Craig Cunningham, on behalf of himself and all others similarly situated v. General Dynamics Information Technology, Inc.

PUBLISHED
UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT
No. 17-1592
CRAIG CUNNINGHAM, on behalf of himself and all others similarly situated,
Plaintiff - Appellant,
v.
GENERAL DYNAMICS INFORMATION TECHNOLOGY, INC.,
Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at
Alexandria. Liam O’Grady, District Judge. (1:16-cv-00545-LO-TCB)
Argued: January 24, 2018 Decided: April 24, 2018
Before TRAXLER and FLOYD, Circuit Judges, and SHEDD, Senior Circuit Judge.
Affirmed by published opinion. Judge Floyd wrote the opinion in which Judge Traxler
and Senior Judge Shedd joined.
ARGUED: Aytan Yehoshua Bellin, BELLIN & ASSOCIATES LLC, White Plains, New
York, for Appellant. James P. Rouhandeh, DAVIS, POLK & WARDWELL, LLP, New
York, New York, for Appellee. ON BRIEF: Roger Furman, Los Angeles, California, for
Appellant. Neil H. MacBride, Washington, D.C., Paul S. Mishkin, DAVIS POLK &
WARDWELL LLP, New York, New York; Attison L. Barnes, III, Stephen J. Obermeier,
WILEY REIN LLP, Washington, D.C., for Appellee.

-- 1 of 18 --

2
FLOYD, Circuit Judge:
Greg Cunningham alleges that he received an autodialed, prerecorded phone call
from General Dynamics Information Technology, Inc. (“GDIT”) advertising the
commercial availability of health insurance, without having given his prior express
consent, in violation of the Telephone Consumer Protection Act (“TCPA”). The district
court granted GDIT’s motion to dismiss for lack of subject matter jurisdiction on the
ground that GDIT is immune from suit under the Yearsley doctrine, which immunizes
government contractors from suit when the government authorized the contractor’s
actions and the government validly conferred that authorization. Yearsley v. W. A. Ross
Constr. Co., 309 U.S. 18, 20–21 (1940).
On appeal, Cunningham argues that the district court erred in conferring Yearsley
immunity and consequently dismissing the suit for three distinct reasons. First, he asserts
that the Yearsley doctrine does not apply as a matter of law to federal claims. Next, he
asserts that GDIT fails to qualify for Yearsley immunity both because the government did
not authorize its actions and because the authorization was not validly conferred. Finally,
he asserts that even if Yearsley immunity applies, Yearsley is a merits defense from
liability rather than a jurisdictional immunity. We find these arguments unpersuasive,
and now affirm the district court’s dismissal for lack of subject matter jurisdiction.

-- 2 of 18 --

3
I.
A.
Pursuant to the doctrine of sovereign immunity, the United States is immune from
private civil actions absent an express waiver. Kerns v. United States, 585 F.3d 187,
193–94 (4th Cir. 2009) (citing United States v. Sherwood, 312 U.S. 584, 586 (1941)).
Under the concept of derivative sovereign immunity, stemming from the Supreme
Court’s decision in Yearsley, 309 U.S. at 20–21, agents of the sovereign are also
sometimes protected from liability for carrying out the sovereign’s will. In re KBR, Inc.,
Burn Pit Litig., 744 F.3d 326, 341–42 (4th Cir. 2014) (internal quotation marks omitted)
(interpreting Yearsley as recognizing that private employees should receive immunity
from suit when they perform the same functions as government employees). This
immunity derives from “ ‘the government’s unquestioned need to delegate governmental
functions,’ ” and the acknowledgement that “[i]mposing liability on private agents of the
government would directly impede the significant governmental interest in the
completion of its work.” Butters v. Vance Int’l, Inc., 225 F.3d 462, 466 (4th Cir. 2000)
(quoting Mangold v. Analytic Servs., Inc., 77 F.3d 1442, 1448 (4th Cir. 1996)). “[U]nder
Yearsley, a government contractor is not subject to suit if (1) the government authorized
the contractor’s actions and (2) the government ‘validly conferred’ that authorization,
meaning it acted within its constitutional power.” In re KBR, 744 F.3d at 342 (citing
Yearsley, 309 U.S. at 20–21).

