Parkhill, Esq. Barnow and Associates, P.C. Chicago, IL Counsel for Plaintiff Krandle

Todd Seth Garber, Esq. Andrew Charles White, Esq. Finkelstein, Blankinship, Frei-Pearson & Garber LLP White Plains, NY Counsel for Plaintiffs Esposito and Cortazar Matthew S. Freedus, Esq. Feldesman Leifer LLP Washington, DC Counsel for Defendant

Brian Gilbert Cesaratto, Esq. Stewart Michael Gerson, Esq. James Patrick Flynn, Esq. Epstein Becker & Green, P.C. New York, NY Counsel for Defendant

Brandon H. Cowart, Esq. United States Attorney’s Office for the Southern District of New York New York, NY Counsel for the United States of America

KENNETH M. KARAS, United States District Judge: Rebecca Krandle (“Krandle”), Dawn Esposito (“Esposito”), and Paola Cortazar (“Cortazar”; collectively, “Plaintiffs”) bring two Actions on behalf of themselves and all others similarly situated against Refuah Health Center, Inc. (“RHC” or “Defendant”) alleging various claims arising out of a 2021 data breach of RHC’s systems. (See generally Not. of Removal, Ex. A (“Krandle Compl.”) (Dkt. No. 1-1, 22-CV-4977 Dkt.); Not. of Removal, Ex. A (“Esposito Compl.”) (Dkt. No. 1-1, 22-CV-5039 Dkt.).) Before the Court is RHC’s Motion to Substitute the United States as the sole Defendant. (Not. of Mot. (Dkt. No. 50).)1 For the foregoing reasons, RHC’s Motion is granted.

1 Where papers have been filed in both Actions, and unless otherwise stated, the Court refers to the docket numbers in the first-filed Krandle Action, No. 22-CV-4977. I. Background A. Factual Background The Court assumes the Parties’ familiarity with the facts and procedural history described in its remand opinion. See Krandle v. Refuah Health Ctr., Inc., No. 22-CV-4977, 2023 WL 2662811, at *1 (S.D.N.Y. Mar. 28, 2023). To recap, RHC is a New York-based non-for-profit company that provides a full suite of

healthcare services at its four service sites and through its fleet of mobile medical units. (Krandle Compl. ¶¶ 2, 8, 11; Esposito Compl. ¶¶ 1–2, 9.) RHC collects personal identifying information (“PII”) and personal health information (“PHI”) in the course, and as a condition, of providing care. (Krandle Compl. ¶ 2; Esposito Compl. ¶ 2). That information includes, among other things, Social Security numbers, bank account information, credit and debit card information, medical treatment and diagnosis information, and health insurance policy numbers. (Krandle Compl. ¶ 1; Esposito Compl. ¶ 2.) RHC suffered a data breach between May 31 and June 1, 2021. (Krandle Compl. ¶¶ 15– 16; see also Esposito Compl. ¶ 32 (alleging that RHC began to notify Plaintiffs of the breach on

April 29, 2022).) After an investigation, RHC found that third parties accessed its systems and extracted PII and PHI, resulting in the exposure of each named Plaintiff’s information. (Krandle Compl. ¶ 7; Esposito Compl. ¶¶ 35, 36.) Among other claims, Plaintiffs allege that RHC acted negligently by failing to safeguard Plaintiffs’ PHI and PII. That obligation, they say, arises out of the “special relationship” between RHC and its patients and a variety of regulations, including HIPAA, rules that task RHC with protecting confidential data from “any intentional or unintentional use or disclosure.” (Esposito Compl. ¶¶ 67–68 (citing 45 C.F.R. § 164.530(c)(1)); see also Krandle Compl. ¶ 59 (alleging similar duties).) B. Procedural History Because the Krandle and Esposito Actions are related, and because of the similar questions presented in each one, the Parties and the United States have engaged in parallel motion practice. See Krandle, 2023 WL 2662811, at *1 n.1. RHC proposed the instant Motion in a letter dated June 20, 2023, (Letter from Brian Cesaratto, Esq. to Court (June 20, 2023) (Dkt.

No. 47)), after which the Court adopted a briefing schedule, (Memo Endorsement (Dkt. No. 48)). Pursuant to that schedule, RHC filed the instant Motion on July 26, 2023. (Not. of Mot.; Mem. of Law in Supp. of Mot. (“Def’s Mem.”) (Dkt. No. 51).) After an extension, (see Dkt. No. 57), Krandle and Esposito filed their Oppositions on September 14, 2023, (Mem. of Law in Opp. (“Krandle Mem.”) (Dkt. No. 59); Mem. of Law in Opp. (“Esposito Mem.”) (Dkt. No. 53, 22-CV- 5039 Dkt.)).2 The Government, which also received an extension, (see Dkt. No. 52), filed its Opposition the same day. (See Mem. of Law in Opp. to Mot. (“Govt. Mem.”) (Dkt. No. 60).)3 RHC filed its reply on November 1, 2023. (Reply Mem. of Law (“Def’s Reply”) (Dkt. No. 64); Decl. of Leora Perl, Esq. in Supp. of Mot. (“Perl Decl.”) (Dkt. No. 63).) On January 25, 2024, the Court requested supplemental briefing regarding whether

RHC’s confidentiality obligations, assuming they are “medical . . . or related function[s]” for the purposes of 42 U.S.C. § 233(a), encompass protection against both unauthorized disclosure and unauthorized access by third parties. (See Order (Dkt. No. 65).) After an extension, (Dkt. No. 66), the Parties filed supplemental memoranda on February 16, 2024, (Supp. Mem. of Law

2 The Krandle and Esposito briefs are quite similar. Compare Krandle Mem., with Esposito Mem. Instead of using parallel citations throughout the Opinion, the Court refers mostly to the Krandle brief and cites to the Esposito brief where the two diverge.

3 It appears that the Government filed its brief twice. (Compare Dkt. No. 60, with Dkt. No. 61.) (“Krandle Supp. Mem.”) (Dkt. No. 69); Supp. Br. (“Def’s Supp. Mem.”) (Dkt. No. 70); Supp. Mem. of Law (“Esposito Supp. Mem.”) (Dkt. No. 60, 22-CV-5039 Dkt.), and the United States filed the next day, on February 17, 2024, (Supp. Mem. of Law (“Govt. Supp. Mem.”) (Dkt. No. 71)).4

II. Discussion A. Standard of Review RHC styles its submission as a Motion to Substitute, but its request is best thought of as a motion to dismiss and a request to substitute the United States. If RHC is entitled to official immunity, it is protected “not just from liability but also from suit . . ., thereby sparing [it] the necessity of defending by submitting to discovery on the merits or undergoing a trial.” See X– Men Sec., Inc. v. Pataki, 196 F.3d 56, 65 (2d Cir. 1999); see also Hui v. Castaneda, 559 U.S. 799, 806 (2010) (describing 42 U.S.C. § 233(a) immunity as a form of “absolute immunity” that “bar[s] all actions” against deemed entities for covered conduct). It is also “well established that an affirmative defense of official immunity may be resolved by Rule 12(b)(6) if clearly established by the allegations within the complaint[.]” Liberian Cmty. Ass’n of Conn. V.

