Oral argument — Esposito v. Refuah Health Center, Inc.

25-765 and 25-766. We'll hear, I think, first from counsel for plaintiff appellants, and then from the government, and then from appellate counsel. So, Mr. Parkhill, you're first, and you've reserved two minutes for them. Thank you. Good afternoon. May it please the Court, Anthony Parkhill on behalf of plaintiff's appellants in both actions. These two cases arose from allegations that the defendant, Refuah Health Center, failed to prevent a criminal cyber attack that impacted plaintiff's personal information. These actions were originally filed in state court. They were removed pursuant to 42 U.S.C. 233, in addition to 1442A1, the general officer removal statute. And there are two issues based on the proceedings in the district court that are before the court today. The first is whether the defendant's actions in failing to protect its patient's information from a criminal cyber attack constituted a medical, surgical, dental, or related function for the purposes of 42 U.S.C. 233A. And so give us your best version of how to interpret that. So I think the best interpretation of this provision, which has been the Ninth Circuit said it's not a model of clarity in the Bloomberger decision, but I think that the Fourth Circuit's analysis of this provision in the Ford v. Sandhills case is extremely detailed, it's extremely textual, and I think it makes sense in the context of the statute. And that interpretation was that this provision, this, by the way, is the only Circuit Court of Appeals decision interpreting the meaning of related function in the context of a cybersecurity clause action. And what the Fourth Circuit held was that this provision, related functions within this provision, refers only to the provision of health care. So in reaching this conclusion, the Fourth Circuit looked at- So that's the definition you want us to adopt? So that- The provision of health care. That is, I think, limiting 233A's related function language to that interpretation makes the most sense. But even if this language is given any of the other interpretations that courts have used, including the interwoven tests that certain district courts within the Ninth have applied, or even the test that the district court here applied, which is a related function is a function that has an established relationship to the practice of medicine, even applying that test, the outcome of this case should have been different. So it's one way. I think the way that the defendants want to read this is medical, surgical, or dental functions, or tasks related to those functions, right? And as opposed to what you're saying is you think that it's what the Fourth Circuit, I think, is saying. It's medical, surgical, dental, or similar functions. Is that really- So that is one of the interpretive differences. As Judge Nathan was asking you, tell us exactly what you want the definition to be. Is it exactly what Ford says that you want us to adopt? Yes, Your Honor, although plaintiff's position is that even under any other interpretation that a court has used, that the outcome of this case should have been the opposite outcome. Because even if this is parsed to mean- So presumably we have to interpret it in order to issue a decision. And so the language, and I understand, I mean, at least you agree with the government's definition that it would fall within-without this. But so just so I have it in hand, what do you propose the meaning to be? That the related functions, as was held in the Ford v. Sandhills case, refers to other categories of the provision of health care. As a district court in Frankfurter held in a decision on Monday, this is a list of items all concerning healing the human body, and related functions needs to be understood- So in the context of treatment. That's correct, Your Honor. So hypo, I'll ask you, let's say that-let's say it's not a data breach, but a doctor just orally provides medical information about a patient to somebody else. So these cases, and these are cases that have been decided. There are a number of district court-level decisions about breaches of confidentiality that aren't cybersecurity cases, and those cases easily fall within related functions under 233A. And the issue there, the critical distinction, is that cybersecurity is very far afield from the provision of medical treatment. It's the conduct- It would depend on the specific facts of this disclosure, but in general that would be a related function pursuant to 233A. And what about slip and fall outside the health care center? So these premises liabilities in sort of the-in a majority of all decisions interpreting this provision, the way that judges have tried to interpret this provision is that there's a category of cases on one side that's clearly outside the provision of 233, and that the emblematic case that they mostly use is a premises liability case. And they say- Do you agree with that? I certainly agree that a premises liability action is outside the related functions under 233A. I would say that if you look at the district- So this fact is a fact that all the courts interpreting this language accept, and then they use this as a way of sort of handicapping or figuring out whether their analysis works. Because if their analysis- That is- Yes. Legal analysis. Yes. And if their interpretation of 233A says that premises liability would be a related function, then they've got the wrong test. So this is actually an analysis that the district court in this action conducted. And what he found in applying- what the court found in applying the established relationship to the practice of medicine test was that these duties that are involved in premises liability cases are duties that just exist generally and apply to the world generally and have nothing much to do with medicine. But the duty of medical confidentiality is a special duty that exists