W. Va. Dept. of Health and Human Resources/Behavioral Health v. E.H.

778 S.E.2d 728, 236 W. Va. 279, 2015 W. Va. LEXIS 995

• Court: West Virginia Supreme Court
• Decided: October 15, 2015
• Docket: 14-0965
• Status: Published

Opinions

LOUGHRY, Justice:

The West Virginia Department of Health and Human Resources, the Bureau for Behavioral Health and Health Facilities (“DHHR”), seeks to reverse the August 27, 2014, order of the Circuit Court of Kana-wha County, through which the DHHR was directed to immediately restore access to patients and patient records to the patient advocates working at this state’s two psychiatric hospitals.¹ In challenging this ruling, the DHHR argues that the circuit court’s order violates both the patients’ constitutional rights to privacy and the Federal Health Insurance Portability and Accountability Act (“HIPAA”). The respondent advocates for patients at Sharpe and Bateman Hospitals (sometimes referred to as the “hospitals”) insist that the directives of the circuit court should be affirmed due to the clear lack of constitutional or HIPAA violations. Having reviewed the record in this case to verify the absence of constitutional infirmity as well as the lack of state or federal privacy law violations stemming from the access historically afforded to patient advocates at these facilities, we affirm the circuit court’s decision to restore the access afforded to the patient advocates to the level they experienced prior to the abrupt change of course in June 2014. Given the lower court’s partial reliance on certain HIPAA definitions and exclusions that we find to be wholly inapplicable, our decision to affirm is grounded solely on state law rather than an amalgam of state and federal law.²

I. Factual and Procedural Background

The underlying litigation had its genesis in 1981 with a petition for a writ of mandamus filed by a group of institutionalized individuals to address the civil rights of patients with mental disabilities.³ See E.H. v. Matin (known as “Hartley” or “Matin I”), 168 W.Va. 248, 284 S.E.2d 232 (1981). This Court remanded the Hartley case to the Kanawha County Circuit Court to- achieve the legislative mandate of providing appropriate care and treatment to those individuals who are involuntarily hospitalized. See W.Va.Code § 27-5-9 (2013). To that end, the West Virginia Behavioral Health System Plan (“BHSP”), a comprehensive mental health plan, which addressed the various standards, conditions, and facilities, was accepted by the' circuit court ’ in 1983.⁴ See E.H. v. Matin (“Matin II”), 189 W.Va. 102, 104, 428 S.E.2d 523, 525 (1993). As part of the BHSP, the DHHR was required'to estab-' lish a patient advocacy system within the state hospitals to protect the rights of institutionalized patients on an ongoing basis. Originally, the patient advocates were DHHR employees who maintained offices within the hospitals.' Due to issues' that arose in the late 1980s stemming from improper personal relationships between the patient advocates and the hospital administrators, the court monitor formally recommended that the DHHR be required to contract with an external entity to perform the patient advocacy services. No one objected to this proposal and the recommendation was adopted by order, entered on February 20,1990 (the “1990 order”).⁵

In accordance with its obligations under the 1990 order, the DHHR immediately contracted with Legal Aid of West Virginia (“Legal Aid”) to provide patient advocacy services. In this role, which it has occupied since its selection in 1990, Legal Aid assists with and investigates individual grievances, conducts abuse and neglect investigations, educates staff and patients about patient civil rights, and monitors Sharpe and Bateman for the purpose of ensuring compliance with this state’s guarantee of patient civil rights. See W.Va.Code § 27-5-9. Legislative rules expressly designed to “establish[ ] the rights of clients of State-operated tíehavioral health facilities” were adopted in 1995.⁶ See 64 C.S.R. § 59-1.1. Those rules specify procedures that pertain to the mandated provision of patient advocacy services⁷ and delineate a litany of patient rights that the hospitals are required to observe, including confidentiality. See id. at §§ 59-1 to -20.

Court monitoring of the Hartley case continued until 2002 when, by agreement of the parties, the case was removed from the active docket of the court.⁸ See E.H. v. Matin (‘‘Matin III ”), 189 W.Va. 445, 432 S.E.2d 207 (1993), (approving continued circuit court monitoring). In that same year, the DHHR decided to create the Office of the Ombudsman (“Ombudsman”)-an office charged with overseeing compliance with the statutory duties related to operation of the state hospitals. As the direct result of the Ombudsman’s July 3, 2008, report, documenting deplorable conditions and treatment of patients at Sharpe and Bateman, the circuit court reopened the Hartley case. See State ex rel. Matin v. Bloom (“Matin IV”), 223 W.Va. 379, 383-84, 674 S.E.2d 240, 244-45 (2009) (identifying issues of overcrowding, lack of privacy, and denial of patients’ daily grooming and cleanliness needs).

