Mark Jessie Ramirez, individually, and on behalf of all others similarly situated v. Imperial Beach Community Clinic

Opinion

MARK JESSIE RAMIREZ, individually, Case No.: 3:26-cv-1326-CAB-JLB and on behalf of all others similarly situated, ORDER GRANTING MOTION TO Plaintiff,

v. [Doc. No. 6] IMPERIAL BEACH COMMUNITY Defendant. Before the Court is Plaintiff Mark Jessie Ramirez’s (“Plaintiff”) motion to remand this action to state court. [Doc. No. 6.] The motion has been fully briefed, and the Court finds it suitable for determination on the papers. See CivLR 7.1(d)(1). This case is one of four related cases before the Court.1 Also before the Court is a joint motion requesting a status conference which includes a stipulation that the parties in the related cases will

1 See Cynthia Maldonado, et al. v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01312 (S.D. Cal. March 2, 2026); Donna Mack v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01371 (S.D. Cal. March 4, 2026); Rasiel Pena v. Imperial Beach Cmty. Clinic, Case No. 3:26-cv-01594 (S.D. Cal. March abide by the Court’s decision in the case before the Court. [Doc. No. 14.] For the reasons set forth below, the motion to remand is GRANTED. On January 12, 2026, Plaintiff filed a putative class action complaint against Defendant in the Superior Court of the State of California for the County of San Diego asserting claims for: (1) negligence; (2) breach of implied contract; (3) breach of the implied covenant of good faith and fair dealing; (4) violations of the California Confidentiality of Medical Information Act; and (5) violations of the California Unfair Competition Law, Business and Professions Code. [See generally Doc. No. 1-2 (“Complaint”).] Plaintiff alleges that Defendant, a healthcare services provider, failed to properly safeguard its patients’ personal information stored in its information network. On March 2, 2026, Defendant removed this action to this Court based on removal jurisdiction under 42 U.S.C. § 233(l)(2) or 28 U.S.C. § 1442(a)(1). [Doc. No. 1.] 42 U.S.C. § 233 provides federal immunity to certain healthcare providers for damages resulting from their performance of “medical, surgical, dental, or related functions.” 28 U.S.C. § 1442(a)(1) allows for the removal to federal court of “[a] civil action or criminal prosecution” against “[t]he United States or any agency thereof or any officer (or any person acting under that officer) of the United States.” On April 1, 2026, Plaintiff filed a motion to remand, contesting that Defendant’s failure to safeguard its patients’ personal information does not fall within the scope of claims for which Defendant could be immune from pursuant to 42 U.S.C. § 233(a). [Doc. No 6-1 at 9–18.] Additionally, Plaintiff argues that § 1442(a)(1) does not apply here because the relevant actions were not taken pursuant to a federal officer’s directions. [Id. at 18–20.] Only state court actions that could originally have been filed in federal court may be removed. 28 U.S.C. § 1441(a); Caterpillar, Inc. v. Williams, 482 U.S. 386, 392 (1987). The proper procedural vehicle for challenging removal is a motion to remand. See 28 U.S.C. § 1447(c). The Ninth Circuit “strictly construe[s] the removal statute against removal jurisdiction.” Gaus v. Miles, Inc., 980 F.2d 564, 566 (9th Cir. 1992). The removing party generally bears the burden of establishing federal jurisdiction and that removal is proper. See id. at 566; Emrich v. Touche Ross & Co., 846 F.2d 1190, 1195 (9th Cir. 1988) (citing Wilson v. Republic Iron & Steel Co., 257 U.S. 92, 97 (1921)). A. Removal Under Section 233 was Improper The United States “is immune from suit save as it consents to be sued . . . and the terms of its consent to be sued in any court define that court’s jurisdiction to entertain the suit.” Lehman v. Nakshian, 453 U.S. 156, 160 (1981) (internal quotation marks omitted). The Federal Tort Claims Act (“FTCA”) “provides a limited waiver of the sovereign immunity of the United States for torts committed by federal employees acting within the scope of their employment.” Nurse v. United States, 226 F.3d 996, 1000 (9th Cir. 2000). The Federally Supported Health Centers Assistance Act (“FSHCAA”) provides that the exclusive remedy for damages resulting from the performance of medical functions by employees of