-- 3 of 18 --

4
B.
On appeal, we review whether the district court erred in conferring Yearsley
immunity on GDIT’s phone call to Cunningham.1 As relevant here, the Affordable Care
Act (“ACA”) directs the U.S. Department of Health and Human Services, Centers for
Medicare & Medicaid Services (“CMS”) to establish a system to keep applicants
informed about their eligibility for enrollment in a qualified health plan. See 42 U.S.C.
§ 18083(a), (b)(2), (e). CMS maintains the HealthCare.gov website, through which
individuals may enroll for health coverage under the ACA using an online application.
The online application requires visitors to provide their name and phone number, and
accept CMS’s privacy policy by affirmatively clicking an “Accept” box acknowledging,
inter alia, that CMS may use the phone number provided to contact them with more
information.
To carry out their statutorily mandated obligations under the ACA, CMS awarded
a contract to Vangent, Inc., which subsequently merged into GDIT, for contact center
operations support for CMS programs, including the HealthCare.gov website. Under the
contract, GDIT was required to make phone calls from January 1, 2015, through May 16,
2016, to inform individuals about their ability to buy health insurance through the health
insurance exchanges created by the ACA. In accordance with this instruction, CMS
authorized GDIT to use an autodialer to make the calls, provided a script for each call,
1 Cunningham filed this claim as a putative class action, alleging that GDIT made
hundreds of thousands of autodialed, prerecorded phone calls in violation of the TCPA.
For convenience, we refer only to the disputed call to Cunningham.

-- 4 of 18 --

5
and provided a list of phone numbers for each call. Section 17 of the CMS-GDIT
contract also required GDIT to “maintain a corporate compliance program” that included
“[a]n internal monitoring and auditing function to help ensure compliance with statutes
[and] regulations,” and “[a]n enforcement and disciplinary process to address violations
of applicable statutes [and] regulations . . . .” J.A. 731–32.
On December 1, 2015, pursuant to the ACA’s statutory mandate, CMS sent GDIT
approximately 2.65 million telephone numbers and directed GDIT to call each of those
numbers over the next five days in accordance with their contract. The numbers were
divided into seven lists specifying the exact day that GDIT was to call each number and
which of the scripts CMS provided that GDIT was to use for each call. One of CMS’s
lists directed GDIT to call Cunningham’s cell phone and approximately 680,000 other
numbers the next day, December 2, 2015. GDIT made the autodialed, prerecorded call to
Cunningham’s cell phone on December 2, 2015. When Cunningham did not pick up, the
prerecorded message left the following approximately 30-second voicemail message:
Hello! This is an important message from HealthCare.gov. The deadline to
enroll in a 2016 health insurance plan is coming soon. You may be able to
qualify for financial help to make health insurance more affordable. With
financial help, most people can find plans for $75 or less per month. Visit
HealthCare.gov today to see how much you can save. If you have
questions, you can call the Health Insurance Marketplace to talk to a trained
enrollment specialist at 1-800-318-2596. That’s 1-800-318-2596. We are
available 24 hours a day and the call is free. Don’t forget―the deadline to
enroll is Tuesday, December 15th. If you’ve already taken action and have
2016 health coverage, please ignore this message. Thank You! Goodbye.
J.A. 28. This message was identical to the script CMS provided GDIT.
Cunningham alleges that he received this autodialed, prerecorded phone call from