Lamont, 970 F.3d 174, 186 (2d Cir. 2020) (alteration adopted) (quoting Pani v. Empire Blue Cross Blue Shield, 152 F.3d 67, 75 (2d Cir. 1998)). The Supreme Court has held that although a complaint “does not need detailed factual allegations” to survive a Rule 12(b)(6) motion to dismiss, “a plaintiff’s obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S.

4 The Government missed the February 16 filing deadline due to an internet connectivity issue, (see Dkt. No. 72), and the Court granted its post-hoc extension request, (see Order (Dkt. No. 73)). 544, 555 (2007) (alteration and quotation marks omitted). “[W]hen ruling on a defendant’s motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (per curiam), and “draw all reasonable inferences in the plaintiff’s favor,” Division 1181 Amalgamated Transit Union-New York Emps. Pension Fund v. N.Y.C. Dep’t of Educ., 9 F.4th 91, 94 (2d Cir. 2021) (citation

omitted). Additionally, “when ruling on a Rule 12(b)(6) motion to dismiss,” district courts are directed to confine their consideration to “the complaint in its entirety, . . . documents incorporated into the complaint by reference, and matters of which a court may take judicial notice.” Bellin v. Zucker, 6 F.4th 463, 473 (2d Cir. 2021) (quotation marks omitted); see also Dashnau v. Unilever Mfg. (US), Inc., 529 F. Supp. 3d 235, 240 (S.D.N.Y. 2021) (same). B. Analysis 1. Section 233(a) The Federal Tort Claims Act (“FTCA”) waives the United States’s sovereign immunity for certain tort claims based on the acts or omissions of a Government employee “acting within the scope of his office or employment.” Celestine v. Mount Vernon Neighborhood Health Ctr.,

403 F.3d 76, 80 (2d Cir. 2005) (quoting 28 U.S.C. § 1346(b)(1)). Occasionally, Congress makes the FTCA the exclusive remedy for claims against certain officers, in effect granting those officers immunity from suit. See Carlson v. Green, 446 U.S. 14, 20 (1980) (collecting examples of exclusive remedy provisions). One such provision is 42 U.S.C. § 233(a), which “makes the [FCTA] the exclusive remedy for specified actions against members of the Public Health Service [‘PHS’].” Cuoco v. Moritsugu, 222 F.3d 99, 107 (2d Cir. 2000). That provision also applies to health centers, like RHC, that receive funding under the Public Health Service Act, 42 U.S.C. § 254b, and that are “deemed” to be PHS employees for the purposes of 233(a), see id. § 233(g).5 Relevant here, there is no dispute that RHC was a “deemed” PHS employee when the alleged conduct occurred. (See Def’s Mem. 14; see also Govt Mem. 5 (“[RHC] [was] also ‘deemed’ an employee of the Public Health Service with respect to [its] funded health care services.”).)

This case centers on § 233(a)’s text. The statute provides in relevant part that:

The remedy against the United States provided by [the FTCA] . . . for damage for personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigation, by any commissioned officer or employee of the Public Health Service while acting within the scope of his office or employment, shall be exclusive of any other civil action or proceeding by reason of the same subject- matter against the officer or employee (or his estate) whose act or omission gave rise to the claim.

Id. As explained by the Supreme Court, “[§] 233(a) grants absolute immunity to PHS officers and employees for actions arising out of the performance of medical or related functions within the scope of their employment by barring all actions against them for such conduct.” Hui, 559 U.S. at 806; see also Agyin, 986 F.3d at 172 (same). Here, the Court must decide whether RHC can “claim the benefits of official immunity for the alleged misconduct.” See Hui, 559 U.S. at

5 Qualifying health centers may apply for deemed status each year for the upcoming calendar year. See 42 U.S.C. § 233(g)(1)(A); see also Agyin v. Razmzan, 986 F.3d 168, 172 (2d Cir. 2021). A copy of RHC’s deeming application for calendar year 2021 appears as an exhibit to RHC’s Reply Declaration. (See Perl Decl., Ex. B (“Deeming App.”) (Dkt. No. 63-1).) Relatedly, Defendant’s declaration contains a significant amount of text that does not appear in Defendant’s briefs. (See generally id.) To the extent Defendant intended to use that Declaration to make additional arguments about its status as a deemed entity, the Court will not consider them. See In re Terrorist Attacks on Sept. 11, 2001, No. 03-MD-1570, 2022 WL 356190, at *1 (S.D.N.Y. Feb. 7, 2022) (“Courts have [] rejected attempts to slip additional expert or lawyer arguments into declarations or affirmations.”); see also Quattlander v. Ray, No. 18- CV-3229, 2021 WL 5043004, at *2 n.4 (S.D.N.Y. Oct. 29, 2021) (“I will not allow counsel to bypass the page limits on memoranda of law . . . by submitting additional argument in the form of an affirmation.”) 808. To be more precise, it must examine whether RHC’s alleged duty to safeguard PII and PHI is a “medical . . . or related function.” See 42 U.S.C. § 233(a). While this appears to be an issue of first impression in this District, four courts in other districts have weighed in on similar data breach actions, with three concluding that § 233(a)

immunity applies, and one concluding that it does not. Compare Doe v. Neighborhood Healthcare, No. 21-CV-1587, 2022 WL 17663520, at *8 (S.D. Cal. Sept. 8, 2022) (applying immunity for an “alleged data breach”), Mixon v. CareSouth Carolina, Inc., No. 22-CV-269, 2022 WL 1810615, at *7 (D.S.C. June 2, 2022) (same), and Ford v. Sandhills Med. Found., Inc., No. 21-CV-02307, 2022 WL 1810614, at *4 (D.S.C. June 2, 2022) (same), with Marshall v. Lamoille Health Partners, Inc., No. 22-CV-166, 2023 WL 2931823, at *5 (D. Vt. Apr. 13, 2023) (holding that “protection from cyberattack” is not a “related function”).6 If § 233(a) immunity applies, there is also a question about how to proceed. RHC argues that the Court should enter an order substituting the Government as the sole defendant, while the Government believes additional procedures are required before it can become a party. (See

