The opinion
IN THE SUPREME COURT OF APPEALS OF WEST VIRGINIA
September 2015 Term FILED
__________ October 15, 2015
released at 3:00 p.m.
No. 14-0965 RORY L. PERRY II, CLERK
SUPREME COURT OF APPEALS
__________ OF WEST VIRGINIA
WEST VIRGINIA DEPARTMENT of HEALTH and HUMAN RESOURCES,
BUREAU for BEHAVIORAL HEALTH and HEALTH FACILITIES,
Petitioners
v.
E.H., et al.,
Respondents
______________________________________________________
Appeal from the Circuit Court of Kanawha County
Honorable Louis H. Bloom
Civil Action No. 81-MISC-585
AFFIRMED
________________________________________________________
Submitted: September 15, 2015
Filed: October 15, 2015
Patrick Morrisey, Esq. Jennifer S. Wagner, Esq.
Attorney General Mountain State Justice, Inc.
Elbert Lin, Esq. Clarksburg, West Virginia
Solicitor General
Julie Marie Blake, Esq. Lydia C. Milnes, Esq.
Assistant Attorney General Mountain State Justice, Inc.
Charleston, West Virginia Charleston, West Virginia
Counsel for DHHR Counsel for Respondents
JUSTICE LOUGHRY delivered the Opinion of the Court.
JUSTICE DAVIS dissents and reserves the right to file a dissenting opinion.
SYLLABUS
1. “In the context of institutional reform litigation, this Court may choose to
exercise its appellate jurisdiction over an order entered by the circuit court that it deems to
approximate a final order by its nature and effect.” Syl. Pt. 1, West Virginia Dep’t of Health
and Human Servs. v. E.H., Nos. 14-0664, 14-0845, __ W.Va. __, __ S.E.2d __ (Oct. 7,
2015).
2. A written agreement between the Department of Health and Human
Resources and the provider of patient advocacy services that specifies the legal obligations
of the parties, including the manner of payment and the duties associated with the provision
of patient advocacy services, constitutes a contract within the meaning of 64 C.S.R. § 59
11.5.1.d. for purposes of permitting patient advocates to access records without the written
consent of individuals hospitalized with mental health issues in state facilities.
LOUGHRY, Justice:
The West Virginia Department of Health and Human Resources, the Bureau
for Behavioral Health and Health Facilities (“DHHR”), seeks to reverse the August 27,
2014, order of the Circuit Court of Kanawha County, through which the DHHR was directed
to immediately restore access to patients and patient records to the patient advocates working
at this state’s two psychiatric hospitals.1 In challenging this ruling, the DHHR argues that
the circuit court’s order violates both the patients’ constitutional rights to privacy and the
Federal Health Insurance Portability and Accountability Act (“HIPAA”). The respondent
advocates for patients at Sharpe and Bateman Hospitals (sometimes referred to as the
“hospitals”) insist that the directives of the circuit court should be affirmed due to the clear
lack of constitutional or HIPAA violations. Having reviewed the record in this case to
verify the absence of constitutional infirmity as well as the lack of state or federal privacy
law violations stemming from the access historically afforded to patient advocates at these
facilities, we affirm the circuit court’s decision to restore the access afforded to the patient
advocates to the level they experienced prior to the abrupt change of course in June 2014.
Given the lower court’s partial reliance on certain HIPAA definitions and exclusions that
we find to be wholly inapplicable, our decision to affirm is grounded solely on state law
rather than an amalgam of state and federal law.2
1
Mildred Mitchell Bateman (“Bateman”) and William R. Sharpe, Jr. (“Sharpe”).
2
See Syl. Pt. 3, Barnett v. Wolfolk, 149 W.Va. 246, 140 S.E.2d 466 (1965) (“This
Court may, on appeal, affirm the judgment of the lower court when it appears that such
1
I. Factual and Procedural Background
The underlying litigation had its genesis in 1981 with a petition for a writ of
mandamus filed by a group of institutionalized individuals to address the civil rights of
patients with mental disabilities.3 See E.H. v. Matin (known as “Hartley” or “Matin I”), 168
W.Va. 248, 284 S.E.2d 232 (1981). This Court remanded the Hartley case to the Kanawha
County Circuit Court to achieve the legislative mandate of providing appropriate care and
treatment to those individuals who are involuntarily hospitalized. See W.Va. Code § 27-5-9
(2013). To that end, the West Virginia Behavioral Health System Plan (“BHSP”), a
comprehensive mental health plan, which addressed the various standards, conditions, and
facilities, was accepted by the circuit court in 1983.4 See E.H. v. Matin “(“Matin II”), 189
W.Va, 102, 104, 428 S.E.2d 523, 525 (1993). As part of the BHSP, the DHHR was required
to establish a patient advocacy system within the state hospitals to protect the rights of
institutionalized patients on an ongoing basis. Originally, the patient advocates were DHHR
employees who maintained offices within the hospitals. Due to issues that arose in the late
1980s stemming from improper personal relationships between the patient advocates and the
judgment is correct on any legal ground disclosed by the record, regardless of the ground,
reason or theory assigned by the lower court as the basis for its judgment.”).