-- 5 of 18 --

6
GDIT advertising the commercial availability of health insurance without having given
his prior consent, in violation of the TCPA.2 As relevant here, the TCPA prohibits any
person, absent the prior express consent of the recipient, from “mak[ing] any
call . . . using any automatic telephone dialing system . . . to a paging service [or] cellular
telephone service . . . .” Telephone Consumer Protection Act, 47 U.S.C.
§ 227(b)(1)(A)(3). The TCPA also authorizes a private right of action for conduct
violating the Act. § 227(b)(3). However, “[t]he United States and its agencies, it is
undisputed, are not subject to the TCPA’s prohibitions because no statute lifts their
immunity.” Campbell-Ewald Co. v. Gomez, 136 S. Ct. 663, 672 (2016). Thus, GDIT
would also be immune from liability for making this phone call if derivative sovereign
immunity applies.
Cunningham commenced this putative class action suit against GDIT on May 16,
2016, seeking damages and injunctive relief as authorized under the TCPA. See 47
U.S.C. § 227(b)(1)(A)(iii), (b)(1)(B), (b)(3). GDIT moved to dismiss for lack of subject
matter jurisdiction on the ground that GDIT is immune from suit under the Yearsley
2 GDIT asserts that Cunningham did in fact consent to the phone call by starting
an application on the HealthCare.gov website on November 18, 2015, providing his cell
phone number, and affirmatively accepting the privacy policy that stated applicants may
be contacted with more information. However, the merits of whether Cunningham gave
consent are not before the Court; we are solely considering the applicability of the
Yearsley doctrine, and this disputed fact is inconsequential to our analysis. See Holloway
v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 453 (4th Cir. 2012) (holding that
disputes over whether plaintiff would be able to prove the elements of his cause of action
“must be resolved either by a Rule 56 motion or by trial,” and were not relevant to
whether the court had jurisdiction).

-- 6 of 18 --

7
doctrine.3 See Fed. R. Civ. P. 12(b)(1). On October 18, 2016, the district court issued an
interim order concluding that GDIT was entitled to Yearsley immunity, and granted
limited jurisdictional discovery for Cunningham to contest this determination. The
district court issued this order, in part, because it concluded that CMS had “authorized
and instructed GDIT to do exactly what it did.” J.A. 259. Discovery lasted 75 days and
included six subpoenas, four Touhy requests, numerous document requests, six
depositions of GDIT and CMS employees, and supplemental briefing on the issue. On
May 1, 2017, the district court granted GDIT’s motion to dismiss for lack of subject
matter jurisdiction on the ground that GDIT was immune from suit under the Yearsley
doctrine. This appeal followed.
II.
In reviewing a district court’s order dismissing an action for lack of subject matter
jurisdiction, this Court reviews conclusions of law de novo and findings of fact for clear
error. Velasco v. Gov’t of Indon., 370 F.3d 392, 398 (4th Cir. 2004). To conclude that a
district court’s factual finding is clearly erroneous, the reviewing court must be “left with
the definite and firm conviction that a mistake has been committed.” HSBC Bank USA v.
F & M Bank N. Va., 246 F.3d 335, 338 (4th Cir. 2001) (quoting Anderson v. City of
Bessemer City, 470 U.S. 564, 573 (1985)).
3 GDIT also filed motions to dismiss for failure to state a claim and failure to join
CMS as a necessary party. Fed. R. Civ. P. 12(b)(6), (7).

-- 7 of 18 --

8
III.
In his first claim on appeal, Cunningham asserts that the Yearsley doctrine does
not apply as a matter of law to federal claims. Instead, he claims that Yearsley only
applies when a federal contract or federal directive displaces state law to absolve
government contractors from state law liability. Finding nothing in Yearsley or its
progeny that limits its application solely to state law liability, we disagree.
We begin our analysis with the language in Yearsley itself. In describing the
immunity, we find no language indicating that the Supreme Court intended to limit its
holding to claims arising under state law. See Yearsley, 309 U.S. at 20–21 (“[I]t is clear
that if this authority to carry out the project was validly conferred, that is, if what was
done was within the constitutional power of Congress, there is no liability on the part of
the contractor for executing its will.” (citations omitted)). Additionally, the Supreme
Court identified instances when government contractors were not immune from liability,
and notably did not mention federal law claims. See id. at 21 (“Where an agent or officer
of the Government purporting to act on its behalf has been held to be liable for his
conduct causing injury to another, the ground of liability has been found to be either that
he exceeded his authority or that it was not validly conferred.” (citations omitted)). The
test the Supreme Court outlined for conferring Yearsley immunity, therefore, omitted any
requirement that the claim arise under state law and omitted any reference to exempting
federal law liability from its reach. Yearsley’s progeny have also failed to make any such
distinction. See, e.g., Campbell-Ewald, 136 S. Ct. at 672–73 (reaffirming the basic
requirements of Yearsley applicability without implying that its grant of immunity was

