Cybersecurity Policy Report, D. Conn.: Suit over federally-supported community health center’s data breach is remanded to state court, (Feb 13, 2026)

By Donielle Tigay Stutland, J.D.

The FSHCAA, the federal officer removal statute, and the CAFA did not provide federal jurisdiction in this case.

The federal district court for the District of Connecticut granted a plaintiff’s motion to remand a suit to state court. The plaintiff was a patient of Community Health Center, Inc. (CHC) and brought a suit alleging various state claims due to a data breach of the health center in October 2024. The district court granted the patient’s motion to remand after concluding that nether the Federally Supported Health Centers Assistance Act (FSHCAA), 42 U.S.C. § 233, the federal officer removal statute, 28 U.S.C. § 1442(a)(1), nor the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d) provided federal jurisdiction (Frankfurter v. Community Health Center, Inc., No. 3:25cv344 (D. Conn. Feb. 9, 2026)).

Background. The plaintiff, a patient, on behalf of himself and a putative class, sued the defendant, CHC, a healthcare provider, in state court. The suit alleges that the health center failed to safeguard its patient information and that as a result, the plaintiff and others’ information was disclosed in an October 14, 2024 data breach. The patient is a resident of the state of Connecticut and the health center is a nonprofit, federally-supported community health center that serves patients at more than 200 locations in Connecticut. It is a corporation organized under the laws of Connecticut with its principal place of business in Middletown, Connecticut. CHC is a “deemed” community health center under the FSHCAA.

The complaint asserts state law claims of negligence, breach of implied contract, unjust enrichment, and invasion of privacy. The health center removed the suit to federal court, asserting jurisdiction under the FSHCAA, 42 U.S.C. § 233, the federal officer removal statute, 28 U.S.C. § 1442(a)(1), and the CAFA, 28 U.S.C. § 1332(d).

The patient moved to remand the suit to state court.

42 U.S.C. § 233(l)(2). The court began its analysis by reviewing 42 U.S.C. § 233(l)(2), as the patient argued that removal under 42 U.S.C. § 233(l)(2) is improper. The court outlined that removal under the FSHCAA is authorized “in only two circumstances.” First, the Attorney General may remove a case to federal court. Second, the defendant may remove the case if the Attorney General fails to appear in the state court proceeding within fifteen days of being notified of the filing of the case as set forth in § 233(l)(1).

The health center argued that because the Secretary of HHS had “deemed” CHC to be an employee of the Public Health Service, the Attorney General was required to remove the case under § 233(l)(1). The court rejected this argument contrasting the health center’s cited case, Blumberger v. Tilley, 115 F.4th 1113 (9th Cir. 2024), as that not determine the issue presented here - whether the defendant was permitted to remove under § 233(l)(2) after the Attorney General timely appeared. Here, the Attorney General timely appeared and advised that the claims (related to data security, not medical functions) were not covered by § 233(a). The court stressed that “Section 233(l)(1) is not, by itself, a removal statute at all; it makes no reference to removal. The statute merely requires the Attorney General to provide advice to the state court about the defendant’s status “with respect to the actions or omissions that are the subject of” the lawsuit.” The court also disagreed with the reliance on Blumberger given that case involved medical malpractice. But here, “the category of services identified in the complaint,”, does not fall within the “performance of medical, surgical, dental, or related functions.”

The court concluded that removal was not proper under § 233(l)(2).

28 U.S.C. § 1442(a)(1). The court next addressed the patient’s challenge to the health center’s removal under § 1442(a), the federal officer removal statute, which provides for removal jurisdiction over civil actions commenced against “[t]he United States or any agency thereof or any officer (or any person acting under that officer) of the United States or of any agency thereof, in an official or individual capacity, for or relating to any act under color of such office ….” At issue is whether the health center was “acting under” a federal officer.

The health center offered various statutes and regulations to assert it was acting under a federal officer when it “provided medical and related services to Plaintiffs (thereby collecting, generating, and needing to protect the confidential information at issue).” The health center also relied on Agyin in which a physician employed by a deemed community health center who was sued in state court for medical malpractice. However, the court found that in Agyin, the Second Circuit concluded that removal under § 1442 was proper because the defendant was acting under a federal officer when he provided medical care to the plaintiff. The court contrasted that in that case, the defendant physician was providing direct medical care - the core function that Congress intended deemed health centers to perform. The federal government extensively regulates how medical care is provided in a deemed health center but that degree of specific and comprehensive regulation is absent with respect to data security. Wrote the court, “CHC has not shown it was acting under the ‘close supervision, subjection, guidance, or control of federal officers’ in discharging its obligation to safeguard patient information,” Tong, 83 F.4th at 144, “or that the acts forming the basis of the complaint – alleged tortious conduct in failing to protect personal data from unauthorized access - were taken pursuant to a federal officer’s direct orders or to comprehensive and detailed regulations.”

The court concluded that the health center did not establish the requisite federal direction and removal was not proper under 28 U.S.C. § 1442(a)(1).

28 U.S.C. § 1332(d). The court last turned to the patient’s argument that removal under CAFA was improper because CAFA’s “home state” exception applies. The home state exception requires district courts to “decline to exercise jurisdiction” over class actions in which two-thirds or more of the class, and the primary defendants, are citizens of the state in which the action was filed.

Here, the health center is a Connecticut citizen. The health center also concurred that 1,008,519 individuals out of the total affected group of 1,060,936 provided CHC with a Connecticut address. The court indicated that it is reasonable to infer that at least two-thirds of prospective class members are Connecticut citizens. The court determined that the case must be remanded under CAFA’s home state exception.

The case is No. 3:25cv344(MPS).

Judge: Shea, M.

Attorneys: Chloe Mangan (Diserio Martin O'Connor & Castiglioni LLP) for David Frankfurter. Philip H. Bieler (Baker & Hostetler LLP) for Community Health Center, Inc.

Companies: Community Health Center, Inc.

Cases: CaseDecisions ConfidentialityNews CyberPrivacyFeed HIPAANews DataSecurity DataBreach LitigationEnforcement ConnecticutNews DataPrivacy