                                     PUBLISHED

                     UNITED STATES COURT OF APPEALS
                         FOR THE FOURTH CIRCUIT


                                     No. 17-1592


CRAIG CUNNINGHAM, on behalf of himself and all others similarly situated,

                   Plaintiff - Appellant,

             v.

GENERAL DYNAMICS INFORMATION TECHNOLOGY, INC.,

                   Defendant - Appellee.


Appeal from the United States District Court for the Eastern District of Virginia, at
Alexandria. Liam O’Grady, District Judge. (1:16-cv-00545-LO-TCB)


Argued: January 24, 2018                                     Decided: April 24, 2018


Before TRAXLER and FLOYD, Circuit Judges, and SHEDD, Senior Circuit Judge.


Affirmed by published opinion. Judge Floyd wrote the opinion in which Judge Traxler
and Senior Judge Shedd joined.


ARGUED: Aytan Yehoshua Bellin, BELLIN & ASSOCIATES LLC, White Plains, New
York, for Appellant. James P. Rouhandeh, DAVIS, POLK & WARDWELL, LLP, New
York, New York, for Appellee. ON BRIEF: Roger Furman, Los Angeles, California, for
Appellant. Neil H. MacBride, Washington, D.C., Paul S. Mishkin, DAVIS POLK &
WARDWELL LLP, New York, New York; Attison L. Barnes, III, Stephen J. Obermeier,
WILEY REIN LLP, Washington, D.C., for Appellee.
FLOYD, Circuit Judge:

       Greg Cunningham alleges that he received an autodialed, prerecorded phone call

from General Dynamics Information Technology, Inc. (“GDIT”) advertising the

commercial availability of health insurance, without having given his prior express

consent, in violation of the Telephone Consumer Protection Act (“TCPA”). The district

court granted GDIT’s motion to dismiss for lack of subject matter jurisdiction on the

ground that GDIT is immune from suit under the Yearsley doctrine, which immunizes

government contractors from suit when the government authorized the contractor’s

actions and the government validly conferred that authorization. Yearsley v. W. A. Ross

Constr. Co., 309 U.S. 18, 20–21 (1940).

       On appeal, Cunningham argues that the district court erred in conferring Yearsley

immunity and consequently dismissing the suit for three distinct reasons. First, he asserts

that the Yearsley doctrine does not apply as a matter of law to federal claims. Next, he

asserts that GDIT fails to qualify for Yearsley immunity both because the government did

not authorize its actions and because the authorization was not validly conferred. Finally,

he asserts that even if Yearsley immunity applies, Yearsley is a merits defense from

liability rather than a jurisdictional immunity. We find these arguments unpersuasive,

and now affirm the district court’s dismissal for lack of subject matter jurisdiction.




                                              2
                                            I.

                                           A.

      Pursuant to the doctrine of sovereign immunity, the United States is immune from

private civil actions absent an express waiver. Kerns v. United States, 585 F.3d 187,

193–94 (4th Cir. 2009) (citing United States v. Sherwood, 312 U.S. 584, 586 (1941)).

Under the concept of derivative sovereign immunity, stemming from the Supreme

Court’s decision in Yearsley, 309 U.S. at 20–21, agents of the sovereign are also

sometimes protected from liability for carrying out the sovereign’s will. In re KBR, Inc.,

Burn Pit Litig., 744 F.3d 326, 341–42 (4th Cir. 2014) (internal quotation marks omitted)

(interpreting Yearsley as recognizing that private employees should receive immunity

from suit when they perform the same functions as government employees).             This

immunity derives from “ ‘the government’s unquestioned need to delegate governmental

functions,’ ” and the acknowledgement that “[i]mposing liability on private agents of the

government would directly impede the significant governmental interest in the

completion of its work.” Butters v. Vance Int’l, Inc., 225 F.3d 462, 466 (4th Cir. 2000)

(quoting Mangold v. Analytic Servs., Inc., 77 F.3d 1442, 1448 (4th Cir. 1996)). “[U]nder

Yearsley, a government contractor is not subject to suit if (1) the government authorized

the contractor’s actions and (2) the government ‘validly conferred’ that authorization,

meaning it acted within its constitutional power.” In re KBR, 744 F.3d at 342 (citing

Yearsley, 309 U.S. at 20–21).




