          IN THE SUPREME COURT OF APPEALS OF WEST VIRGINIA


                                 September 2015 Term                FILED
                                     __________                 October 15, 2015
                                                                  released at 3:00 p.m.
                                     No. 14-0965                  RORY L. PERRY II, CLERK
                                                                SUPREME COURT OF APPEALS
                                     __________                     OF WEST VIRGINIA




    WEST VIRGINIA DEPARTMENT of HEALTH and HUMAN RESOURCES,

      BUREAU for BEHAVIORAL HEALTH and HEALTH FACILITIES,

                           Petitioners


                                           v.

                                     E.H., et al.,

                                     Respondents


          ______________________________________________________

                  Appeal from the Circuit Court of Kanawha County

                             Honorable Louis H. Bloom

                           Civil Action No. 81-MISC-585


                                AFFIRMED

         ________________________________________________________

                             Submitted: September 15, 2015

                                Filed: October 15, 2015


Patrick Morrisey, Esq.                          Jennifer S. Wagner, Esq.

Attorney General                                Mountain State Justice, Inc.

Elbert Lin, Esq.                                Clarksburg, West Virginia

Solicitor General

Julie Marie Blake, Esq.                         Lydia C. Milnes, Esq.

Assistant Attorney General                      Mountain State Justice, Inc.

Charleston, West Virginia                       Charleston, West Virginia

Counsel for DHHR                                Counsel for Respondents


JUSTICE LOUGHRY delivered the Opinion of the Court.

JUSTICE DAVIS dissents and reserves the right to file a dissenting opinion.

                                    SYLLABUS




              1. “In the context of institutional reform litigation, this Court may choose to

exercise its appellate jurisdiction over an order entered by the circuit court that it deems to

approximate a final order by its nature and effect.” Syl. Pt. 1, West Virginia Dep’t of Health

and Human Servs. v. E.H., Nos. 14-0664, 14-0845, __ W.Va. __, __ S.E.2d __ (Oct. 7,

2015).



              2. A written agreement between the Department of Health and Human

Resources and the provider of patient advocacy services that specifies the legal obligations

of the parties, including the manner of payment and the duties associated with the provision

of patient advocacy services, constitutes a contract within the meaning of 64 C.S.R. § 59­

11.5.1.d. for purposes of permitting patient advocates to access records without the written

consent of individuals hospitalized with mental health issues in state facilities.
LOUGHRY, Justice:

                The West Virginia Department of Health and Human Resources, the Bureau

for Behavioral Health and Health Facilities (“DHHR”), seeks to reverse the August 27,

2014, order of the Circuit Court of Kanawha County, through which the DHHR was directed

to immediately restore access to patients and patient records to the patient advocates working

at this state’s two psychiatric hospitals.1 In challenging this ruling, the DHHR argues that

the circuit court’s order violates both the patients’ constitutional rights to privacy and the

Federal Health Insurance Portability and Accountability Act (“HIPAA”). The respondent

advocates for patients at Sharpe and Bateman Hospitals (sometimes referred to as the

“hospitals”) insist that the directives of the circuit court should be affirmed due to the clear

lack of constitutional or HIPAA violations. Having reviewed the record in this case to

verify the absence of constitutional infirmity as well as the lack of state or federal privacy

law violations stemming from the access historically afforded to patient advocates at these

facilities, we affirm the circuit court’s decision to restore the access afforded to the patient

advocates to the level they experienced prior to the abrupt change of course in June 2014.

Given the lower court’s partial reliance on certain HIPAA definitions and exclusions that

we find to be wholly inapplicable, our decision to affirm is grounded solely on state law

rather than an amalgam of state and federal law.2

       1
           Mildred Mitchell Bateman (“Bateman”) and William R. Sharpe, Jr. (“Sharpe”).
       2
       See Syl. Pt. 3, Barnett v. Wolfolk, 149 W.Va. 246, 140 S.E.2d 466 (1965) (“This
Court may, on appeal, affirm the judgment of the lower court when it appears that such

                                               1

                         I. Factual and Procedural Background

              The underlying litigation had its genesis in 1981 with a petition for a writ of

mandamus filed by a group of institutionalized individuals to address the civil rights of

patients with mental disabilities.3 See E.H. v. Matin (known as “Hartley” or “Matin I”), 168

W.Va. 248, 284 S.E.2d 232 (1981). This Court remanded the Hartley case to the Kanawha

County Circuit Court to achieve the legislative mandate of providing appropriate care and

treatment to those individuals who are involuntarily hospitalized. See W.Va. Code § 27-5-9

(2013). To that end, the West Virginia Behavioral Health System Plan (“BHSP”), a

comprehensive mental health plan, which addressed the various standards, conditions, and

facilities, was accepted by the circuit court in 1983.4 See E.H. v. Matin “(“Matin II”), 189

W.Va, 102, 104, 428 S.E.2d 523, 525 (1993). As part of the BHSP, the DHHR was required

to establish a patient advocacy system within the state hospitals to protect the rights of

institutionalized patients on an ongoing basis. Originally, the patient advocates were DHHR

employees who maintained offices within the hospitals. Due to issues that arose in the late

1980s stemming from improper personal relationships between the patient advocates and the


judgment is correct on any legal ground disclosed by the record, regardless of the ground,
reason or theory assigned by the lower court as the basis for its judgment.”).
       3
        See W.Va. Code § 27-5-9 (2013) (providing, inter alia, that “[e]ach patient of a
mental health facility . . . shall receive care and treatment that is suited to his or her needs
and administered in a skillful, safe and humane manner with full respect for his or her
dignity and personal integrity”).
       4
       This plan, a 330-page document, was reached by agreement among the parties. See
Matin II, 189 W.Va. at 104 n.2, 428 S.E.2d at 525 n.2.