in the context of the provision of health care. And that meets that established relationship to the practice of medicine. The problem with that analysis is that the focus needs to be on conduct, not on duty. It's not on causative action. In interpreting the scope of 233A, we have to look at the conduct. And so is the difference- because I think you said that the doctor who actually picks up the phone and discloses the information does fall within related functions. But where the information is seized by a hacker, it does not. How- is that because somehow it's different because the conduct is intentional? I'm not sure how that affects the relatedness. No, Your Honor. It's not about the intentional nature of the conduct. It's because if you look at the- it's about the fact that the physician did it on the one hand. And protecting information, cybersecurity- So what if instead of the physician doing it, it is a staff person? Again, these hypotheticals get difficult because they do depend on the nature- Well, that's why we get paid the big bucks to ask them and you get paid the big bucks to answer. If the staff person who made the disclosure was a nurse or some sort of professional who was involved in the treatment of patients because it's the conduct- So does it matter who set up the database? If it's a small medical practice and the lead doctor fancies himself a tech expert and he sets up the database that's breached, then is it a related function because he's a doctor? It's not based solely on the identity of the person. It's based on the conduct. And this information technology function, whether it's being performed by a physician, which I think would strain professional responsibility, or being done by an information technology professional, which I think in general it is, the issue is the conduct. So when disclosures are made- So many of the cases deal with mandated reporting contacts like the INRAE, CARISA, Regalia. These cases involving mandated reporting, the reason that these disclosures that are made by these health care providers are a related function is because, as was held in the Teresa T. case, it's an element of the doctor's examination of the patient. So the duty to report the abuse is part of the physician's treatment of the patient. So if the physician, as part of her examination, is duty-bound to record in the patient's record a condition, a complaint, that information, does that convert data maintenance, information maintenance, into the same way that mandatory reporting is part of the- Because I watch the doctor sit there and type things in, right? That's part of my appointment. How is that different? Your Honor, the difference, again, is the conduct at issue here. It's not about a general duty of maintaining information in confidence, which belongs to health care providers and a wide array of other types of businesses. It's about protecting information from cyberattacks. So if we're thinking about what this means in the context of a clinic, I think a clear analog would be, like, security measures to make sure that the file cabinets containing paper medical records, like, this is very far afield from medical treatment. No medical expertise can be brought to bear on this topic. It doesn't fall within the realm of medical professional liability. This is a topic and a subject that belongs in a completely separate domain, as was held by the court in Fort Higgins-Van Hilton. I know I've run far over my time. No, that's okay. You asked for more time, and I just figured we'd keep you up as long as we need you. But if we didn't need you, we'd cut it off. So let me ask Judge Cabran, do you have any additional questions? Well, a simple one. What exactly do you want us to do? What's the decree that you're seeking from us? So plaintiff appellants are asking that the court reverse the order of the district court denying plaintiff appellant's motion to remand, reverse the order of the U.S. District Court granting Refua's motion to substitute the United States as a defendant, and vacate the judgments entered in favor of the United States, and then remand this action with instructions to remand this matter to state court. One further question. There wasn't much discussion in the brief, so I'll get your views on it. Of the language that precedes, as I read it, medical function, surgical function, dental function, or related functions, which is resulting from the performance of, which at least to my ear maybe doesn't resolve what the meaning of related function is, but it has a sort of expansiveness to it that I don't know that I've seen carefully addressed. What's your view of that language? So I think the right way to parse these specific words, which follow the category of damage limitations to personal injury and death, resulting from the performance of, what that language does is exactly what this court held in Cuoco, which is put the focus on conduct. The focus for what falls within 233A is, are damages resulting from the performance of medical, surgical, dental, or related functions, resulting from the performance. It's about conduct. It's not about legal duties. It's not about the duty to maintain confidentiality. It's about injuries that result from the listed conduct. Okay. All right. We have your time for rebuttal. We can hear from the United States, Mr. Torrence, with two minutes reserved for rebuttal from the government. Thank you, Your Honor. May it please the Court, Benjamin Torrence on behalf of the United States. Since the Court's focused on 233A, I will start there. We also endorse the Ford test. We think that that is the correct analysis of the statute. And I think one potentially helpful framework for this is, when asking, since the word in the statute is function, is to ask whose function it is. Is it a doctor doing a doctor's function, or is it an IT function? Is it something that you would typically see the IT department