3
See W.Va. Code § 27-5-9 (2013) (providing, inter alia, that “[e]ach patient of a
mental health facility . . . shall receive care and treatment that is suited to his or her needs
and administered in a skillful, safe and humane manner with full respect for his or her
dignity and personal integrity”).
4
This plan, a 330-page document, was reached by agreement among the parties. See
Matin II, 189 W.Va. at 104 n.2, 428 S.E.2d at 525 n.2.
2
hospital administrators, the court monitor formally recommended that the DHHR be required
to contract with an external entity to perform the patient advocacy services. No one objected
to this proposal and the recommendation was adopted by order, entered on February 20,
1990 (the “1990 order”).5
In accordance with its obligations under the 1990 order, the DHHR
immediately contracted with Legal Aid of West Virginia (“Legal Aid”) to provide patient
advocacy services. In this role, which it has occupied since its selection in 1990, Legal Aid
assists with and investigates individual grievances, conducts abuse and neglect
investigations, educates staff and patients about patient civil rights, and monitors Sharpe and
Bateman for the purpose of ensuring compliance with this state’s guarantee of patient civil
rights. See W.Va. Code § 27-5-9. Legislative rules expressly designed to “establish[] the
rights of clients of State-operated behavioral health facilities” were adopted in 1995.6 See
64 C.S.R. § 59-1.1. Those rules specify procedures that pertain to the mandated provision
of patient advocacy services7 and delineate a litany of patient rights that the hospitals are
required to observe, including confidentiality. See id. at §§ 59-1 to -20.
5
Pursuant to that order, the DHHR was directed to “contract with an entity outside
State government for the provision of advocacy.”
6
These rules were adopted under authority of West Virginia Code § 27-5-9(g).
7
“There shall be persons designated as client (or patient or resident) advocates who
are independent of the facility management in every behavioral health facility.” 64 C.S.R.
§ 59-20.1.
3
Court monitoring of the Hartley case continued until 2002 when, by agreement
of the parties, the case was removed from the active docket of the court.8 See E.H. v. Matin
(“Matin III”), 189 W.Va. 445, 432 S.E.2d 207 (1993) (approving continued circuit court
monitoring). In that same year, the DHHR decided to create the Office of the Ombudsman
(“Ombudsman”)–an office charged with overseeing compliance with the statutory duties
related to operation of the state hospitals. As the direct result of the Ombudsman’s July 3,
2008, report, documenting deplorable conditions and treatment of patients at Sharpe and
Bateman, the circuit court reopened the Hartley case. See State ex rel. Matin v. Bloom
(“Matin IV”), 223 W.Va. 379, 383-84, 674 S.E.2d 240, 244-45 (2009) (identifying issues
of overcrowding, lack of privacy, and denial of patients’ daily grooming and cleanliness
needs).
Systemic violations of patient rights, including the use of “chemical restraints,”
were demonstrated during a two-day evidentiary hearing held before the circuit court in
April 2009. At the conclusion of the hearing, the trial court ordered the parties to participate
in mediation which resulted in an agreement between the parties covering multiple issues.
Under that court-approved agreement, commonly referred to as the “2009 Agreed Order,”
the Ombudsman is charged with the duty to oversee implementation of the specific terms of
8
Court monitoring was resumed in 2009 based on reports of both the conditions and
treatment of patients at Sharpe and Bateman.
4
the agreement. Included in those terms is a provision requiring Sharpe and Bateman to fully
comply with the state regulations that address issues of patient care and patient advocacy
services. See 64 C.S.R. §§ 59-1 to -20. The 2009 Agreed Order requires that “[p]eriodic
review shall be established for compliance with [specified] sections.”9 In recognition of this
duty, the DHHR contracted with Legal Aid to “produce a report to inform Judge Bloom,
[and] the Hartley Court Monitor . . . of any progress or lack of progress in implementing
areas of Legislative Rule Title 64 Code of State Rules (CSR) Series 59 . . . within Sharpe
and Bateman by the end of the grant period.”10
On January 5, 2010, the parties agreed that the patient advocates would create
an assessment tool for the hospital audits necessary to enable the DHHR to comply with the
periodic review contemplated by the 2009 Agreed Order. On March 31, 2010, the DHHR
agreed that quarterly audits should be conducted by providing the patient advocates with
complete access to at least two patients from each unit independent of any actual grievances
filed. On May 5, 2010, the parties agreed that the audit instrument was finalized and the
patient advocates were instructed “to begin implementation.”
9
Those sections are 64 C.S.R. §§ 59-12, -13, -14, -15.1.7, -15.1.12, -15.2, -15.3, and
-16.4.2.
10
This language appears in each of the annual grant documents in the record of this
case. Those documents set forth the duties of Legal Aid in relation to the patient advocacy
services and provide the necessary funding for such services.
5
For more than a decade, the DHHR provided the patient advocates with full
access to computerized patient records, to the patient wards, and other areas of the hospitals.
