Mark Jessie Ramirez, individually, and on behalf of all others similarly situated v. Imperial Beach Community Clinic

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 MARK JESSIE RAMIREZ, individually, Case No.: 3:26-cv-1326-CAB-JLB and on behalf of all others similarly 12 situated, ORDER GRANTING MOTION TO 13 REMAND Plaintiff,

14 v. [Doc. No. 6] 15 IMPERIAL BEACH COMMUNITY 16 CLINIC, 17 Defendant. 18 19 Before the Court is Plaintiff Mark Jessie Ramirez’s (“Plaintiff”) motion to remand 20 this action to state court. [Doc. No. 6.] The motion has been fully briefed, and the Court 21 finds it suitable for determination on the papers. See CivLR 7.1(d)(1). This case is one 22 of four related cases before the Court.1 Also before the Court is a joint motion requesting 23 a status conference which includes a stipulation that the parties in the related cases will 24 25

26 1 See Cynthia Maldonado, et al. v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01312 (S.D. Cal. 27 March 2, 2026); Donna Mack v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01371 (S.D. Cal. March 4, 2026); Rasiel Pena v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01594 (S.D. Cal. March 28 1 abide by the Court’s decision in the case before the Court. [Doc. No. 14.] For the reasons 2 set forth below, the motion to remand is GRANTED. 3 I. BACKGROUND 4 On January 12, 2026, Plaintiff filed a putative class action complaint against 5 Defendant in the Superior Court of the State of California for the County of San Diego 6 asserting claims for: (1) negligence; (2) breach of implied contract; (3) breach of the 7 implied covenant of good faith and fair dealing; (4) violations of the California 8 Confidentiality of Medical Information Act; and (5) violations of the California Unfair 9 Competition Law, Business and Professions Code. [See generally Doc. No. 1-2 10 (“Complaint”).] Plaintiff alleges that Defendant, a healthcare services provider, failed to 11 properly safeguard its patients’ personal information stored in its information network. 12 On March 2, 2026, Defendant removed this action to this Court based on removal 13 jurisdiction under 42 U.S.C. § 233(l)(2) or 28 U.S.C. § 1442(a)(1). [Doc. No. 1.] 42 14 U.S.C. § 233 provides federal immunity to certain healthcare providers for damages 15 resulting from their performance of “medical, surgical, dental, or related functions.” 28 16 U.S.C. § 1442(a)(1) allows for the removal to federal court of “[a] civil action or criminal 17 prosecution” against “[t]he United States or any agency thereof or any officer (or any 18 person acting under that officer) of the United States.” 19 On April 1, 2026, Plaintiff filed a motion to remand, contesting that Defendant’s 20 failure to safeguard its patients’ personal information does not fall within the scope of 21 claims for which Defendant could be immune from pursuant to 42 U.S.C. § 233(a). [Doc. 22 No 6-1 at 9–18.] Additionally, Plaintiff argues that § 1442(a)(1) does not apply here 23 because the relevant actions were not taken pursuant to a federal officer’s directions. [Id. 24 at 18–20.] 25 II. LEGAL STANDARD 26 Only state court actions that could originally have been filed in federal court may 27 be removed. 28 U.S.C. § 1441(a); Caterpillar, Inc. v. Williams, 482 U.S. 386, 392 (1987). 28 The proper procedural vehicle for challenging removal is a motion to remand. See 28 1 U.S.C. § 1447(c). The Ninth Circuit “strictly construe[s] the removal statute against 2 removal jurisdiction.” Gaus v. Miles, Inc., 980 F.2d 564, 566 (9th Cir. 1992). The 3 removing party generally bears the burden of establishing federal jurisdiction and that 4 removal is proper. See id. at 566; Emrich v. Touche Ross & Co., 846 F.2d 1190, 1195 (9th 5 Cir. 1988) (citing Wilson v. Republic Iron & Steel Co., 257 U.S. 92, 97 (1921)). 6 III. DISCUSSION 7 A. Removal Under Section 233 was Improper 8 The United States “is immune from suit save as it consents to be sued . . . and the 9 terms of its consent to be sued in any court define that court’s jurisdiction to entertain the 10 suit.” Lehman v. Nakshian, 453 U.S. 156, 160 (1981) (internal quotation marks omitted). 11 The Federal Tort Claims Act (“FTCA”) “provides a limited waiver of the sovereign 12 immunity of the United States for torts committed by federal employees acting within the 13 scope of their employment.” Nurse v. United States, 226 F.3d 996, 1000 (9th Cir. 2000). 