doing? And in this case, it falls squarely in that latter. And I would say that that is not only what Ford said, but Ford relied on this Court's decision in Cuoco to come up with that test. They quoted the Cuoco decision, saying that it's an act in the capacity as a doctor, responsible for and rendering treatment to the patient. And that really accords with the plain language of the statute, as the Fourth Circuit told us. Related in the view that RFRA offers is essentially limitless. They seem to say that almost anything that a health sensor does or has a duty to do could be covered as a related function. That would include the district court in Hawaii gave a very good analysis of that. That would include everything like keeping your building up to code. It would include clearing the snow from the sidewalks to make sure that patients are safe. All those things are things that a health sensor has to do, and has to do to keep its patients safe and to care for its patients. But that's far more than Congress could have possibly intended. If we look at not only the plain language, but the context of the statute, it's clear from that and the legislative history that what Congress is doing in Section 233A, when it originally enacted it in 1970, was to ensure that the public health service would be protected from medical malpractice liability, would be protected from the cost of medical malpractice insurance. And we see that from the statute is replete with references to medical malpractice. The origin of 233A in its original form was a request from the Surgeon General to immunize public health service employees from medical malpractice suits. They also, you know, they modeled this on the old Drivers Act, which immunized federal employees from damage to property. The X says the word property when they copied the statute, when they copied the Drivers Act over to the Public Health Service Act. And they limited it to damages for personal injury or death, which as the Fourth Circuit again pointed out is exactly the type of damage that you would expect from medical malpractice, but not from some other type of tort. So there are numerous clues that tell us that the board— Can I ask, Mr. Torrence, how you'd respond to the hypothetical of a— we'll start with a doctor who orally releases patient private information and then take a staff, a non-medically trained staff member who does that. Right. So the Fourth Circuit did—they distinguished the Mele case, I don't know how it's pronounced, from the District of Connecticut, and suggested that that first hypothetical would be immune from liability because the same test that I'm suggesting here, it's a doctor doing a doctor's responsibility. A doctor has a responsibility in the course of providing treatment not to walk into the waiting room and tell everybody confidential information or something like that. To disclose that improperly, that's a doctor violating a doctor's function. The staff member, again, it goes back to the function. It's not about who. So if a staff member is part of the medical staff and does that same thing, I think that probably would be immune as well. But it's different from when the health center says, maybe it's to its IT department or maybe it's to its acquisition department, go out and buy the firewall software and install it correctly and make sure that the medical and personal sensitive data that we have is kept safe. That's a different function. That's something that, first of all, lots of businesses are responsible. Lots of businesses have a duty to do exactly that, to safeguard personally identifiable sensitive information. That function is not something that's unique in any way to the medical field. It's not a medical function and it's not a related function in the sense that the statute uses that term. So in essence, Ford completely gets it right and adopts a test that is much more workable than the one that was applied here or the one that Rethuah suggests in this case. It's one that's consistent with the statutory history, with the statutory language. And so we would urge the court to adopt that. If I might, I know I'm over time, but if I might say a word about removal as well. First of all, the removal statute requires that there be a colorable federal defense and we would suggest that on the merits they don't have one and so that's a reason to reject removal and to direct, in response to Judge Cabranes' question, to direct remand to the state court because removal was improper. On the other ground, we know we have the Agian decision that we do disagree with, but at the least we would ask the court not to expand Agian even farther. The test under 1442 involves a person acting under a federal officer who has to be assisting that federal officer in the basic governmental functions. It is not a basic governmental function to assist a private entity to protect information that it received and has a duty to protect as part of its private business. That is far afield from even what Agian said. In Agian, it was the provision of medical services that was at issue. It's a different standard because it wasn't technically medical malpractice maybe, but it was the provision of medical services. It was a Med-Mal case. Agian was. Right. So doesn't that distinguish it from this case? Yes. I mean, that's essentially what I'm saying. Okay. This is a different type of tort altogether. And so even if we accept the analysis of Agian, it would be a fairly major expansion of it to say that it applies in this case. I just, I guess I'm not, maybe it's overly simplified, but we know that Refua has been deemed an employee of the public health service here. Yes. And what they're doing in provision of service is acting within the scope of that employment, right? What they're doing in providing medical care to their patients would be, but were we asked, had we been given the time to respond as directed