-- 8 of 18 --

9
limited to state law liability).
Yearsley immunity has also been applied to federal causes of action and, most
recently, the Supreme Court even addressed Yearsley in relation to the TCPA―the same
federal law at issue here. See, e.g., id. at 672 (concluding that Yearsley may immunize
violations of the TCPA); Yearsley, 309 U.S. at 22–23 (applying Yearsley immunity to a
claim arising under the Takings Clause of the Constitution); Tozer v. LTV Corp., 792
F.2d 403, 405 (4th Cir. 1986), cert. denied, 487 U.S. 1233 (1988) (concluding that a
military contractor could assert a Yearsley defense to a federal cause of action).4
Consequently, we hold that the Yearsley doctrine applies to claims arising under federal
law.
IV.
Next, Cunningham attacks the merits of the district court’s decision by asserting
that GDIT fails to satisfy either prong required under Yearsley. We disagree.
“[U]nder Yearsley, a government contractor is not subject to suit if (1) the
government authorized the contractor’s actions and (2) the government ‘validly
4 Cunningham also argues that even if Yearsley, standing alone, could be
interpreted to apply to claims arising under federal law, Boyle v. United Techs. Corp.,
487 U.S. 500 (1988), limited Yearsley’s applicability to state law claims. The Supreme
Court implicitly rejected this argument in Campbell-Ewald when it analyzed whether a
federal contractor was immune from suit under Yearsley for violations of the TCPA―a
federal law. 136 S. Ct. at 672–74. Additionally, as we stated in In re KBR, Boyle is
inapposite to determining the applicability of derivative sovereign immunity. In re KBR,
744 F.3d at 342 n.6 (distinguishing between the Boyle preemption analysis and the
Yearsley immunity analysis). Therefore, we decline to address Cunningham’s arguments
related to Boyle.

-- 9 of 18 --

10
conferred’ that authorization, meaning it acted within its constitutional power.” In re
KBR, 744 F.3d at 342 (citing Yearsley, 309 U.S. at 20–21). Recently, the Supreme Court
reaffirmed this test and expressly stated that as long as the authorization was validly
conferred, “ ‘there is no liability on the part of the contractor’ who simply performed as
the Government directed.” Campbell-Ewald, 136 S. Ct. at 673 (quoting Yearsley, 309
U.S. at 20–21). Authorization is “validly conferred” on a contractor if Congress
authorized the government agency to perform a task and empowered the agency to
delegate that task to the contractor, provided it was within the power of Congress to grant
the authorization. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at 342, 344 n.7.
Conversely, “[w]hen a contractor violates both federal law and the Government’s
explicit instructions, . . . no ‘derivative immunity’ shields the contractor from suit by
persons adversely affected by the violation.” Campbell-Ewald, 136 S. Ct. at 672; see
also Yearsley, 309 U.S. at 21; In re KBR, 744 F.3d at 345 (“[Yearsley] suggests that the
contractor must adhere to the government’s instructions to enjoy derivative sovereign
immunity; staying within the thematic umbrella of the work that the government
authorized is not enough to render the contractor’s activities ‘the act[s] of the
government.’ ” (alteration in original) (quoting Yearsley, 309 U.S. at 22)); Myers v.
United States, 323 F.2d 580, 583 (9th Cir. 1963) (stating that a government contractor is
not liable under Yearsley if the work was done under the contract and in conformity with
the contract terms, but may be liable for damages from acts “over and beyond acts
required to be performed” or acts “not in conformity” with the contract).

