Cybersecurity Policy Report, Tex. App.: Governmental immunity of hospital authority did not extend to its subsidiary group, (Sep 8, 2025)

By Jeffrey H. Brochin, J.D.

Hospital authority as political subdivision enjoyed governmental immunity under Texas law, however, as to its subsidiary not-for-profit entity, the Legislature did not demonstrate clear legislative intent that such an entity should be considered an arm of the state government.

The Court of Appeals for The First District of Texas has affirmed in part and reversed in part the ruling of the Trial Court that dismissed Patients’ claims against both the Oakbend Medical Center (Center) a governmental hospital authority, and its subsidiary, Oakbend Medical Group (Group). The Trial Court found that both entities enjoyed governmental immunity based on the Center being a hospital authority for the City of Richmond, however, the Appeals Court disagreed, finding that although the Center had governmental immunity as a political subdivision, the not-for-profit Group that it created did not (Somer v. Oakbend Medical Center, No. 01-24-00187-CV (Tex. App. Aug. 26, 2025)).

Cyberattack data breach. In September 2022, cyber criminals launched a ransomware attack against the computer network and servers of OakBend Medical Center. The Center quickly learned of the attack and was able to take measures to protect its system. However, the criminals accessed personally identifiable information (PII) relating to current and former patients and employees, which may have included names, mailing addresses, email addresses, phone numbers, Social Security numbers, dates of birth, and medical information.

A former patient, sued both OakBend Medical Center and OakBend Medical Group on her own behalf and on behalf of all others similarly situated, alleging acts and omissions that allegedly caused her injuries. Her negligence claim alleged that both entities knew of an increasing risk of cyberattacks on healthcare providers but failed to exercise reasonable care to safeguard and protect her PII. As a result of such negligence, she suffered harm including a substantially increased risk of identity theft.

Trial Court dismissal. The Center filed a ‘plea to the jurisdiction’, arguing that its governmental immunity barred the claims against it because as a hospital authority created by the City of Richmond, it was a political subdivision of the state and had governmental immunity from suit. It further argued that no waiver of governmental immunity applied to the claims; although the Texas Tort Claims Act contains limited waivers of governmental immunity (including a waiver for personal injury or death caused by ‘a condition or use of tangible personal or real property’), the Center contended that the waiver did not apply because personal information—the alleged theft of which formed the crux of all the claims—was not tangible personal property.

The Group also asserted governmental immunity, relying on a slightly different source for its immunity: although it was not a political subdivision of the state, it was controlled and funded by the Center, as evidenced by a declaration from the Center’s CEO. The Trial Court dismissed the Complaint with prejudice, and the instant appeal ensued.

Arm of the state immunity. The Texas Health and Safety Code allowed for the municipality, City of Richmond, to create a hospital authority, and therefore, the Patient did not contest on appeal that the Center enjoyed governmental immunity from suit. However, she denied that the parent’s immunity passed down to the subsidiary Group. The Appeals Court noted that the hospital authority was authorized to form and sponsor a nonprofit corporation (economic development corporation) under the Texas Nonprofit Corporation Law, allowing it to own and operate all or part of one or more ancillary health care facilities.

When determining whether an entity authorized by the Legislature is entitled to share in the state’s immunity, courts consider whether the governing statutory authority informs a legislative intent to grant an entity the ‘nature, purposes, and powers’ of an ‘arm of the state government.’ The Texas Supreme Court has addressed that form of immunity several times in recent years, inquiring whether a municipally-created economic development corporation under the Local Government Code’s Development Corporation Act was a governmental entity in its own right that could assert immunity. Significantly, the Development Corporation Act explicitly states that an economic development corporation is not a political subdivision; and, the Act prohibits a municipality from delegating to an economic development corporation any of the municipality’s attributes of sovereignty, including the power to tax, the power of eminent domain, and the police power.

Impact of CEO’s declaration. Both OakBend entities argued that the undisputed facts demonstrated that the Center controlled the Group’s operations and governance, and they referenced the Center’s CEO’s declaration that the Center was the Group’s sole member. They further listed the powers reserved to the Center in that capacity, including composition of the Group’s board and management; approval of budgets, mergers, acquisitions, and sale of real assets; creation of partnerships or joint ventures; and dissolution or liquidation. Furthermore, the Center provided funding to the Group.

However, the Appeals Court found that the CEO’s declaration did not state that the Center provided all funding for the Group (only that the hospital authority that creates a nonprofit corporation “may contribute money to or solicit money for the nonprofit corporation,”) and that there existed the possibility that the Group received funding from other sources.

Legislative intent and caselaw lacking. Although no Texas court has addressed whether the Legislature has demonstrated an intent to grant a nonprofit corporation created by a hospital authority under Health and Safety Code the ‘nature, purposes, and powers’ of an ‘arm of the state government’, the Appeals Court determined that based on the relevant provisions of the Health and Safety Code, caselaw, and the state of the record, the Group most closely resembled the type of economic development corporation found to not be an arm of the state, and they therefore concluded that the Group did not have immunity as an arm of the state government. Or, as the Appeals Court characterized the notion of extended immunity: ‘Governmental immunity does not extend like ripples from a pebble tossed into a pond but, instead, is limited to those entities acting as an arm of state government’.

Based on the foregoing, the Appeals Court ruled that the Center, as a hospital authority, did enjoy government immunity and they affirmed the Trial Court’s ruling of dismissal as to the Center. However, they reversed and remanded as to the Group, there being no passing of government immunity from a political subdivision down to its statutorily created subsidiary corporation.

The case is No. 01-24-00187-CV.

Judge: Gunn, D.

Attorneys: Anthony L. Parkhill (Barnow and Associates, P.C.) for Kimberly Somer. Jarrett Lee Ellzey (Ellzey, Kherkher, Sanford & Montgomery LLP) for Cody Janssen and Alline Henderson. Leisa Talbert Peschel (Jackson Walker LLP) for OakBend Medical Center and OakBend Medical Group.

Companies: OakBend Medical Center; OakBend Medical Group

MainStory: TopStory CaseDecisions CyberPrivacyFeed EHRNews HIPAANews DataBreach TexasNews DataPrivacy DataSecurity