by 233L, our advice to the state court would have been the negative response. It's not like a detour or a frolic question. I mean, I just don't see the two as identical questions. So it's hard for me to see how the collection and protection of private medical, private information, medical information by an employee of the government, essentially as deemed part of the public health service, is not acting within the scope of employment. I think that there's a difference between scope of employment and scope of the deeming. And I would not characterize this private entity as a government employee. So a public health employee, public health service employee. Section 233 says deemed for the purpose of this section. It's very limited. Yes. And so it has to be the type of thing that 233G covers, that the grant covers, that it's about providing medical care to underserved communities. But that doesn't extend to other functions that they do as a private entity. Just as an example, the HHS provides all these health centers with a manual directing them how to comply, and they advise them to make sure they have insurance for all these other types of things that private businesses would be insured for. It's only what's within 233A, essentially the medical malpractice coverage, that the immunity applies, and that we would advise the state court that the deeming applies. So it's a much more limited scope than just anything connected to their provision of health care. Thank you. Thank you. All right. And you do have two minutes for rebuttal. And we'll hear now from counsel for RFUA, Mr. Freitas. Thank you, Your Honor. May it please the Court, Matthew Freitas along with Rosie Dawn Griffin on behalf of RFUA Health Center. I'd like to knock out hopefully a couple of discrete points and then move into a larger one concerning what's within the scope of a health center's project and its deemed status. First, to your question, Your Honor, about whether related functions means similar functions or tasks, Congress could have used the word similar, and it did not. And the omission of that word is meaningful. Second thing I'd say is this immunity extends to board directors, officers, employees, all non-clinicians of a health center. The phrase that gives that immunity meaning is related function. It's not the medical function so much. I mean, you could have a medical assistant. But primarily, related function gives meaning to the immunity that is unquestionably extended to officers, board members, all non-clinicians of a health center. As to the scope of a health center's project and the scope of its deemed status, I'd refer the Court to appendix page 133 and the pages before and after. But that page in particular refers to an attestation that the health center has to make in an application prescribed under law, under the FISCA statute, the secretary has to prescribe this application and did so. And in that application, requires health centers to attest to doing a variety of things. I think this application can easily be likened to a contract and or a job application, where you have to state your abilities, knowledge, you know, the sort of things that you see in a job description when applying to work for the federal government. And in this page, the health center has to attest that my health center has developed and implemented an annual risk management training plan by staff members based on identified areas and activities of highest clinical risk for the health center. And then it lists medical HIPAA, medical record confidentiality requirements, as one of those mandatory areas of training to all personnel, not just providers, the entire health center. And the way in which you would train them could differ, of course, but the training has to be to everybody. And you have to attest under penalty of perjury. The second page that I want to call the court's attention to is 138. Same application. The health center has to attest under penalty of perjury. I attest that my health center has implemented systems and procedures for protecting the confidentiality of patient information and safeguarding this information against loss, destruction, or unauthorized use consistent with federal and state requirements. This is the secretary who the Blumberger decision out of the Ninth Circuit described as having the expertise in managing the health center program and the steaming program. That secretary has authority over both. That secretary has drawn a connection explicitly between confidentiality and the highest clinical risk for the health center. Clinical risk, not administrative risk, not slip and fall risk, but clinical risk. And I'll tell you what you won't find in this application. You will not find an attestation that we plow the parking lot or that we sweep the floors or that we make sure the lighting in every room is adequate. Those are things that, of course, you have to do, but they don't meet the test that Judge Karras laid out here. And I would say, and we're going to, the conclusion that I'm getting to is that's the best test that any court has devised. Judge Karras did fantastic work here surveying every case out there that's dealt with related functions. Granted, it wasn't an endless list. There were only so many because there are only so many health centers requesting coverage for the functions that could qualify plausibly under the related functions prong. That test is administrable, it's reasonable, and it's faithful to the text. He goes through the entire statute word by word, and what he comes up with essentially is faith-based test, faithful to the text, I should say, where he's saying, you don't look at the skies, the limits of relationships. He's aware of the Supreme Court's caution. It's not uncritical literalism. Let's look closely at what we've got here. You have to have, and he used various words for the relationship, close, discoverable, established, real. In