-- 10 of 18 --

11
A.
Turning to the first step, we analyze whether the government authorized GDIT’s
actions. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. The ACA
directs CMS to establish a system to keep applicants informed about their eligibility for
enrollment in a qualified health plan. See 42 U.S.C. § 18083(a), (b)(2), (e). CMS
contracted with GDIT to carry out this statutory mandate, and the contract required GDIT
to call individuals about health insurance options. On December 1, 2016, CMS provided
GDIT with a list of approximately 680,000 phone numbers, including Cunningham’s cell
phone number, and instructed GDIT to call the numbers on December 2, 2016, and leave
a prerecorded message. The contract also permitted GDIT to use an autodialer to make
the call. On December 2, 2016, GDIT used an autodialer to call Cunningham’s cell
phone number and left a voicemail with the exact script CMS had provided to GDIT.
Quite plainly, GDIT performed exactly as CMS directed: GDIT called the number CMS
instructed GDIT to call, on the prescribed day, and followed CMS’s provided script when
leaving the message.
Without contesting these facts, Cunningham nonetheless asserts that GDIT did not
perform as CMS directed. Cunningham argues that Section 17 of the CMS-GDIT
contract required GDIT to follow applicable laws, and that by failing to independently
obtain prior consent from each name on the list provided by CMS to ensure compliance
with the TCPA, GDIT violated the contract, requiring this Court to find that CMS did not
authorize GDIT’s actions. This argument is unavailing. There is no indication that GDIT
was authorized to contact these individuals other than to place the automated call, and

-- 11 of 18 --

12
GDIT was not permitted to deviate from the script provided. Deposition testimony from
Naomi Johnson, the CMS Contracting Officer Representative, confirmed that CMS did
not direct GDIT to obtain consent from the individuals on the call lists CMS provided,
did not direct GDIT to investigate the numbers provided, and did not expect GDIT to
obtain consent before making the calls. Therefore, we conclude that GDIT did not
violate the contract by failing to independently obtain consent to make the phone call
CMS instructed it to make.
Notably, this scenario is vastly distinguishable from the facts of Campbell-Ewald.
In that case, plaintiffs similarly alleged that a government contractor violated the TCPA
by failing to get prior consent to send text messages as part of a recruiting campaign for
the United States Navy. Campbell-Ewald, 136 S. Ct. at 667. There, however, the
contract expressly provided that it was the contractor’s responsibility to generate a list of
the phone numbers of those who had opted in to receive the marketing, and the
government’s approval of sending the message was conditioned on this consent. Id. at
673–74. The contractor, therefore, failed to adhere to the contract by not obtaining prior
consent to send these messages and, by failing to obtain prior consent, had also violated
the TCPA. Id. at 672–74. As a result of violating “both federal law and the
Government’s explicit instructions,” the Supreme Court held that the contractor was not
entitled to derivative sovereign immunity. Id. at 672.
Consequently, because GDIT adhered to the terms of its contract with CMS, we
conclude that the government authorized GDIT’s actions, satisfying step one of the
Yearsley analysis.

-- 12 of 18 --

13
B.
In analyzing the second step of the Yearsley immunity analysis, we consider
whether the government “validly conferred” the authorization for GDIT to make this
phone call. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. GDIT
made this call pursuant to CMS’s statutory mandate to administer the ACA and keep
applicants informed about their eligibility for enrollment in a qualified health plan. See
42 U.S.C. § 18083(a), (b)(2), (e). There does not seem to be any dispute that the
government can delegate the authority to make this automated phone call to GDIT.
Instead, Cunningham argues that the government cannot “validly confer” the authority to
engage in conduct that violates the law, and thus that CMS did not validly confer
authority to GDIT to call him because making the phone call without prior consent
violated the TCPA.5 With this argument, Cunningham misinterprets the scope of
5 In response, GDIT argues that even if the government directed GDIT to make
this phone call without obtaining prior consent, the federal government and its common
law agents are not subject to the TCPA, and therefore the government could not have
directed the phone calls be made in violation of the TCPA because they were not required
to comply with the TCPA. For this argument, GDIT points to a 2016 declaratory ruling
issued by the Federal Communications Commission (“FCC”) whereby the FCC
interpreted § 227(b)(1)’s prohibition of calls made by any “person” as “not includ[ing]
the federal government or agents acting within the scope of their agency under common-
law principles of agency.” In re Rules & Regulations Implementing the Tel. Consumer
Protection Act of 1991, CG Docket No. 02-278, 31 F.C.C. Rcd. 7394, 7398 (2016); see
id. at 7394 (“[T]he TCPA does not apply to calls made by or on behalf of the federal
government in the conduct of official government business, except when a call made by a
contractor does not comply with the government’s instructions.”). Because we conclude
that Cunningham’s claim fails even if the government is subject to the TCPA, we decline
to address this argument.