                                            3
                                           B.

      On appeal, we review whether the district court erred in conferring Yearsley

immunity on GDIT’s phone call to Cunningham. 1 As relevant here, the Affordable Care

Act (“ACA”) directs the U.S. Department of Health and Human Services, Centers for

Medicare & Medicaid Services (“CMS”) to establish a system to keep applicants

informed about their eligibility for enrollment in a qualified health plan. See 42 U.S.C.

§ 18083(a), (b)(2), (e).   CMS maintains the HealthCare.gov website, through which

individuals may enroll for health coverage under the ACA using an online application.

The online application requires visitors to provide their name and phone number, and

accept CMS’s privacy policy by affirmatively clicking an “Accept” box acknowledging,

inter alia, that CMS may use the phone number provided to contact them with more

information.

      To carry out their statutorily mandated obligations under the ACA, CMS awarded

a contract to Vangent, Inc., which subsequently merged into GDIT, for contact center

operations support for CMS programs, including the HealthCare.gov website. Under the

contract, GDIT was required to make phone calls from January 1, 2015, through May 16,

2016, to inform individuals about their ability to buy health insurance through the health

insurance exchanges created by the ACA. In accordance with this instruction, CMS

authorized GDIT to use an autodialer to make the calls, provided a script for each call,

      1
        Cunningham filed this claim as a putative class action, alleging that GDIT made
hundreds of thousands of autodialed, prerecorded phone calls in violation of the TCPA.
For convenience, we refer only to the disputed call to Cunningham.


                                            4
and provided a list of phone numbers for each call. Section 17 of the CMS-GDIT

contract also required GDIT to “maintain a corporate compliance program” that included

“[a]n internal monitoring and auditing function to help ensure compliance with statutes

[and] regulations,” and “[a]n enforcement and disciplinary process to address violations

of applicable statutes [and] regulations . . . .” J.A. 731–32.

       On December 1, 2015, pursuant to the ACA’s statutory mandate, CMS sent GDIT

approximately 2.65 million telephone numbers and directed GDIT to call each of those

numbers over the next five days in accordance with their contract. The numbers were

divided into seven lists specifying the exact day that GDIT was to call each number and

which of the scripts CMS provided that GDIT was to use for each call. One of CMS’s

lists directed GDIT to call Cunningham’s cell phone and approximately 680,000 other

numbers the next day, December 2, 2015. GDIT made the autodialed, prerecorded call to

Cunningham’s cell phone on December 2, 2015. When Cunningham did not pick up, the

prerecorded message left the following approximately 30-second voicemail message:

       Hello! This is an important message from HealthCare.gov. The deadline to
       enroll in a 2016 health insurance plan is coming soon. You may be able to
       qualify for financial help to make health insurance more affordable. With
       financial help, most people can find plans for $75 or less per month. Visit
       HealthCare.gov today to see how much you can save. If you have
       questions, you can call the Health Insurance Marketplace to talk to a trained
       enrollment specialist at 1-800-318-2596. That’s 1-800-318-2596. We are
       available 24 hours a day and the call is free. Don’t forget―the deadline to
       enroll is Tuesday, December 15th. If you’ve already taken action and have
       2016 health coverage, please ignore this message. Thank You! Goodbye.

J.A. 28. This message was identical to the script CMS provided GDIT.

       Cunningham alleges that he received this autodialed, prerecorded phone call from


                                               5
GDIT advertising the commercial availability of health insurance without having given

his prior consent, in violation of the TCPA. 2 As relevant here, the TCPA prohibits any

person, absent the prior express consent of the recipient, from “mak[ing] any

call . . . using any automatic telephone dialing system . . . to a paging service [or] cellular

telephone    service . . . .”   Telephone     Consumer      Protection    Act,    47   U.S.C.