                                               2

hospital administrators, the court monitor formally recommended that the DHHR be required

to contract with an external entity to perform the patient advocacy services. No one objected

to this proposal and the recommendation was adopted by order, entered on February 20,

1990 (the “1990 order”).5



                In accordance with its obligations under the 1990 order, the DHHR

immediately contracted with Legal Aid of West Virginia (“Legal Aid”) to provide patient

advocacy services. In this role, which it has occupied since its selection in 1990, Legal Aid

assists with and investigates individual grievances, conducts abuse and neglect

investigations, educates staff and patients about patient civil rights, and monitors Sharpe and

Bateman for the purpose of ensuring compliance with this state’s guarantee of patient civil

rights. See W.Va. Code § 27-5-9. Legislative rules expressly designed to “establish[] the

rights of clients of State-operated behavioral health facilities” were adopted in 1995.6 See

64 C.S.R. § 59-1.1. Those rules specify procedures that pertain to the mandated provision

of patient advocacy services7 and delineate a litany of patient rights that the hospitals are

required to observe, including confidentiality. See id. at §§ 59-1 to -20.

       5
        Pursuant to that order, the DHHR was directed to “contract with an entity outside
State government for the provision of advocacy.”
       6
           These rules were adopted under authority of West Virginia Code § 27-5-9(g).
       7
        “There shall be persons designated as client (or patient or resident) advocates who
are independent of the facility management in every behavioral health facility.” 64 C.S.R.
§ 59-20.1.

                                              3

              Court monitoring of the Hartley case continued until 2002 when, by agreement

of the parties, the case was removed from the active docket of the court.8 See E.H. v. Matin

(“Matin III”), 189 W.Va. 445, 432 S.E.2d 207 (1993) (approving continued circuit court

monitoring). In that same year, the DHHR decided to create the Office of the Ombudsman

(“Ombudsman”)–an office charged with overseeing compliance with the statutory duties

related to operation of the state hospitals. As the direct result of the Ombudsman’s July 3,

2008, report, documenting deplorable conditions and treatment of patients at Sharpe and

Bateman, the circuit court reopened the Hartley case. See State ex rel. Matin v. Bloom

(“Matin IV”), 223 W.Va. 379, 383-84, 674 S.E.2d 240, 244-45 (2009) (identifying issues

of overcrowding, lack of privacy, and denial of patients’ daily grooming and cleanliness

needs).



              Systemic violations of patient rights, including the use of “chemical restraints,”

were demonstrated during a two-day evidentiary hearing held before the circuit court in

April 2009. At the conclusion of the hearing, the trial court ordered the parties to participate

in mediation which resulted in an agreement between the parties covering multiple issues.

Under that court-approved agreement, commonly referred to as the “2009 Agreed Order,”

the Ombudsman is charged with the duty to oversee implementation of the specific terms of



       8
       Court monitoring was resumed in 2009 based on reports of both the conditions and
treatment of patients at Sharpe and Bateman.

                                               4

the agreement. Included in those terms is a provision requiring Sharpe and Bateman to fully

comply with the state regulations that address issues of patient care and patient advocacy

services. See 64 C.S.R. §§ 59-1 to -20. The 2009 Agreed Order requires that “[p]eriodic

review shall be established for compliance with [specified] sections.”9 In recognition of this

duty, the DHHR contracted with Legal Aid to “produce a report to inform Judge Bloom,

[and] the Hartley Court Monitor . . . of any progress or lack of progress in implementing

areas of Legislative Rule Title 64 Code of State Rules (CSR) Series 59 . . . within Sharpe

and Bateman by the end of the grant period.”10



              On January 5, 2010, the parties agreed that the patient advocates would create

an assessment tool for the hospital audits necessary to enable the DHHR to comply with the

periodic review contemplated by the 2009 Agreed Order. On March 31, 2010, the DHHR

agreed that quarterly audits should be conducted by providing the patient advocates with

complete access to at least two patients from each unit independent of any actual grievances

filed. On May 5, 2010, the parties agreed that the audit instrument was finalized and the

patient advocates were instructed “to begin implementation.”




       9
        Those sections are 64 C.S.R. §§ 59-12, -13, -14, -15.1.7, -15.1.12, -15.2, -15.3, and
-16.4.2.
       10
         This language appears in each of the annual grant documents in the record of this
case. Those documents set forth the duties of Legal Aid in relation to the patient advocacy
services and provide the necessary funding for such services.

                                              5

              For more than a decade, the DHHR provided the patient advocates with full

access to computerized patient records, to the patient wards, and other areas of the hospitals.

