Key Points

  • The Seventh Circuit affirmed orders remanding four consolidated suits against health care providers to state court.
  • Health care providers that built online patient portals under CMS's Meaningful Use Program were not "acting under" a federal officer within 28 U.S.C. § 1442(a)(1).
  • The court held that the providers merely complied with federal regulation and lacked the unusually close relationship with the federal government that the statute requires; a nonbinding ONC patient-engagement guide did not change that.
  • The panel joined the Third, Fifth, Eighth, Ninth and Tenth Circuits and did not reach the statute's remaining elements.

Four health care providers facing nearly identical lawsuits in Indiana over the alleged sharing of patients' health data with Facebook cannot move the cases into federal court, the U.S. Court of Appeals for the Seventh Circuit ruled on Oct. 20. The court held that building online patient portals to earn federal incentive payments did not make the hospitals agents of the federal government.

A three-judge panel affirmed orders from three judges of the U.S. District Court for the Southern District of Indiana that sent the suits back to state court. Circuit Judge Lee wrote the opinion for a panel that also included Circuit Judges Jackson-Akiwumi and Kolar. No judge wrote separately.

The ruling turns away the hospitals' central argument for a federal forum: that they were "acting under" the Department of Health and Human Services when they built their portals. The panel said it was joining the Third, Fifth, Eighth, Ninth and Tenth Circuits, which had rejected the same theory. The appeals were argued on May 28, 2024, nearly two and a half years before the decision.

The lead case was brought by Brian and Annie Elkins, patients of Columbus Regional Health, a health system serving ten counties in southeastern Indiana. They allege that a Facebook tracking software called the "Meta Pixel," embedded in the system's website, shared their health data without their consent. Their suit asserts breach of implied contract and unjust enrichment, along with violations of the Indiana Deceptive Consumer Sales Act and the Indiana Wiretapping Act.

The other three appeals involve nearly identical claims against Goshen Health System, the Board of Trustees of the Hancock Regional Hospital and Methodist Hospitals. A fifth appeal, against Sarah Bush Lincoln Health Center, was consolidated with the others and has been dismissed. "Given that this is a consolidated appeal, our holding applies equally to all four appeals," Lee wrote.

Each hospital removed its case under the federal officer removal statute, 28 U.S.C. § 1442(a)(1). That law lets federal courts hear suits against the United States, federal agencies, federal officers and persons "acting under" a federal officer. The hospitals said their portals put them in that last category.

Their theory rested on the Health Information Technology for Economic and Clinical Health Act, a 2009 law known as the HITECH Act. The statute directed HHS to make incentive payments to Medicare providers that qualified as a "meaningful EHR user," meaning a meaningful user of electronic health records, and to cut Medicare reimbursements starting in 2015 for providers that fell short. Regulations issued in 2010 by the Centers for Medicare and Medicaid Services created the Meaningful Use Program. One of its objectives required providers to give patients "timely electronic access to their health information," and providers built patient portals to meet it.

The district court in the Elkins case had found that the hospital's "patient portal is not something the government 'needs.'" It also concluded that maintaining private patients' electronic records is not a "basic governmental task."

Lee's analysis began with Watson v. Philip Morris Cos., a 2007 decision in which the Supreme Court held that a cigarette maker was not acting under the Federal Trade Commission despite the agency's close oversight of cigarette testing. The Supreme Court wrote there that acting under the government "does not include simply complying with the law." Lee contrasted that ruling with Seventh Circuit decisions allowing removal by manufacturers that built turbines for an aircraft carrier, heavy bombers for the Air Force and that supplied raw materials during World War II under government specifications and supervision.

The hospitals argued that, unlike the cigarette maker, they were performing a "fundamental federal governmental task" by creating the portals. The panel disagreed. "When the health care providers construct and operate their patient portals, they are not doing the government's business," Lee wrote, adding that the portals are private websites built by private actors that benefit providers and patients most directly.

Lee acknowledged that the portals serve a federal goal. "To be sure, the patient portals advance government policy by making EHRs more accessible," Lee wrote. "But a private party does not accomplish a basic government task every time it acts in response to a government incentive."

The court gave a second reason. Federal officer removal requires an "unusually close" relationship with a federal superior "involving detailed regulation, monitoring, or supervision," the opinion said, and the Meaningful Use regulations "do not provide any details as to how Defendants were to maintain their online patient portals." The relevant rule required only that providers let patients view, download and transmit their health information online within four days of its availability.

The hospitals also cited a patient-engagement guide published by the Office of the National Coordinator for Health Information Technology. Lee wrote that the guide is not binding and describes itself as a "compilation of tips and best practices … from clinicians and health systems." Such "nonbinding recommendations about patient portal development," the court wrote, fall far short of the detailed government specifications that the court's military contractor cases involved.

The panel cited the Eighth Circuit's 2023 ruling in Doe v. BJC Health System, which said that designing private websites has never been a basic governmental task. It also cited rulings from the Third, Fifth, Ninth and Tenth Circuits and wrote, "we see no reason to disagree with their analysis." Lee closed by borrowing the Supreme Court's phrase from Watson: the incentives, Lee wrote, are "regulation, not delegation."

Because the hospitals failed the "acting under" requirement, the court did not decide whether they satisfied the statute's other elements, including whether they had a colorable federal defense. The judgments of the district courts were affirmed, leaving the remand orders in place.