§ 227(b)(1)(A)(3).     The TCPA also authorizes a private right of action for conduct

violating the Act. § 227(b)(3). However, “[t]he United States and its agencies, it is

undisputed, are not subject to the TCPA’s prohibitions because no statute lifts their

immunity.” Campbell-Ewald Co. v. Gomez, 136 S. Ct. 663, 672 (2016). Thus, GDIT

would also be immune from liability for making this phone call if derivative sovereign

immunity applies.

       Cunningham commenced this putative class action suit against GDIT on May 16,

2016, seeking damages and injunctive relief as authorized under the TCPA. See 47

U.S.C. § 227(b)(1)(A)(iii), (b)(1)(B), (b)(3). GDIT moved to dismiss for lack of subject

matter jurisdiction on the ground that GDIT is immune from suit under the Yearsley


       2
         GDIT asserts that Cunningham did in fact consent to the phone call by starting
an application on the HealthCare.gov website on November 18, 2015, providing his cell
phone number, and affirmatively accepting the privacy policy that stated applicants may
be contacted with more information. However, the merits of whether Cunningham gave
consent are not before the Court; we are solely considering the applicability of the
Yearsley doctrine, and this disputed fact is inconsequential to our analysis. See Holloway
v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 453 (4th Cir. 2012) (holding that
disputes over whether plaintiff would be able to prove the elements of his cause of action
“must be resolved either by a Rule 56 motion or by trial,” and were not relevant to
whether the court had jurisdiction).


                                              6
doctrine. 3 See Fed. R. Civ. P. 12(b)(1). On October 18, 2016, the district court issued an

interim order concluding that GDIT was entitled to Yearsley immunity, and granted

limited jurisdictional discovery for Cunningham to contest this determination.           The

district court issued this order, in part, because it concluded that CMS had “authorized

and instructed GDIT to do exactly what it did.” J.A. 259. Discovery lasted 75 days and

included six subpoenas, four Touhy requests, numerous document requests, six

depositions of GDIT and CMS employees, and supplemental briefing on the issue. On

May 1, 2017, the district court granted GDIT’s motion to dismiss for lack of subject

matter jurisdiction on the ground that GDIT was immune from suit under the Yearsley

doctrine. This appeal followed.


                                             II.

       In reviewing a district court’s order dismissing an action for lack of subject matter

jurisdiction, this Court reviews conclusions of law de novo and findings of fact for clear

error. Velasco v. Gov’t of Indon., 370 F.3d 392, 398 (4th Cir. 2004). To conclude that a

district court’s factual finding is clearly erroneous, the reviewing court must be “left with

the definite and firm conviction that a mistake has been committed.” HSBC Bank USA v.

F & M Bank N. Va., 246 F.3d 335, 338 (4th Cir. 2001) (quoting Anderson v. City of

Bessemer City, 470 U.S. 564, 573 (1985)).



       3
       GDIT also filed motions to dismiss for failure to state a claim and failure to join
CMS as a necessary party. Fed. R. Civ. P. 12(b)(6), (7).


                                             7
                                              III.

       In his first claim on appeal, Cunningham asserts that the Yearsley doctrine does

not apply as a matter of law to federal claims. Instead, he claims that Yearsley only

applies when a federal contract or federal directive displaces state law to absolve

government contractors from state law liability.        Finding nothing in Yearsley or its

progeny that limits its application solely to state law liability, we disagree.

       We begin our analysis with the language in Yearsley itself. In describing the

immunity, we find no language indicating that the Supreme Court intended to limit its

holding to claims arising under state law. See Yearsley, 309 U.S. at 20–21 (“[I]t is clear

that if this authority to carry out the project was validly conferred, that is, if what was

done was within the constitutional power of Congress, there is no liability on the part of

the contractor for executing its will.” (citations omitted)). Additionally, the Supreme

Court identified instances when government contractors were not immune from liability,

and notably did not mention federal law claims. See id. at 21 (“Where an agent or officer

of the Government purporting to act on its behalf has been held to be liable for his

conduct causing injury to another, the ground of liability has been found to be either that

he exceeded his authority or that it was not validly conferred.” (citations omitted)). The

test the Supreme Court outlined for conferring Yearsley immunity, therefore, omitted any

requirement that the claim arise under state law and omitted any reference to exempting

federal law liability from its reach. Yearsley’s progeny have also failed to make any such

distinction. See, e.g., Campbell-Ewald, 136 S. Ct. at 672–73 (reaffirming the basic

requirements of Yearsley applicability without implying that its grant of immunity was

                                               8
limited to state law liability).