other words, meaningful connections between the function that you're performing that can give rise to a claim and the medical care that you provide. And then he said, there's two features that I would look at to determine if a function meets that close, discoverable relationship test. And the first is, is the function required or imposed on the health center as a provider of care? And second, is that function essential or is it necessary for effective care? That's going to weed out all the hypotheticals that you've heard, and that's going to narrow down, what is a broad phrase? It's broad for a reason, and I think this touches on another question that you asked of my friends, and that is, you know, the types of claims that would be covered. It's important to note that 233A, interpreted by the Supreme Court unanimously in Hui v. Castaneda, which, by the way, sided with Cuoco in a split between the Second Circuit and the Ninth Circuit, undergirding Cuoco's observations, saying that this immunity is broad enough, easily broad enough, to cover both known and unknown causes of action, meaning we're going to give this immunity that has flexibility in a broad suite so we don't have to come back and amend this statute, Congress. We are going to cover claims that we don't even know the names of yet. And I would submit to this Court that this claim, this data breach cybersecurity claim, all that is is a modern-day equivalent of a breach of confidence claim, a breach of confidentiality, an intrusion upon seclusion, an intrusion upon privacy. That is all it is. These claimants could have come in individually and said, you breached my confidentiality. The immunity cannot turn on how the plaintiff designs or artfully pleads the cause of action, and we've seen that time and again. I have a whole bunch of hypotheticals, too, but I don't want to suggest them, but I wanted to hear if the Court had any. Of course I want to answer yours first, but I do want to tell you one about a premises liability claim. To really get down into, you can distinguish between the types of functions at issue. We had a case out in Oregon where the allegation was the provider of a residential treatment facility. This is Moretti v. Central City Concern, or Letty Owings. The provider had a residential treatment facility where they housed mothers with newborns where the mother had drug addiction issues, drug abuse issues. And the model of care is that it's better to keep the unit together. There's risks associated with it, but ultimately better. If you can get the mother out of that treatment program with her child, best-case scenario for ultimate outcome. Unfortunately, terrible outcome in that case. The staff, non-clinicians, failed to monitor, allegedly, the room that the mother was put in with her child. And she rolled over on the child and suffocated the child. That function of walking room to room and checking on mothers, done periodically by a standard of care, was deemed to be a related function. That was a high school graduate trained person told by the clinical staff what to do and why to do it and how to do it, and then performed it. To your question about what if a chief medical officer designed the electronic medical system, they are absolutely involved in the design of those systems. They have to know how to coordinate the telemedicine records with the behavioral health records. The case you said, the language that struck me was that they were told what to do, where to do it, and how to do it. And that seems unlikely to be the case of doctors or medical staff vis-à-vis a sophisticated IT system. Doesn't that? I'm reluctant to say because I am not trained in those areas and we don't have, we didn't have. I mean, if your law firm were setting up an IT system, it's hard to imagine it's the lawyers telling the what to do, where to do, and how to do it. I think the answer, maybe the best place to direct your attention, Your Honor, to the answer to that question is in all the preambles to the privacy rules and the security rules that are implemented, that implement the HIPAA legislation. And there you will see, it's a slog, we've read them all, you will see a description of the privacy officer and security officer in the C-suite of a health center coordinating with those other C-suite personnel to design systems and processes to safeguard, which is why I believe it's in the job application to implement systems and processes for protecting confidential information and also why it's in there that you have to train everybody on them. But the way records work today is, you know, they're in the cloud. There's electronic monitoring of pacemakers, of blood sugar levels. The physicians have to know how that is going to work. They're going to have to know how to access that. They're going to have to know what the threats are when they access it. So that, if I could dovetail nicely into another hypothetical, which is an actual case out of California, where a provider, in communicating with what they thought was another provider, was tell prey to a fishing expedition. And they clicked on something they thought was a provider's email. It was a provider's email, hijacked. And they were trying to share medical information. And boom, breach. That's the doctor, or in this case, I think it was a dietician. That's a provider, licensed provider, trying to share information about a patient with another provider about patients to improve patient care. And boom, data breach case. So these cases, they can materialize. What about the premises liability cases then? And so this is, let's say the doctor is the one, this is an orthopedist. And the doctor says, look, people coming and going from here. I do hip replacements. People coming and going from here are going to have limited mobility. We need to ensure there's good ice removal. There's a ramp. All those things. The doctor is the one thinking