Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—7th Cir.: Court remands consolidated hospital privacy breach lawsuit back to state court, (Oct 22, 2026)

By Sherri M. Schroeder, J.D.

The four consolidated cases from Indiana and Illinois presented nearly identical claims for breach of privacy against health care providers claiming federal jurisdiction under § 1442(a)(1).

An Indiana couple alleged that Columbus Regional Health (CRH) shared their health data without their consent through a Facebook-tracking software called the "Meta Pixel" embedded in CRH's online webpage. CRH moved the putative class action from Indiana state court to federal court by invoking the federal officer removal state, 28 U.S.C. § 1442(a)(1), but the couple moved to have their claims remanded back to state court. The district court agreed. CRH appealed, and the case was consolidated with four nearly identical lawsuits against health care providers also claiming federal jurisdiction under § 1442(a)(1). In each of the cases, the district court had similarly rejected the provider's § 1442(a)(1) jurisdictional argument that they were "acting under" HHS when they created their online patient portals and accepted federal incentive payments for doing so, and the court remanded the claims back to state court. The Seventh Circuit agreed with the district courts, finding that the providers were not doing the government's business when they constructed and operated their patient portals, nor did the providers have "unusually close" relationships with the federal government. Therefore, the court affirmed the judgments of the district courts and remanded the cases back to the state courts (Elkins v. Southeastern Indiana Health Management Inc., No. 23-3159 (7th Cir. Oct. 20, 2026)).

Patient portals. The Seventh Circuit began by reviewing cases interpreting § 1442(a)(1). It concluded that the health care providers in the cases at hand did not "act under" an officer or agency of the federal government when they created their patient portals. Like the cigarette manufacturer in Watson v. Philip Morris Cos., 551 U.S. 142 (2007), and the nursing home in Martin v. Petersen Health Operations, 37 F.4th at 1213 (2022), the health care providers merely complied with federal regulations when establishing and maintaining their patient portals. Even though an entity may be “subject to extensive federal regulation," stated the court, quoting Martin, such regulation “does not turn a private entity into a public actor."

Government business. Although CRH argued that their relationship with the federal government went beyond regulation because they were completing a "fundamental federal governmental task" by creating patient portals, unlike in Watson or Martin, the court disagreed. In the court's view, the health care providers were not doing the government's business when constructing and operating their patient portals because the portals are private websites designed by private actors. It was the providers and patients who benefited most from the patient portals once they were up and running and not the federal government. The court did agree that the portals advanced government policy by making electronic health records (EHRs) more accessible, but "a private party does not accomplish a basic government task every time it acts in response to a government incentive."

No “unusually close” relationship. Furthermore, to qualify for federal jurisdiction under § 1442(a)(1), a private entity must have an "unusually close" relationship to a federal superior "involving detailed regulation, monitoring, or supervision," according to the Supreme Court in Watson. However, in the cases at hand, the health care providers lacked that "unusually close" relationship with the federal government. The regulations under the Health Information Technology for Economic and Clinical Health Act encouraged health care providers to adopt the use of EHRs by directing HHS to make incentive payments to any Medicare-participating provider who was a "meaningful EHR user." However, the regulations did not provide any details as to how health care providers were to maintain their online patient portals and instead required only generally that they "provide patients the ability to view online, download, and transmit their health information within four days of the information being available to the [eligible professional]." 42 C.F.R. § 495.20(d)(12)(i)(B). Although the health care providers attempted to use the "Patient Engagement Playbook" published by the Office of the National Coordinator for Health Information Technology to show the federal government's close supervision, the court found the nonbinding recommendations about patient portal development to be "a far cry from the detailed government specifications typically required to establish the unusually close relationship required for jurisdiction under § 1441(a)(1)."

The court ultimately concluded that the health care providers were not acting under a federal officer or agency when they created their patient portals. "The CDC's Meaningful Use regulations may have incentivized them to create online patient portals, but these incentives are 'regulation, not delegation,'" stated the court, quoting Watson. Therefore, the court affirmed the judgments of the district courts. However, a footnote noted that the court's conclusion did not reach to the questions of whether the providers' conduct related to their exercise of federal authority or whether they had a colorable federal defense.

The case is No. 23-3159.

Judge: Lee, J.

Attorneys: Eugene Alexis Sokoloff (Molo Lamken LLP) for Brian Elkins. Matthew T. Albaugh (Taft Stettinius & Hollister LLP) for Southeastern Indiana Health Management Inc.

Companies: Southeastern Indiana Health Management Inc.

MainStory: TopStory CaseDecisions EHRNews GCNNews GeneralNews IllinoisNews IndianaNews WisconsinNews