       Yearsley immunity has also been applied to federal causes of action and, most

recently, the Supreme Court even addressed Yearsley in relation to the TCPA―the same

federal law at issue here. See, e.g., id. at 672 (concluding that Yearsley may immunize

violations of the TCPA); Yearsley, 309 U.S. at 22–23 (applying Yearsley immunity to a

claim arising under the Takings Clause of the Constitution); Tozer v. LTV Corp., 792

F.2d 403, 405 (4th Cir. 1986), cert. denied, 487 U.S. 1233 (1988) (concluding that a

military contractor could assert a Yearsley defense to a federal cause of action). 4

Consequently, we hold that the Yearsley doctrine applies to claims arising under federal

law.


                                           IV.

       Next, Cunningham attacks the merits of the district court’s decision by asserting

that GDIT fails to satisfy either prong required under Yearsley. We disagree.

       “[U]nder Yearsley, a government contractor is not subject to suit if (1) the

government authorized the contractor’s actions and (2) the government ‘validly

       4
          Cunningham also argues that even if Yearsley, standing alone, could be
interpreted to apply to claims arising under federal law, Boyle v. United Techs. Corp.,
487 U.S. 500 (1988), limited Yearsley’s applicability to state law claims. The Supreme
Court implicitly rejected this argument in Campbell-Ewald when it analyzed whether a
federal contractor was immune from suit under Yearsley for violations of the TCPA―a
federal law. 136 S. Ct. at 672–74. Additionally, as we stated in In re KBR, Boyle is
inapposite to determining the applicability of derivative sovereign immunity. In re KBR,
744 F.3d at 342 n.6 (distinguishing between the Boyle preemption analysis and the
Yearsley immunity analysis). Therefore, we decline to address Cunningham’s arguments
related to Boyle.


                                            9
conferred’ that authorization, meaning it acted within its constitutional power.” In re

KBR, 744 F.3d at 342 (citing Yearsley, 309 U.S. at 20–21). Recently, the Supreme Court

reaffirmed this test and expressly stated that as long as the authorization was validly

conferred, “ ‘there is no liability on the part of the contractor’ who simply performed as

the Government directed.” Campbell-Ewald, 136 S. Ct. at 673 (quoting Yearsley, 309

U.S. at 20–21).    Authorization is “validly conferred” on a contractor if Congress

authorized the government agency to perform a task and empowered the agency to

delegate that task to the contractor, provided it was within the power of Congress to grant

the authorization. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at 342, 344 n.7.

       Conversely, “[w]hen a contractor violates both federal law and the Government’s

explicit instructions, . . . no ‘derivative immunity’ shields the contractor from suit by

persons adversely affected by the violation.” Campbell-Ewald, 136 S. Ct. at 672; see

also Yearsley, 309 U.S. at 21; In re KBR, 744 F.3d at 345 (“[Yearsley] suggests that the

contractor must adhere to the government’s instructions to enjoy derivative sovereign

immunity; staying within the thematic umbrella of the work that the government

authorized is not enough to render the contractor’s activities ‘the act[s] of the

government.’ ” (alteration in original) (quoting Yearsley, 309 U.S. at 22)); Myers v.

United States, 323 F.2d 580, 583 (9th Cir. 1963) (stating that a government contractor is

not liable under Yearsley if the work was done under the contract and in conformity with

the contract terms, but may be liable for damages from acts “over and beyond acts

required to be performed” or acts “not in conformity” with the contract).



                                            10
                                           A.

      Turning to the first step, we analyze whether the government authorized GDIT’s

actions. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. The ACA

directs CMS to establish a system to keep applicants informed about their eligibility for

enrollment in a qualified health plan. See 42 U.S.C. § 18083(a), (b)(2), (e). CMS

contracted with GDIT to carry out this statutory mandate, and the contract required GDIT

to call individuals about health insurance options. On December 1, 2016, CMS provided

GDIT with a list of approximately 680,000 phone numbers, including Cunningham’s cell

phone number, and instructed GDIT to call the numbers on December 2, 2016, and leave

a prerecorded message. The contract also permitted GDIT to use an autodialer to make

the call. On December 2, 2016, GDIT used an autodialer to call Cunningham’s cell

phone number and left a voicemail with the exact script CMS had provided to GDIT.

