Before Stewart, Duncan, and Engelhardt, Circuit Judges. Carl E. Stewart, Circuit Judge: Disability Rights Texas (“DRTx”), an advocacy organization designated to protect the rights of persons with mental illness pursuant to the Protection and Advocacy for Individuals with Mental Illness Act brought this action against Houston Behavioral Healthcare Hospital (“Houston Behavioral”) to compel the disclosure of video footage pertaining to the involuntary confinement of its client G.S., an individual with mental illness. Holding that the videotape footage must be disclosed, the district court granted summary judgment for DRTx and issued an injunction. Houston Behavioral appealed. We AFFIRM. I. Factual and Procedural History In August 2021, G.S. was detained in a psychiatric inpatient program at the Houston Behavioral Psychiatric Intensive Care Unit (“PICU”).[1] Following his release, G.S. filed a complaint with DRTx, alleging that he was abused at Houston Behavioral, and signed a waiver allowing DRTx to access his records. Relevant here, the Developmental Disabilities Assistance and Bill of Rights Act, 42 U.S.C. § 15001, et seq. (the “DD Act”); the Protection and Advocacy for Individuals with Mental Illness Act, 42 U.S.C. § 10801, et seq. (the “PAIMI Act”);[2] and the Protection and Advocacy for Individual Rights Act, 29 U.S.C. § 794e, (the “PAIR Act”) (collectively, the “P&A Acts”) mandate states to designate nonprofits (“P&A organizations”)[3] to protect and advocate for the civil rights of individuals with disabilities. DRTx serves as the P&A organization for Texas pursuant to the PAIMI Act, 42 U.S.C. § 10801(b)(2). On August 19, 2021, DRTx requested G.S.’s records from his confinement at Houston Behavioral, including records from the PICU. Houston Behavioral cooperated with DRTx’s first set of requests for information, and on August 26, 2021, it produced all records requested. On September 8, 2021, DRTx requested that Houston Behavioral preserve surveillance video footage, which it claimed was necessary to investigate the alleged abuse of its client, G.S., and other Houston Behavioral patients. The video footage depicts G.S. and other patients receiving care in the PICU. With its record request, DRTx included G.S.’s signed authorization to permit release of his relevant health information. Thereafter, Houston Behavioral refused to provide DRTx with the requested video record. On or about September 17, 2021, DRTx received a letter explaining that Houston Behavioral was prohibited from releasing the video because the footage depicts substance use disorder (“SUD”) treatment information protected under 42 C.F.R. Part 2 regulations.[4] On November 18, 2021, DRTx replied to Houston Behavioral explaining that the Part 2 SUD confidentiality requirements did not apply to G.S.’s treatment because (1) he was receiving mental health services in a psychiatric services unit and (2) Houston Behavioral records did not identify G.S. as someone with an SUD. Additionally, DRTx maintained that it would not be possible to identify any individual on the silent video as someone with an SUD. When Houston Behavioral continued to deny it access to the requested video footage, DRTx filed this suit to compel Roy Hollis, in his official capacity as the Chief Executive Officer of Houston Behavioral, to produce the video record. DRTx sought declaratory and permanent injunctive relief. Both parties filed cross-motions for summary judgment. After conducting a motion hearing on February 24, 2023, the district court granted DRTx’s motion with modifications and denied Hollis’s motion. The district court granted an injunction limited to the footage pertaining to G.S.’s complaint. Hollis appealed the district court’s final judgment. Houston Behavioral has preserved the video record evidence pending this court’s adjudication of the issue. We issued a temporary administrative stay and ordered that Hollis’s opposed motion for injunction pending appeal be carried with the case on July 11, 2023. II. STANDARD OF REVIEW “This court reviews de novo a district court’s grant of summary judgment, applying the same standard as the district court.” Austin v. Kroger Tex., L.P., 864 F.3d 326, 328 (5th Cir. 2017) (citation omitted). Summary judgment is proper “if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a); Alkhawaldeh v. Dow Chem. Co., 851 F.3d 422, 426 (5th Cir. 2017). III. DISCUSSION Enacted in 1975, the DD Act authorizes P&A organizations “to pursue legal, administrative, and other appropriate remedies or approaches” to ensure that individuals with disabilities are protected. 