the U.S. Public Health Service acting within the scope of their employment is a claim against the United States under the FTCA. See 42 U.S.C. § 233(g); D.L. by & through Junio v. Vassilev, 858 F.3d 1242, 1244 (9th Cir. 2017). In particular, § 233(a) immunizes claims for “personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions” by any “employee of the Public Health Service while acting within the scope of his office or employment.” When immunity under § 233(a) applies, the United States is substituted as the defendant and the action proceeds as one brought under the FTCA. Friedenberg v. Lane Cnty., 68 F.4th 1113, 1118 (9th Cir. 2023). The FTCA’s applicability is not automatic. Rather, U.S. Attorneys—in accordance with the Attorney General’s delegation of such duties—evaluate when a lawsuit’s alleged actions or omissions trigger the FTCA’s coverage. 42 U.S.C. § 233(c). If a healthcare provider is sued in state court, there are two avenues for the case’s removal to federal court: (1) the Attorney General can remove the case after certifying the defendant “is deemed to be an employee of the Public Health Service for purposes of this section with respect to the actions or omissions that are the subject of such civil action or proceeding”; or (2) the healthcare provider can remove the case on its own if the Attorney General fails to appear within 15 days of receiving notice of the case. See id. at §§ 233(l)(1)–(2). Once a case is removed to federal court, however, remand may still be appropriate under 42 U.S.C. § 233(c) if a district court “determine[s] on a hearing on a motion to remand held before a trial on the merit that the case so removed is one in which a remedy by suit within the meaning of [42 U.S.C. § 233(a)] is not available against the United States . . . [.]” Here, the parties dispute whether this case falls within the immunity provision of 42 U.S.C. § 233(a). In particular, Plaintiff argues the immunity conferred by § 233(a) is limited to damages “resulting from the performance of medical, surgical, dental, or related functions.” [Doc. No. 6 at 12.] Plaintiff contends the scope of this immunity does not extend to the injuries alleged here, which stem from Defendant’s failure to properly safeguard its patients’ personal information stored in Defendant’s information network. [Doc. No. 6 at 12–16.] Defendant counters that Plaintiff’s claims arise out of Defendant’s provision of healthcare services because “the acquisition, storage, protection, retrieval, and review of [Personal Identifying Information] and [Personal Health Information] is intrinsically related to the provisioning of medical care.” [Doc. No. 11 at 12.] Defendant argues that “confidentiality requirements are ‘interwoven’ with the provision of medical services” and the lawsuit is a “related function[.]” [Id. at 9.] The Court finds that Defendant’s electronic storage of Plaintiff’s personal information and medical data was not a “medical, surgical, dental, or related function[ ]” within the meaning of 42 U.S.C. § 233(a). At its core, the storage of patients’ personal identifying information is not a medical, surgical, or dental function. Therefore, to fall within the purview of § 233(a), it must be a “related” function. Although the Ninth Circuit has not precisely defined a “related function,” it has explained that for a lawsuit to fall “within the ambit of § 233,” the legal duty allegedly violated must be “tied to [the defendants’] status as medical health professionals,” and the defendants’ allegedly wrongful conduct must have a “distinct connection to the provision of [health care.]” Friedenberg, 68 F.4th at 1130. Plaintiff’s claims against Defendant do not satisfy either requirement, as they neither turn on Defendant’s status as a health care provider, nor have a distinct connection to the provision of healthcare. To be sure, the injuries are “related” to the provision of medical treatment in a broad sense—the data is collected in the course of providing medical services. And as Defendant points out, it has a statutory duty to “maintain[ ] the confidentiality of patient records.” 