Labor & Employment Law Daily Wrap Up, PUBLIC EMPLOYEES—D. Haw.: Public Health Service employee not entitled to removal to federal court in cybersecurity lawsuit, (Jul 11, 2025)

By Jeffrey H. Brochin, J.D.

To fall within 42 U.S.C. § 233(a) category of services, the conduct must have involved “the performance of medical, surgical, dental, or related functions,” and cybersecurity to protect patients’ data was undisputedly not the performance of such functions.

A federal District Court in Hawaii has granted the Motion to Remand filed by the United States (non-party) in a consolidated class action lawsuit filed against a Provider who experienced a massive cyberattack. The Provider removed to federal court based on its receipt of federal funding under the Federally Supported Health Centers Assistance Act (FSHCAA). Although the United States generally agreed that the Provider was deemed a federal employee of the Public Health Service (PHS) for the purposes of immunity from malpractice liability, it expressly denied that such status allowed the Provider to remove to federal court over claims arising out of a cyberattack (In Re Community Clinic of Maui Data Breach Litigation, No. 1:24-cv-00431-MWJS-WRP (D. Haw. July 7, 2025)).

Massive cyberattack. In May 2024, the Community Clinic of Maui, Inc., doing business as Malama I Ke Ola Health Center (Malama or Provider), experienced a cyberattack in which thousands of patients’ personal data were stolen. A number of lawsuits arose from the incident, several of which were filed in state court, and although those cases raised only state law claims, Malama notified the United States that it believed it was entitled to immunity and to removal to federal court. The belief was based on its receipt of federal funding under the (FSHCAA). Presently before the court was the government’s Motion to Remand, which for the reasons cited below, the court granted.

FSHCAA and ‘federal employee’ status. Under the FSHCAA, federally funded health centers and their employees can be “deemed” federal employees of the PHS for the purposes of malpractice liability, whereby, if approved for FSHCAA protections, the health centers and their employees benefit from the same immunity as true PHS employees. What that means in practice is that just like the United States may not be sued without its consent and that the Federal Tort Claims Act (FTCA) applies, so too it applies to health centers enjoying FSHCAA immunity making the Act the exclusive remedy for malpractice claims.

However, such immunity is limited for health centers or their employees for “actions taken within the scope of their employment.” They are therefore not automatically immunized from any particular suit, rather, only for suits claiming damages for “personal injury, including death, resulting from the performance of medical, surgical, dental, or related functions” under 42 U.S.C. § 233(a).

Impact of Attorney General’s appearance. The instant dispute revolved around whether a cyberattack was within the “scope of employment” for the purposes of federal immunity and removal. To assist courts in determining whether a provider is a federal employee, federal law directs the U.S. Attorney General to appear in cases brought against federally supported health centers or their personnel and to certify whether the “entity, officer, governing board member, employee, or contractor of the entity is deemed to be an employee of the Public Health Service” for the purposes of the FSHCAA“ with respect to the actions or omissions that are the subject of such civil action or proceeding.” Such appearance must be made within 15 days of receiving notice of an action against a deemed employee, and if the Attorney General answers in the affirmative, the employee is presumed to be acting within the scope of their employment.

Here, it was undisputed that the United States appeared in state court within the fifteen-day period prescribed by § 233(l)(1), but that it expressly declined to remove the cases. They certified that although Malama was “deemed” an “employee” of PHS for the relevant time period, the complaints in state court did “not arise out of any conduct” by Malama for which § 233(a) makes the remedy against the United States exclusive,” rather, they arose out of the performance of cybersecurity, and not a medical or related function. Malama countered that removal was proper because removal was mandated based on the substance of the Attorney General’s certification that Malama was “deemed” an employee at the time of the incident, regardless of whether Malama was deemed as such with respect to the particular actions or omissions at issue.

Cyberattack not ‘scope of employment.’ The court agreed with the United States, finding that the categories of service for which a medical center may be deemed an employee are “the performance of medical, surgical, dental, or related functions.” Put another way, the Attorney General must certify in the affirmative and remove the case to federal court if two requirements are met: (1) the provider was “deemed” an employee for the time period at issue, and (2) the claims brought fall within the category of services for which the provider was deemed an employee. Notably, Section 233(l)(1) does not call on the Attorney General to resolve whether the provider was acting within the scope of employment prior to removal.

Referencing the precedent proffered by the Provider under Blumberger v. Tilley, 115 F.4th 1113, 1117 (9th Cir. 2024), the court observed that under Blumberger, the Attorney General’s § 233(l)(1) not only encompasses the question of whether a provider was “deemed” an employee of PHS at the relevant time, rather, the Attorney General must further certify that the provider was deemed as such “with respect to the actions or omissions that are the subject of such civil action.” In the instant case, the Attorney General, after determining employee status, specifically disclaimed that Malama was deemed an employee with respect to the cybersecurity incident at hand.

Based on the foregoing, the court concluded that claims for the data breach alleged in the complaints did not arise out of the performance of medical, surgical, dental, or related functions that fell within the ambit of § 233(a), they accordingly granted the government’s Motion to Remand.

The case is No. 1:24-cv-00431-MWJS-WRP.

Judge: Smith, M.

Attorneys: Bryan L. Bleichner (Chestnut Cambronne PA) for Marie Aleuta. David W. Schelberg (McDonald Hopkins PLC) for Community Clinic of Maui, Inc. d/b/a Malama I Ke Ola Health Center.

Companies: Community Clinic of Maui, Inc. d/b/a Malama I Ke Ola Health Center

Cases: PublicEmployees Procedure ComputerFraudPrivacy HawaiiNews