Then, in June 2014, with no prior notice, the DHHR began requiring the patient advocates

to obtain signed releases from each patient, the patient’s guardian, and/or the person with

the medical power of attorney before obtaining any information from or about the patient.11

Under the altered procedures, a newly-executed release specifying the basis of inquiry was

required each time the advocates sought to review a patient’s records. Legal Aid stated that

even if the inquiry pertained to a previously-authorized matter, a new release was required

for each successive day a patient advocate sought access to a patient’s records.12 In addition

to this novel procedure of requiring a release in advance of any records inspection, Legal

Aid was denied access to the network of patient records–access required for conducting the

systemic reviews or audits of the two facilities.



              In response to this abrupt change of policy regarding access to patient records,

the patient advocates filed a motion for emergency relief with the circuit court and a hearing

was held on August 1, 2014. After finding no violation of federal or state law, the circuit


       11
        The decision to alter access was made by the DHHR’s Privacy Officer, Lindsey
McIntosh. Before making this change in tack, Ms. McIntosh acknowledged she did not
investigate the role or needs of the advocates; she did not visit Bateman or Sharpe; she did
not speak to Legal Aid; and she did not review any of the orders pertaining to this case.
       12
       According to the DHHR’s representation in its response to the Motion for
Emergency Relief, each authorization was good for 180 days.

                                              6

court directed the DHHR, by order of August 24, 2014, to immediately restore Legal Aid

to the previous levels of access at Sharpe and Bateman. On August 29, 2014, the circuit

court denied the DHHR’s motion for stay of the August 27, 2014, amended ruling.13 By

order of September 14, 2014, this Court stayed the lower court’s order and granted the

appeal filed by the DHHR.



                                 II. Standard of Review

              Given our conclusion that the August 27, 2014, amended ruling constitutes a

final order notwithstanding the trial court’s contrary ruling,14 we review the subject order

pursuant to our well-established standard of examining questions of law de novo while

reversing factual determinations only upon a showing of clear error. See Syl. Pt. 2, Walker

v. W.Va. Ethics Comm’n, 201 W.Va. 108, 492 S.E.2d 167 (1997). This Court recently




       13
          Minor changes were made to the previous ruling. The only substantive amendments
were to remove the reference to the patient advocates as having been created by both federal
and state law (they were created solely under state law) and to recognize that grievances may
be initiated independently by a patient advocate separate from a patient’s allegation of abuse
or assertion of a civil rights violation.
       14
          By order entered on August 29, 2014, the circuit court refused to grant the DHHR’s
request to have the August 27, 2014, order deemed a final order. The rationale for its ruling
is clear: the trial court was trying to prevent the DHHR from belatedly seeking relief from
its previously unappealed 1990 Order. Because the court’s ruling was not impelled by the
need to address additional issues arising from reduced access (i.e. a lack of finality) and
because there are no further issues to be resolved concerning access, we deem the August
27, 2014, ruling to be final for purposes of allowing this Court to address the issues before
us through the subject appeal.

                                              7

dispelled any concerns with regard to its right to consider this matter by means of an appeal15

with our recent holding in syllabus point one of West Virginia Department of Health and

Human Services et al. v. E.H., __ W.Va. __, __ S.E.2d __ , Nos. 14-0664, 14-0845 (Oct. 7,

2015), wherein we held that “[i]n the context of institutional reform litigation, this Court

may choose to exercise its appellate jurisdiction over an order entered by the circuit court

that it deems to approximate a final order by its nature and effect.” Accordingly, we proceed

to determine whether the trial court erred in issuing the ruling under review.



                                        III. Discussion

                              A. Constitutional Privacy Rights

                 In support of its position that the lower court’s order improperly requires

unfettered disclosure of patient records to the patient advocates, the DHHR maintains that

the Fourteenth Amendment has been recognized to protect an individual’s right to privacy

with regard to avoiding disclosure of personal matters. See Whalen v. Roe, 429 U.S. 589,

599 (1977); accord Doe v. City of New York, 15 F.3d 264, 267 (2d Cir. 1994) (“Extension

of the right to confidentiality to personal medical information recognizes there are few

matters that are quite so personal as the status of one’s health, and few matters the

dissemination of which one would prefer to maintain greater control over.”). Because the

trial court failed to employ a balancing test to assess the reasonableness of the privacy


       15
            Cf. Syl. Pt. 5, Riffe v. Armstrong, 197 W.Va. 626, 477 S.E.2d 535 (1996).

                                               8

intrusion that flows from the sweeping access mandated by the order at issue, the DHHR

argues that the constitutional rights of patients at Sharpe and Bateman outweigh Legal Aid’s

interest in accessing patient files. See Nixon v. Adm’r of Gen’l Servs., 433 U.S. 425, 458-60

(1977) (utilizing balancing test to measure privacy intrusion against reasonableness of

governmental actions). Emphasizing the enhanced need to conduct this inquiry when a

realistic probability of public disclosure exists as in this case, the DHHR posits that the

circuit court erred by failing to consider the applicability of constitutionally-based

protections for the health information contained in the patient records.