42 U.S.C. § 254b(k)(3)(C). The Friedenberg court noted that a duty that is “imposed on doctors acting within their professional capacity” is typically “related” to medical services for the purposes of § 233(a). Friedenberg, 68 F.4th at 1129–30. But not everything that is “related” to the provision of medical treatment in a broad sense is “related” in the manner that § 233(a) requires. For example, a medical center might have a duty to keep its building up to code or to maintain certain standards of cleanliness, but that does not mean that the performance of construction or janitorial services arises out of the performance of medical or related functions. Further, there is a difference between medical professionals’ maintenance of confidentiality in their practice and data security professionals’ maintenance of confidentiality through technological safeguards. The duty to maintain the security of stored data is therefore not “intertwined” with medical treatment. Contrast with Friedenberg, 68 F.4th at 1129 (finding that defendants’ failure to report a patient’s repeated failures to comply with his court-ordered mental health treatment plan was “intertwined” with the provision of medical services). This Court’s understanding of § 233 is in line with the holdings of other circuits in substantively identical circumstances. In Ford v. Sandhills Medical Foundation, Inc., the Fourth Circuit recently examined the meaning of “related functions” in § 233 and held that it did not cover data breaches. 97 F.4th 252, 260 (4th Cir. 2024) (“[the term] ‘related functions’ explicitly encompasses only the provision of health care.”). The court further observed that § 233 provides for immunity “solely for claims ‘for damage for personal injury, including death’” and that “[m]isfeasance in the provision of health care would most likely lead to personal injury or death[,]” confirming that a “wider definition of ‘related functions’ may improperly broaden § 233(a) to encompass misfeasance that results in other types of damages, such as contract damages.” Id. The Eighth Circuit reached the same conclusion. In Hale v. ARcare, Inc, the Eighth Circuit held that that the term “related functions” in § 233(a) refers to “a field of health care outside of medicine, surgery, or dentistry.” 167 F.4th 995, 1001 (8th Cir. 2026). The court also acknowledged that the injuries stemming from data breaches are “related” to the provision of medical treatment in a broad sense, but similarly decided that § 233(a) does not cover the injuries from a data breach. Id. at 1001–02 (“Although data security is now integrated into the modern practice of medicine with the transition to electronic medical records, it is not itself a field of health care.”). The Court concludes that the claims for the alleged data breach do not arise out of the performance of medical, surgical, dental, or related functions that fall within the ambit of § 233(a). Accordingly, the Court holds that Defendant’s conduct does not fall within the immunity provisions of 42 U.S.C. § 233(a), and Defendant cannot assert federal subject matter jurisdiction on this basis. As such, the Court declines to reach the issue of whether Defendant had a removal right based on Defendant’s alleged failure to timely provide notice to the Attorney General. B. Removal Under 1442(a)(1) was Improper Defendant also relies on the general federal officer removal statute found in 28 U.S.C. § 1442(a)(1) for removal jurisdiction. Section 1442(a)(1) permits removal of actions initially brought in state court against “any officer (or any person acting under that officer) of the United States or of any agency thereof . . . for or relating to any act under color of such office.” Plaintiff argues that § 1442(a)(1) does not provide a basis for removal because Defendant was not a person acting under a United States officer under § 1441(a)(1). To satisfy the general federal officer removal statute, “a removing entity must establish that: (a) it is a person within the meaning of the statute; (b) there is a causal nexus between its actions, taken pursuant to a federal officer’s directions, and the plaintiff’s claims; and (c) it can assert a colorable federal defense.” Doe v. Cedars-Sinai Health Sys., 106 F.4th 907, 913 (9th Cir. 2024) (cleaned up). While federal officer removal must be “liberally construed,” it is “not limitless.” Id. Federal courts must avoid “bringing within its scope state-court actions filed against private firms in many highly regulated industries.” Id. (quoting Cnty. of San Mateo