42 U.S.C. § 15043(a)(2)(A)(i). However, the DD Act is limited in scope to P&A organizations designed to protect and advocate for individuals with developmental disabilities. Id. at § 15043(a)(1). Relevant here, the PAIMI Act protects the rights of individuals with mental illness. Enacted in 1986, the PAIMI Act conditions states’ federal funding on their establishment of P&A organizations with the authority to investigate and remedy suspected abuse or neglect of individuals with mental illness. Id. at § 10805(a)(1). The PAIMI Act, like the DD Act, directs that P&A organizations shall have broad investigatory authority to carry out their responsibility to protect individuals with mental illness and to advocate on their behalf. Id. (authorizing P&A organizations to “investigate incidents of abuse and neglect . . . ; pursue administrative, legal, and other appropriate remedies . . . ; and . . . pursue administrative, legal, and other remedies on behalf of an individual”). Enacted in 1994, the PAIR Act serves people with disabilities who are not covered under either the DD Act or the PAIMI Act. 29 U.S.C. § 794e. In addition to their general investigative authority, P&A organizations have the authority, consistent with the requirements of the P&A Acts, to “have access to all records of any individual” with disabilities or mental illness “who is a client of the [P&A] system if such individual or legal guardian, conservator, or other legal representative of such individual, has authorized the system to have such access.” 42 U.S.C. § 15043(a)(2)(I)(i); 42 U.S.C. § 10805(a)(4)(A); 29 U.S.C. § 794e(f)(2). The district court correctly determined that this suit is governed by the PAIMI Act because it involves DRTx’s efforts to obtain video records of an individual with a mental illness. Specifically, § 10805(a) provides that a P&A organization such as DRTx: shall . . . (4) in accordance with section 10806 of this title, have access to all records of— (A) any individual who is a client of the system if such individual, or the legal guardian, conservator, or other legal representative of such individual, has authorized the system to have such access; (B) any individual (including an individual who has died or whose whereabouts are unknown)-(i) who by reason of the mental or physical condition of such individual is unable to authorize the system to have such access; (ii) who does not have a legal guardian, conservator, or other legal representative, or for whom the legal guardian is the State; and (iii) with respect to whom a complaint has been received by the system or . . . there is probable cause to believe that such individual has been subject to abuse or neglect; and (C) any individual with a mental illness, who has a legal guardian, conservator, or other legal representative, with respect to whom a complaint has been received by the system or with respect to whom there is probable cause to believe the health or safety of the individual is in serious and immediate jeopardy . . . . 42 U.S.C. § 10805(a). Section 10806 then provides: As used in this section, the term “records” includes reports prepared by any staff of a facility rendering care and treatment or reports prepared by an agency charged with investigating reports of incidents of abuse, neglect, and injury occurring at such facility that describe incidents of abuse, neglect, and injury occurring at such facility and the steps taken to investigate such incidents, and discharge planning records. Id. § 10806(b)(3)(A). Where an individual has no parent or guardian, the P&A organizations may access records so long as they have probable cause to believe that abuse has occurred. 42 U.S.C. § 15043(a)(2)(I)(ii); 42 U.S.C. § 10805(a)(4)(B); 29 U.S.C. § 794e(f)(2). Where an individual’s guardian has failed or refused to act, the P&A organizations may access records under the DD Act and the PAIR Act so long as they have probable cause to believe that the individual has been subject to abuse or neglect. 42 U.S.C. § 15043(a)(2)(I)(iii); 29 U.S.C. § 794e(f)(2). Under the PAIMI Act, they may do so if they have probable cause to believe that an individual’s health or safety is in serious and immediate jeopardy. 42 U.S.C. § 10805(a)(4)(C). In accordance with the requirements for receiving federal funds, P&A organizations are authorized to engage in various pursuits on behalf of persons with the mental illness and impairments, such as investigating complaints of discrimination, abuse, and neglect. See 42 U.S.C. § 15043; 42 U.S.C. § 10805. It is undisputed that, as a P&A organization, DRTx is charged with a federal mandate to protect and advocate for the rights of individuals with mental illness by accessing their confidential records from programs serving them and investigating allegations of abuse and neglect. The dispute between the parties herein hinges on a determination of how broad that grant of authority is. The district court determined