              Legal Aid contends that the DHHR improperly seeks to inject constitutional

error into this matter with an issue never addressed by the circuit court.16 Not only does

Legal Aid concur with the tenets of privacy law articulated by the DHHR, but it fully agrees

with the petitioners’ statement that “the Fourteenth Amendment’s right to informational

privacy forbids the indiscriminate disclosure of state psychiatric records.” Legal Aid

emphasizes that the patient advocates neither seek the indiscriminate disclosure of patient

records nor do they conduct their advocacy services in a manner inconsistent with the


       16
         Legal Aid asserts that the DHHR did not raise the issue of constitutional error at the
August 1, 2014, hearing. In response, the DHHR states that the evidentiary proceeding was
not the forum in which to assert legal error. The record demonstrates that the DHHR
advanced the issue of constitutional error in its response to Legal Aid’s Motion for
Emergency Relief. Citing Griswold v. Connecticut, 381 U.S. 479 (1965), the DHHR
asserted that unlimited access to patient records absent patient consent is a violation of the
right to privacy judicially deemed to arise under the First Amendment.

                                              9

patients’ privacy rights. Dismissing the need for an extended discourse about the existence

of privacy rights, Legal Aid states that the issue presented is simply whether the disclosure

of patient records pursuant to state and federal laws enacted to protect patient rights runs

afoul of those acknowledged rights. Or stated in the converse, do provisions of federal

and/or state law permit the disclosure of patient records to the patient advocates under

contract with DHHR to provide advocacy services at Bateman and Sharpe.



              At the outset, we observe that the constitutional concerns raised by the DHHR

are confined to the previous longstanding practice of permitting the advocates to review

patient records for purposes of assessing overall hospital conditions.17 The DHHR does not

raise the possibility of constitutionally-based privacy violations with regard to individual

grievances or complaints of abuse and neglect.18 What the DHHR challenges is the circuit

court’s directive that allows the advocates to have access to patient files unrelated to specific

complaints or grievances. This access was authorized, consistent with past practice and the

agreement of the parties, for purposes of discerning systemic issues related to the patient

       17
          It is difficult for this Court to avoid the conclusion that, while seeking to prevent
access to the patient advocates under the guise of privacy concerns, the DHHR’s true
objective is to make the discovery of systemic problems more difficult for the advocates to
identify.
       18
         Legal Aid asserts that the new policy implemented by the DHHR prevents Legal
Aid from complying with the time constraints pertaining to the investigation of abuse and
neglect complaints under state law. See 64 C.S.R. § 59-20.2.9 (requiring submission of
written report by patient advocate “[w]ithin the next eight (8) regular working hours” of
receipt of abuse or neglect grievance).

                                               10

rights established by state regulation.19 See 64 C.S.R. §§ 59-1 to -20. Pursuant to the

governing Grant Agreement that outlines the duties the DHHR requires of the patient

advocates, an annual report reflecting the results of the systemic review is required to be

tendered to the circuit court judge, court monitor, the DHHR, and Mountain State Justice.20



              Inherent in the DHHR’s argument is a presumption that the systemic review

of patients’ records necessarily results in the wrongful disclosure of medical information.

Given that the first and only complaint concerning an alleged violation of HIPAA was filed

in 2014 by the DHHR–almost twenty years after the federal act became law–it is clear that

inappropriate disclosure of patient information has not been taking place as implied by the

DHHR. Not only have there been no complaints filed until the DHHR instituted one,21 but

the state privacy officers whose responsibility it is to oversee these matters have failed to



       19
         These periodic reviews, required by the 2009 Agreed Order, have been performed
by the patient advocates. Additionally, as noted by the trial court in both its August 18 and
27, 2014, rulings, the “Respondents [DHHR] agreed to the Formal Recommendations [of
the Court Monitor], which set forth that systemic advocacy will be pursued by LAWV
[Legal Aid], without objection, thereby allowing them to take on the force of Court Order.”
       20
         During the evidentiary hearing held in this matter on August 1, 2014, the DHHR’s
privacy officer, Lindsey McIntosh, was questioned as to how the patient advocates were
going to do the systemic audits “without access to records or patients or have conversations
with staff without individual releases specifying specific grievances.” She answered the
query by stating, “I don’t know how you’re going to conduct audits if you have to do that.”
       21
         Finding it to be baseless, the trial court ordered the DHHR to dismiss its complaint.
A review of the complaint demonstrates that even the DHHR was dubious about the
violation given its statement in the complaint that the “level of harm”was unclear.

                                             11

either independently identify or confirm the existence of any issues concerning the level of

access historically afforded to the patient advocates.



              In seeking to convince this Court that the provision of advocacy services over

the past two decades has just recently become a matter of constitutional significance, the

DHHR ignores the annual HIPAA training, the executed confidentiality agreements, and

state law provisions all designed for the purpose of, and apparently successful at, imposing

a high level of confidentiality upon the patient advocates with regard to their review of

sensitive health information. As Legal Aid explained, the review undertaken by the patient

advocates is conducted in confidence without public disclosure of any protected health

information. Critically, there has never been any complaint filed by a Bateman or Sharpe

patient, or the patient’s representative, associated with the wrongful dissemination of

confidential health information.22 Because the record in this case wholly fails to demonstrate

the indiscriminate disclosure of confidential information by the patient advocates–let alone

any disclosure of protected health information, we are not persuaded that a meritorious issue

exists with regard to Legal Aid’s dissemination of confidential health information.23


       22
         In contrast, there have been patient-initiated complaints since the DHHR imposed
the new, limited access provisions. According to Legal Aid, the patients were frustrated by
their inability to gain immediate access to the advocates, who were no longer permitted to
freely roam the facilities where patients could easily seek them out when needed.
       23
        As Legal Aid observes, there is no greater risk posed by the patient advocates than
by any of the Hospital employees who have access to patient records.