v. Chevron Corp., 32 F.4th 733, 757 (9th Cir. 2022)). Here, two elements of § 1442 are deficient. First, and most simply, Defendant cannot assert a “colorable federal defense.” Mesa v. California, 489 U.S. 121, 129 (1989). Section 233 immunity is the only federal defense that Defendant raises, and that defense is not colorable for the reasons explained above—namely, because § 233(a) immunity does not extend to the data breach claims asserted in the Complaint. That alone is reason enough to reject the § 1442 removal. See Lockhart, 2025 WL 1161464, at *9 (rejecting § 1442 as a ground for removal where § 233 immunity did not apply because defendant raised no colorable federal defense). Second, Defendant’s data-storing activities were not “taken pursuant to a federal officer’s directions[.]” Cedars-Sinai, 106 F.4th at 913. To satisfy § 1442’s “causal nexus” requirement, a defendant “must demonstrate that it was acting under a federal officer in performing some act under color of federal office, i.e., that it was involved in an effort to assist, or to help carry out, the duties or tasks of the federal superior.” Id. (internal quotation marks and italics omitted). Factors the Court considers in making this determination include: (1) whether the person is acting on behalf of the government in a manner akin to an agency relationship, (2) whether the person is subject to the government’s close direction, (3) whether the private person is assisting the government in fulfilling “basic governmental tasks” that the government “itself would have had to perform” if it had not contracted with the private person, and (4) whether the private person’s activity is so closely related to the government’s implementation of its federal duties that the private person faces a “significant risk of ‘state-court prejudice,’” as the government itself would face. Id. at 914. Managing a network storing medical patients’ data does not satisfy this test. In arguing for the opposite conclusion, Defendant relies on Agyin v. Razmzan, 986 F.3d 168 (2nd Cir. 2021). But Agyin involved a medical malpractice suit related to the delivery of a low-income patient’s stillborn child. Id. at 171. That is distinct from the performance of cybersecurity and other technological functions by medical centers. In Doe v. Cedars- Sinai Health Systems, the Ninth Circuit concluded that a federally supported health center’s building of a patient portal and website with tracking technology was not a basic governmental task. 106 F.4th at 916. The Circuit acknowledged that building the portal and website might well “advance the government’s policy by operating a patient portal that meets certain objectives and measures.” Id. at 917. But that is not enough to make the conduct a basic governmental task; the applicable governmental regulations vested “considerable discretion” in the health center and did not require the health center “to build a specific type of website or patient portal,” nor did they implement the “requisite federal control or supervision.” Id. Undeniably, as a federally supported health center, Defendant has a statutory duty to maintain the confidentiality of patient data. 42 U.S.C. § 254b(k)(3)(C). But “[m]erely complying with federal laws, policies or regulations,” without more, “does not constitute ‘acting under’ a federal official for the purposes of federal officer removal.” Nevada v. Optum, Inc., No. 2:24-cv-00493, 2025 WL 947041, at *6 (D. Nev. Mar. 30, 2025) (citing Watson v. Philip Morris Cos., 551 U.S. 142, 145 (2007)); see also Cedars-Sinai, 106 F.4th at 913–14. Because these elements of § 1442 are not met, § 1442 does not provide a valid basis for removal. The Court finds that Defendant fails to meet its burden to establish removal jurisdiction under either § 233(a) or § 1442(a). Therefore, the Court lacks subject matter jurisdiction over this case. The Court GRANTS Plaintiff's motion to remand this action to the Superior Court of California, County of San Diego. [Doc. No. 6.] Pursuant to the parties’ joint motion, [Doc. No. 14], the Court will enter orders in the other related cases remanding those actions. The joint request for a status hearing is DENIED AS MOOT. [Jd] The Clerk of Court shall close the case. Itis SO ORDERED. g Dated: May 12, 2026 € Z ? Hon. Cathy Ann Bencivengo United States District Judge