-- 13 of 18 --

14
Yearsley’s second step. The question is not whether informing applicants of their
enrollment eligibility violated the law, but rather whether Congress had the authority to
assign GDIT to complete that task. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at
342, 344 n.7. The purpose of Yearsley immunity is to prevent a government contractor
from facing liability for an alleged violation of law, and thus, it cannot be that an alleged
violation of law per se precludes Yearsley immunity. Consequently, we reject
Cunningham’s overinclusive interpretation of what constitutes a “valid conferral” of
authority under this prong. We conclude that the government validly conferred the
authorization for GDIT to make this phone call, satisfying step two of the Yearsley
immunity analysis.
Therefore, because the government authorized GDIT’s actions and that
authorization was validly conferred, we hold that the district court did not err in
concluding that GDIT was entitled to derivative sovereign immunity for this claim.
V.
Finally, Cunningham asserts that even if the district court properly conferred
Yearsley immunity on GDIT, the district court nonetheless erred in treating the Yearsley
doctrine as immunity from suit and dismissing the case for lack of subject matter
jurisdiction, rather than treating the doctrine as a merits defense to liability. See Fed. R.
Civ. P. 12(b)(1). In advancing this argument, Cunningham asserts that neither the
Supreme Court nor this Court has squarely addressed the issue of whether the Yearsley
defense is jurisdictional, and that the “immunity” provided by Yearsley is not necessarily

-- 14 of 18 --

15
a jurisdictional immunity. We again disagree.
As an initial matter, it is clear that “[i]f the basis for dismissing a Yearsley claim is
sovereign immunity, then a Yearsley defense would be jurisdictional” because “sovereign
immunity deprives federal courts of jurisdiction to hear claims, and a court finding that a
party is entitled to sovereign immunity must dismiss the action for lack of subject-matter
jurisdiction.” Ackerson v. Bean Dredging LLC, 589 F.3d 196, 207 (5th Cir. 2009)
(emphasis added) (ultimately concluding that Yearsley immunity does not deprive the
court of subject matter jurisdiction); see also Fed. R. Civ. P. 12(h)(3) (“If the court
determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the
action.”).
Recently, in In re KBR, this Court reaffirmed that we treat the Yearsley doctrine as
derivative sovereign immunity that confers jurisdictional immunity from suit. There, as
here, the district court had dismissed the claim for lack of subject matter jurisdiction
based on Yearsley immunity. In re KBR, 744 F.3d at 343. We stated that “[t]he concept
of derivative sovereign immunity stems from the Supreme Court’s decision in
[Yearsley],” and that when the Yearsley doctrine applies, “a government contractor is not
subject to suit.” Id. at 342 (emphases added); see also id. at 344 (“Yearsley recognizes
that private employees can perform the same functions as government employees and
concludes that they should receive immunity from suit when they perform these
functions.” (emphasis added)). Ultimately, this Court concluded that the record did not
contain enough evidence to determine whether the contractor was entitled to derivative
sovereign immunity, and vacated the district court’s decision and remanded for further