Systemic violations of patient rights, including the use of “chemical restraints,” were demonstrated during a two-day evidentiary hearing held before the circuit court in April 2009. At the conclusion of. the hearing, the trial court ordered the parties to participate in mediation which resulted in an agreement between the parties covering multiple issues. Under that court-approved agreement, commonly referred to as the “2009 Agreed Order,” the Ombudsman is charged with the duty to oversee implementation of the specific terms of the agreement. Included in those terms is a provision requiring Sharpe and Bateman to fully comply with the state regulations that address issues of patient care and patient advocacy services. See 64 C.S.R. §§ 59-1 to -20. The 2009 Agreed Order requires that “[p]eriodic review shall be established for compliance with [specified] sections.”⁹ In recognition of this duty, the DHHR contracted with Legal Aid to “produce a report to inform Judge Bloom, [and] the Hartley Court Monitor .... of any progress or lack of progress in implementing areas of Legislative Rule Title 64 Code of State Rules (CSR) Series 59 ... within Sharpe and Bateman by the end of the grant period.”¹⁰

On January 5, 2010, the parties agreed that the patient advocates would create an assessment tool for the hospital audits necessary to enable the DHHR to comply with the periodic review contemplated by the 2009 Agreed Order. On March 31, 2010, the DHHR agreed that quarterly audits should be conducted by providing the patient advocates with complete access to at least two patients from each unit independent of any actual grievances filed. On May 5, 2010, the parties agreed that the audit instrument was finalized and the patient advocates were instructed “to begin implementation.”

•For more than a decade, the DHHR provided the- patient advocates with full access to computerized patient records, to the patient wards, and other areas of the hospitals. Then, in June 2014, with no prior notice, the DHHR began requiring the patient advocates to obtain signed releases from each patient, the patient’s guardian, and/or the person with the medical power of attorney before obtaining any information 'from or about the patient.¹¹ Under the altered procedures, a' newly-executed release specifying the basis of inquiry was required each time the advocates sought to review a patient’s records. Legal Aid stated that even if the inquiry pertained to a previously-authorized matter, a new release was required for each successive day a patient advocate sought access to a patient’s records.¹² In addition to. this novel procedure of requiring a release in advance of any records inspection, Legal Aid was denied access‘to the network of patient records — access required for conducting the systemic reviews or audits of the'two facilities.

In response to this abrupt change of policy regarding access to patient records, the patient advocates filed a motion for emergency relief with the circuit court and a hearing was held on August 1, 2014. After finding no violation of federal or state law, the circuit court directed the DHHR, by order of August 24, 2014, to immediately restore Legal Aid to the previous levels of access at Sharpe and Bateman. On August 29, 2014, the circuit court denied the DHHR’s motion for stay of the August 27, 2014, amended ruling.¹³ By order of September 14, 2014, this Court stayed the lower court’s, order and granted the appeal filed by the DHHR. .

II. Standard of Review

Given our conclusion that the August 27, 2014, amended ruling constitutes a final order notwithstanding the trial court’s contrary ruling,¹⁴ we review the subject order pursuant to our well-established' standard of examining questions of law de novo while reversing factual determinations only upon a showing of clear error. See Syl. Pt. 2, Walker v. W.Va. Ethics Comm’n, 201 W.Va. 108, 492 S.E.2d 167 (1997). This Court recently dispelled any concerns with regard to its right to consider this matter by means of an appeal¹⁵ with our recent holding in syllabus point one of West Virginia Department of Health and Human Resources et al. v. E.H., 236 W.Va. 194, 778 S.E.2d 643, Nos. 14-0664, 14-0845, 2015 WL 5928503 (Oct. 7, 2015), wherein we held that “[i]n the context of institutional reform litigation, this Court may choose to exercise its appellate jurisdiction over an order entered by the. circuit court that it deems to approximate a final order by its nature and effect.” Accordingly, we proceed to determine whether the trial court erred in issuing the ruling under review.

III. Discussion

A. Constitutional Privacy Rights

In support of its position that the lower court’s order improperly requires unfettered disclosure of patient records to the patient advocates, the DHHR maintains that the Fourteenth Amendment has been recognized to protect an individual’s right to privacy with regard to avoiding disclosure Of personal matters. See Whalen v. Roe, 429 U.S. 589, 599, 97 S.Ct. 869, 51 L.Ed.2d 64 (1977); accord Doe v. City of New York, 15 F.3d 264, 267 (2d Cir.1994) (“Extension of the right to confidentiality to personal medical information recognizes there are few matters that are quite so personal as the status of one’s health, and few matters the dissemination of which one would prefer to maintain greater control over.”). Because the trial court failed to employ a balancing test -to- assess the reasonableness of the privacy intrusion that flows from the sweeping access mandated by the order at issue, the DHHR argues- that the constitutional rights of patients at Sharpe and Bateman outweigh Legal Aid’s interest in accessing patient files. See Nixon v. Adm’r of Gen’l Servs., 433 U.S. 425, 458-60, 97 S.Ct. 2777, 53 L.Ed.2d 867 (1977) (utilizing balancing test to measure privacy intrusion against reasonableness of governmental actions). Emphasizing the enhanced need to conduct this inquiry when a realistic probability of public disclosure exists as in this case, the.DHHR posits that the circuit court erred by failing to consider the applicability of constitutionally-based protections for the health information contained in the patient records.