                                             12

Accordingly, we reject the DHHR’s contention that the trial court erred in failing to address

whether the access afforded to Legal Aid violates the constitutionally-based rights of privacy

of patients at Sharpe and Bateman.



                                        B. HIPAA

              Pursuant to HIPAA’s Privacy Rule (“Privacy Rule”), “[a] covered entity or

business associate may not use or disclose24 protected health information” barring either a

regulatory exemption or written authorization from the subject of the information or his/her

representative. 45 C.F.R. § 164.502(a) (2014) (footnote added). The DHHR argues that the

patient advocates do not come within any exemptions provided under HIPAA that would

eliminate the need to obtain patient consent before viewing medical records. Specifically,

the DHHR disagrees with the trial court’s decision that Legal Aid falls within the HIPAA

definition for a “business associate,” a “health oversight agency,” or          “health care

operations.” The DHHR also objects to the trial court’s reliance on the HIPAA exemption

pertaining to disclosures “required by law.” Each of these HIPAA definitions and its

respective applicability to the matter before us will be examined in turn.




       24
        Disclosure is “the release, transfer, provision of access to, or divulging in any
manner of information outside the entity holding the information.” 45 C.F.R. § 160.103
(2014).

                                             13

                                 1. “Business Associate”

              Under HIPAA, a “business associate” relates to and is defined in reference to

a “covered entity.” The Privacy Rule’s construct of a “covered entity” extends to: (1) a

health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any

health information in electronic form in connection with a covered transaction. See 45

C.F.R. § 160.103 (2014). As the circuit court correctly ruled in its August 27th order, both

Bateman and Sharpe qualify as covered entities under HIPAA. With scant analysis,25 the

trial court and Legal Aid simply adopted the position that the patient advocates necessarily

meet the HIPAA definition of a “business associate.” An examination of the pertinent

regulations addressing the nature of a “business associate” clearly refutes this conclusion.



              Legal Aid repeatedly refers to itself as a “business associate” of the DHHR.

Because the DHHR is not a “covered entity” under HIPAA, the relationship between Legal

Aid and the DHHR is not controlling. To come within HIPAA’s exclusionary language,

Legal Aid must be a “business associate” of Sharpe and Bateman. In further explanation of

what is necessary to qualify as a “business associate,” the regulations provide that it is a


       25
         The trial court ruled that Legal Aid is a “business associate” as set forth in its
contract with the DHHR and also due to its receipt of protected health information for
quality assurance, patient safety, and other health care operations. As discussed infra, the
DHHR’S description of Legal Aid as a “business associate” is neither controlling nor
accurate. The review of protected health information as part of the provision of advocacy
services at Sharpe and Bateman does not impel the conclusion that Legal Aid is a “business
associate.”

                                             14

person who:

                      (i) On behalf of such covered entity . . . but other than in
              the capacity of a member of the workforce of such covered
              entity or arrangement, creates, receives, maintains, or transmits
              protected health information for a function or activity regulated
              by this subchapter, including claims processing or
              administration, data analysis, processing or administration,
              utilization review, quality assurance, patient safety activities
              listed at 42 CFR 320, billing, benefit management, practice
              management, and repricing; or
                      (ii) Provides, other than in the capacity of a member of
              the workforce of such covered entity, legal, actuarial,
              accounting, consulting, data aggregation . . . , management,
              administrative, accreditation, or financial services to or for such
              covered entity . . . .

45 C.F.R. § 160.103.



              The DHHR argues, and we agree, that the patient advocacy services performed

at Bateman and Sharpe are not performed on behalf of either of those facilities within the

meaning of the Privacy Rule. See id. In purveying the list of activities that constitute

services typically performed by a “business associate” for a “covered entity,” patient

advocacy is noticeably absent. Rather than serving the interests of the hospitals in terms of

providing managerial assistance with their operations, the patient advocates serve the

personal interests of the patients who reside at those facilities. From the beginning, the

provision of patient advocacy services was created to protect the interests of individual

patients. See W.Va. Code § 27-5-9; 64 C.S.R. § 59-20.1 (mandating patient advocates in

every behavioral health facility who are independent of facility management). Despite the

                                              15

expanded role of the patient advocates with regard to systemic auditing, the primary

objective in conducting these reviews is compliance with patient-oriented rights.26



              While it might be tempting to view the provision of patient advocacy services

as improving the operations of the facilities under discussion, the pivotal inquiry is whether

the advocacy services are being offered by Legal Aid on behalf of the hospitals. That Legal

Aid is not operating on behalf of Sharpe and Bateman is easily demonstrated by considering

the adversity inherent to the role the patient advocates occupy in relation to those facilities.