that the “(1) plain language of the law, (2) purpose of the P&A Acts, and (3) existence of stringent statutory privacy protections for P&A systems provide clear and consistent evidence for [DRTx's] position that [Houston Behavioral] must grant [it] access to the video.” We agree. A. Statutory Language & Purpose Houston Behavioral concedes that “[t]he P&A Acts are read broadly to ensure that DRTx can conduct its investigation,” but it contends that DRTx’s authority under the P&A Acts “pertain[s] to records and review of information that pertain specifically to the patient at issue.” It argues that “there are other patients within the video who have not been put on notice that the investigation is ongoing and most importantly, have not provided their consent for their facial images to be a part of the investigative file.” Similar to the court in Disability Rights Texas v. Bishop, the district court here held that DRTx is entitled to the video records it requested and Houston Behavioral’s denial of the request is a violation of the PAIMI Act. See 615 F. Supp. 3d 454, 461 (N.D. Tex. 2022). Like the Bishop court, the district court here determined that both declaratory and permanent injunctive relief— though limited in scope—was warranted. Relying on federal court precedent[5] and citing 42 U.S.C. § 10805(a)(4), the district court surmised that the PAIMI Act’s statutory language has consistently been read to provide P&A organizations with broad access to records. We agree. Still, Houston Behavioral argues that Bishop is inapplicable to the instant case because Houston Behavioral advances arguments that are dissimilar to those of the defendant in Bishop. In Bishop, the court rejected the defendant’s argument that, under the PAIMI Act, “records” only includes those produced as part of “the care and treatment” or “a specific investigation into allegations of abuse, neglect or injury” of a specific individual. 615 F. Supp. 3d at 460. In Bishop, the defendant claimed that because the video footage captured more than just the DRTx client at a particular time and place, the requested footage was not part of the “records” required to be produced to the P&A organization. Id. at 460–61.[6] Houston Behavioral, too, contends that the video footage at issue here goes beyond the “care” or “alleged abuse” of a “specific individual.” And because the video footage also includes other patients, it contends that the video footage is not encapsulated in the definition of “records” required to be produced to DRTx. We disagree because such an argument is contrary to the broad investigatory powers Congress bestowed upon P&A organizations. Specifically, “the ordinary public meaning of ‘records,’ as well as statutory structure and context, confirm that the term includes videos of a P&A client’s alleged abuse or neglect.” Id. at 461. The Bishop court also made note of “existing statutory protections [which] adequately protect the privacy rights of other detainees [or patients].” Id. There, it noted that: [T]he phrase, “of . . . any individual,” need not be read so narrowly—as Bishop suggests—to imply that a record must be exclusively produced for or regarding a particular individual. The “preposition ‘of’ may be used to show connection or association, as well as ownership . . . and it seems clear that the term is used in the former sense here.” Pa. Prot. & Advoc., Inc. v. Houstoun, 228 F.3d 423, 427 (3d Cir. 2000) (Alito, J.) (citing Random House Dictionary of the English Language 999 (1967)) (construing “records” in Section 10805(a)(4) to include peer-review reports belonging to a hospital rather than an individual patient). Id. at 465. In this case, the district court also maintained that, notwithstanding other individuals’ privacy rights which may be implicated, the purpose of the P&A Acts necessitates DRTx’s access to video record evidence. Allowing Houston Behavioral to block DRTx from reviewing video records would significantly hinder the P&A organization from fulfilling its federal mandate. The district court noted that the stated statutory purpose of P&A organizations’ investigative powers is to “investigate incidents of abuse and neglect of individuals with mental illness” and “to ensure the rights of individuals with mental illness are protected.” 