Def’s Mem. 1; Govt. Mem. 19–23.) The Court considers each issue in turn. a. Statutory Interpretation The scope of § 233(a)’s “medical . . . or related functions” language is an issue of statutory construction, and one that courts have not considered in great detail. The Court begins, “as it must, with the text.” Nat. Res. Def. Council, Inc. v. U.S. Food & Drug Admin., 760 F.3d 151, 172 (2d Cir. 2014). Because the statute does not define any of the relevant terms, the “starting point” is the “statute’s plain meaning,” which is driven by the “ordinary, common-sense

6 Both Mixon and Ford were decided by Chief Judge Harwell of the District of South Carolina. meaning” of its terms and “the specific context in which that language is used.” See Eisenhauer v. Culinary Inst. of Am., 84 F.4th 507, 517 (2d Cir. 2023) (quotation marks omitted); see also Williams v. MTA Bus Co., 44 F.4th 115, 127 (2d Cir. 2022) (same). If the text “is not entirely clear, [courts] then turn to the broader statutory context and its history.” New York Legal

Assistance Grp. v. Bd. of Immigr. Appeals, 987 F.3d 207, 216 (2d Cir. 2021) (quotation marks omitted). If the text remains ambiguous after that analysis, the Court turns “to traditional canons of statutory construction for guidance in resolving the ambiguity.” Williams, 44 F.4th at 127 (citing United States v. Dauray, 215 F.3d 257, 262 (2d Cir. 2000)); cf. Spadaro v. United States Customs & Border Prot., 978 F.3d 34, 46 (2d Cir. 2020) (“When the language of a statute is unambiguous, judicial inquiry is complete.” (first alteration and internal quotation marks omitted)). That analysis does not proceed on a blank slate, however. The Second Circuit examined the “plain meaning” of § 233(a) in Cuoco v. Moritsugu, a case involving deliberate indifference claims against two prison officials—Barraco and Moritsugu—for their improper diagnosis and treatment of a transsexual inmate. 222 F.3d 99.7 Cuoco explained that § 233(a), “in effect

insures designated public health officials . . . when they are sued for the performance of their medical duties.” Id. at 108. Applying that understanding, the Second Circuit held that § 233(a) covered the defendants’ conduct, but not simply because of their “positions as Public Health Service officials,” instead: Critical to Barraco’s immunity [was] the fact that his complained of behavior occurred entirely in his capacity as a doctor responsible for, and in the course of rendering medical treatment for, [the plaintiff]. Similarly, Moritsugu’s alleged

7 The Second Circuit recently examined how to interpret the “scope-of-employment” portion of § 233(a), but it did not consider the “related functions” portion of the statute. See Agyin, 986 F.3d at 184. misdeeds related only to his decision, as the principal medical official for the Bureau of Prisons, not to authorize a particular medical treatment for Cuoco. If Cuoco alleged and could prove that either of these defendants violated her constitutional rights in the course of something other than the performance of a medical or related function, or while acting outside the scope of his employment, § 233(a) would not, of course, provide that defendant with absolute immunity.

Id. at 109. The diagnosis and treatment allegations—which Cuoco viewed as the heartland of medical functions—made it a straightforward case. Cuoco accordingly did not examine the outer boundaries of a “related function” or discuss what exactly separates “medical duties” from non- medical duties. See id. at 108. The Court must take up those issues here, and they call for a deeper look into the meaning of each relevant word. First up is the meaning of “medical, surgical, [and] dental.” See 42 U.S.C. § 233(a). “Medical” means “related to the . . . practice of medicine,” i.e. the “treatment or diagnosis” of a sick person “by a physician.” Medical, Medicine, Oxford English Dictionary (3d Ed. 2001). Surgical “pertain[s] to . . . surgery,” the “practice of treating injuries . . . and other disorders by manual operation.” Id. (defining Surgical and Surgery). And similarly, dental “relate[s] to dentistry,” “[t]he treatment of diseases and other conditions that affect the teeth and gums.” Id. (defining Dental and Dentistry). Before moving on, the Court pauses to note something about these words—they are all adjectives that pertain or relate to treatment, they are not exclusively defined by treatment. The Government attempts to show otherwise, arguing that these adjectives “each specify a particular practice . . . of attending to human health” and that they refer to specific “care practices.” (Govt. Mem. 8–9 & n.5; see also Krandle Mem. 11–12 (arguing that functions must relate to “medical care”).) But it provides no authority for these specific definitions. Indeed, surrounding provisions demonstrate that when Congress wants to refer to medical treatment, it does so expressly. See 42 U.S.C. § 251(a) (authorizing the provision of “medical, surgical, and dental treatment and hospitalization and optometric care for Federal employees . . . .”). Section 233(a)’s illustrative example—conducting clinical studies and investigations—also detracts from a treatment-focused reading.8 Indeed, 42 U.S.C. § 241, the relevant study provision, talks about the “causes, diagnosis, [and] treatment” of diseases but also extends as far as “water purification,

sewage treatment, and pollution” to the extent those are things “relating to” physical and mental diseases. Id. (emphasis added). The Second Circuit’s decision in Cuoco is not to the contrary. (See Govt. Supp. Mem. 4.) Although Cuoco emphasized the fact that the defendants’ actions occurred “in the course of rendering medical treatment,” it nowhere said that all related functions must arise during such treatment. See Cuoco, 222 F.3d at 109. Next up is “related.” That term is “typically defined [] broadly and is not [even] necessarily tied to the concept of a causal connection.” See Coregis Ins. Co. v. Am. Health Found., Inc., 241 F.3d 123, 128–29 (2d Cir. 2001). Its plain meaning is simply that two or more subjects are “connected by reason of an established or discoverable relation.” Id. (quotation marks omitted); see also Dan’s City Used Cars, Inc. v. Pelkey, 569 U.S. 251, 260 (2013) (noting

“related to” embraces subjects “having a connection with or reference to” one another, “whether directly or indirectly”); see also Related, Black’s Law Dictionary (11th ed. 2019) (“Connected in