Rather than advancing the hospitals’ interests, the advocates are responsible for investigating

individual grievances against the hospitals and identifying instances of the hospitals’ failure

to comply with the civil rights afforded to institutionalized patients under state law. By

design, the patient advocates operate independently of the hospitals’ interests and, most

decidedly, not on their behalves. We further observe that the improper characterization of

Legal Aid as “business associates” in the Grant Agreement does not serve to repair the

underlying definitional disconnect.27        As the DHHR properly acknowledges, its

identification of Legal Aid as a “business associate,” in an admitted and overly-expansive


       26
        The fact that the institutions may benefit from the provision of these auditing
services does not alter the wholly independent and individual-oriented nature of the
advocacy actions at issue.
       27
        The Grant Agreement makes clear that “Business Associate shall have the meaning
given to such term in 45 CFR § 160.103.”

                                              16

attempt to comply with HIPAA,28 has no corresponding ability to make the characterization

a reality under the law. Based on the foregoing, we conclude that the trial court erred in

finding that Legal Aid is a “business associate” of a “covered entity” under HIPAA.



                                2. “Health Oversight Agency”

                 Cherry picking parts of the HIPAA definition of a “health oversight agency,”29

the trial court concluded that Legal Aid is such an agency because it “is authorized by law

to oversee the health care system . . . or government programs . . . or to enforce civil rights

laws for which health information is relevant.” The DHHR argues that no state law invests

Legal Aid, a private entity, with public oversight authority. The individualized advocate role

that Legal Aid performs, emphasizes the DHHR, is not on par with the public health



       28
        The DHHR stated that boilerplate business associate addendums were regularly
attached to all grant agreements, even when unnecessary, in an effort to comply with
HIPAA’s “stern mandate to have an agreement in place with any business associate.”
       29
            A “health oversight agency” is defined as

                 an agency or authority of the United States, a State, . . . or a
                 person or entity acting under a grant of authority from or
                 contract with such public agency, . . . that is authorized by law
                 to oversee the health care system . . . or government programs
                 in which health information is necessary to determine eligibility
                 or compliance, or to enforce civil rights laws for which health
                 information is relevant.

45 C.F.R. § 164.501 (2014).

                                                17

concerns that a health oversight agency is charged to superintend. With regard to the

auditing function that Legal Aid performs, that duty is similarly not authorized by state law.

Furthermore, Legal Aid has no enforcement power with regard to the civil rights of the

patients.



              From the list of agencies recognized to engage in health oversight activities,

such as state insurance commissions, state health professional licensure agencies, state

Medicaid fraud control units, the Pension and Welfare Benefit Administration, the HHS

Office for Civil Rights,30 it is clear that Legal Aid does not qualify as such an agency.

Inherent to the concept of a “health oversight agency” is a charge by law to oversee matters

involving public health or for which public health information is intrinsic to the public-

oriented duties at hand. Here, the advocacy duties Legal Aid provides do not have at their

core a concern for public health or a need to review public health information for eligibility

purposes. See 45 C.F.R. § 164.512(d) (2014) (approving disclosure to health oversight

agency of protected health information to determine eligibility for government benefit

programs).



              While state regulations authorize patient advocates to investigate and ensure


       30
       See Standards for Privacy of Individually Identifiable Health Information, 65 Fed.
Reg. 82462-01, 82492.

                                             18

compliance with civil rights guaranteed by West Virginia Code § 27-5-9, that authority does

not imbue Legal Aid with health oversight authority within the meaning of HIPAA. See

64 C.S.R. § 59-20. Unlike the United States Department of Justice, the HHS Office for

Civil Rights, and the United States Equal Employment Opportunity Commission, Legal Aid

has no enforcement powers pertinent to the patient civil rights it is charged with overseeing.

See 65 Fed. Reg. 82462-01, 82492 (identifying entities with civil rights enforcement

powers). In the instance of a civil rights violation, Legal Aid lacks authority to sua sponte

correct the deficiencies giving rise to the violation or to impose sanctions or penalties.

Consequently, we conclude that the trial court committed error in ruling that Legal Aid

comes within the definition of a “health oversight agency” under HIPAA.



                              3. “Health Care Operations”

              An additional HIPAA provision that the trial court found applicable is the

exemption which permits a “covered entity” to “use or disclose protected health care

information for its own treatment, payment, or health care operations.” 45 C.F.R. §

164.506(c)(1) (2014) (emphasis added). Because “health care operations” are defined to

include “[c]onducting quality assessment,” “auditing functions, including . . . abuse

detection and compliance programs,” and “[r]esolution of internal grievances,” the trial court

ruled that the advocacy and auditing services provided by Legal Aid are part of the

hospitals’ covered health care operations. See 45 C.F.R. § 164.501 (2014).

                                             19

              Once again, the trial court has deemed a HIPAA exemption to apply based on

a flawed interpretation of the subject definition. Reading from the bottom up, the trial court

simply concludes that because auditing and compliance functions are part of “health care

operations,” then the services performed by Legal Aid must necessarily be covered by this

exemption. What the trial court overlooks is the critical distinction, similar to the limitation

imposed on a “business associate,” that these services, by definition, are those that are

performed at the direction of or on behalf of the facility as part of its own internal operating

procedures. “[H]ealth care operations are the listed activities undertaken by the covered

entity that maintains the protected health information.” 65 Fed. Reg. 82462-01, 82490

(emphasis supplied). The auditing and compliance functions performed by an independent

entity such as Legal Aid–an entity charged by law to uncover violations of patient rights by

the facilities rather than to assist a facility with the management of its operations–do not fall

within the meaning of “health care operations” as that term is defined by HIPAA. See 45

C.F.R. § 164.501.