about that maybe, because she knows that her patients have these specific mobility issues. Is it her responsibility if the engineer who puts in the ramp does it wrong and somebody falls? Or if the snow removal guy doesn't get the snow removal done right? I would say, Your Honor, that doesn't meet either of the two prongs of the Judge Karas test. That is not a requirement that is classically, traditionally imposed on providers. That's imposed on anybody who has a building. And there are providers who don't have buildings. They have mobile vans. They take their doctor's satchel and they go to the patient's house. So the mode of delivery of care varies too. But I'd say it doesn't meet the two prongs. And that's how you weed those cases out. I'll also say those cases aren't brought. And there's a reason for that, because the plausibility starts with the health center. And they are just, there's not a floodgates problem here where they're asking for coverage of claims because someone slipped on the sidewalk or on the ramp up into the building. But if the safety of the patient's information is the doctor's, is within the scope of the related function to medical care, then why isn't the safety of the patient's person within the scope of a related function to medical care? I'm just not aware of any authorities that are unique to providers. I'm not asking if there's authority. I'm sort of asking you to, because it does feel to me like those are hard to separate. And if we hold here that safeguarding information about a patient is a related function to the medical treatment, I'm asking you to tell me why the next case would say, but safeguarding the patient's personal physical safety, not during the exam, but in the facility, is not. Yeah, I think maybe the word trust would be the key concept to differentiate between those concepts. The duty to protect confidentiality goes back thousands of years to the Hippocratic Oath, all the way through every medical opinion and ethics opinion of every profession up through HIPAA, including the Guthrie decision of the Court of Appeals that was a certified question from this court. Unbroken. What you don't see is an unbroken chain of having a ramp going up into the building that is properly connected above the stairs. I don't know, first do no harm or something like that. Well, this is true. But that, what's at the core of that is the trust piece. And you are not going to destroy the trust of your patients if you fail to properly de-ice the entryway to your building. Let me ask you another hypothetical. I was in an office one time, and I could hear the patient next to me, which was a pediatric dental practice. I could hear everything that kid was dealing with and everything the dentist was saying to his mom. That's a HIPAA violation presumably at some level. I'm hearing everything. Is that dentist, is it a related function to that dental practice to ensure that there is soundproofing? Yeah, I think, as I understood plaintiffs in the United States, they'd suggest that that's an easily covered case, is that if a provider is, and I don't want to know where you receive care, but that if a provider is doing that, yes, that's a real problem. If you're not closing the door. Well, the door is closed. I was not even at a doctor's office. This is just one of those buildings that has a bunch of different stuff in it. And the office next to the office I was visiting happened to be a pediatric dentist. That dentist may or may not know upon renting that space exactly what the quality of the wall is. But, again, you're telling me that that would be a related function, ensuring the soundproofing between two suites in a shared building. Yes, Your Honor. I think you'd find that in the security rule of HIPAA, too. It's every form of thing you have to do to say. Anything about data. That's what's magic here is that it's data. It's that it's medical data. And I would say on that piece, that does distinguish Ford from this case. Ford was about privacy information, your social security number, your bank account. This case is about health information. Doesn't it also say there was disclosure of social security numbers? Another PII? Yeah, but I think you can check me if I'm wrong. But I believe you need other data points for that to become personal health information. And these are defined terms. But the Ford decision made a point of saying. So if it were just PII? Yeah, I think. Then you would say what? So a good hypothetical would be if there was a breach of your employee personnel files. That is not the same thing as personal health information. What about, I like my HIPAA. So it's a patient, but it's not medical information specifically. It's just name, address, social security number, phone number, personal identifying information. What's your view then? That is a hard case. That is similar. I mean, the Ford case is about that data. I mean, I think the decision actually is inconsistent with the record. I think the record suggests there was personal health information. But the decision says there's not. The decision of the court says it's PII as it's known only. I think we have that here too. So I think we do need an answer. That is so closely connected to your health information and the systems that would maintain the patient's personal information is going to have the medical information too. So you have to safeguard it the same way. It's actually the conduct to safeguard the system. Plaintiffs said this repeatedly. That's fighting the hypo. Sorry. You're fighting the hypo, I think. Let's say this is a breach in which only name, social security number, address is breached. What is your answer as to immunity? I think that function is so closely connected to your personal health information as a patient that it has to be covered. It's a harder factual issue, but it's a function that you've got to provide. Yeah, I think it's close