Legal -Aid contends that the DHHR improperly seeks to inject constitutional error into this matter with an issue never addressed by the circuit court.¹⁶ Not only does Legal Aid concur with the tenets of privacy law articulated by the DHHR, but it fully agrees with the petitioners’ statement that “the Fourteenth Amendment’s right to informational privacy forbids the indiscriminate disclosure of state psychiatric records.” Legal Aid emphasizes that the patient advocates neither seek the indiscriminate disclosure of patient records nor do they conduct their advocacy services in a manner inconsistent with the patients’ privacy rights. Dismissing the need for an extended discourse about the existence of privacy rights, Legal Aid states that the issue presented is simply whether the disclosure of patient records pursuant to state and federal laws enacted to protect patient rights runs afoul of those acknowledged rights. Or stated in' the converse, do provisions of federal and/or state law permit the disclosure of patient records to the patient advocates under contract with DHHR to provide advocacy services at Bate-man and Sharpe.

At the outset, we. observe that the constitutional concerns raised by the DHHR are confined to the previous longstanding practice of permitting the advocates to review patient records for purposes of assessing overall hospital Conditions.¹⁷ The DHHR does not raise the possibility of constitutionally-based privacy violations with regard to individual grievances or complaints of abuse and neglect;¹⁸ What the DHHR challenges is the circuit court’s directive that allows the advocates to have access to patient files unrelated to specific complaints or grievances. This access was authorized, consistent with past practice and the agreement of the parties, for purposes of discerning systemic issues related to the patient rights established by state regulation.¹⁹ See 64 C.S.R.'§§ 59-1 to -20. Pursuant to the governing Grant Agreement that outlines the duties the DHHR requires of the patient advocates, an annual report reflecting the results of the systemic review is required to be tendered to the circuit court judge, court monitor, the DHHR, and Mountain State Justice.²⁰

Inherent in the DHHR’s argument is a presumption that the systemic review of patients’ records necessarily results in the wrongful disclosure of medical information. Given that the first and only complaint concerning an alleged violation of HIPAA was filed in 2014 by the DHHR — almost twenty years after the federal act became law — it is clear that inappropriate disclosure of patient information has not been taking place as implied by the DHHR. Not only have there been no complaints filed until the DHHR instituted one,²¹ but the state .privacy officers whose responsibility it is to oversee these matters have failed to either independently identify or confirm the existence of any issues concerning the level of access historically afforded to the patient advocates.

In seeking to convince this Court that the provision of advocacy services over the past two decades has just recently become a matter of constitutional significance, the DHHR ignores the annual HIPAA training, the executed confidentiality agreements, and state law provisions all designed for the purpose of, and apparently successful at, imposing a high level of confidentiality upon the patient advocates with regard to their review of sensitive health information. As Legal Aid explained, the review undertaken by the patient advocates is conducted in confidence without public disclosure of any protected health information. Critically, there has never been any complaint filed by a Bateman or Sharpe patient, or the patient’s representative, associated with the wrongful dissemination of confidential health information²² Because the record in this case wholly fails to demonstrate the indiscriminate disclosure of confidential information.by the patient advocates — let alone any disclosure of protected health information, 'we are not persuaded that a meritorious issue exists with regard to Legal Aid’s dissemination of confidential health information.²³ Accordingly, we reject the DHHR’s contention that the trial court erred in failing to address whether the access afforded to Legal Aid violates the constitutionally-based rights of privacy of patients at Sharpe and Bateman.

B. HIPAA

Pursuant to HIPAA’s Privacy Rule (“Privacy Rule”), “[a] covered entity or business' associate may hot use or disclose ²⁴ protected health information” barring either a regulatory exemption or written authorization from the subject of the information or his/her representative. 45 C.P.R. § 164.502(a) (2014) (footnote added). The DHHR argues that the patient advocates do not come within any exemptions provided under HIPAA that would eliminate the need to obtain patient consent before viewing medical records. Specifically, the DHHR disagrees with the trial court’s decision that Legal Aid falls within the HIPAA definition for a “business associate” a “health oversight agency,” or “health care operations.” The DHHR-also objects to the trial court’s reliance on the HIPAA exemption pertaining to disclosures “required by law.” Each of these HIPAA definitions and its respective applicability to the matter before us will be examined in turn.