8 The Government argues that the use of “including” implies that the list “does not encompass items significantly different that the types of items listed as illustrations.” (Govt. Mem. 9.) But “the Supreme Court has made clear that the word ‘includes,’ when used in a statute, ‘is usually a term of enlargement, and not of limitation.’” Pfizer, Inc v. United States Dep’t of Health & Hum. Servs., 42 F.4th 67, 76 (2d Cir. 2022) (quoting Burgess v. United States, 553 U.S. 124, 131 n.3 (2008)); see also 2A N. Singer & J. Singer, Sutherland Statutory Construction § 47:7 (7th ed. 2023) (same). Samantar is not to the contrary. (See Govt. Mem. 9.) That case recognized that “‘include’ can signal that the list that follows is meant to be illustrative rather than exhaustive” and relied on other textual indicators to conclude a provision defining “foreign state” did not “encompass” certain entities. See Samantar v. Yousuf, 560 U.S. 305, 317 (2010). some way; having a relationship to or with something else[.]”).9 Of course, “related” does not exist on its own: The preceding three adjectives provide context and specify what another function must relate to. See Suttlehan v. MidFirst Bank, 205 F. Supp. 3d 366, 371 (S.D.N.Y. 2016) (explaining that a general term is contextually “limited by the three specific terms that

precede it”). Plaintiffs and the Government contend that the ejusdem generis canon requires a narrower reading. (See, e.g., Govt. Mem. 8 (citing Southwest Airlines Co. v. Saxon, 142 S. Ct. 1783, 1789–90 (2022)); Esposito Mem. 9.) See also Eisenhauer, 84 F.4th at 521 (explaining “the canons of ejusdem generis and noscitur a sociis” which respectively state that “a general term that follows specific ones [] refer[s] only to items of the same ‘class’” and that “a word is known by the company it keeps” (quotation marks and citations omitted)). As a threshold matter, resort to interpretive canons is “useful only for resolving ambiguity.” Eisenhauer, 84 F.4th at 521 n.66 (citing Harrison v. PPG Indus., Inc., 446 U.S. 578, 588 (1980) (“The rule of jusdem generis . . . is only an instrumentality for ascertaining the correct meaning of words when

there is uncertainty.” (internal quotation marks omitted)). And “the fact that a term is broad in scope does not necessarily make it ambiguous.” See Coregis, 241 F.3d at 129 (concluding the phrase “related to” was “clear and unambiguous”). Even if the canon applies, however, Plaintiffs and the Government do not provide any definitions establishing that the “common attribute[s]” among these words are particular practices like “nursing, radiology, or physical

9 The Court notes that much of the precedent interpreting “related” does so in the context of jurisdiction-granting statutes that use the phrase “related to.” See, e.g., Dan’s City Used Cars, Inc., 569 U.S. at 260. These cases, however, still rely on definitions of “related.” See Coregis Ins. Co., 241 F.3d at 128 (“Webster’s Dictionary defines ‘related’ simply as “connected by reason of an established or discoverable relation.”). therapy.” (See Govt. Mem. 8–9.) Instead, the adjectives refer to the “practice of medicine,” surgery, and dentistry generally. See supra. To be sure, related “does not mean the sky is the limit.” See Dan’s City Used Cars, Inc., 569 U.S. at 260. “[R]elated to” or “[in] connection with,” lower courts are told, should not be

applied using “uncritical literalism.” See New York State Conf. of Blue Cross & Blue Shield Plans v. Travelers Ins. Co., 514 U.S. 645, 656 (1995). It likewise does not embrace connections that are “too tenuous, remote, or peripheral.” See Rowe v. New Hampshire Motor Transp. Ass’n, 552 U.S. 364, 371 (2008) (quotation marks omitted). And Cuoco demonstrates that a given task is not “related” simply because it is required as part of someone’s “position[] as a Public Health Service official[].” See 222 F.3d at 109. Instead, it must have a real relationship to the practice of medicine. Finally, a function is an “activity” or “purpose natural to or intended for a person or thing.” See Function, Oxford English Dictionary (3d Ed. 2001).10 In its supplemental briefing the Government says that functions relate to “business[es] or profession[s],” see Function,

Black’s Law Dictionary (11th ed. 2019), and that § 233(a) therefore refers to “the work of doctors, surgeons, dentists,” or similar individuals. (Govt. Supp. Mem. 4.) But that conclusion does not follow. Recalling the definitions of medical, surgical, and dental, functions may relate generally to “profession[s]” of medicine, surgery, and dentistry—nothing in the statute limits

10 For the sake of completeness, these definitions track those current at the time § 233 was enacted in 1970. See Pub. L. 91-623, § 4, Dec. 31, 1970, 84 Stat. 1870; see also Function, Websters Third New International Dictionary 920–21 (1961) (“[T]he activity appropriate to the nature or position of a person or thing.”); id. at 1402 (defining “medical” as “of, relating to, or concerned with physicians or the practice of medicine often as distinct from surgery”); id. at 1916 (defining “related” as “having [a] relation: connected by reason of an established or discoverable relationship”). “functions” to a particular individual’s tasks. See Mele v. Hill Health Ctr., 609 F. Supp. 2d 248, 256 (D. Conn. 2009) (holding, in case against clinician, that “[§] 233(a) . . . is not restricted to physicians and nurses”). Another theory is that functions refer to the specific alleged “performative conduct,” as opposed to general duties. (See Govt. Supp. Mem. 5–7; see also

Esposito Mem. 12 (arguing functions must arise “in the course of [] medical treatment”).) Yet that approach is also contrary to the term’s plain meaning. Even the definitions cited by the Government state that the term encompasses “role[s] [and] dut[ies]” in addition to “activities,” to the extent “activities” even refers to specific acts. (See Govt. Supp. Mem. 4 (quoting Function, Black’s Law Dictionary (11th ed. 2019)).) Together, then, the plain meaning of “medical . . . or related functions” appears to cover the performance of activities with an established relationship to the practice of treating or diagnosing patients. Apart from the arguments above, Plaintiffs and the Government devote much of their time to other indicators of meaning.11 But these additional arguments are unavailing.

First, they argue that purpose and history demonstrate that § 233(a) is limited to claims sounding in medical malpractice. (Krandle Mem. 6–7; Govt. Mem. 11–13.) To be sure, there is support for Congress’ concern with malpractice. For instance, Representatives claimed that PHS doctors “[could] not afford to take out the customary liability insurance that most doctors do.” See, e.g., 116 Cong. Rec. H42,543 (1970). And Congress, when it amended § 233 to provide

11 The Government briefly argues that the phrase “resulting from” in “resulting from the performance of medical, surgical, dental, or related functions” warrants a narrower meaning. (Govt. Mem. 14–15 (emphasis omitted).) But it does not explain which claims “resulting from” screens out that something broader like “arising out of” would keep in. As the Second Circuit recognized in the case cited by the Government, “the respective reaches of terms such as ‘arising out of,’ ‘resulting from,’ and ‘relating to’ are not self-evident.” In re WTC Disaster Site, 414 F.3d 352, 375 (2d Cir. 2005). immunity for deemed entities, titled the statute an act to “permanently extend and clarify malpractice coverage for health centers.” Federally Supported Health Centers Assistance Act of 1995, Pub. L. No. 104-73, 109 Stat. 777, 777 (1995); see also H.R. Rep. 102-823, at 6 (1992) (“The FTCA would be the exclusive remedy for medical malpractice claims against these