enough. Maybe this is my instinct, and I think that's what most of the decisions go on, which isn't what we're trying to do here. We're trying to come up with a test that can be applied and understood by the courts. I think all the different tests, it sort of feels like at the end of the day it's still going on. Whatever we're choosing, it still feels like it's going on. I think that's true. But it's hard to look at someone in the face and say that as a provider, one of the duties imposed on you as a provider of care, and what you have to do necessarily to provide effective care is sweep your parking lot. Like it's just, that's a different thing. And so there are, you can separate cases. There will be harder cases, and I think Judge Karras identified, look, these are not, there will be other situations that are difficult. So run the PII that go through Judge Karras' test, because I'm not sure that gets the result that you just disclaimed. They have to as a matter of law under HIPAA. HIPAA does require protection of both categories, and they will give it the definition of PII, and they'll give a definition of PHI. So it's not distinguishable from the court. Well, it is, but it requires another fact that I did not mention, which is that all the conduct in that case was the conduct of a third-party vendor. So that was outsourced by Sandhills Medical Foundation to NetGain. The name of the entity is not in there, but that's not here. This health center did it in-house, all with its own people. An alternative to that, and maybe that's what everyone will do, potentially, because in those cases. If it's outsourced, you agree, then it's not in there. Your questions are brutal. But I don't know that I'm getting paid enough to answer them. You have to answer the questions. I know. I do think that that passes the test, and that's because of the connection between privacy and health under HIPAA. So that is a law imposed on all covered entities. It defines the group of covered entities. They are providers, so it meets the first prong, and it meets the second prong because you simply can't exist if you are not taking that data from your client in order to provide the care. You can't exist if your front doorway isn't accessible. If the test is can you exist as a health care provider, then we are as far as we can be into status liability. I don't think so, Your Honor. I don't think one person slipping and falling on an entranceway affects the thousands of other patients at the health center. I think one data breach makes every patient worry that they can disclose their sensitive information and whether they're going to provide honest information and get quality care. Fundamentally different. People don't hear about a slip and ball and go, gosh, I'm not going to go to that doctor that I love and has treated me well all these years. They are going to pause if they hear that their provider can't keep their confidential information secure because they have to disclose really sensitive things to get appropriate care. You just can't say that about slip and fall. You can't say that about any of the premise liability concerns. You could say that about the one patient, maybe, who had the injury from the thing. They might be so upset they don't come back, but not because they don't trust the quality of the care of the provider that's back in the exam room. So I think you can make these distinctions. Judge Kerr has looked at every case and applied his test to every one, so all the known cases that we have, I think you can apply this test. Are there fact patterns that haven't yet arisen that will make the application of that test harder? That could be. But this test works for every case we've seen. All right. Thank you. Thank you, Your Honor. Judge Kibanis, anything? I'm fine. All right. Thank you. We'll have Mr. Parco. You have two minutes to rebuttal. So I guess I'd start by saying that the test the district court used, there is one conspicuous case that it fails, which is Ford against Sandhills and the Fourth Circuit. And I think the reason for that is the Ford case was decided after the district court's ruling in this case, but the fact is the district court's analysis applying that test cannot explain or reach the outcome of Ford. And at the same time, applying the Ford test actually does a remarkable job of explaining 15 or 20 years of district court decisions looking at edge cases outside of the cybersecurity context. If we look at the Ford analysis and use that as an interpretive lens to look at what district courts have actually done in interpreting this language, it does a remarkably good job of getting the outcomes of all of those cases right. Just briefly, with respect to statutory interpretation, officers, board members, et cetera, why are they included as being covered by the immunity? And the answer is the statute doesn't depend on what wrapper you put a medical malpractice claim in. And we see this in a lot of the cases that are cited throughout the briefs. People will sue. They will file what is in essence a medical malpractice case, and they'll say the medical center was negligent in hiring this physician who was inexperienced. I think that was something we saw actually in Cuoco. And the holding of Cuoco is that that wrapper that the case is in, whether it's a Bivens action sounding in the Constitution or a state law medical malpractice action, isn't what is relevant to the application of the immunity. What is relevant to the application of the immunity is the conduct. And I think the Moretti case that counsel talked about is another nice illustration of that fact, where Refua talked about how this individual. So conduct then gets you a level of generality problem, right, how you define the conduct. If the conduct is maintaining patient confidential medical information. So the relevant conduct is the conduct in caring for patients. That is the Ford v. Sandhills