1. “Business Associate”

Under HIPAA, a “business associate” relates to and is defined in reference to a “covered entity.” The , Privacy Rule’s construct of a “covered .entity” extends to: ■ (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any health information in electronic form in connection with a covered transaction. See 45 C.F.R. § 160.103 (2014). As the -circuit court correctly ruled in its August 27th order, both Bateman and Sharpe qualify as covered entities under HIPAA With scant analysis,²⁵ the trial court and Legal Aid simply adopted the position that the patient advocates necessarily meet the HIPAA definition of a “business associate.” An examination of the pertinent regulations .addressing the nature of a “business associate” clearly refutes this conclusion.

Legal Ad repeatedly refers to itself as a “business associate” of the DHHR. Because the DHHR is not a “covered entity” under HIPAA, the relationship between Legal Ad and the DHHR is not controlling. To come within HIPAA’s exclusionary language, Legal Ad must be a “business associate” of Sharpe and Bateman. In further explanation of what is necessary to qualify as a “business associate,” the regulations provide that it is a person who:

(i) On behalf of such covered entity ,.. but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or-transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 320, - billing; benefit management, practice management, and repricing; or

(ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation ..., management, administrative, accreditation, or’financial services to or for such covered entity....

45 C.F.R. § 160.103.

The DHHR argues, and we agree, that the patient advocacy services performed at Bateman and Sharpe are not performed on behalf of either of those facilities within the meaning of the Privacy Rule. See id. . In purveying the list of activities that constitute services typically performed by a “business associate” for a “covered entity,” patient advocacy is noticeably absent. Rather than serving the interests' of the hospitals in terms of providing managerial assistance with their operations, the patient advocates serve the personal interests of the patients who .reside at those facilities. From the beginning, the provision of. patient advocacy services .was created to protect the interests of individual patients. See W.Va.Code § 27-5-9; 64 C.S.R. § 59-20.1 (mandating patient advocates in every behavioral health facility who are independent of facility management). Despite the expanded role of the patient advocates with regard to systemic auditing, the primary objective in conducting these reviews is compliance with patient-oriented rights.²⁶

While it might be tempting to view the provision of patient advocacy services as improving the operations of the facilities under discussion, the pivotal inquiry is whether the advocacy services are being offered by Legal Aid on behalf of the 'hospitals. That Legal Aid is-not operating on behalf of Sharpe and Bateman is easily demonstrated by considering the adversity inherent to the role the patient advocates occupy in relation to those facilities. . Rather than- advancing the hospitals’ interests, the advocates are. responsible for investigating individual grievances against the hospitals and identifying instances of the hospitals’ failure to comply with the civil rights afforded to institutionalized patients under state law. By design, the patient advocates operate independently of the hospitals’ interests and, most decidedly, not on their behalves. We further observe that the improper eharacterizatioii of Legal Aid as “business associates” in the Grant Agreement does not serve to repair the underlying definitional disconnect.²⁷ As the DHHR properly acknowledges, its identification of Legal Aid as a “business' associate,?’ in an admitted and overly-expansive attempt to comply with HIPAA,²⁸ has no corresponding ability to make the characterization a reality under the law. , Based on the foregoing, we conclude that the trial court erred in finding that. Legal Aid is a “business associate” of a “covered entity” under HIPAA.

2. “Health Oversight Agency”

Cherry picking parts of the HIPAA definition of a “health oversight agency,”²⁹ the trial court concluded that Legal Aid is such an agency because it “is authorized by law-to oversee the health Care system ... or government programs ... or to enforce civil rights laws'for-which health information- is relevant.” The DHHR argues that no state law invests Legal Aid, a private entity, with public oversight authority. The individualized advocate role that Legal Aid performs, emphasizes the DHHR, is not on par with the public health concerns that a health oversight agency is charged to superintend. With' regard to the auditing function that Legal Aid performs, that duty is similarly not authorized by state law. Furthermore, Legal Aid has no enforcement power with regard to the civil rights of the patients.

From the list of agencies recognized to engage in health oversight activities, such as state • insurance commissions, state health professional licensure agencies, state Medicaid fraud control units, the Pension and Welfare Benefit Administration, the HHS Office for Civil Rights,³⁰ it is clear that Legal Aid does not- qualify as. such an agency. Inherent to the concept of a “health oversight agency” is.a charge by law to oversee matters involving public' health or for which public health information is intrinsic to the public-oriented- duties at. hand. Here, the advocacy ■ duties Legal Aid provides do not have at their core. a concern for public health or s, need to review public health information for eligibility purposes. See '45 C.F.R. § 164.512(d) (2014) (approving disclosure to health over-sight -agency of protected health information' to determine eligibility for government benefit programs).