individuals and programs.”); Mendez v. Belton, 739 F.2d 15, 19 (1st Cir. 1984) (“The statute protects Public Health Service officers . . . from suits that sound in medical malpractice.”); Chronis v. United States, 932 F.3d 544, 546 (7th Cir. 2019) (stating deemed-entity status enables health centers to “spend their money on patient care rather than malpractice premiums”); Dedrick v. Youngblood, 200 F.3d 744, 745 (11th Cir. 2000) (“The Act essentially makes the U.S. government the medical malpractice insurer for qualifying [ ] health centers[.]”). Yet none of that history “forecloses an interpretation of [§] 233(a) that includes the circumstances of this case.” See Pomeroy v. United States, No. 17-CV-10211, 2018 WL 1093501, at *2 (D. Mass. Feb. 27, 2018). Notably absent from Plaintiff and the Government’s arguments is evidence of an intent to exclude non-malpractice claims. (See generally Govt. Mem.; Krandle Mem.) And that,

combined with Congress’s use of “related,” reduces the salience of this history as a hard limit on covered functions. The Second Circuit, moreover, has expressly rejected the argument that “§ 233(a) provides immunity only from medical malpractice claims,” because “there is nothing in the language of § 233(a) to support that conclusion.” Cuoco, 222 F.3d at 108; see also Teresa T. v. Ragaglia, 154 F. Supp. 2d 290, 299–300 (D. Conn. 2001) (same) (citing Cuoco). Instead, “[w]hen Congress has sought to limit immunity to medical malpractice claims it has done so explicitly.” Id. (citing 38 U.S.C. § 7316(a)(1) (providing an exclusive remedy only “for damages for personal injury . . . arising from malpractice or negligence of a medical care employee” of the Veterans Health Administration)). Numerous references to malpractice elsewhere in the statute reinforce that conclusion. See, e.g., 42 U.S.C. § 233(n)(1)(A) (requiring Comptroller General to submit report on the “medical malpractice liability claims experience” of deemed entities); id. § 233(g)(2) (subrogating benefits under “an insurance policy with respect to medical malpractice”

to the United States). (See also Esposito Mem. 7 (collecting additional examples).) And other provisions distinguish malpractice from other types of claims. For example, to qualify as a PHS entity, a center must implement policies “to reduce the risk of malpractice and the risk of lawsuits arising out of any health or health-related functions performed by the entity.” Id. § 233(h)(1) (emphasis added). Those provisions demonstrate Congress’s familiarity with “malpractice” and underscore § 233(a)’s broader language. The Government, aware of Cuoco, reframes § 233(a)’s purpose as generally directed towards “misfeasance” in the provision of healthcare. (Govt. Mem. 11.) In other words, § 233(a) can still be limited to medical negligence, even if it covers more than just malpractice. But there is no textual basis for this argument, either. Section 233(a) applies to claims “for

personal injury, including death, resulting from the performance of medical . . . or related functions”; it does not apply only to claims of medical negligence resulting from the same conduct. Indeed, Congress used almost that exact language in a different subsection about PHS employees on foreign assignment: The Secretary or his designee may . . . hold harmless or provide liability insurance for any officer or employee of the Public Health Service for damage for personal injury, including death, negligently caused by such officer or employee while acting within the scope of his office or employment and as a result of the performance of medical, surgical, dental, or related functions, including the conduct of clinical studies or investigations, if such employee is assigned to a foreign country . . . and if the circumstances are such as are likely to preclude the remedies of third persons against the United States . . . . 42 U.S.C. § 233(f). Congress’ choice not to include such specific language in § 233(a) reinforces its plain, broad meaning: to bar “all actions” against PHS entities “arising out of the performance of medical or related functions,” not just negligence actions. See Hui, 559 U.S. at 806.

Further, the Government contends § 233(a) should be narrowly construed because it waives sovereign immunity. (Govt. Mem. 10 (citing Department of Army v. Blue Fox, Inc., 525 U.S. 255, 261 (1999)). But that is incorrect. While the FTCA waives sovereign immunity, § 233(a) simply makes the FTCA the “exclusive remedy” for certain injuries caused by PHS employees. See Hui, 559 U.S. at 806; see also Cuoco (“Section 233(a) makes the Federal Tort Claims Act the exclusive remedy for specified actions against members of the Public Health Service[.]”). The scope of the FTCA—and the scope of the United States’ waiver—is a separate question which § 233 says nothing about. Cf. United States v. Smith, 499 U.S. 160, 162 (1991) (holding absolute immunity for Government employees applies even where the FTCA precludes a plaintiff’s suit).

Accordingly, the Court will consider whether the conduct alleged bears an established relationship to the practice of treating or diagnosing patients. The Court notes that its interpretation—in addition to being faithful to the text—is in line with a significant number of courts outside this district, which have applied § 233(a) to functions “interwoven” with, but district from, “direct medical care.” See Goss v. United States, 353 F. Supp. 3d 878, 886 (D. Ariz. 2018); see also C. K. v. United States, No. 19-CV-2492, 2020 WL 6684921, at *6 (S.D. Cal. Nov. 12, 2020) (rejecting argument that “related functions” must be “somehow related to a direct relationship between a health care provider and a patient” (quotation marks omitted)); Kezer v. Penobscot Cmty. Health Ctr., No. 15-CV-225, Dkt. No. 184, at 17 (D. Me. Mar. 21, 2019) (adopting report and recommendation) (finding § 233(a) immunity where health center employees gained unauthorized access to confidential counseling records); Teresa T., 154 F. Supp. 2d at 300 (holding a doctor’s duty to report suspected child abuse was a “related function” because it was “inextricably woven into his performance of medical functions”).12

b. Application The Court next considers whether the conduct alleged is a medical or related function— i.e. whether it bears an established relationship to the practice of medicine. Other courts applying similar tests have identified a few key features of such relationships. Some cases focus on whether a given function “is imposed on doctors acting in their professional capacity,” or whether it is a “required element” of evaluating a patient. See Teresa T., 154 F. Supp. 2d at 300 (holding a doctor’s “duty to report[] suspected abuse” of his patient was a related function); see also Brignac v. United States, 239 F. Supp. 3d 1367, 1377 (N.D. Ga. 2017) (holding a defendant health center immune from a negligent hiring claim because, “to become a deemed entity in the first place,” 42 U.S.C. § 233(h) required the center to vet physicians and thus “[could] be viewed as adding a required element to the provision of

medical care” (quotation marks omitted) (alterations adopted)). And others focus on what is “necessary to effectively treat patients.” See Doe, 2022 WL 17663520, at *7 (explaining the importance of “maintaining confidential personal and health information”). The Court finds both factors to be useful indicators.