Quite plainly, GDIT performed exactly as CMS directed: GDIT called the number CMS

instructed GDIT to call, on the prescribed day, and followed CMS’s provided script when

leaving the message.

      Without contesting these facts, Cunningham nonetheless asserts that GDIT did not

perform as CMS directed.      Cunningham argues that Section 17 of the CMS-GDIT

contract required GDIT to follow applicable laws, and that by failing to independently

obtain prior consent from each name on the list provided by CMS to ensure compliance

with the TCPA, GDIT violated the contract, requiring this Court to find that CMS did not

authorize GDIT’s actions. This argument is unavailing. There is no indication that GDIT

was authorized to contact these individuals other than to place the automated call, and

                                           11
GDIT was not permitted to deviate from the script provided. Deposition testimony from

Naomi Johnson, the CMS Contracting Officer Representative, confirmed that CMS did

not direct GDIT to obtain consent from the individuals on the call lists CMS provided,

did not direct GDIT to investigate the numbers provided, and did not expect GDIT to

obtain consent before making the calls. Therefore, we conclude that GDIT did not

violate the contract by failing to independently obtain consent to make the phone call

CMS instructed it to make.

       Notably, this scenario is vastly distinguishable from the facts of Campbell-Ewald.

In that case, plaintiffs similarly alleged that a government contractor violated the TCPA

by failing to get prior consent to send text messages as part of a recruiting campaign for

the United States Navy. Campbell-Ewald, 136 S. Ct. at 667. There, however, the

contract expressly provided that it was the contractor’s responsibility to generate a list of

the phone numbers of those who had opted in to receive the marketing, and the

government’s approval of sending the message was conditioned on this consent. Id. at

673–74. The contractor, therefore, failed to adhere to the contract by not obtaining prior

consent to send these messages and, by failing to obtain prior consent, had also violated

the TCPA.      Id. at 672–74.     As a result of violating “both federal law and the

Government’s explicit instructions,” the Supreme Court held that the contractor was not

entitled to derivative sovereign immunity. Id. at 672.

       Consequently, because GDIT adhered to the terms of its contract with CMS, we

conclude that the government authorized GDIT’s actions, satisfying step one of the

Yearsley analysis.

                                             12
                                           B.

      In analyzing the second step of the Yearsley immunity analysis, we consider

whether the government “validly conferred” the authorization for GDIT to make this

phone call. In re KBR, 744 F.3d at 342; see also Yearsley, 309 U.S. at 20–21. GDIT

made this call pursuant to CMS’s statutory mandate to administer the ACA and keep

applicants informed about their eligibility for enrollment in a qualified health plan. See

42 U.S.C. § 18083(a), (b)(2), (e).    There does not seem to be any dispute that the

government can delegate the authority to make this automated phone call to GDIT.

Instead, Cunningham argues that the government cannot “validly confer” the authority to

engage in conduct that violates the law, and thus that CMS did not validly confer

authority to GDIT to call him because making the phone call without prior consent

violated the TCPA. 5    With this argument, Cunningham misinterprets the scope of


      5
         In response, GDIT argues that even if the government directed GDIT to make
this phone call without obtaining prior consent, the federal government and its common
law agents are not subject to the TCPA, and therefore the government could not have
directed the phone calls be made in violation of the TCPA because they were not required
to comply with the TCPA. For this argument, GDIT points to a 2016 declaratory ruling
issued by the Federal Communications Commission (“FCC”) whereby the FCC
interpreted § 227(b)(1)’s prohibition of calls made by any “person” as “not includ[ing]
the federal government or agents acting within the scope of their agency under common-
law principles of agency.” In re Rules & Regulations Implementing the Tel. Consumer
Protection Act of 1991, CG Docket No. 02-278, 31 F.C.C. Rcd. 7394, 7398 (2016); see
id. at 7394 (“[T]he TCPA does not apply to calls made by or on behalf of the federal
government in the conduct of official government business, except when a call made by a
contractor does not comply with the government’s instructions.”). Because we conclude
that Cunningham’s claim fails even if the government is subject to the TCPA, we decline
to address this argument.