Then, in June 2014, with no prior notice, the DHHR began requiring the patient advocates
to obtain signed releases from each patient, the patient’s guardian, and/or the person with
the medical power of attorney before obtaining any information from or about the patient.11
Under the altered procedures, a newly-executed release specifying the basis of inquiry was
required each time the advocates sought to review a patient’s records. Legal Aid stated that
even if the inquiry pertained to a previously-authorized matter, a new release was required
for each successive day a patient advocate sought access to a patient’s records.12 In addition
to this novel procedure of requiring a release in advance of any records inspection, Legal
Aid was denied access to the network of patient records–access required for conducting the
systemic reviews or audits of the two facilities.
In response to this abrupt change of policy regarding access to patient records,
the patient advocates filed a motion for emergency relief with the circuit court and a hearing
was held on August 1, 2014. After finding no violation of federal or state law, the circuit
11
The decision to alter access was made by the DHHR’s Privacy Officer, Lindsey
McIntosh. Before making this change in tack, Ms. McIntosh acknowledged she did not
investigate the role or needs of the advocates; she did not visit Bateman or Sharpe; she did
not speak to Legal Aid; and she did not review any of the orders pertaining to this case.
12
According to the DHHR’s representation in its response to the Motion for
Emergency Relief, each authorization was good for 180 days.
6
court directed the DHHR, by order of August 24, 2014, to immediately restore Legal Aid
to the previous levels of access at Sharpe and Bateman. On August 29, 2014, the circuit
court denied the DHHR’s motion for stay of the August 27, 2014, amended ruling.13 By
order of September 14, 2014, this Court stayed the lower court’s order and granted the
appeal filed by the DHHR.
II. Standard of Review
Given our conclusion that the August 27, 2014, amended ruling constitutes a
final order notwithstanding the trial court’s contrary ruling,14 we review the subject order
pursuant to our well-established standard of examining questions of law de novo while
reversing factual determinations only upon a showing of clear error. See Syl. Pt. 2, Walker
v. W.Va. Ethics Comm’n, 201 W.Va. 108, 492 S.E.2d 167 (1997). This Court recently
13
Minor changes were made to the previous ruling. The only substantive amendments
were to remove the reference to the patient advocates as having been created by both federal
and state law (they were created solely under state law) and to recognize that grievances may
be initiated independently by a patient advocate separate from a patient’s allegation of abuse
or assertion of a civil rights violation.
14
By order entered on August 29, 2014, the circuit court refused to grant the DHHR’s
request to have the August 27, 2014, order deemed a final order. The rationale for its ruling
is clear: the trial court was trying to prevent the DHHR from belatedly seeking relief from
its previously unappealed 1990 Order. Because the court’s ruling was not impelled by the
need to address additional issues arising from reduced access (i.e. a lack of finality) and
because there are no further issues to be resolved concerning access, we deem the August
27, 2014, ruling to be final for purposes of allowing this Court to address the issues before
us through the subject appeal.
7
dispelled any concerns with regard to its right to consider this matter by means of an appeal15
with our recent holding in syllabus point one of West Virginia Department of Health and
Human Services et al. v. E.H., __ W.Va. __, __ S.E.2d __ , Nos. 14-0664, 14-0845 (Oct. 7,
2015), wherein we held that “[i]n the context of institutional reform litigation, this Court
may choose to exercise its appellate jurisdiction over an order entered by the circuit court
that it deems to approximate a final order by its nature and effect.” Accordingly, we proceed
to determine whether the trial court erred in issuing the ruling under review.
III. Discussion
A. Constitutional Privacy Rights
In support of its position that the lower court’s order improperly requires
unfettered disclosure of patient records to the patient advocates, the DHHR maintains that
the Fourteenth Amendment has been recognized to protect an individual’s right to privacy
with regard to avoiding disclosure of personal matters. See Whalen v. Roe, 429 U.S. 589,
599 (1977); accord Doe v. City of New York, 15 F.3d 264, 267 (2d Cir. 1994) (“Extension
of the right to confidentiality to personal medical information recognizes there are few
matters that are quite so personal as the status of one’s health, and few matters the
dissemination of which one would prefer to maintain greater control over.”). Because the
trial court failed to employ a balancing test to assess the reasonableness of the privacy
15
Cf. Syl. Pt. 5, Riffe v. Armstrong, 197 W.Va. 626, 477 S.E.2d 535 (1996).
8
intrusion that flows from the sweeping access mandated by the order at issue, the DHHR
argues that the constitutional rights of patients at Sharpe and Bateman outweigh Legal Aid’s
interest in accessing patient files. See Nixon v. Adm’r of Gen’l Servs., 433 U.S. 425, 458-60
(1977) (utilizing balancing test to measure privacy intrusion against reasonableness of
governmental actions). Emphasizing the enhanced need to conduct this inquiry when a
realistic probability of public disclosure exists as in this case, the DHHR posits that the
circuit court erred by failing to consider the applicability of constitutionally-based
protections for the health information contained in the patient records.
