Opinion ID: 3066860
Heading Depth: 3
Heading Rank: 2

Heading: “Health Oversight Agency”

Text: Cherry picking parts of the HIPAA definition of a “health oversight agency,”29 the trial court concluded that Legal Aid is such an agency because it “is authorized by law to oversee the health care system . . . or government programs . . . or to enforce civil rights laws for which health information is relevant.” The DHHR argues that no state law invests Legal Aid, a private entity, with public oversight authority. The individualized advocate role that Legal Aid performs, emphasizes the DHHR, is not on par with the public health 28 The DHHR stated that boilerplate business associate addendums were regularly attached to all grant agreements, even when unnecessary, in an effort to comply with HIPAA’s “stern mandate to have an agreement in place with any business associate.” 29 A “health oversight agency” is defined as an agency or authority of the United States, a State, . . . or a person or entity acting under a grant of authority from or contract with such public agency, . . . that is authorized by law to oversee the health care system . . . or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant. 45 C.F.R. § 164.501 (2014). 17 concerns that a health oversight agency is charged to superintend. With regard to the auditing function that Legal Aid performs, that duty is similarly not authorized by state law. Furthermore, Legal Aid has no enforcement power with regard to the civil rights of the patients. From the list of agencies recognized to engage in health oversight activities, such as state insurance commissions, state health professional licensure agencies, state Medicaid fraud control units, the Pension and Welfare Benefit Administration, the HHS Office for Civil Rights,30 it is clear that Legal Aid does not qualify as such an agency. Inherent to the concept of a “health oversight agency” is a charge by law to oversee matters involving public health or for which public health information is intrinsic to the publicoriented duties at hand. Here, the advocacy duties Legal Aid provides do not have at their core a concern for public health or a need to review public health information for eligibility purposes. See 45 C.F.R. § 164.512(d) (2014) (approving disclosure to health oversight agency of protected health information to determine eligibility for government benefit programs). While state regulations authorize patient advocates to investigate and ensure 30 See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82462-01, 82492. 18 compliance with civil rights guaranteed by West Virginia Code § 27-5-9, that authority does not imbue Legal Aid with health oversight authority within the meaning of HIPAA. See 64 C.S.R. § 59-20. Unlike the United States Department of Justice, the HHS Office for Civil Rights, and the United States Equal Employment Opportunity Commission, Legal Aid has no enforcement powers pertinent to the patient civil rights it is charged with overseeing. See 65 Fed. Reg. 82462-01, 82492 (identifying entities with civil rights enforcement powers). In the instance of a civil rights violation, Legal Aid lacks authority to sua sponte correct the deficiencies giving rise to the violation or to impose sanctions or penalties. Consequently, we conclude that the trial court committed error in ruling that Legal Aid comes within the definition of a “health oversight agency” under HIPAA.