12 In reply, RHC makes arguments about the distinction between the scope of § 233(a) immunity and the scope of FTCA liability. (Def’s Reply. 4–5.) It is unclear exactly what this point has to do with the Motion, but the Court notes, as the Supreme Court has held, that official immunity can apply even where the FTCA “precludes recovery against the government.” Smith, 499 U.S. at 165 (analyzing a similar exclusive remedy provision for military medical personnel). Although this fact pattern is an issue of first impression in this District, similar factors have led other courts to apply § 233(a) immunity in analogous cases involving data breaches at health centers. For instance, the Southern District of California in Doe held that the “proper storage and security” of confidential data was a “function related to medical care.” Doe, 2022

WL 17663520, at *6. It explained that “long-standing principles” established that the privacy of health information was “critical to the delivery of needed medical care.” Id. at *7 (quotation marks and citation omitted). Important, too, was the fact that the defendant health center was “statutorily mandated to preserve and store the requisite information.” Id. at *6. For that proposition, Doe relied on Mixon and Ford, two District of South Carolina cases decided by Chief Judge Harwell. As those cases recognize, “[t]o be eligible for deemed status,” health centers must show that they “will have an ongoing quality improvement system that includes clinical services and management, and that maintains the confidentiality of patient records.” Ford, 2022 WL 1810614, at *5 (emphasis in original) (quoting 42 U.S.C. § 254b(k)(3)(C)); Mixon, 2022 WL 1810615, at *4 (same); see also Kezer, No. 15-CV-225, Dkt. No. 184 at 17

(“[Q]uality improvement and quality assurance activities are patently related to the provision of medical services. Indeed, the whole point is to review the quality of previously rendered services to improve the quality of future services.”). The Court finds those factors to be an effective way to examine established relationships, and one that comports with the Second Circuit’s decision in Cuoco. First, a function must be required in a center’s capacity as a health services provider. See Cuoco, 222 F.3d at 109 (noting the complained-of function “occurred entirely in [the defendant’s] capacity as a doctor”). Of course, deemed status is not sufficient and does not “alone render [an entity] immune from suit.” See id. Second, the function must also be necessary to effective medical care. There may be functions outside those parameters that satisfy § 233(a) but if a given duty satisfies both conditions, the Court is confident that it falls within the statute’s scope. Both considerations warrant coverage here. First, “RHC must keep patient records safe as required by federal statute.” See Krandle, 2023 WL 2662811, at *11. And that duty—

whether it is referred to as “confidentiality” or “privacy”—encompasses both protections against unauthorized disclosure and unauthorized access by third parties. Indeed, to obtain deemed status, RHC had to demonstrate that it had a “system” to “maintain[] the confidentiality of patient records.” 42 U.S.C. § 254b(k)(3)(C); see also id. § 233(g)(1), (4) (providing that, to obtain deemed status, a health center must be a “public or non-profit entity receiving Federal funds under section 254b”).13 Further, RHC must comply with HIPAA and its associated privacy rules, which drive home the need to protect against external threats. See id. § 1320d-1 (stating HIPAA standards apply to “health care provider[s] who transmit[] health information in electronic form”); id. §§ 1395x(s)(E), (aa) (defining covered health care provider to include “Federally qualified health center[s]”). (See, e.g., Def’s Supp. Mem. 1–2; accord Govt. Supp.

Mem. 8.) Those rules ask RHC to “safeguard protected health information from any intentional or unintentional use or disclosure,” 45 C.F.R. § 164.530(c)(2)(i) (emphasis added), and “[p]rotect against any reasonably anticipated threats or hazards to the security or integrity of such information.” Id. § 164.306(a)(2).14 In implementing those rules, the Secretary made clear that

13 The Government acknowledges that a breach of patient confidences “may, under some circumstances, result from the performance of a medical function within the meaning of 42 U.S.C. § 233(a).” (Govt. Supp. Mem. 2–3.)

14 Some of these requirements come from the HHS “Security Rule,” which provides standards for the security and integrity of electronic health information. See Health Insurance Reform: Security Standards, 68 Fed. Reg. 8334 (Feb. 20, 2003) (codified at 45 C.F.R. pts. 160, 164). unauthorized disclosures “c[ould] occur deliberately or accidently” and could arise both “within an organization or be the result of an external breach of security.” Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”), 65 Fed. Reg. 82462, 82467 (Dec. 28, 2000). That panoply of regulations demonstrates that RHC has a particular responsibility to

secure data from internal and external threats in its capacity as a deemed entity. Second, that function is essential to the practice of medicine. Indeed, “[t]he need for privacy of health information, in particular, has long been recognized as critical to the delivery of needed medical care” because it implicates the keystone of the doctor-patient relationship: “trust.” See Privacy Rule, 65 Fed. Reg. at 82467. Accurate diagnoses depend on “accurate, detailed information about [] personal health, behavior, and other aspects” of a patient’s life. Id. That same information assists “in the development of a treatment plan,” and without it, “there is a serious risk” that treatment will be “inappropriate to the patient’s situation.” Id.; see also Doe, 2022 WL 17663520, at *7 (recognizing privacy is “necessary to effectively treat patients”). What is more, from the patient’s perspective, it does not matter if the breach is internal or

external because “the harm to the individual is the same.” See Privacy Rule, 65 Fed. Reg. at 82467. These privacy concerns have other practical consequences, as well. As the Department of Health and Human Services recently reported, the significant increase in breaches in the past few years, has “led to extended care disruptions . . .[,] patient diversions to other facilities[,] . . . nonrendered services, and delayed medical procedures.” Dep’t of Health and Hum. Servs., Healthcare Sector Cyber Security, 1 (Dec. 6, 2023). Plaintiffs and the Government disagree, relying heavily on Marshall, a recent District of Vermont case involving a data breach that reached the opposite conclusion. (See Govt. Mem. 16 –17; Krandle Mem. 8–9; Krandle Supp. Mem. 4.) Marshall recognized that several cases applied § 233(a) to tasks “interwoven” with treatment but held that data security encompassed “technology-related activities” far afield from “the provision of medical care.” Marshall, 2023 WL 2931823, at *5. In its view, all the interwovedness cases involved some sort of “direct[]” connection to the “provision of medical care.” Id. at *4. And it distinguished other cases

involving confidentiality because “the data in question was part of a broad data breach, was not released . . . in the course of treatment, and was not shared to further such treatment.” Id. The court was also concerned that the complaint primarily alleged a “failure to adhere to [] industry best practices,” as opposed to duties connected to medical care. Id. As explained above, however, the Court does not interpret § 233(a) to require a direct connection to the course of medical treatment received by a plaintiff. See supra § II.B.1.a. Beyond that, the fact that a function can be labeled something besides “medical” does not preclude it from being “related.” Indeed, “[t]he statute must cover a broader scope of activity than the delineated categories alone, or else ‘related functions’ would be mere superfluity.” See Pomeroy, 2018 WL 1093501, at *2 (citing, inter alia, TRW Inc. v. Andrews, 534 U.S. 19, 31