Legal Aid contends that the DHHR improperly seeks to inject constitutional
error into this matter with an issue never addressed by the circuit court.16 Not only does
Legal Aid concur with the tenets of privacy law articulated by the DHHR, but it fully agrees
with the petitioners’ statement that “the Fourteenth Amendment’s right to informational
privacy forbids the indiscriminate disclosure of state psychiatric records.” Legal Aid
emphasizes that the patient advocates neither seek the indiscriminate disclosure of patient
records nor do they conduct their advocacy services in a manner inconsistent with the
16
Legal Aid asserts that the DHHR did not raise the issue of constitutional error at the
August 1, 2014, hearing. In response, the DHHR states that the evidentiary proceeding was
not the forum in which to assert legal error. The record demonstrates that the DHHR
advanced the issue of constitutional error in its response to Legal Aid’s Motion for
Emergency Relief. Citing Griswold v. Connecticut, 381 U.S. 479 (1965), the DHHR
asserted that unlimited access to patient records absent patient consent is a violation of the
right to privacy judicially deemed to arise under the First Amendment.
9
patients’ privacy rights. Dismissing the need for an extended discourse about the existence
of privacy rights, Legal Aid states that the issue presented is simply whether the disclosure
of patient records pursuant to state and federal laws enacted to protect patient rights runs
afoul of those acknowledged rights. Or stated in the converse, do provisions of federal
and/or state law permit the disclosure of patient records to the patient advocates under
contract with DHHR to provide advocacy services at Bateman and Sharpe.
At the outset, we observe that the constitutional concerns raised by the DHHR
are confined to the previous longstanding practice of permitting the advocates to review
patient records for purposes of assessing overall hospital conditions.17 The DHHR does not
raise the possibility of constitutionally-based privacy violations with regard to individual
grievances or complaints of abuse and neglect.18 What the DHHR challenges is the circuit
court’s directive that allows the advocates to have access to patient files unrelated to specific
complaints or grievances. This access was authorized, consistent with past practice and the
agreement of the parties, for purposes of discerning systemic issues related to the patient
17
It is difficult for this Court to avoid the conclusion that, while seeking to prevent
access to the patient advocates under the guise of privacy concerns, the DHHR’s true
objective is to make the discovery of systemic problems more difficult for the advocates to
identify.
18
Legal Aid asserts that the new policy implemented by the DHHR prevents Legal
Aid from complying with the time constraints pertaining to the investigation of abuse and
neglect complaints under state law. See 64 C.S.R. § 59-20.2.9 (requiring submission of
written report by patient advocate “[w]ithin the next eight (8) regular working hours” of
receipt of abuse or neglect grievance).
10
rights established by state regulation.19 See 64 C.S.R. §§ 59-1 to -20. Pursuant to the
governing Grant Agreement that outlines the duties the DHHR requires of the patient
advocates, an annual report reflecting the results of the systemic review is required to be
tendered to the circuit court judge, court monitor, the DHHR, and Mountain State Justice.20
Inherent in the DHHR’s argument is a presumption that the systemic review
of patients’ records necessarily results in the wrongful disclosure of medical information.
Given that the first and only complaint concerning an alleged violation of HIPAA was filed
in 2014 by the DHHR–almost twenty years after the federal act became law–it is clear that
inappropriate disclosure of patient information has not been taking place as implied by the
DHHR. Not only have there been no complaints filed until the DHHR instituted one,21 but
the state privacy officers whose responsibility it is to oversee these matters have failed to
19
These periodic reviews, required by the 2009 Agreed Order, have been performed
by the patient advocates. Additionally, as noted by the trial court in both its August 18 and
27, 2014, rulings, the “Respondents [DHHR] agreed to the Formal Recommendations [of
the Court Monitor], which set forth that systemic advocacy will be pursued by LAWV
[Legal Aid], without objection, thereby allowing them to take on the force of Court Order.”
20
During the evidentiary hearing held in this matter on August 1, 2014, the DHHR’s
privacy officer, Lindsey McIntosh, was questioned as to how the patient advocates were
going to do the systemic audits “without access to records or patients or have conversations
with staff without individual releases specifying specific grievances.” She answered the
query by stating, “I don’t know how you’re going to conduct audits if you have to do that.”
21
Finding it to be baseless, the trial court ordered the DHHR to dismiss its complaint.
A review of the complaint demonstrates that even the DHHR was dubious about the
violation given its statement in the complaint that the “level of harm”was unclear.
11
either independently identify or confirm the existence of any issues concerning the level of
access historically afforded to the patient advocates.
In seeking to convince this Court that the provision of advocacy services over
the past two decades has just recently become a matter of constitutional significance, the
DHHR ignores the annual HIPAA training, the executed confidentiality agreements, and
state law provisions all designed for the purpose of, and apparently successful at, imposing
a high level of confidentiality upon the patient advocates with regard to their review of
sensitive health information. As Legal Aid explained, the review undertaken by the patient
advocates is conducted in confidence without public disclosure of any protected health
information. Critically, there has never been any complaint filed by a Bateman or Sharpe
patient, or the patient’s representative, associated with the wrongful dissemination of
confidential health information.22 Because the record in this case wholly fails to demonstrate
the indiscriminate disclosure of confidential information by the patient advocates–let alone
any disclosure of protected health information, we are not persuaded that a meritorious issue
exists with regard to Legal Aid’s dissemination of confidential health information.23
22
In contrast, there have been patient-initiated complaints since the DHHR imposed
the new, limited access provisions. According to Legal Aid, the patients were frustrated by
their inability to gain immediate access to the advocates, who were no longer permitted to
freely roam the facilities where patients could easily seek them out when needed.