                                           13
Yearsley’s second step.     The question is not whether informing applicants of their

enrollment eligibility violated the law, but rather whether Congress had the authority to

assign GDIT to complete that task. See Yearsley, 309 U.S. at 20; In re KBR, 744 F.3d at

342, 344 n.7. The purpose of Yearsley immunity is to prevent a government contractor

from facing liability for an alleged violation of law, and thus, it cannot be that an alleged

violation of law per se precludes Yearsley immunity.             Consequently, we reject

Cunningham’s overinclusive interpretation of what constitutes a “valid conferral” of

authority under this prong. We conclude that the government validly conferred the

authorization for GDIT to make this phone call, satisfying step two of the Yearsley

immunity analysis.

       Therefore, because the government authorized GDIT’s actions and that

authorization was validly conferred, we hold that the district court did not err in

concluding that GDIT was entitled to derivative sovereign immunity for this claim.


                                             V.

       Finally, Cunningham asserts that even if the district court properly conferred

Yearsley immunity on GDIT, the district court nonetheless erred in treating the Yearsley

doctrine as immunity from suit and dismissing the case for lack of subject matter

jurisdiction, rather than treating the doctrine as a merits defense to liability. See Fed. R.

Civ. P. 12(b)(1).    In advancing this argument, Cunningham asserts that neither the

Supreme Court nor this Court has squarely addressed the issue of whether the Yearsley

defense is jurisdictional, and that the “immunity” provided by Yearsley is not necessarily


                                             14
a jurisdictional immunity. We again disagree.

       As an initial matter, it is clear that “[i]f the basis for dismissing a Yearsley claim is

sovereign immunity, then a Yearsley defense would be jurisdictional” because “sovereign

immunity deprives federal courts of jurisdiction to hear claims, and a court finding that a

party is entitled to sovereign immunity must dismiss the action for lack of subject-matter

jurisdiction.” Ackerson v. Bean Dredging LLC, 589 F.3d 196, 207 (5th Cir. 2009)

(emphasis added) (ultimately concluding that Yearsley immunity does not deprive the

court of subject matter jurisdiction); see also Fed. R. Civ. P. 12(h)(3) (“If the court

determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the

action.”).

       Recently, in In re KBR, this Court reaffirmed that we treat the Yearsley doctrine as

derivative sovereign immunity that confers jurisdictional immunity from suit. There, as

here, the district court had dismissed the claim for lack of subject matter jurisdiction

based on Yearsley immunity. In re KBR, 744 F.3d at 343. We stated that “[t]he concept

of derivative sovereign immunity stems from the Supreme Court’s decision in

[Yearsley],” and that when the Yearsley doctrine applies, “a government contractor is not

subject to suit.” Id. at 342 (emphases added); see also id. at 344 (“Yearsley recognizes

that private employees can perform the same functions as government employees and

concludes that they should receive immunity from suit when they perform these

functions.” (emphasis added)). Ultimately, this Court concluded that the record did not

contain enough evidence to determine whether the contractor was entitled to derivative

sovereign immunity, and vacated the district court’s decision and remanded for further

                                              15
fact finding. Id. at 345. See also Butters, 225 F.3d at 466 (acknowledging the “well-

settled law that contractors and common law agents acting within the scope of their

employment for the United States have derivative sovereign immunity” and describing

Yearsley as derivatively extending sovereign immunity to a private contractor acting

pursuant to a contract with the United States (emphasis added)); id. (favorably

referencing the Fifth Circuit’s affirmance that a private individual “was immune from

suit” when it followed the sovereign’s orders (emphasis added) (citing Alicog v. Kingdom

of Saudi Arabia, 860 F. Supp. 379, 384–84 (S.D. Tex. 1994), aff’d, 79 F.3d 1145 (5th

Cir. 1996) (table decision))).