14 The Federally Supported Health Centers Assistance Act (“FSHCAA”) provides that 15 the exclusive remedy for damages resulting from the performance of medical functions by 16 employees of the U.S. Public Health Service acting within the scope of their employment 17 is a claim against the United States under the FTCA. See 42 U.S.C. § 233(g); D.L. by & 18 through Junio v. Vassilev, 858 F.3d 1242, 1244 (9th Cir. 2017). In particular, § 233(a) 19 immunizes claims for “personal injury, including death, resulting from the performance 20 of medical, surgical, dental, or related functions” by any “employee of the Public Health 21 Service while acting within the scope of his office or employment.” When immunity 22 under § 233(a) applies, the United States is substituted as the defendant and the action 23 proceeds as one brought under the FTCA. Friedenberg v. Lane Cnty., 68 F.4th 1113, 1118 24 (9th Cir. 2023). 25 The FTCA’s applicability is not automatic. Rather, U.S. Attorneys—in accordance 26 with the Attorney General’s delegation of such duties—evaluate when a lawsuit’s alleged 27 actions or omissions trigger the FTCA’s coverage. 42 U.S.C. § 233(c). If a healthcare 28 provider is sued in state court, there are two avenues for the case’s removal to federal 1 court: (1) the Attorney General can remove the case after certifying the defendant “is 2 deemed to be an employee of the Public Health Service for purposes of this section with 3 respect to the actions or omissions that are the subject of such civil action or proceeding”; 4 or (2) the healthcare provider can remove the case on its own if the Attorney General fails 5 to appear within 15 days of receiving notice of the case. See id. at §§ 233(l)(1)–(2). Once 6 a case is removed to federal court, however, remand may still be appropriate under 42 7 U.S.C. § 233(c) if a district court “determine[s] on a hearing on a motion to remand held 8 before a trial on the merit that the case so removed is one in which a remedy by suit within 9 the meaning of [42 U.S.C. § 233(a)] is not available against the United States . . . [.]” 10 Here, the parties dispute whether this case falls within the immunity provision of 11 42 U.S.C. § 233(a). In particular, Plaintiff argues the immunity conferred by § 233(a) is 12 limited to damages “resulting from the performance of medical, surgical, dental, or related 13 functions.” [Doc. No. 6 at 12.] Plaintiff contends the scope of this immunity does not 14 extend to the injuries alleged here, which stem from Defendant’s failure to properly 15 safeguard its patients’ personal information stored in Defendant’s information network. 16 [Doc. No. 6 at 12–16.] Defendant counters that Plaintiff’s claims arise out of Defendant’s 17 provision of healthcare services because “the acquisition, storage, protection, retrieval, 18 and review of [Personal Identifying Information] and [Personal Health Information] is 19 intrinsically related to the provisioning of medical care.” [Doc. No. 11 at 12.] Defendant 20 argues that “confidentiality requirements are ‘interwoven’ with the provision of medical 21 services” and the lawsuit is a “related function[.]” [Id. at 9.] 22 The Court finds that Defendant’s electronic storage of Plaintiff’s personal 23 information and medical data was not a “medical, surgical, dental, or related function[ ]” 24 within the meaning of 42 U.S.C. § 233(a). At its core, the storage of patients’ personal 25 identifying information is not a medical, surgical, or dental function. Therefore, to fall 26 within the purview of § 233(a), it must be a “related” function. Although the Ninth Circuit 27 has not precisely defined a “related function,” it has explained that for a lawsuit to fall 28 “within the ambit of § 233,” the legal duty allegedly violated must be “tied to [the 1 defendants’] status as medical health professionals,” and the defendants’ allegedly 2 wrongful conduct must have a “distinct connection to the provision of [health care.]” 3 Friedenberg, 68 F.4th at 1130. Plaintiff’s claims against Defendant do not satisfy either 4 requirement, as they neither turn on Defendant’s status as a health care provider, nor have 5 a distinct connection to the provision of healthcare. 6 To be sure, the injuries are “related” to the provision of medical treatment in a broad 7 sense—the data is collected in the course of providing medical services. And as Defendant 8 points out, it has a statutory duty to “maintain[ ] the confidentiality of patient records.” 