Cybersecurity Policy Report, E.D. Cal.: Provider’s removal of privacy lawsuit to federal court found deficient, premature, (Feb 24, 2025)

By Patricia K. Ruiz, J.D.

The patients brought claims under California’s Invasion of Privacy Act and its Unfair Competition Law and argued the provider was unjustly enriched.

The U.S. District Court for the Eastern District of California stayed any ruling on patients’ motion to remand in a lawsuit alleging that a health care service provider allowed Google LLC to intercept their private and medical information by using Google Analytics on its web platforms and patient portal. The court found that the provider’s removal to federal court was deficient and premature but ordered the parties to meet and confer to advise the court if a hearing is needed to determine whether the provider was acting within the scope of its employment under 42 U.S.C. §233(c) (Mixon v. WellSpace Health, No. 2:24-cv-02290-DJC-CSK (E.D. Cal. Feb. 18, 2025)).

Lawsuit. WellSpace Health is a health care service provider offering several services on its online platforms and patient portal, which allow users to search for medical care providers, schedule appointments, and pay bills, among other things. While utilizing these services, users must often input private and medical information. Two patients alleged in a class action lawsuit that WellSpace enabled Google to intercept much of the private and medical information by placing Google Analytics on its online platforms. They allege Google Analytics intercepts users’ information in real time and redirects it to Google without users’ knowledge or consent. In exchange for sending the data to Google, the patients allege WellSpace receives analytics and reports that it uses to improve marketing efficacy and increase revenue. The patients brought claims under California’s Invasion of Privacy Act and its Unfair Competition Law. The patients also argued that WellSpace has been unjustly enriched.

Removal to federal court. WellSpace removed the action to federal court, arguing that it was acting under the direction of a federal officer when deploying Google Analytics and that its deployment of Google Analytics is immunized as a “related function” to its provision of health care services. The patients moved to remand, arguing removal was untimely and substantively deficient. The court ordered the parties to submit supplemental briefing to address the impact of Blumberger on the motion to remand. The court also invited the U.S. Attorney for the Eastern District of California to file briefing addressing Nlumberger. The U.S. Attorney and the parties filed the requested briefing.

Timeliness of removal. The patients first argued the removal was untimely under 28 U.S.C. §1442(a)(1) because WellSpace removed the action more than 30 days after receiving the complaint—a mandatory time limit. The patients argued they left a copy of the complaint with and mailed a copy of the complaint to WellSpace’s registered California agent on June 21, 2024. As WellSpace did not remove the action until August 22, 2024, the patients argue the remand is appropriate. In response, WellSpace argued removal was timely because the patients did not sufficiently serve them on July 1, 2025, and that it did not receive a copy of the complaint until July 23, 2024. WellSpace argued that service was defective because the address to which the patients served WellSpace is the location of an entirely separate business, unrelated to WellSpace. It is not the office listed on WellSpace’s corporate filings and is not even a WellSpace location, nearly 20 of which are located in the greater Sacramento area.

Under California law, service must be attempted at an agent’s “office or, if no physical address is known, at his or her usual mailing address.” Based on the record, the court found it to be unclear that WellSpace was sufficiently served as of July 1, 2024. The proof of service documents show that service was attempted at a mail center, as the agent’s physical address was unknown. However, WellSpace’s corporate statement of information lists a different address for the agent’s office. The court found that, because the patients failed to establish the agent’s physical address was unknown, service was not clearly completed as of July 1, 2024. Thus, the patients failed to establish removal on August 22, 2024, was untimely and declined to remand on that basis.

Federal officer removal. Section 1442(a) permits removal of a state-court action against an “officer (or any person acting under that officer) of the United States or of any agency thereof, in an official or individual capacity, for or relating to any act under color of such office.” When the removing party under the federal officer removal statute is not itself a federal officer or agency, it must make a threshold showing that: (1) it is a person within the meaning of the statute; (2) there is a causal nexus between its actions, taken pursuant to a federal officer’s directions, and the plaintiff’s claims; and (3) it can assert a colorable federal defense. WellSense asserted that federal jurisdiction exists because it is a person within the meaning of the statute; it developed its online platforms and patient portal pursuant to federal direction, and there is a causal nexus between its development of the websites and the patients’ claims; and it has a colorable federal defense to the patients’ claims. WellSense outlined the legislative and regulatory background leading to the development of its online platforms and patient portal, arguing that, in the creation and implementation of its online platforms and patient portal, it acted in response to and in furtherance of federal directives, such as the Health Information Technology for Economic and Clinical Health Act and the Meaningful Use Program.

The patients dispute that WellSense was acting under the direction of a federal officer when adopting and using Google Analytics. The court agreed with the patients, as the mere fact that a federal regulatory agency directs, supervises, and monitors a company’s activities in considerable detail does not mean the company acts under a federal officer for removal purposes. The court found that WellSense was not “acting under” a federal officer by participating in the Meaningful Use Program or in creating and operating its online platforms and patient portal. Thus, §1442(a)(1) does not provide a basis for jurisdiction in this case.

Premature removal. Under the Federally Supported Health Centers Assistance Act, health centers deemed to be U.S. Public Health Service (PHS) employees by HHS are entitled immunity from any civil action or proceeding resulting from their performance or failure to perform medical or related functions within the scope of their employment. When such immunity applies, the U.S. is substituted as the defendant, and the action proceeds as one brought under the Federal Torts Claims Act (FTCA); however, the applicability of the FTCA is not automatic, as U.S. Attorneys evaluate when a lawsuit’s alleged actions or omissions trigger the FTCA’s coverage. If a health acre provider is sued in state court, there are two avenues for removal to federal court: (1) the Attorney General can remove the case after certifying that the defendant is deemed a PHS employee whose actions or omissions fall within the FTCA’s purview; or (2) the health care provider can remove the case on its own if the Attorney General fails to appear within 15 days of receiving notice of the case. The timing requirements are mandatory, and courts have remanded actions in which a defendant failed to comply with them.

In the instant case, WellSense removed the action on August 22, 2024; however, the Attorney General was not notified of the action until August 29, 2024, and appeared in the state court action on September 5, 2024. Thus, removal was premature, as WellSense removed the action before the Attorney General was notified and appeared. The court found that, applying the Blumberger’s reasoning, WellSense’s procedural error in removing the action too soon is moot, as the Attorney General was required to remove the action upon appearing in the state court action and certifying that WellSense was a deemed employee of the PHS. Thus, had WellSense not already removed the case, the U.S. Attorney would have been obligated to remove the case to federal court.

The case is No. 2:24-cv-02290-DJC-CSK.

Judge: Calabretta, D.

Attorneys: Andrew Daniel Bluth (Singleton Schreiber, LLP) for Latasha Mixon and Rosana Korman. Reid Eric Dammann (Gordon Rees Scully Mansukhani, LLP) for WellSpace Health.

Companies: WellSpace Health

Cases: CaseDecisions ConfidentialityNews CyberPrivacyFeed EHRNews HITNews HIPAANews DataPrivacy CaliforniaNews DataSecurity