23
As Legal Aid observes, there is no greater risk posed by the patient advocates than
by any of the Hospital employees who have access to patient records.
12
Accordingly, we reject the DHHR’s contention that the trial court erred in failing to address
whether the access afforded to Legal Aid violates the constitutionally-based rights of privacy
of patients at Sharpe and Bateman.
B. HIPAA
Pursuant to HIPAA’s Privacy Rule (“Privacy Rule”), “[a] covered entity or
business associate may not use or disclose24 protected health information” barring either a
regulatory exemption or written authorization from the subject of the information or his/her
representative. 45 C.F.R. § 164.502(a) (2014) (footnote added). The DHHR argues that the
patient advocates do not come within any exemptions provided under HIPAA that would
eliminate the need to obtain patient consent before viewing medical records. Specifically,
the DHHR disagrees with the trial court’s decision that Legal Aid falls within the HIPAA
definition for a “business associate,” a “health oversight agency,” or “health care
operations.” The DHHR also objects to the trial court’s reliance on the HIPAA exemption
pertaining to disclosures “required by law.” Each of these HIPAA definitions and its
respective applicability to the matter before us will be examined in turn.
24
Disclosure is “the release, transfer, provision of access to, or divulging in any
manner of information outside the entity holding the information.” 45 C.F.R. § 160.103
(2014).
13
1. “Business Associate”
Under HIPAA, a “business associate” relates to and is defined in reference to
a “covered entity.” The Privacy Rule’s construct of a “covered entity” extends to: (1) a
health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any
health information in electronic form in connection with a covered transaction. See 45
C.F.R. § 160.103 (2014). As the circuit court correctly ruled in its August 27th order, both
Bateman and Sharpe qualify as covered entities under HIPAA. With scant analysis,25 the
trial court and Legal Aid simply adopted the position that the patient advocates necessarily
meet the HIPAA definition of a “business associate.” An examination of the pertinent
regulations addressing the nature of a “business associate” clearly refutes this conclusion.
Legal Aid repeatedly refers to itself as a “business associate” of the DHHR.
Because the DHHR is not a “covered entity” under HIPAA, the relationship between Legal
Aid and the DHHR is not controlling. To come within HIPAA’s exclusionary language,
Legal Aid must be a “business associate” of Sharpe and Bateman. In further explanation of
what is necessary to qualify as a “business associate,” the regulations provide that it is a
25
The trial court ruled that Legal Aid is a “business associate” as set forth in its
contract with the DHHR and also due to its receipt of protected health information for
quality assurance, patient safety, and other health care operations. As discussed infra, the
DHHR’S description of Legal Aid as a “business associate” is neither controlling nor
accurate. The review of protected health information as part of the provision of advocacy
services at Sharpe and Bateman does not impel the conclusion that Legal Aid is a “business
associate.”
14
person who:
(i) On behalf of such covered entity . . . but other than in
the capacity of a member of the workforce of such covered
entity or arrangement, creates, receives, maintains, or transmits
protected health information for a function or activity regulated
by this subchapter, including claims processing or
administration, data analysis, processing or administration,
utilization review, quality assurance, patient safety activities
listed at 42 CFR 320, billing, benefit management, practice
management, and repricing; or
(ii) Provides, other than in the capacity of a member of
the workforce of such covered entity, legal, actuarial,
accounting, consulting, data aggregation . . . , management,
administrative, accreditation, or financial services to or for such
covered entity . . . .
45 C.F.R. § 160.103.
The DHHR argues, and we agree, that the patient advocacy services performed
at Bateman and Sharpe are not performed on behalf of either of those facilities within the
meaning of the Privacy Rule. See id. In purveying the list of activities that constitute
services typically performed by a “business associate” for a “covered entity,” patient
advocacy is noticeably absent. Rather than serving the interests of the hospitals in terms of
providing managerial assistance with their operations, the patient advocates serve the
personal interests of the patients who reside at those facilities. From the beginning, the
provision of patient advocacy services was created to protect the interests of individual
patients. See W.Va. Code § 27-5-9; 64 C.S.R. § 59-20.1 (mandating patient advocates in
every behavioral health facility who are independent of facility management). Despite the
15
expanded role of the patient advocates with regard to systemic auditing, the primary
objective in conducting these reviews is compliance with patient-oriented rights.26
While it might be tempting to view the provision of patient advocacy services
as improving the operations of the facilities under discussion, the pivotal inquiry is whether
the advocacy services are being offered by Legal Aid on behalf of the hospitals. That Legal
Aid is not operating on behalf of Sharpe and Bateman is easily demonstrated by considering
the adversity inherent to the role the patient advocates occupy in relation to those facilities.
Rather than advancing the hospitals’ interests, the advocates are responsible for investigating
individual grievances against the hospitals and identifying instances of the hospitals’ failure
to comply with the civil rights afforded to institutionalized patients under state law. By
design, the patient advocates operate independently of the hospitals’ interests and, most
decidedly, not on their behalves. We further observe that the improper characterization of
Legal Aid as “business associates” in the Grant Agreement does not serve to repair the
underlying definitional disconnect.27 As the DHHR properly acknowledges, its
identification of Legal Aid as a “business associate,” in an admitted and overly-expansive
26
The fact that the institutions may benefit from the provision of these auditing
services does not alter the wholly independent and individual-oriented nature of the
advocacy actions at issue.