42 U.S.C. § 10801(b). We agree and hold that the statutory plain language and purpose grants DRTx access to “all records of . . . any individual,” including the video footage requested here. Id. B. HIPAA & Confidentiality Houston Behavioral devotes most of its briefing to describe the potential penalties it may incur under the Heath Insurance Portability and Accountability Act (“HIPAA”) if it were to release the video record to DRTx. It contends that this suit implicates its “ability to remain in compliance with two separate statutes [HIPAA and the P&A Acts] when there is no administrative guidance as to how the statutes co-exist in relation to third-party facial images within video footage for a P&A entity.” It maintains that the district court’s judgment disfavors “protecting covered entities [or healthcare providers] from violations under HIPAA.” It asserts that just because “DRTx has been able to obtain unredacted footage from other parties does not mean it follows the requirements of HIPAA.” Houston Behavioral maintains that “[i]n order for covered entities to disclose the [video] footage [including] third-party patients” one of the following paths must be pursued: (1) the facility must ensure all patients captured inthe video footage give consent for the disclosure of the footage; (2) DRTx must have probable cause for all patients in the video; or (3) DRTx must obtain a court order for a full copy of the footage. It argues that presently no guidance from the Office of Civil Rights exists as to whether HIPAA applies in the instant case. It posits that although a court order would prevent the Office of Civil Rights from penalizing Houston Behavioral for producing the unredacted video footage of G.S., it does not preclude the agency from penalizing Houston Behavioral for producing footage of other patients. Notably, the privacy of individuals’ health records is governed by regulations issued by the United States Department of Health and Human Services (“HHS”) under HIPAA, 42 U.S.C. § 1320d, et seq. See 45 C.F.R. Pt. 164. In 2001, HHS proposed and subsequently adopted a privacy rule. See 45 C.F.R. Pt. 160, 164 (the “Privacy Rule”). The Privacy Rule prohibits an organization subject to its requirements, such as a healthcare provider (a “covered entity”), from using or disclosing an individual’s protected health information (“PHI”) except as mandated or permitted by its provisions. 45 C.F.R. § 164.502(a). However, a covered entity may disclose an individual’s PHI without that person’s consent “to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law” under the required-by-law exception. 45 C.F.R. § 164.512(a)(1). The regulations define the pertinent phrase, required-by-law, here: Required by law means a mandate contained in law that compels an entity to make a use or disclosure of [PHI] and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits. Id. at § 164.103. The PAIMI Act requires P&A organizations to “maintain the confidentiality of such records to the same extent as is required of the provider of [the mental health services].” 42 U.S.C. § 10806(a); see also 42 C.F.R. § 51.45(a)(1) (“The P&A system must . . . keep confidential all records and information, including information contained in any automated electronic database.”); 42 C.F.R. § 51.46 (stating that “if a P&A system has access to records pursuant to [§ 10805(a)(4)] which, under Federal or State law, are required to be maintained in a confidential manner by a provider of mental health services, it may not disclose information from such records”).[7] Weighing the parties’ arguments in this statutory context, we hold that HIPAA is not violated when video records containing third-party patients are released to P&A organizations in accordance with the P&A Acts. See 42 U.S.C. § 10805(a)(1)(A). This is particularly relevant here where Houston Behavioral refuses to produce video records to a P&A organization because it posits that it must protect the confidentiality of those individuals who have not signed releases to DRTx. This concern is unfounded. DRTx argues, and we agree, that HHS guidance outlines that “[w]here disclosures are required by law, the Privacy Rule’s minimum necessary standard does not apply . . . Moreover, . . . a covered entity cannot use the Privacy Rule as a reason not to comply with its other legal obligations.” U.S. Dep’t Of Health & Human Servs., May a Covered Entity Disclose Protected Health Information to a Protection and Advocacy System Where the Disclosure is Required by Law? (June 10, 2005) https://www.hhs.gov/hipaa/for-professionals/faq/909/may-a-covered-entity-disclose-information-to-a-protection-system/index.html. Furthermore, in one of the seminal district court cases concerning whether P&A record access was barred by HIPAA or Medicaid laws, the court held that “[w]here a release of records is specifically allowed under the PAIMI [Act] . . . HIPAA does not bar disclosure since such records are produced based on the ‘as required by law’ exception . . . If there is no probable cause, HIPAA would prohibit facilities from disclosing . . . [PHI] without the authorization of the individual.” Protec. & Advoc. Sys., Inc. v. Freudenthal, 412 F. Supp. 2d 1211, 1220 (D. Wyo. 2006); see also id. at 1219 (holding that the PAIMI Act grants P&A organizations the “authority to investigate incidents of abuse and neglect of individuals with mental illness if the incidents are reported to the system or if there is probable cause to believe the incidents occurred”). In its amicus briefing, the United States maintains that HIPAA does not require a healthcare provider to withhold video footage during a P&A organization’s investigation of alleged abuse, even if the footage shows other patients. The United States contends that “[a]s HHS explained when it issued the Privacy Rule, the required-by-law exception permits disclosure of [PHI] to [P&A] organizations when the [P&A] Acts require disclosure: ‘the rules below will not impede the functioning of the existing [P&A] System.’” See 65 Fed. Reg. 82,594 (Dec. 28, 2000). It continues by arguing that “nothing in the [P&A] Acts requires a healthcare facility to withhold or even redact an individual’s records under these circumstances.” See Wise, 171 F. Supp. 3d at 59 (“The statutes make clear that P&A systems . . . are entitled to all records of subject individuals, and give no indication that investigative agencies should redact or withhold portions of their reports.”). The United States’ argument is persuasive here. The United States contends that “Congress could have restricted [P&A] organizations from accessing records that included other patients’ confidential health information, but it did not.” Rather, the only restriction, amicus points out, is the requirement to keep records confidential. See 42 U.S.C. 10806(a). It maintains that “[b]ecause the [P&A] Acts impose ‘an especially significant duty of confidentiality’ on [P&A] organizations, courts have refused to allow entities to withhold records based on purported privacy concerns.” It cites to a Seventh Circuit case, Disability Rights Wisconsin, Inc. v. State of Wisconsin Department OfPublic Instruction, for this proposition. 463 F.3d at 728. There, the Seventh Circuit compelled a school to produce confidential information about students to a P&A organization without the consent of those students or their guardians, explaining that the P&A Acts “impose[] a specific duty of confidentiality upon the P&A organizations in the context of mental health records obtained from a provider of mental health services.” Id. at 729–30. Undeniably, the video footage in dispute here qualifies as PHI, and HIPAA generally restricts disclosure of that information. See 45 C.F.R. § 164.502(a). However, pursuant to the required-by-law exception, disclosure is permitted when another law requires it. See 45 C.F.R. §§ 164.502(a)(1)(vi), 164.512(a). The United States argues that the definition of “required by law” sweeps broadly and includes “a mandate contained in law that compels an entity to make a use or disclosure of [PHI] and that is enforceable in a court of law.” See 45 C.F.R. § 164.103. The United States further argues that DRTx is required by law to keep the video footage confidential to the same extent that Houston Behavioral itself is required to do. 42 U.S.C. § 10806(a); see also 45 C.F.R. § 1326.21. We agree. Under the required-by-law exception, healthcare providers like Houston Behavioral may disclose an individual’s PHI without that person’s consent “to the extent that such . . . disclosure is required by law and the . . . disclosure complies with and is limited to the relevant requirements of such law.” 45 C.F.R. § 164.512(a)(1). Lastly, the United States contends that HHS’s longstanding interpretation of the required-by-law exception reinforces the conclusion that healthcare providers face no liability under HIPAA when they comply with a P&A organization’s request for access under the P&A Acts. Amici curiae— National Disability Rights Network (“NDRN”) and Disability Rights Louisiana (“DRLA”) also add that HHS has spoken on this issue, providing that “[t]he Privacy Rule permits a covered entity to disclose [PHI] without the authorization of the individual to the state-designated [P&A] system to the extent that such disclosure is required by law and the disclosure complies with the requirements of that law. 45 C.F.R. § 164.512(a).” See Health Information Privacy, U.S. Dep’t Of Health & Human Servs., https://www.hhs.gov/hipaa/forprofessionals/faq/909/may-a-covered-entity-disclose-information-to-a-protectionsystem/index.html (last visited September 26, 2023). Thus, as Amici curiae note, we do not see a conflict between HIPAA and the P&A Acts under the circumstances presented in this case. IV. Conclusion For the foregoing reasons, we AFFIRM the judgment of the district court. Further, the temporary administrative stay issued by this court on July 11, 2023, is VACATED and the motion for stay pending appeal is DISMISSED AS MOOT.