While state regulations authorize- patient advocates to investigate and ensure compliance with! civil rights guaranteed by West Virginia Code' § 27-5-9, that authority does not imbue 'Legal Aid with health oversight authority within the- meaning of HIPAA. See 64 C.S.R. § 59-20. Unlike the United States Department of Justice, the HHS Office for Civil Rights, and the United States Equal Employment Opportunity Commission, Legal Aid has no enforcement powers pertinent to the patient civil rights it is charged with overseeing. See 65 Fed. Reg. 82462-01, 82492 (identifying entities with civil rights enforcement powers). In the instance of a civil rights violation, Legal Aid lacks authority to su a sponte correct the deficiencies giving rise to the violation or to impose sanctions or penalties. Consequently, we conclude that the trial court committed error in ruling that Legal Aid comes within the definition of a “health oversight agency” under HIPAA.

3. “Health Care Operations”

An additional HIPAA provision that the trial court found applicable is the exemption which permits a “covered entity” to “use or disclose protected health care information for its own treatment, payment, or health care operations.” 45 C.F.R. § 164.506(c)(1) (2014) (emphasis added).. Because “health care operations”., are defined ,to include “Conducting quality assessment,” “auditing .functions, including .,. abuse detection and compliance programs,” and “[rjesolution of internal grievances,” the trial court ruled that the advocacy and auditing services provided by Legal Ad are part of .the hospitals’ .covered health care operations. See 45 C.F.R. § 164.501 (2014).

Once again, the trial court has deemed a HIPAA exemption to apply based on a flawed interpretation of the subject definition. Reading from the bottom up, the trial court simply concludes that because auditing and compliance functions are part of “health care operations,” then the services performed by Légal Ad must necessarily be covered by this exemption. What the trial court overlooks is the critical distinction, similar to the limitation imposed on a “business associate”’ that these services, by definition, are those that are performed at the direction of or on behalf of the facility as part of its own internal operating procedures. “[Hjealth care operations are the listed activities undertaken by the covered entity that maintains the, protected health information.” 65 Fed. Reg. 82462-01, 82490 (emphasis supplied). The auditing and compliance functions performed by an independent entity such as Legal Ad-an entity Charged by law to uncover violations of patient rights by the facilities rather than to assist a facility with the management of its operations — do not fall within the meaning of “health care operations” as that term is .defined by HIPAA See 45 C.F.R. § 164.501.

Further distinguishing between the activities that constitute “health care operations” and those that do not, the DHHR explains that a hospital can access patient records within the meaning of the subject exemption to resolve internal grievances. In contrast, the initiation of a grievance, by Legal Ad is an activity external to the facility and thus beyond the scope of the exemption.. In the same.vein, a facility may access patient records for its own internal audits, but external audits such as those performed by Legal Ad fall outside the scope of the facility’s operations and thus the applicability of the exemption. Accordingly, we -find that the trial court erred in reasoning that the “health care operations” exemption under HIPAA. is available to Legal Ad.

4. ■ “Required by Law”

In generalized fashion, the trial court relied upon the HIPAA exemption that permits disclosure without written consent where “such use or disclosure is required by law.” 45 C.F.R. § 164.512(a). For more specific support,' the trial court cited the provision of HIPAA that permits a covered entity to disclose protected health information to' a government authority when the covered entity reasonably believes • that the information pertains to a victim of abuse or neglect.³¹ See id. at § 164.512(c). Seeking further authority for its ruling, the trial court concluded that “the disclosure may be made in response to an express authorization by court order.” See 45 C.F.R. § 164.512(e)(l)(i).

As the DHHR clarifies, the exemption laced to a legal directive both contemplates and requires “a mandate contained in law that compels a covered entity to make a use or disclosure of 'protected health information ... that is enforceable in a court of law.” 65 Fed. Reg. 82462-01, 82497. Application of this exemption is specifically constrained by the requirement that “the use or disclosure complies with and is limited to the relevant requirements of such law.” 45 C.F.R. § 164.512(a). The DHHR contends that this exemption does not apply because there is no state law that requires the hospitals to disclose patient records in the unfettered fashion decreed by the trial court. We agree. While state regulations authorize patient advocates to gain access to patient records in the process of investigating grievances without express consent, there is no state-enacted law or regulation that expansively directs facilities such as Bateman and Sharpe to disclose all patient records to Legal Aid without' consent. See 64 C.S.R. § 59-11.5.1.d. The abuse and neglect provision is similarly inapplicable as it concerns disclosure to a governmental authority rather than to a private entity such as Legal Aid.

In its reach to come within the parameters of the “required by law” exemption, the trial court suggests that HIPAA’s requirements may be avoided with the entry of a court order, Not only is this deduction erroneous but it ignores the additional requirement that a court-directed disclosure applies only to “expressly authorized” disclosures made “in the course of any judicial or administrative proceeding.” 45 C.F.R. § 164.512(e)(l)(i).' A ruling that seeks to broadly sanction disclosure not expressly linked to a specific judicial or administrative matter falls outside the framework of the HIPAA exemption which permits disclosure pursuant to judicial authorization. See id. Moreover, as HIPAA makes clear, the provision for directives issued in the course of specific judicial and administrative proceedings “do[es] not supersede other provisions of this section that otherwise permit or restrict use or disclosure of protected health information. 45 C.F.R. § 164.512(e)(2).. We have little difficulty concluding that the HIPAA exemption premised on a judicial ruling has no application to the prospective disclosures contemplated by the August 27th decree as such disclosures would be made outside the framework of an ongoing proceeding. Accordingly, we find that the. trial court erred in its reliance on the HIPAA exemptions pertaining to legal mandates or ■ rulings. See 45 C.F.R. §§ 164.512(a), 512(e)(l)(i).