test. That is the relevant conduct. So in this case in Moretti, this individual with relatively little medical expertise was performing a medical function. They were checking rooms. That was the provision of care. So there is this level of generality. So it's not just you're not then it's really not just saying conduct. It's saying conduct in the provision of treatment essentially. That's correct. Or something like that. So that's the level of generality problem. Because conduct just begs the question of what conduct we're looking at, I think. That's correct. And I should have more fully stated it as conduct in caring for patients. That is the test from the Sandhills case. On this question of outsourcing, I don't believe. Just to focus on that, is a doctor's maintaining of a patient's medical information part of the provision of care? So it has to be more specific than that. So if a physician, we talked about cases where physicians disclose information, clearly part of the provision of treatment. And that's conduct. That is. So at that level of generality, a doctor's maintaining, doctor's conduct in maintaining private medical information in the provision of care is within the scope. It can be. And a circumstance where it just isn't is when it's about, it's a case about the plaintiff sued. I mean, it just seems like at some level that's the question. And then how it's done, including with the updates of technology over time. And you want to say with the updates of technology over time, it moves out of it. And I'm not sure what textually would account for that. So I think looking at the outsourcing question is helpful. I don't think there's anything in the record that supports the position with who has stated that they did this all in-house. I don't believe that's in the record. Often in cases I've done, it's not the case. I don't believe that the question of whether a separate vendor is used for this or not matters. Instead, what matters is whether the conduct. So here we're talking about failing to prevent a criminal cyber security attack on information technology systems. Whether that conduct occurred in the course of hearing provisions. That's a very specific level of lack of generality. That's a description that's as specific as it gets. That's all the case is about. The only, that is what this case is about. That is what we sued RFUA for. If RFUA wasn't a health care provider, but was. Of course, that's what every case is about, the specific thing it's about. And the question is, under the language of the statute, what's the appropriate level of generality to understand the relevant conduct to answer, whether it's relating to the provision of medical function or related function, et cetera? I think the Fourth Circuit's interpretation of related functions as meaning other fields of healing is the right interpretation of related functions. I think if we apply something like the test the district court here used, we end up seeing that these premises liability cases come out on the wrong side. So there are actually, and this was cited in the briefs by the United States, and I believe in the Maui decision by the district court, there are actually a number of health care regulations that touch and concern exactly these issues about safe and accessible clinics. So there are Medicare regulations requiring health care providers who receive Medicare to do things like comply with safety codes, rules with ventilation, lighting, water supplies. And just as a treating physician, it's not within their professional capacity to make sure that all of the electrical wiring in the clinic is grounded. It's something they must hire an electrician for. It is not a medical, surgical, dental, or related function. And cybersecurity is the same thing. And so if the district court had applied this test correctly, I don't think that the correct application of the district court's test in an established relationship to the practice of medicine, I don't think that it would have resulted in the outcome that the district court found. I think that this area of cybersecurity breach litigation is something that I've been doing for most of my career, and the private businesses that the district court found would not be subject to this type of case are most of who I've spent my career suing. So there's nothing about this liability, this risk, that's unique to health care clinics. Thank you, counsel. Mr. Torrence, you have two minutes for a button. Thank you again, Your Honor. I reiterate that the test is not workable, and I think that Rufua's presentation shows us that it's not workable. We're talking about bringing in HIPAA. We're talking about bringing in the concept of whether the doctor has lost trust. This is really far afield from the text of the statute. The text of the statute talks about the function that they're performing. And so I think the question we need to ask is whose function went wrong? Is it the doctor doing a doctor's function? As this court said in Cuoco, in the course of providing medical treatment, which is exactly what the Ford decision said. Or is it an IT department function? And there's no doubt that there will always be difficult cases at the margin. It's not going to be a clean test always, but that is the test that is most faithful to the text and to the history and to the objectives of this statute. And that's why the district court is fundamentally wrong about this. The test that the court adopted talks about being necessary to effective medical care, and in a sense that's not that different from what Ford said. But the problem is that the way it was applied seems to have really no limit as to what duty of the health center would be covered by this. And as Ford said, it's not about the duty, it's about the function. And that's why we ask this court to reverse. Thank you. All right. Tandem cases are submitted, and that concludes the hearing.