              Further distinguishing between the activities that constitute “health care

operations” and those that do not, the DHHR explains that a hospital can access patient

records within the meaning of the subject exemption to resolve internal grievances. In

contrast, the initiation of a grievance by Legal Aid is an activity external to the facility and

thus beyond the scope of the exemption. In the same vein, a facility may access patient

                                               20

records for its own internal audits, but external audits such as those performed by Legal Aid

fall outside the scope of the facility’s operations and thus the applicability of the exemption.

Accordingly, we find that the trial court erred in reasoning that the “health care operations”

exemption under HIPAA is available to Legal Aid.



                                 4. “Required by Law”

              In generalized fashion, the trial court relied upon the HIPAA exemption that

permits disclosure without written consent where “such use or disclosure is required by

law.” 45 C.F.R. § 164.512(a). For more specific support, the trial court cited the provision

of HIPAA that permits a covered entity to disclose protected health information to a

government authority when the covered entity reasonably believes that the information

pertains to a victim of abuse or neglect.31 See id. at § 164.512(c). Seeking further authority

for its ruling, the trial court concluded that “the disclosure may be made in response to an

express authorization by court order.” See 45 C.F.R. § 164.512(e)(1)(i).



              As the DHHR clarifies, the exemption laced to a legal directive both

contemplates and requires “a mandate contained in law that compels a covered entity to



       31
        The trial court looked additionally to the subsection permitting disclosure in the
instance of incapacity when awaiting consent would materially and adversely impact an
immediate enforcement activity. See 45 C.F.R. § 164.512(c)(1)(iii)(B).

                                              21

make a use or disclosure of protected health information . . . that is enforceable in a court

of law.” 65 Fed. Reg. 82462-01, 82497. Application of this exemption is specifically

constrained by the requirement that “the use or disclosure complies with and is limited to the

relevant requirements of such law.” 45 C.F.R. § 164.512(a). The DHHR contends that this

exemption does not apply because there is no state law that requires the hospitals to disclose

patient records in the unfettered fashion decreed by the trial court. We agree. While state

regulations authorize patient advocates to gain access to patient records in the process of

investigating grievances without express consent, there is no state-enacted law or regulation

that expansively directs facilities such as Bateman and Sharpe to disclose all patient records

to Legal Aid without consent. See 64 C.S.R. § 59-11.5.1.d. The abuse and neglect

provision is similarly inapplicable as it concerns disclosure to a governmental authority

rather than to a private entity such as Legal Aid.



              In its reach to come within the parameters of the “required by law” exemption,

the trial court suggests that HIPAA’s requirements may be avoided with the entry of a court

order. Not only is this deduction erroneous but it ignores the additional requirement that a

court-directed disclosure applies only to “expressly authorized” disclosures made “in the

course of any judicial or administrative proceeding.” 45 C.F.R. § 164.512(e)(1)(i). A ruling

that seeks to broadly sanction disclosure not expressly linked to a specific judicial or

administrative matter falls outside the framework of the HIPAA exemption which permits

                                             22

disclosure pursuant to judicial authorization. See id. Morever, as HIPAA makes clear, the

provision for directives issued in the course of specific judicial and administrative

proceedings “do[es] not supersede other provisions of this section that otherwise permit or

restrict use or disclosure of protected health information. 45 C.F.R. § 164.512(e)(2). We

have little difficulty concluding that the HIPAA exemption premised on a judicial ruling has

no application to the prospective disclosures contemplated by the August 27th decree as such

disclosures would be made outside the framework of an ongoing proceeding. Accordingly,

we find that the trial court erred in its reliance on the HIPAA exemptions pertaining to legal

mandates or rulings. See 45 C.F.R. §§ 164.512(a), 512(e)(1)(i).



                                       C. State Law

              Having determined that federal law does not provide the necessary authority

for disclosure of patients’ records to Legal Aid without consent, we proceed to determine

if our state law provides an independent basis to support the lower court’s ruling. As the

DHHR acknowledges, HIPAA’s preemption clause provides that the federal act “shall

supersede any contrary provision of State law,” unless state law is more stringent or if one

of several other exceptions applies. 42 U.S.C. § 1320d-7 (2012); 45 C.F.R. §§ 160.202, ­

203 (2014) (listing exceptions to preemption). If no exception applies, “State laws are

contrary to HIPAA if: (1) it would be impossible for the health care provider to comply

simultaneously with HIPAA and the state directive; or (2) the state provision stands as an

                                             23

obstacle to the accomplishment of the full objectives of HIPAA.” Wade v. Vabnick-Wener,

922 F.Supp.2d 679, 686 (W.D. Tenn. 2010).



                   From the record of this case, it is clear that this state undertakes to examine

our codified law on an annual basis to analyze whether our state laws are more stringent than

HIPAA’s for preemption purposes.32 Because the HIPAA Privacy Rule is viewed as a floor

of privacy protections for individuals, state laws may provide greater or more stringent

protections. In those instances where state law is determined to be more stringent because

it imposes enhanced or more detailed protections, the state law is not preempted by HIPAA.