27
The Grant Agreement makes clear that “Business Associate shall have the meaning
given to such term in 45 CFR § 160.103.”
16
attempt to comply with HIPAA,28 has no corresponding ability to make the characterization
a reality under the law. Based on the foregoing, we conclude that the trial court erred in
finding that Legal Aid is a “business associate” of a “covered entity” under HIPAA.
2. “Health Oversight Agency”
Cherry picking parts of the HIPAA definition of a “health oversight agency,”29
the trial court concluded that Legal Aid is such an agency because it “is authorized by law
to oversee the health care system . . . or government programs . . . or to enforce civil rights
laws for which health information is relevant.” The DHHR argues that no state law invests
Legal Aid, a private entity, with public oversight authority. The individualized advocate role
that Legal Aid performs, emphasizes the DHHR, is not on par with the public health
28
The DHHR stated that boilerplate business associate addendums were regularly
attached to all grant agreements, even when unnecessary, in an effort to comply with
HIPAA’s “stern mandate to have an agreement in place with any business associate.”
29
A “health oversight agency” is defined as
an agency or authority of the United States, a State, . . . or a
person or entity acting under a grant of authority from or
contract with such public agency, . . . that is authorized by law
to oversee the health care system . . . or government programs
in which health information is necessary to determine eligibility
or compliance, or to enforce civil rights laws for which health
information is relevant.
45 C.F.R. § 164.501 (2014).
17
concerns that a health oversight agency is charged to superintend. With regard to the
auditing function that Legal Aid performs, that duty is similarly not authorized by state law.
Furthermore, Legal Aid has no enforcement power with regard to the civil rights of the
patients.
From the list of agencies recognized to engage in health oversight activities,
such as state insurance commissions, state health professional licensure agencies, state
Medicaid fraud control units, the Pension and Welfare Benefit Administration, the HHS
Office for Civil Rights,30 it is clear that Legal Aid does not qualify as such an agency.
Inherent to the concept of a “health oversight agency” is a charge by law to oversee matters
involving public health or for which public health information is intrinsic to the public-
oriented duties at hand. Here, the advocacy duties Legal Aid provides do not have at their
core a concern for public health or a need to review public health information for eligibility
purposes. See 45 C.F.R. § 164.512(d) (2014) (approving disclosure to health oversight
agency of protected health information to determine eligibility for government benefit
programs).
While state regulations authorize patient advocates to investigate and ensure
30
See Standards for Privacy of Individually Identifiable Health Information, 65 Fed.
Reg. 82462-01, 82492.
18
compliance with civil rights guaranteed by West Virginia Code § 27-5-9, that authority does
not imbue Legal Aid with health oversight authority within the meaning of HIPAA. See
64 C.S.R. § 59-20. Unlike the United States Department of Justice, the HHS Office for
Civil Rights, and the United States Equal Employment Opportunity Commission, Legal Aid
has no enforcement powers pertinent to the patient civil rights it is charged with overseeing.
See 65 Fed. Reg. 82462-01, 82492 (identifying entities with civil rights enforcement
powers). In the instance of a civil rights violation, Legal Aid lacks authority to sua sponte
correct the deficiencies giving rise to the violation or to impose sanctions or penalties.
Consequently, we conclude that the trial court committed error in ruling that Legal Aid
comes within the definition of a “health oversight agency” under HIPAA.
3. “Health Care Operations”
An additional HIPAA provision that the trial court found applicable is the
exemption which permits a “covered entity” to “use or disclose protected health care
information for its own treatment, payment, or health care operations.” 45 C.F.R. §
164.506(c)(1) (2014) (emphasis added). Because “health care operations” are defined to
include “[c]onducting quality assessment,” “auditing functions, including . . . abuse
detection and compliance programs,” and “[r]esolution of internal grievances,” the trial court
ruled that the advocacy and auditing services provided by Legal Aid are part of the
hospitals’ covered health care operations. See 45 C.F.R. § 164.501 (2014).
19
Once again, the trial court has deemed a HIPAA exemption to apply based on
a flawed interpretation of the subject definition. Reading from the bottom up, the trial court
simply concludes that because auditing and compliance functions are part of “health care
operations,” then the services performed by Legal Aid must necessarily be covered by this
exemption. What the trial court overlooks is the critical distinction, similar to the limitation
imposed on a “business associate,” that these services, by definition, are those that are
performed at the direction of or on behalf of the facility as part of its own internal operating
procedures. “[H]ealth care operations are the listed activities undertaken by the covered
entity that maintains the protected health information.” 65 Fed. Reg. 82462-01, 82490
(emphasis supplied). The auditing and compliance functions performed by an independent
entity such as Legal Aid–an entity charged by law to uncover violations of patient rights by
the facilities rather than to assist a facility with the management of its operations–do not fall
within the meaning of “health care operations” as that term is defined by HIPAA. See 45
C.F.R. § 164.501.