42 9 U.S.C. § 254b(k)(3)(C). The Friedenberg court noted that a duty that is “imposed on 10 doctors acting within their professional capacity” is typically “related” to medical services 11 for the purposes of § 233(a). Friedenberg, 68 F.4th at 1129–30. But not everything that 12 is “related” to the provision of medical treatment in a broad sense is “related” in the 13 manner that § 233(a) requires. For example, a medical center might have a duty to keep 14 its building up to code or to maintain certain standards of cleanliness, but that does not 15 mean that the performance of construction or janitorial services arises out of the 16 performance of medical or related functions. Further, there is a difference between 17 medical professionals’ maintenance of confidentiality in their practice and data security 18 professionals’ maintenance of confidentiality through technological safeguards. The duty 19 to maintain the security of stored data is therefore not “intertwined” with medical 20 treatment. Contrast with Friedenberg, 68 F.4th at 1129 (finding that defendants’ failure 21 to report a patient’s repeated failures to comply with his court-ordered mental health 22 treatment plan was “intertwined” with the provision of medical services). 23 This Court’s understanding of § 233 is in line with the holdings of other circuits in 24 substantively identical circumstances. In Ford v. Sandhills Medical Foundation, Inc., the 25 Fourth Circuit recently examined the meaning of “related functions” in § 233 and held 26 that it did not cover data breaches. 97 F.4th 252, 260 (4th Cir. 2024) (“[the term] ‘related 27 functions’ explicitly encompasses only the provision of health care.”). The court further 28 observed that § 233 provides for immunity “solely for claims ‘for damage for personal 1 injury, including death’” and that “[m]isfeasance in the provision of health care would 2 most likely lead to personal injury or death[,]” confirming that a “wider definition of 3 ‘related functions’ may improperly broaden § 233(a) to encompass misfeasance that 4 results in other types of damages, such as contract damages.” Id. 5 The Eighth Circuit reached the same conclusion. In Hale v. ARcare, Inc, the Eighth 6 Circuit held that that the term “related functions” in § 233(a) refers to “a field of health 7 care outside of medicine, surgery, or dentistry.” 167 F.4th 995, 1001 (8th Cir. 2026). The 8 court also acknowledged that the injuries stemming from data breaches are “related” to 9 the provision of medical treatment in a broad sense, but similarly decided that § 233(a) 10 does not cover the injuries from a data breach. Id. at 1001–02 (“Although data security is 11 now integrated into the modern practice of medicine with the transition to electronic 12 medical records, it is not itself a field of health care.”). 13 The Court concludes that the claims for the alleged data breach do not arise out of 14 the performance of medical, surgical, dental, or related functions that fall within the ambit 15 of § 233(a). Accordingly, the Court holds that Defendant’s conduct does not fall within 16 the immunity provisions of 42 U.S.C. § 233(a), and Defendant cannot assert federal 17 subject matter jurisdiction on this basis. As such, the Court declines to reach the issue of 18 whether Defendant had a removal right based on Defendant’s alleged failure to timely 19 provide notice to the Attorney General. 20 B. Removal Under 1442(a)(1) was Improper 21 Defendant also relies on the general federal officer removal statute found in 28 22 U.S.C. § 1442(a)(1) for removal jurisdiction. Section 1442(a)(1) permits removal of 23 actions initially brought in state court against “any officer (or any person acting under that 24 officer) of the United States or of any agency thereof . . . for or relating to any act under 25 color of such office.” Plaintiff argues that § 1442(a)(1) does not provide a basis for 26 removal because Defendant was not a person acting under a United States officer under 27 § 1441(a)(1). 28 1 To satisfy the general federal officer removal statute, “a removing entity must 2 establish that: (a) it is a person within the meaning of the statute; (b) there is a causal nexus 3 between its actions, taken pursuant to a federal officer’s directions, and the plaintiff’s 4 claims; and (c) it can assert a colorable federal defense.” Doe v. Cedars-Sinai Health Sys., 5 106 F.4th 907, 913 (9th Cir. 2024) (cleaned up). While federal officer removal must be 6 “liberally construed,” it is “not limitless.” Id. Federal courts must avoid “bringing within 7 its scope state-court actions filed against private firms in many highly regulated 8 industries.” Id. (quoting Cnty. of San Mateo v. Chevron Corp., 32 F.4th 733, 757 (9th Cir. 9 2022)). 