From the record submitted in this case, the protections set forth in Title 64, Series 59 have

been determined to be more stringent than those required by federal law.33 Accordingly, our

state regulations set forth in Title 64, Series 59 are not preempted by HIPAA. See 45 C.F.R.

§§ 160.202, -203.



                 Within our state regulations that were adopted to provide “skillful, safe and

humane” care to incarcerated patients with mental health issues, the confidentiality of patient


       32
            This annual analysis is required by HIPAA.
       33
         Analyses completed in 2013 and 2014 entitled West Virginia Health Care Privacy
Laws and HIPPA Preemption Analysis for the DHHR conclude that our state regulations set
forth in 64 C.S.R. § 59 are not preempted by HIPPA as our provisions are more stringent.
The 2015 analysis reached the same conclusion.

                                                24

records is addressed at length. W.Va. Code § 27-5-9. The regulations specify in detail what

information is deemed confidential and when a patient’s records may be disclosed. See 64

C.S.R. § 59-11.1. While a patient may authorize the release of his or her records to any

person or entity, those records may also be obtained by the “providers of health, social, or

welfare services involved in caring for or rehabilitating the client.” 64 C.S.R. § 59-11.5.1.d.

Under this same provision, it is provided that “[n]o written consent is necessary for

employees of the department, comprehensive behavioral health centers serving the client or

advocates under contract with the department.” Id. (emphasis supplied).



              In an obvious attempt to thwart legislative intent, the DHHR denies that it has

a contract with Legal Aid. The DHHR maintains that the Grant Agreement pursuant to

which it employs Legal Aid on an annual basis to provide advocacy services for the patients

at Sharpe and Bateman does nothing but address the exchange of money. Our review of the

record demonstrates quite the opposite. In the initial sixteen pages of the Grant Agreement,

standard contractual matters such as scope, term, cancellation, remedies, and assignment are

addressed. Through a separate but expressly incorporated, ten-page document, the services

and activities required of Legal Aid are delineated. A review of the Grant Exhibit, along

with the multiple attached exhibits, wholly disproves the DHHR’s position that the

document fails to address the legal obligations of the parties. As a result, we hold that a

written agreement between the DHHR and the provider of patient advocacy services that

                                              25

specifies the legal obligations of the parties, including the manner of payment and the duties

associated with the provision of patient advocacy services, constitutes a contract within the

meaning of 64 C.S.R. § 59-11.5.1.d. for purposes of permitting patient advocates to access

records without the written consent of individuals hospitalized with mental health issues in

state facilities. This conclusion is specifically premised on the fact that the DHHR is

required by the 1990 Order to employ external patient advocates for purposes of complying

with the mandate contained in West Virginia Code § 27-5-9.



                 Returning to the trial court’s ruling, we affirm the lower court’s ruling that the

DHHR’s revocation of patient advocate access to patients, staff, and patient records absent

express written consent violates state law. The long term practice of providing unlimited

record access to the patient advocates, agreed to by the parties and sanctioned by the court

through the 2009 Agreed Order, has become part of the rule of this case. See generally

Keller v. Norfolk & W. Ry. Co., 113 W.Va. 286, 167 S.E. 448 (1932). Thus, for the DHHR

to act in violation of that established practice was contrary to the rule of law which governs

this case. Furthermore, the policy adopted by the DHHR is not required by HIPAA as this

state’s laws set forth in 64 C.S.R. § 59-1 to -20 are more stringent than those set forth in

HIPAA.34 As a result, we are convinced that the confidentiality protections, including the



       34
            See supra note 33.

                                                 26

annual training that the patient advocates undergo along with hospital staff, all combine as

designed to protect the interests of the patients at Sharpe and Bateman.



                 We further affirm the trial court’s ruling that the patient advocates shall have

access to patient records without limitation except when patients expressly request

limitations on the disclosure of their individual, identifiable health information. There is a

clear need for non-grievance related review of patient records to identify systemic issues of

noncompliance with the regulations that address issues of patient care. Furthermore, the

inclusion of language in the Grant Agreement that requires the preparation and submission

of a report to both the circuit court judge and the court monitor, as well as the parties,

documents the duty imposed on Legal Aid to review patient records independent of specific

grievances. A common thread that exists in both West Virginia § 27-5-9 and HIPAA is the

improvement of the quality of health care.35 That objective was undeniably blocked when

the DHHR instituted wholly unwarranted roadblocks in the path of the patient advocates.

Without unrestricted access to patient records, access that the Legislature expressly

approved, the patient advocates were effectively blocked from discovering violations of the

patients’ civil rights. HIPAA was never intended to serve as a hindrance to patient services

or civil rights; it was designed to prevent the inappropriate use or dissemination of protected



       35
            See 65 Fed. Reg. 82462-01, 82463.

                                                27

health information.36 In the case before us, the DHHR has failed to demonstrate that Legal

Aid has disseminated any protected health information in violation of federal or state law.



                                       IV. Conclusion

                 Based on the foregoing, the August 27, 2014, order of the Circuit Court of

Kanawha County is affirmed with regard to its multiple directives concerning the restoration

of access without limitation by patient advocates to patients at Sharpe and Bateman.37

                                                                                  Affirmed.




       36
            See supra note 35.
       37
         Consistent with the trial court’s directives, that access is subject to the right of
patients to place limitations on the disclosure of their health information.

                                              28