(2001) (“[A] statute ought . . . to be so construed that . . . no clause, sentence, or word shall be superfluous, void, or insignificant.” (quotation marks omitted))). Nor must the related function be performed by a physician. Nothing in the text requires that, see supra § II.B.1.a., and as multiple courts have recognized, administrative staff can have a significant effect on treatment, too. See Pomeroy, 2018 WL 1093501, at *1, 3 (holding health center immune for negligent food service by nursing staff and rejecting argument that “food service does not fall under any of the[] [enumerated] categories”); Robinson v. Kibbs et al., No. 16-CV-3826 , 2017 WL 3578700, at *4 (holding same for claim against physician’s assistant); De La Cruz v. Graber, No. 16-CV-1294, 2017 WL 4277129, at *4 (C.D. Cal. June 15, 2017) (applying 233(a) to medical administrator), report and recommendation adopted, 2017 WL 4271122 (C.D. Cal. Sept. 21, 2017). What matters instead is the substantive connection between those functions, which Defendant has aptly demonstrated. Putting the shoe on the other foot, Plaintiffs and the Government rely on arguments about § 233(a)’s scope, but they do little to explain why privacy is not closely

connected to effective care. The Government counters that not everything strictly “necessary” to effective care can be a related function. (Govt. Mem. 14, 19.) If so, it says, § 233(a) would reach things like removing snow from sidewalks. (See id. at 14.) But § 233(a) builds in a few key limitations. For instance, the duty to keep premises safe is not required in RHC’s capacity as a community health center—it applies to property owners generally. See Silvestri v. Kohl’s Dep’t Stores, Inc., No. 19-CV-10550, 2022 WL 2971988, at *4 (S.D.N.Y. July 27, 2022) (discussing a landowner’s “duty to maintain the premises in a reasonably safe condition” (quoting Borley v. United States, 22 F.4th 75, 82 (2d Cir. 2021) (emphasis and quotation marks omitted)). The same is not true of confidentiality. If someone blurts out sensitive medical information while ordering food at a

restaurant, the server need not safeguard that information. Cf. In re Mid-Island Hosp., Inc., 276 F.3d 123, 130 (2d Cir. 2002) (“[W]hen parties deal at arms length in a commercial transaction, no relation of confidence or trust sufficient to find the existence of a fiduciary relationship will arise absent extraordinary circumstances.”). But RHC, by virtue of being a PHS entity and healthcare service provider, takes on certain confidentiality, privacy, and security duties unique to such businesses. See, e.g., 42 U.S.C. § 1320d-1. And even if something is theoretically necessary to care, it must also bear an established relationship to care. Courts have thus declined to extend § 233(a) to “employment disputes” between PHS entities and employees. See Cuoco, 222 F.3d at 108 (characterizing the First Circuit’s decision in Mendez as holding a racial discrimination claim “had nothing to do with the performance of medical or related functions” (quotation marks omitted) (citing Mendez, 739 F.2d at 19)); see also Logan v. St. Charles Health Council, Inc., No. 06-CV-39, 2006 WL 1149214, at *3 (W.D. Va. May 1, 2006) (“[W]hile § 233(a) is not expressly limited to malpractice actions . . .

Congress did not intend the statute to extend to employment disputes . . . .”). And the Court can imagine similar scenarios where functions are unrelated because they are too remote from medical practice or do not involve patients at all. The Court addresses one final point. The Government briefly contends that granting RHC immunity would expose the United States to significant liability. (See, e.g., Govt. Mem. 15 (arguing RHC’s interpretation “would make the United States liable when a grant recipient violated any precondition for receiving the grant”).) But that overstates the stakes here. Holding that immunity applies just means that the FTCA is the “exclusive remedy” for Plaintiffs’ claims. The FTCA, itself, controls the scope of liability. And, on that front, Plaintiffs may face an uphill battle at later phases of this case. See Liranzo v. United States, 690 F.3d 78, 86 (2d Cir. 2012)

(“[T]he FTCA directs courts to consult state law to determine whether the government is liable for the torts of its employees.”); cf. In re Canon U.S.A. Data Breach Litig., No. 20-CV-6239, 2022 WL 22248656, at *11 (E.D.N.Y. Mar. 15, 2022) (“New York courts do not ‘recognize a breach of confidence claim brought by an employee for a third party’s theft of her PII’” (alteration adopted) (quoting In re Waste Mgmt. Data Breach Litig., No. 21-CV-6147, 2022 WL 561734, at *3 (S.D.N.Y. Feb. 24, 2022))). Although the liablity question must be reserved, the Court notes that its reading of § 233(a)—which follows the text—will not unduly burden the federal fisc. And, of course, any risk to the Treasury can be addressed by Congress. The Court therefore finds that § 233(a) applies to the conduct alleged in the two instant Actions. 2. Substitution Assuming immunity applies, the Government also argues that no statute authorizes its substitution as a party. (Govt. Mem. 19–23.) Its specific argument is that Congress must

expressly authorize substitution by courts, something it failed to do in § 233(a), as confirmed by the enactment of the Westfall Act. The issue largely revolves around something called “scope certification.” The FTCA, as amended by the Westfall Act, expressly provides for substitution of the United States as a defendant where the Attorney General certifies that an employee “was acting within the scope of his office or employment.” 28 U.S.C. § 2679(d)(1); Hui, 559 U.S. at 810 (“Under the FTCA, ‘certification by the Attorney General that the defendant employee was acting within the scope of his office or employment at the time of the incident out of which the claim arose’ transforms an action against an individual federal employee into one against the United States.” (quoting § 2679(d)(1))). If the Attorney General declines issue such a certification, a defendant employee

can “petition the court” to make a scope-of-employment finding, which operates to substitute the United States “as the party defendant.” 28 U.S.C. § 2679(d)(3). Also relevant is that 28 U.S.C. § 2679(d) postdated § 233(a) by roughly two decades. See Hui, 559 U.S. at 810. Because § 233(a) does not contain an express substitution provision, the Government contends that Defendant must rely on § 2679(d)’s procedures to substitute the United States as a party. But the Supreme Court rejected almost the exact same argument in Hui. To be clear, Hui considered a slightly different question—whether scope certification was required to invoke § 233(a) immunity—but its reasoning is equally applicable. Hui explained that § 2679(d), enacted two decades after § 233(a), simply “provide[d] a convenient mechanism for establishing that the alleged misconduct occurred within the scope of the employee’s duties.” 559 U.S. at 811. It did not somehow supplant § 233(a) or make scope-certification “the exclusive means for PHS personnel to invoke the official immunity.” Id. And Hui stated, more generally, that “the procedure authorized by § 2679(d) is not necessary to effect substitution of the United States.”