C. State Law

Having determined that federal law does not provide the necessary authority for disclosure of patients’ records to Legal Aid without consent, we proceed to determine if our state law provides an independent basis to support the lower court’s ruling. As the DHHR acknowledges, HIPAA?s preemption clause provides that the' federal act “shall supersede any contrary provision of State law,” unless state law is more stringent or-if one of several other exceptions applies: 42 U.S.C. § 1320d-7 (2012); 45 C.F.R. §§'160.202,-203 (2014) (listing exceptions'to preemption). If no exception applies, “State laws are contrary to HIPAA if: (1) it would be impossible for the health care provider to comply simultaneously with HIPAA and the state directive; or (2) the state provision stands as an obstacle to the accomplishment of the full objectives of HIPAA.” Wade v. Vabnick-Wener, 922 F.Supp.2d 679, 686 (W.D.Tenn.2010).

From the record of this case, it is clear that this state undertakes to examine our codified law on an annual basis to analyze whether our state laws are more stringent than HIPAA’s for preemption purposes.³² Because the HIPAA. Privacy Rule is viewed as a floor of privacy protections for individuals, state laws may provide greater of more stringent protections. In those instances where state law is determinéd to be more stringent because it imposes enhanced or more detailed protections, the state law is not preempted by HIPAA. From the record submitted in this case, the protections set forth in Title 64, Series 59 have been determined to be more stringent than those required by federal law.³³ Accordingly, our state regulations set forth in Title 64, Series 59 are not preempted by HIPAA. • See 45 C.F.R. §§ 160.202, -203.

Within our state regulations that were adopted to provide “skillful, safe and humane” care to incarcerated patients' with mental health issues, the confidentiality of patient records is addressed at length. W.Va.Code § 27-5-9. The regulations specify in detail what information is deemed confidential and when a patient’s records may be disclosed. See 64 C.S.R. § 59-11.1. While a patient may authorize the release of his or her records to any person or entity, those records may also be obtained by the “providers of health, social, or welfare services involved in caring for or rehabilitating the client." 64 C.S.R. § 59-11.5.1.d. Under this same provision, it is provided that “[n]o written consent is necessary for employees of the department, comprehensive behavioral health centers serving the client or advocates under contract with the department.” Id. (emphasis supplied).

In an obvious attempt to thwart legislative intent, the DHHR denies that it has a contract with Legal Aid. The DHHR maintains that the Grant Agreement pursuant to which it employs Legal Aid on an annual basis to provide advocacy services for the patients at Sharpe and Bateman does nothing but address the exchange of money. Our review of the record demonstrates quite the opposite. In the initial sixteen pages of the Grant Agreement, standard contractual matters such as scope, term, cancellation, remedies, and assignment are addressed. Through a separate but expressly incorporated, ten-page document, the services and activities required of Legal Aid are delineated. A review of the Grant Exhibit, along with the multiple attached exhibits, wholly disproves the DHHR’s position that the document fails to address the legal obligations of the parties. As a result, we hold that a written agreement between the DHHR and the provider of patient advocacy services that specifies the legal obligations of the parties, including the manner of payment and the duties associated with the provision of patient advocacy services, constitutes a contract within the meaning of 64 C.S.R. § 59-11.5.1.d. for purposes of permitting patient advocates to access records without the written. consent of individuals hospitalized with mental health issues in state facilities. This conclusion is specifically premised on the fact that the DHHR is required by the 1990 Order to employ external patient advocates for purposes of complying with the mandate contained in West Virginia Code § 27-5-9.-

Returning to the trial court’s ruling, we affirm the lower court’s ruling that the DHHR’s revocation of patient advocate access to patients, staff, and patient records absent express written consent violates state law. The long term practice of providing unlimited record access to the patient advocates, .agreed to by the parties and sanctioned by the court through the 2009 Agreed Order, has become part of the rule of this, case. See generally Keller v. Norfolk & W. Ry. Co., 113 W.Va. 286, 167 S.E. 448 (1932). Thus, for the DHHR to act in violation of that established practice was contrary to the rule of law which governs this case. Furthermore, the policy adopted by the DHHR is not required by HIPAA as this state’s laws set forth in 64 C.S.R. § 59-1 to -20 are more stringent than those set forth in HIPAA.³⁴ As a result, we are convinced that the confidentiality protections, including the annual training that the patient advocates undergo along with hospital staff, all combine as designed to protect the interests of the patients at Sharpe and Bateman.