       Although Cunningham argues that In re KBR cannot stand for the proposition that

Yearsley immunity is jurisdictional because we did not affirm the jurisdiction-based

dismissal of the claim, we reject this contention.       This Court’s express statements

regarding Yearsley immunity and its implicit approval of using a Rule 12(b)(1) motion to

dismiss to dispose of a case when the Yearsley doctrine applied compel us to conclude,

once again, that the Yearsley doctrine operates as a jurisdictional bar to suit and not as a

merits defense to liability. See also Adkisson v. Jacobs Eng’g Grp., Inc., 790 F.3d 641,

646 (6th Cir. 2015) (acknowledging that the Fourth Circuit has held that Yearsley

immunity is jurisdictional).

       Cunningham’s argument that the Supreme Court’s recent decision in Lewis v.

Clarke undermines this precedent is also unavailing. 137 S. Ct. 1285, 1291 (2017).

Cunningham argues that Lewis confirms that incanting the word “immunity” does not

necessarily result in immunity from suit, and that “sovereign immunity” is implicated

                                            16
only where “the sovereign is the real party in interest,” i.e., “whe[re] the remedy sought is

truly against the sovereign.” Id. at 1290–92 (holding that the Indian tribe’s sovereign

immunity did not bar a tort suit against a tribal employee to recover for his personal

actions when he was operating a vehicle within the scope of his employment on state

lands). Cunningham’s reliance on Lewis is misplaced. In Lewis, the Supreme Court

distinguished between suits against individual employees and suits against governmental

instrumentalities, and expressly stated that “a suit against an arm or instrumentality of the

State is treated as one against the State itself.” Id. at 1293 (favorably referencing cases

extending sovereign immunity to private healthcare insurance companies that were

“essentially state instrumentalities,” including Pani v. Empire Blue Cross Blue Shield,

152 F.3d 67, 71–71 (2d Cir. 1998)); see also Regents of the Univ. of Cal. v. Doe, 519

U.S. 425, 429 (1997) (stating that sovereign immunity from suit extends to “certain

actions against state agents and state instrumentalities”). Because GDIT is an entity

rather than an individual employee, and was fulfilling CMS’s statutory mandate under the

ACA by making this phone call to Cunningham, Lewis is inapplicable. See Pani, 152

F.3d at 71–72 (stating that a government agent that “acts on behalf of the [government] in

carrying out certain administrative responsibilities that the law imposes” can be entitled

to sovereign immunity, and citing cases holding the same). Thus, under these facts,

Lewis does not undermine this Court’s precedents holding that Yearsley immunity is a

jurisdictional bar to suit, nor does it undermine our affirmance that derivative sovereign

immunity be conferred on GDIT in this case.

       Notwithstanding that Yearsley immunity operates as a jurisdictional bar to suit, we

                                             17
recognize that discovery may be appropriate before granting a Rule 12(b)(1) motion to

dismiss on this basis. See Kerns, 585 F.3d at 193 (describing appropriate evidentiary

proceedings when a court is considering a claim under Rule 12(b)(1)). When, as here, a

party “challenges the veracity of the facts underpinning subject matter jurisdiction, the

trial court may go beyond the complaint, conduct evidentiary proceedings, and resolve

the disputed jurisdictional facts.” Id.; see also United States ex rel. Vuyyuru v. Jadhav,

555 F.3d 337, 348 (4th Cir. 2009). Here, the parties participated in 75 days of limited

discovery on the applicability of Yearsley, which included six subpoenas, four Touhy

requests, numerous other document requests, six depositions of GDIT and CMS

employees, and supplemental briefing on the issue. We are satisfied that this discovery

provided Cunningham with appropriate procedural safeguards and provided sufficient

information for the district court to rule on GDIT’s motion.

       Consequently, we hold that the district court did not err in treating Yearsley

applicability as a jurisdictional bar to suit and granting GDIT’s Rule 12(b)(1) motion to

dismiss on the basis that GDIT is immune from suit under the Yearsley doctrine.


                                            VI.

       For the foregoing reasons, the judgment of the district court is hereby

                                                                                 AFFIRMED.




                                            18