Further distinguishing between the activities that constitute “health care
operations” and those that do not, the DHHR explains that a hospital can access patient
records within the meaning of the subject exemption to resolve internal grievances. In
contrast, the initiation of a grievance by Legal Aid is an activity external to the facility and
thus beyond the scope of the exemption. In the same vein, a facility may access patient
20
records for its own internal audits, but external audits such as those performed by Legal Aid
fall outside the scope of the facility’s operations and thus the applicability of the exemption.
Accordingly, we find that the trial court erred in reasoning that the “health care operations”
exemption under HIPAA is available to Legal Aid.
4. “Required by Law”
In generalized fashion, the trial court relied upon the HIPAA exemption that
permits disclosure without written consent where “such use or disclosure is required by
law.” 45 C.F.R. § 164.512(a). For more specific support, the trial court cited the provision
of HIPAA that permits a covered entity to disclose protected health information to a
government authority when the covered entity reasonably believes that the information
pertains to a victim of abuse or neglect.31 See id. at § 164.512(c). Seeking further authority
for its ruling, the trial court concluded that “the disclosure may be made in response to an
express authorization by court order.” See 45 C.F.R. § 164.512(e)(1)(i).
As the DHHR clarifies, the exemption laced to a legal directive both
contemplates and requires “a mandate contained in law that compels a covered entity to
31
The trial court looked additionally to the subsection permitting disclosure in the
instance of incapacity when awaiting consent would materially and adversely impact an
immediate enforcement activity. See 45 C.F.R. § 164.512(c)(1)(iii)(B).
21
make a use or disclosure of protected health information . . . that is enforceable in a court
of law.” 65 Fed. Reg. 82462-01, 82497. Application of this exemption is specifically
constrained by the requirement that “the use or disclosure complies with and is limited to the
relevant requirements of such law.” 45 C.F.R. § 164.512(a). The DHHR contends that this
exemption does not apply because there is no state law that requires the hospitals to disclose
patient records in the unfettered fashion decreed by the trial court. We agree. While state
regulations authorize patient advocates to gain access to patient records in the process of
investigating grievances without express consent, there is no state-enacted law or regulation
that expansively directs facilities such as Bateman and Sharpe to disclose all patient records
to Legal Aid without consent. See 64 C.S.R. § 59-11.5.1.d. The abuse and neglect
provision is similarly inapplicable as it concerns disclosure to a governmental authority
rather than to a private entity such as Legal Aid.
In its reach to come within the parameters of the “required by law” exemption,
the trial court suggests that HIPAA’s requirements may be avoided with the entry of a court
order. Not only is this deduction erroneous but it ignores the additional requirement that a
court-directed disclosure applies only to “expressly authorized” disclosures made “in the
course of any judicial or administrative proceeding.” 45 C.F.R. § 164.512(e)(1)(i). A ruling
that seeks to broadly sanction disclosure not expressly linked to a specific judicial or
administrative matter falls outside the framework of the HIPAA exemption which permits
22
disclosure pursuant to judicial authorization. See id. Morever, as HIPAA makes clear, the
provision for directives issued in the course of specific judicial and administrative
proceedings “do[es] not supersede other provisions of this section that otherwise permit or
restrict use or disclosure of protected health information. 45 C.F.R. § 164.512(e)(2). We
have little difficulty concluding that the HIPAA exemption premised on a judicial ruling has
no application to the prospective disclosures contemplated by the August 27th decree as such
disclosures would be made outside the framework of an ongoing proceeding. Accordingly,
we find that the trial court erred in its reliance on the HIPAA exemptions pertaining to legal
mandates or rulings. See 45 C.F.R. §§ 164.512(a), 512(e)(1)(i).
C. State Law
Having determined that federal law does not provide the necessary authority
for disclosure of patients’ records to Legal Aid without consent, we proceed to determine
if our state law provides an independent basis to support the lower court’s ruling. As the
DHHR acknowledges, HIPAA’s preemption clause provides that the federal act “shall
supersede any contrary provision of State law,” unless state law is more stringent or if one
of several other exceptions applies. 42 U.S.C. § 1320d-7 (2012); 45 C.F.R. §§ 160.202,
203 (2014) (listing exceptions to preemption). If no exception applies, “State laws are
contrary to HIPAA if: (1) it would be impossible for the health care provider to comply
simultaneously with HIPAA and the state directive; or (2) the state provision stands as an
23
obstacle to the accomplishment of the full objectives of HIPAA.” Wade v. Vabnick-Wener,
922 F.Supp.2d 679, 686 (W.D. Tenn. 2010).
From the record of this case, it is clear that this state undertakes to examine
our codified law on an annual basis to analyze whether our state laws are more stringent than
HIPAA’s for preemption purposes.32 Because the HIPAA Privacy Rule is viewed as a floor
of privacy protections for individuals, state laws may provide greater or more stringent
protections. In those instances where state law is determined to be more stringent because
it imposes enhanced or more detailed protections, the state law is not preempted by HIPAA.