We further affirm the trial court’s ruling that the patient advocates shall have access to patient records without limitation except when patients expressly request limitations on the disclosure of their individual, identifiable health information. There is a clear need for non-grievance related review of paRent records to identify systemic issues of noncompliance with the regulations that address issues of patient care. Furtherrhore, the inclusion of language in the Grant Agreement that requires the preparation and submission of a report to both the circuit court judge and the court monitor, as well as the parties, documents the duty imposed on Legal Aid to review patient records independent of specific grievances. A common thread that exists ¡in both West Virginia § 27-5-9' and HIPAA is the improvement of the quality of health care.³⁵ That objective was undeniably blocked when the DHHR instituted wholly unwarranted roadblocks in the path of the patient advocates. Without unrestricted access to patient records, access that the Legislature expressly approved, the patient advocates were effectively blocked from discovering violations of the patients’ civil rights. HIPAA was never intended to' serve as a hindrance to patient services or civil rights; it was designed to prevent the inappropriate use or. dissemination of protected health information.³⁶ In the case before us, the DHHR has failed to demonstrate that Legal Aid has disseminated any protected health information in violation of federal or state law.

IV. Conclusion

Based on the foregoing, the August 27, 2014, order, of the Circuit Court of Kanawha County is affirmed with regard to its multiple directives concerning the restoration of access without limitation by patient advocates to patients at Sharpe and Bateman.³⁷

Affirmed.

1 . Mildred Mitchell Bateman ("Bateman”) and William R. Sharpe, Jr. ("Sharpe”).

2 . See Syl. Pt. 3, Barnett v. Wolfolk, 149 W.Va. 246, 140 S.E.2d 466 (1965) ("This Court may, on appeal, affirm the judgment of the lower court when it appears that such judgment is correct on any legal ground disclosed by the record, regardless of the ground, reason or theory assigned by the lower court as the basis for its judgment.”).

3 . See W.Va.Code § 27-5-9 (2013) (providing, inter alia, that "[¿jach patient of a mental health facility ... shall receive care and treatment that is suited to his or her needs and administered in a skillful, safe and humane manner with full respect for his or her dignity and personal integrity”).

4 . This plan, a 330-page document, was reached by agreement among the parties. See Matin II, 189 W.Va. at 104 n. 2, 428 S.E.2d at 525 n. 2.

5 . Pursuant to that order, the DHHR was directed to “contract with an entity outside State government for the provision of advocacy.”

6 . These rules were adopted under authority of West Virginia Code § 27 — 5—9(g).

7 . "There shall be persons designated as client (or patient or resident) advocates who are independent of the facility management in every behavioral health facility.” 64 C.S.R. § 59-20.1.

8 . Court monitoring was resumed in 2009 based on reports of both the conditions and treatment of patients at Sharpe and Bateman.

9 . Those sections are 64 C.S.R. §§ 59-12, -13, - 14, -15.1.7, -15.1.12,--15.2, -15.3, and -16.4.2.

10 . Thiá language appears in each of the annual grant documents in ■ the record of this case. Those documents set forth the duties of Legal Aid in relation to the patient advocacy services and provide the necessary funding for such services.

11 . The decision to alter access was made by the DHHR’s Privacy Officer, Lindsey McIntosh. Before making this change in tack, Ms. McIntosh acknowledged she did not investigate the role or needs- of the advocates; she did not visit Bate- , man or Sharpe; shp did not speak- to Legal Aid; and she did not review any of the orders pertaining to this case.

12 . According to the DHHR’s representation in its response to the Motion for Emergency Relief,- - each authorization was good for 180 days.

13 . Minor changes were made to the previous ruling. The only substantive amendments were to remove the reference to the patient advocates as having been created by both federal and state law (they were created solely under state law) and to recognize that grievances may be initiated independently by a patient advocate separate from a patient’s allegation of abuse or assertion of a civil rights violation.

14 . By order entered on August 29, 2014, the . circuit court refused to grant the DHHR’s request to have the August 27, 2014, order deemed a final order. The rationale for its ruling is clear; the trial court was trying to prevent the DHHR from belatedly seeking relief from its previously unappealed 1990 Order. Because the court’s ruling was not impelled by the need to address additional issues arising from reduced access (i.e. a .lack of finality) and because there are no further issues to be resolved concerning¹ access, we deem the August 27, 2014, ruling to be final for purposes of allowing this Court to ' address the issues before us through the subject appeal.

15 . Cf. Syl. Pt. 5, Riffe v. Armstrong, 197 W.Va. 626, 477 S.E.2d 535 (1996).