10 Here, two elements of § 1442 are deficient. First, and most simply, Defendant 11 cannot assert a “colorable federal defense.” Mesa v. California, 489 U.S. 121, 129 (1989). 12 Section 233 immunity is the only federal defense that Defendant raises, and that defense 13 is not colorable for the reasons explained above—namely, because § 233(a) immunity 14 does not extend to the data breach claims asserted in the Complaint. That alone is reason 15 enough to reject the § 1442 removal. See Lockhart, 2025 WL 1161464, at *9 (rejecting 16 § 1442 as a ground for removal where § 233 immunity did not apply because defendant 17 raised no colorable federal defense). 18 Second, Defendant’s data-storing activities were not “taken pursuant to a federal 19 officer’s directions[.]” Cedars-Sinai, 106 F.4th at 913. To satisfy § 1442’s “causal nexus” 20 requirement, a defendant “must demonstrate that it was acting under a federal officer in 21 performing some act under color of federal office, i.e., that it was involved in an effort to 22 assist, or to help carry out, the duties or tasks of the federal superior.” Id. (internal 23 quotation marks and italics omitted). Factors the Court considers in making this 24 determination include: (1) whether the person is acting on behalf of the government in a 25 manner akin to an agency relationship, (2) whether the person is subject to the 26 government’s close direction, (3) whether the private person is assisting the government 27 in fulfilling “basic governmental tasks” that the government “itself would have had to 28 perform” if it had not contracted with the private person, and (4) whether the private 1 person’s activity is so closely related to the government’s implementation of its federal 2 duties that the private person faces a “significant risk of ‘state-court prejudice,’” as the 3 government itself would face. Id. at 914. 4 Managing a network storing medical patients’ data does not satisfy this test. In 5 arguing for the opposite conclusion, Defendant relies on Agyin v. Razmzan, 986 F.3d 168 6 (2nd Cir. 2021). But Agyin involved a medical malpractice suit related to the delivery of 7 a low-income patient’s stillborn child. Id. at 171. That is distinct from the performance 8 of cybersecurity and other technological functions by medical centers. In Doe v. Cedars- 9 Sinai Health Systems, the Ninth Circuit concluded that a federally supported health 10 center’s building of a patient portal and website with tracking technology was not a basic 11 governmental task. 106 F.4th at 916. The Circuit acknowledged that building the portal 12 and website might well “advance the government’s policy by operating a patient portal 13 that meets certain objectives and measures.” Id. at 917. But that is not enough to make 14 the conduct a basic governmental task; the applicable governmental regulations vested 15 “considerable discretion” in the health center and did not require the health center “to build 16 a specific type of website or patient portal,” nor did they implement the “requisite federal 17 control or supervision.” Id. 18 Undeniably, as a federally supported health center, Defendant has a statutory duty 19 to maintain the confidentiality of patient data. 42 U.S.C. § 254b(k)(3)(C). But “[m]erely 20 complying with federal laws, policies or regulations,” without more, “does not constitute 21 ‘acting under’ a federal official for the purposes of federal officer removal.” Nevada v. 22 Optum, Inc., No. 2:24-cv-00493, 2025 WL 947041, at *6 (D. Nev. Mar. 30, 2025) (citing 23 Watson v. Philip Morris Cos., 551 U.S. 142, 145 (2007)); see also Cedars-Sinai, 106 F.4th 24 at 913–14. Because these elements of § 1442 are not met, § 1442 does not provide a valid 25 basis for removal. 26 IV. CONCLUSION 27 The Court finds that Defendant fails to meet its burden to establish removal 28 jurisdiction under either § 233(a) or § 1442(a). Therefore, the Court lacks subject matter 1 ||jurisdiction over this case. The Court GRANTS Plaintiff's motion to remand this action 2 || to the Superior Court of California, County of San Diego. [Doc. No. 6.] 3 Pursuant to the parties’ joint motion, [Doc. No. 14], the Court will enter orders in 4 || the other related cases remanding those actions. The joint request for a status hearing is 5 DENIED AS MOOT. [Jd] 6 The Clerk of Court shall close the case. 7 Itis SO ORDERED. g Dated: May 12, 2026 € Z ? Hon. Cathy Ann Bencivengo 10 United States District Judge 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28