-- 15 of 18 --

16
fact finding. Id. at 345. See also Butters, 225 F.3d at 466 (acknowledging the “well-
settled law that contractors and common law agents acting within the scope of their
employment for the United States have derivative sovereign immunity” and describing
Yearsley as derivatively extending sovereign immunity to a private contractor acting
pursuant to a contract with the United States (emphasis added)); id. (favorably
referencing the Fifth Circuit’s affirmance that a private individual “was immune from
suit” when it followed the sovereign’s orders (emphasis added) (citing Alicog v. Kingdom
of Saudi Arabia, 860 F. Supp. 379, 384–84 (S.D. Tex. 1994), aff’d, 79 F.3d 1145 (5th
Cir. 1996) (table decision))).
Although Cunningham argues that In re KBR cannot stand for the proposition that
Yearsley immunity is jurisdictional because we did not affirm the jurisdiction-based
dismissal of the claim, we reject this contention. This Court’s express statements
regarding Yearsley immunity and its implicit approval of using a Rule 12(b)(1) motion to
dismiss to dispose of a case when the Yearsley doctrine applied compel us to conclude,
once again, that the Yearsley doctrine operates as a jurisdictional bar to suit and not as a
merits defense to liability. See also Adkisson v. Jacobs Eng’g Grp., Inc., 790 F.3d 641,
646 (6th Cir. 2015) (acknowledging that the Fourth Circuit has held that Yearsley
immunity is jurisdictional).
Cunningham’s argument that the Supreme Court’s recent decision in Lewis v.
Clarke undermines this precedent is also unavailing. 137 S. Ct. 1285, 1291 (2017).
Cunningham argues that Lewis confirms that incanting the word “immunity” does not
necessarily result in immunity from suit, and that “sovereign immunity” is implicated

-- 16 of 18 --

17
only where “the sovereign is the real party in interest,” i.e., “whe[re] the remedy sought is
truly against the sovereign.” Id. at 1290–92 (holding that the Indian tribe’s sovereign
immunity did not bar a tort suit against a tribal employee to recover for his personal
actions when he was operating a vehicle within the scope of his employment on state
lands). Cunningham’s reliance on Lewis is misplaced. In Lewis, the Supreme Court
distinguished between suits against individual employees and suits against governmental
instrumentalities, and expressly stated that “a suit against an arm or instrumentality of the
State is treated as one against the State itself.” Id. at 1293 (favorably referencing cases
extending sovereign immunity to private healthcare insurance companies that were
“essentially state instrumentalities,” including Pani v. Empire Blue Cross Blue Shield,
152 F.3d 67, 71–71 (2d Cir. 1998)); see also Regents of the Univ. of Cal. v. Doe, 519
U.S. 425, 429 (1997) (stating that sovereign immunity from suit extends to “certain
actions against state agents and state instrumentalities”). Because GDIT is an entity
rather than an individual employee, and was fulfilling CMS’s statutory mandate under the
ACA by making this phone call to Cunningham, Lewis is inapplicable. See Pani, 152
F.3d at 71–72 (stating that a government agent that “acts on behalf of the [government] in
carrying out certain administrative responsibilities that the law imposes” can be entitled
to sovereign immunity, and citing cases holding the same). Thus, under these facts,
Lewis does not undermine this Court’s precedents holding that Yearsley immunity is a
jurisdictional bar to suit, nor does it undermine our affirmance that derivative sovereign
immunity be conferred on GDIT in this case.
Notwithstanding that Yearsley immunity operates as a jurisdictional bar to suit, we

-- 17 of 18 --

18
recognize that discovery may be appropriate before granting a Rule 12(b)(1) motion to
dismiss on this basis. See Kerns, 585 F.3d at 193 (describing appropriate evidentiary
proceedings when a court is considering a claim under Rule 12(b)(1)). When, as here, a
party “challenges the veracity of the facts underpinning subject matter jurisdiction, the
trial court may go beyond the complaint, conduct evidentiary proceedings, and resolve
the disputed jurisdictional facts.” Id.; see also United States ex rel. Vuyyuru v. Jadhav,
555 F.3d 337, 348 (4th Cir. 2009). Here, the parties participated in 75 days of limited
discovery on the applicability of Yearsley, which included six subpoenas, four Touhy
requests, numerous other document requests, six depositions of GDIT and CMS
employees, and supplemental briefing on the issue. We are satisfied that this discovery
provided Cunningham with appropriate procedural safeguards and provided sufficient
information for the district court to rule on GDIT’s motion.
Consequently, we hold that the district court did not err in treating Yearsley
applicability as a jurisdictional bar to suit and granting GDIT’s Rule 12(b)(1) motion to
dismiss on the basis that GDIT is immune from suit under the Yearsley doctrine.
VI.
For the foregoing reasons, the judgment of the district court is hereby
AFFIRMED.

-- 18 of 18 --