16 . Legal Aid asserts that the DHHR did not raise the issue of constitutional error at the August 1, 2014, hearing. In response, the DHHR states that the evidentiary proceeding was not the forum in which to assert legal error. The record demonstrates that the DHHR advanced the issue of constitutional error in its response to Legal Aid's Motion for Emergency Relief. Citing Griswold v. Connecticut, 381 U.S. 479, 85 S.Ct. 1678, 14 L.Ed.2d 510 (1965), the DHHR asserted that unlimited access to patient records absent patient consent is a violation of the right to privacy judicially deemed to arise under the First Amendment.

17 . It is difficult for this Court to avoid the conclusion that, while seeking to prevent access to the patient advocates under the guise of privacy concerns, the DHHR's true objective is to make the discovery of systemic problems more difficult for the advocates to identify.

18 . Legal'Aid asserts that the new policy implemented by the DHHR- prevents Legal Aid from complying with the time constraints pertaining to the investigation of abusé and neglect complaints under state law.- See 64 C.S.R. § 59--20.2.9 (requiring submission of written report by patient advocate “[wjithin the next eight (8) regular working hours” of receipt-of abuse-or neglect grievance).

19 . These periodic reviews, required by the 2009 Agreed Order, have been performed by the patient advocates. Additionally,- as noted by the trial court in both its August 18 and 27, 2014, rulings; the "Respondents [DHHR] agreed to the Formal Recommendations [of the Court Monitor], which set forth that systemic advocacy will be pursued by LAWV [Legal Aid], without objection, thereby allowing them to take on the force of Court Order."

20 . During the evidentiary hearing held in this matter on August 1, 2014, the DHHR’s privacy officer, Lindsey McIntosh, - was questioned as to how the patient advocates-were going to do the ■ systemic audits "without access to records or patients or have conversations with staff without individual releases specifying specific grievances." She answered tire query by stating, "I don't know how you're going to conduct audits if you have to do that.”

21 . Finding it to be baseless, the trial court ordered the DHHR to dismiss its complaint. A .review of the complaint demonstrates that even the DHHR was dubious about the violation given its statement in the complaint that the "level of harm’’ was unclear.

22 . In contrast, there have been patient-initiated complaints since the DHHR imposed the new, limited access provisions. According to Legal Aid, the patients were frustrated by their inability to gain immediate access to the advocates, who were no longer permitted to freely roam the facilities where patients could easily seek them out when needed.

23 . As Legal Aid observes, there is no greater risk posed by the patient advocates than by any of the Hospital employees who have access to patient records.

24 . Disclosure is "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information." 45 C.F.R. § 160.103(2014).

25 . The trial court ruled that Legal Aid is a “business associate” as set forth in its contract with the DHHR and also due to its receipt of protected health information for quality assurance, patient safety, and other health care operations. As discussed infra, the DHHR'S description of Legal Aid as a "business associate” is neither controlling nor accurate. The review of protected health information as part of the provision of advocacy services at Sharpe and Bateman does not impel the conclusion that Legal Aid is a "business associate.”

26 . The fact that the institutions may benefit from the provision of these auditing services does not alter the wholly independent and individual-oriented nature of the advocacy actions at issue.

27 . The Grant Agreement makes' clear that "'Business Associate shall have the meaning given to such term in 45 CFR § 160.103.", ,

28 . The DHHR stated that boilerplate business associate addendums were regularly attached to all grant agreements, even when unnecessary, in an effort to comply with HIPAAV"stern mandate to have an agreement in place with any business associate.”

29 . A-"health oversight agency” is defined as

an agency or authority of the United States, a State, ...’'of a person or entity acting under a grant of authority from or contract with such public, agency, . -.. that is authorized by law to oversee the health care system ... or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.

45 C.F.R. § 164.501 (2014).

30 .Sge Standards for Privacy of Inclividually Identifiable Health Information, 65 Fed. Reg. 82462-01,82492.,

31 . The trial court looked additionally to the subsection permitting disclosure in the instance of incapacity when awaiting consent would materially and adversely impact an immediate enforcement activity. See 45 C.F.R. § 164.512(c)(l)(iii)(B).

32 . This annual analysis is required by HIPAA.

33 . Analyses completed in 2013 and 2014 entitled West Virginia Health Care Privacy Laws and HIPPA Preemption Analysis for the DHHR conclude that our state regulations set forth in 64 C.S.R. § 59 are not preempted by HIPPA as our provisions are more stringent. The 2015 analysis reached the same conclusion.

34 . See supra note 33.

35 . See 65 Fed, Reg. 82462-01,82463.

36 . See supra note 35.

37 .Consistent with the trial court’s directives, that access is subject to the right of patients to place limitations on the disclosure of their health information.

1 . Actually, "HIPAA mandated the passage of comprehensive privacy legislation by Congress within three years, otherwise the Department of Health and Human Services was required to step in and create privacy regulations.” Guthrie, "Time Is Running Out," 12 Annals Health L. at 144.