Id. The clear import of this statement is that § 2679(d) does not bar substitution and that courts “if necessary” may order substitution to give effect to § 233(a). See, e.g., C. K., 2020 WL 6684921, at *4 (finding “Hui to be controlling” as to a court’s ability to substitute the United States). Other aspects of § 233(a) and § 2679(d) reinforce this conclusion. When it mentions substitution § 2679(d) does not say that a court may order substitution, it simply says that “the United States shall be substituted as the party defendant.” Section 233(b)—which again was enacted well before § 2679(d)—contains strikingly similar language, providing that the “Attorney General shall defend any civil action or proceeding . . . against any person referred to in [233](a).” Id. (emphasis added); see also C. K., 2020 WL 6684921, at *4 (citing § 233(b)). If

the former is sufficient to confer substitution authority, they latter should be as well. Section 233(l)(2) also provides, in certain circumstances, that courts may conduct hearings about “the appropriate forum or procedure for the assertion” of claims against PHS entities.15 Based on that language, courts have concluded that § 233 must provide some “limited jurisdictional authority”

15 Section 233(l)(2) allows for removal of a state court action against a PHS employee or entity, and for a hearing to determine “the appropriate forum or procedure” for the claim, if the Attorney General fails to appear in state court fifteen days after the action commenced. Id. § 233(l)(1)–(2). As the Government notes, § 233(l)(2) does not apply here because the RHC attempted to remove prematurely, before the Attorney General had a chance to appear. See Krandle, 2023 WL 2662811, at *4–8; id. at *11 (concluding instead that RHC properly removed both Actions under 28 U.S.C. § 1442(a)). The Court simply references § 233(l) as a part of the larger statutory analysis. to order substitution where necessary to give effect to § 233(a). See Kezer, No. 15-CV-225, Dkt. No. 184, at 17; see also Est. of Campbell by Campbell v. S. Jersey Med. Ctr., 732 F. App’x 113, 117 (3d Cir. 2018) (“For section 233(l)(2) to have any effect, a district court must at least have jurisdiction to substitute the United States when it is appropriate to do so.”). The Court finds that

reasoning persuasive. Indeed, § 233 would not make much sense without that authority. If an entity can invoke immunity without certification, see Hui, 559 U.S. at 811, and have an action dismissed as to them, who is left to ensure that the United States “shall defend” the action? Unless plaintiffs are to be left in limbo, the answer must be the Court. The Government’s contrary arguments fail to persuade. First, it says the similarly worded Drivers Act, which predated § 233, did not allow for substitution. See Levin v. United States, 568 U.S. 503, 508 n.2 (2013) (explaining that the Drivers Act made the FTCA the “exclusive remedy” for personal injuries resulting from federal employee operation of motor vehicles in the scope of their employment). Despite asserting that courts “universally held” that to be true, none of the Government’s cases appears to support its “no substitution” proposition.

(See Govt. Mem. 20–21.) Instead, these cases all say that Attorney General certification is not required for a defendant to assert immunity. See Lemley v. Mitchell, 304 F. Supp. 1271, 1273 (D.D.C 1969) (“Congress did not contemplate . . . that there must be a certification by the Attorney General before one acting within the scope of government employment may become immune from suit.”); Sangeminio v. Zuckerberg, 454 F. Supp. 206, 208 (E.D.N.Y. 1978) (“[T]he failure (or even refusal) of the Attorney General to supply an appropriate certification will not preclude a defendant driver from invoking the personal immunity.”); cf. Seiden v. United States, 537 F.2d 867, 869 (6th Cir. 1976) (“[D]enial of mandamus does not prevent the government employee from attempting to establish in the state court where he has been sued that he was in fact within the scope of his employment.”) As the Court explained above, the premise that certification is not required to invoke immunity, supports the idea that certification is not required for substitution, either. Second, the Government distinguishes Hui because the Supreme Court did not address

whether courts have the power to substitute under § 233(a). (Govt. Mem. 22.) Viewed narrowly, that is true—the authority-to-substitute question was not before the Court. Nevertheless, the statement that certification is not “necessary” for substitution clearly implies that there are other, sufficient mechanisms to do so. Hui does not say what those mechanisms are. But the, rather obvious, implication is that one such mechanism is a court order. See Kezer, No. 15-CV-225, Dkt. No. 184, at 17 (recognizing a court’s limited jurisdictional authority to order substitution); Est. of Campbell by Campbell, 732 F. App’x at 117 (same).16 Accordingly, the Court concludes that it is appropriate to substitute the United States as a Defendant. In so doing, it joins many other courts around the country that “repeatedly have rejected” this same argument. See Moretti v. Letty Owings Ctr., No. 21-CV-1525, 2023 WL 6216279, at *5 (D. Or.

Sept. 25, 2023); see also C.K., 2020 WL 6684921, at *4 (holding that courts have authority to

16 There is no due process problem here. (See Govt. Mem. 22.) To the extent due process protections even apply, see In re Trans Texas Holdings Corp., 498 F.3d 1290, 1297 n.6 (Fed. Cir. 2007) (“[T]he Due Process Clause of the Fifth Amendment does not apply to the government[.]” (citing South Carolina v. Katzenbach, 383 U.S. 301, 323–24 (1966) (“The word ‘person’ in the context of the Due Process Clause of the Fifth Amendment cannot . . . be expanded to encompass the States of the Union))), the United States has been afforded ample notice and opportunity to present its objections, (see generally Dkt.), and it offers no argument why an oral hearing is required, in place of extensive written submissions, see Greene v. WCI Holdings Corp., 136 F.3d 313, 316 (2d Cir. 1998) (stating “the right of oral argument as a matter of procedural due process varies from case to case in accordance with differing circumstances, as do other procedural regulations” and collecting cases holding that the “‘hearing’ requirements of Rule 12 and Rule 56 do not mean that an oral hearing is necessary”). order substitution); Ford, 2022 WL 1810614, at *4 (same); Kezer, No. 15-CV-225, Dkt. No. 184, at 17 (same). III. Conclusion For the reasons stated above, the Court grants Defendant’s Motion. Accordingly, it orders the substitution of the United States as the Party-Defendant. If RHC has not yet served

the Attorney General in accordance with 42 U.S.C. § 233(b), it shall do so within 30 days of this Opinion and Order. The Clerk of Court is respectfully directed to terminate the pending motion flags, (Dkt. No. 50, 22-CV-4977 Dkt.; Dkt. No. 43, 22-CV-5039 Dkt.). SO ORDERED.

Dated: March 12, 2024 White Plains, New York KENNETH M. KARAS United States District Judge