From the record submitted in this case, the protections set forth in Title 64, Series 59 have
been determined to be more stringent than those required by federal law.33 Accordingly, our
state regulations set forth in Title 64, Series 59 are not preempted by HIPAA. See 45 C.F.R.
§§ 160.202, -203.
Within our state regulations that were adopted to provide “skillful, safe and
humane” care to incarcerated patients with mental health issues, the confidentiality of patient
32
This annual analysis is required by HIPAA.
33
Analyses completed in 2013 and 2014 entitled West Virginia Health Care Privacy
Laws and HIPPA Preemption Analysis for the DHHR conclude that our state regulations set
forth in 64 C.S.R. § 59 are not preempted by HIPPA as our provisions are more stringent.
The 2015 analysis reached the same conclusion.
24
records is addressed at length. W.Va. Code § 27-5-9. The regulations specify in detail what
information is deemed confidential and when a patient’s records may be disclosed. See 64
C.S.R. § 59-11.1. While a patient may authorize the release of his or her records to any
person or entity, those records may also be obtained by the “providers of health, social, or
welfare services involved in caring for or rehabilitating the client.” 64 C.S.R. § 59-11.5.1.d.
Under this same provision, it is provided that “[n]o written consent is necessary for
employees of the department, comprehensive behavioral health centers serving the client or
advocates under contract with the department.” Id. (emphasis supplied).
In an obvious attempt to thwart legislative intent, the DHHR denies that it has
a contract with Legal Aid. The DHHR maintains that the Grant Agreement pursuant to
which it employs Legal Aid on an annual basis to provide advocacy services for the patients
at Sharpe and Bateman does nothing but address the exchange of money. Our review of the
record demonstrates quite the opposite. In the initial sixteen pages of the Grant Agreement,
standard contractual matters such as scope, term, cancellation, remedies, and assignment are
addressed. Through a separate but expressly incorporated, ten-page document, the services
and activities required of Legal Aid are delineated. A review of the Grant Exhibit, along
with the multiple attached exhibits, wholly disproves the DHHR’s position that the
document fails to address the legal obligations of the parties. As a result, we hold that a
written agreement between the DHHR and the provider of patient advocacy services that
25
specifies the legal obligations of the parties, including the manner of payment and the duties
associated with the provision of patient advocacy services, constitutes a contract within the
meaning of 64 C.S.R. § 59-11.5.1.d. for purposes of permitting patient advocates to access
records without the written consent of individuals hospitalized with mental health issues in
state facilities. This conclusion is specifically premised on the fact that the DHHR is
required by the 1990 Order to employ external patient advocates for purposes of complying
with the mandate contained in West Virginia Code § 27-5-9.
Returning to the trial court’s ruling, we affirm the lower court’s ruling that the
DHHR’s revocation of patient advocate access to patients, staff, and patient records absent
express written consent violates state law. The long term practice of providing unlimited
record access to the patient advocates, agreed to by the parties and sanctioned by the court
through the 2009 Agreed Order, has become part of the rule of this case. See generally
Keller v. Norfolk & W. Ry. Co., 113 W.Va. 286, 167 S.E. 448 (1932). Thus, for the DHHR
to act in violation of that established practice was contrary to the rule of law which governs
this case. Furthermore, the policy adopted by the DHHR is not required by HIPAA as this
state’s laws set forth in 64 C.S.R. § 59-1 to -20 are more stringent than those set forth in
HIPAA.34 As a result, we are convinced that the confidentiality protections, including the
34
See supra note 33.
26
annual training that the patient advocates undergo along with hospital staff, all combine as
designed to protect the interests of the patients at Sharpe and Bateman.
We further affirm the trial court’s ruling that the patient advocates shall have
access to patient records without limitation except when patients expressly request
limitations on the disclosure of their individual, identifiable health information. There is a
clear need for non-grievance related review of patient records to identify systemic issues of
noncompliance with the regulations that address issues of patient care. Furthermore, the
inclusion of language in the Grant Agreement that requires the preparation and submission
of a report to both the circuit court judge and the court monitor, as well as the parties,
documents the duty imposed on Legal Aid to review patient records independent of specific
grievances. A common thread that exists in both West Virginia § 27-5-9 and HIPAA is the
improvement of the quality of health care.35 That objective was undeniably blocked when
the DHHR instituted wholly unwarranted roadblocks in the path of the patient advocates.
Without unrestricted access to patient records, access that the Legislature expressly
approved, the patient advocates were effectively blocked from discovering violations of the
patients’ civil rights. HIPAA was never intended to serve as a hindrance to patient services
or civil rights; it was designed to prevent the inappropriate use or dissemination of protected
35
See 65 Fed. Reg. 82462-01, 82463.
27
health information.36 In the case before us, the DHHR has failed to demonstrate that Legal
Aid has disseminated any protected health information in violation of federal or state law.
IV. Conclusion
Based on the foregoing, the August 27, 2014, order of the Circuit Court of
Kanawha County is affirmed with regard to its multiple directives concerning the restoration
of access without limitation by patient advocates to patients at Sharpe and Bateman.37
Affirmed.
36
See supra note 35.
37
Consistent with the trial court’s directives, that access is subject to the right of
patients to place limitations on the disclosure of their health information.
28