DAVIS, Justice:

R.K.,1 plaintiff below/petitioner, seeks reversal of a circuit court order dismissing numerous state-law claims he had asserted against St. Mary's Medical Center, Inc., defendant below/respondent (hereinafter referred to as "St. Mary's"). The circuit court granted St. Mary's 12(b)(6) motion to dismiss based upon its conclusion that R.K.'s state-law claims were preempted by the federal Health Insurance Portability and Accountability Act of 1996 (hereinafter referred to as "HIPAA").

In addition, St. Mary's asserts a cross assignment of error arguing that the circuit court erred by finding that R.K.'s claims did not fall under the West Virginia Medical Professional Liability Act (hereinafter referred to as "the MPLA") and concluding, therefore, that R.K. was not required to file a notice of claim and screening certificate of merit.

I.

FACTUAL AND PROCEDURAL HISTORY

In March of 2010, while R.K. was in the midst of divorce proceedings, he was admitted to St. Mary's as a psychiatric patient. During his hospitalization, and to further his treatment, R.K. disclosed confidential personal information that he had not previously disclosed to anyone, including his estranged wife. R.K. did not authorize the disclosure of information regarding his psychiatric condition or his hospitalization to his estranged wife or to anyone else. Nevertheless, during R.K.'s hospitalization, St. Mary's employees improperly accessed his medical records, which contained his psychological information, and informed R.K.'s estranged wife and her divorce lawyer of R.K.'s hospitalization and disclosed to them other confidential medical and psychological information pertaining to R.K.

In May of 2010, when R.K. learned that his confidential medical and psychological information had been improperly accessed, he contacted St. Mary's and requested an audit of his records. As a result, R.K. was subsequently contacted by a St. Mary's representative and advised that St. Mary's investigation of the matter concluded that there had been "an inappropriate access to his medical record." Although R.K. was informed that appropriate action had been taken, no details regarding the "appropriate action" were provided.

On September 21, 2010, R.K. filed suit against St. Mary's asserting claims for negligence, outrageous conduct, intentional infliction of emotional distress, negligent infliction of emotional distress, negligent entrustment, breach of confidentiality, invasion of privacy, and punitive damages. St. Mary's responded with a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) of the West Virginia Rules of Civil Procedure asserting that R.K.'s claims were preempted by HIPAA. In the alternative, St. Mary's requested a more definite statement pursuant to West Virginia Rule of Civil Procedure 12(e). Finally, St. Mary's argued that R.K.'s claims came under the MPLA, and they should, therefore, be dismissed due to his failure to file the required notice of claim and screening certificate of merit.

Following a hearing on St. Mary's motion, by order entered May 9, 2011, the circuit court concluded that HIPAA completely preempted R.K.'s claims and dismissed the suit in its entirety. Nevertheless, the circuit court additionally ruled that R.K.'s claims had not been filed pursuant to the MPLA, and, therefore, denied St. Mary's motion to dismiss insofar as it alleged R.K.'s failure to comply therewith, and further denied St. Mary's motion for a more definite statement finding that R.K. had alleged sufficient facts to support his claims.2 It is from this order that R.K. appeals and St. Mary's asserts its cross assignment of error.

II.

STANDARD OF REVIEW

In this appeal, R.K. asks this Court to review the circuit court's order granting St. Mary's motion to dismiss. It is well established that "[a]ppellate review of a circuit court's order granting a motion to dismiss a complaint is de novo." Syl. pt. 2, State ex rel. McGraw v. Scott Runyan Pontiac-Buick, Inc., 194 W.Va. 770, 461 S.E.2d 516 (1995). Additionally, St. Mary's, by way of a cross assignment of error, asks this Court to review the circuit court's ruling that R.K.'s allegations are not governed by the MPLA. This issue presents a purely legal question that involves the interpretation of a statute. Thus, St. Mary's cross appeal is likewise governed by a de novo standard of review. "Interpreting a statute or an administrative rule or regulation presents a purely legal question subject to de novo review." Syl. pt. 1, Appalachian Power Co. v. State Tax Dep't, 195 W.Va. 573, 466 S.E.2d 424 (1995). See also Syl. pt. 1, Chrystal R.M. v. Charlie A.L., 194 W.Va. 138, 459 S.E.2d 415 (1995) ("Where the issue on an appeal from the circuit court is clearly a question of law or involving an interpretation of a statute, we apply a de novo standard of review."). With due consideration for these appellate standards, we will consider the issues raised in this appeal.

III.

DISCUSSION

In this appeal, we are asked to resolve two issues. First, R.K. argues that the circuit court erred in dismissing his lawsuit based upon its finding that his claims are preempted by HIPAA. In addition, by cross-assignment of error, St. Mary's asks this court to find that the circuit court erred in finding that the claims asserted by R.K. are not governed by the MPLA and, therefore, are not subject to the MPLA pre-suit requirements. We address each of these issues in turn.

A. R.K.'s State Law Claims and HIPAA

In granting St. Mary's Rule 12(b)(6) motion to dismiss R.K.'s complaint, the circuit court relied upon the fact that HIPAA does not provide for a private cause of action. The circuit court observed that there is little authority on the issue of HIPAA's preemption of state-law claims and dismissed the claims simply because "they involve the disclosure of health information."3 The court concluded that R.K.'s causes of action would afford him "remedies under state law that are not permitted by ... and are rejected by HIPAA."

R.K. argues, in his single assignment of error, that the circuit court erred in dismissing his private causes of action based upon HIPAA preemption because he did not assert any claim under HIPAA. R.K. argues that all of his claims were based on state-law causes of action. Therefore, he asserts, HIPAA preemption does not apply. R.K. submits that a HIPAA preemption analysis applies only if a claim under HIPAA is asserted.4

St. Mary's responds that West Virginia courts are not bound by the labels of the drafter of a complaint when applying the applicable law. St. Mary's asserts that, even though R.K.'s complaint was artfully drafted to not specifically assert claims labeled HIPAA, the circuit court properly looked beyond the labels used by R.K. and correctly determined that the complaint did indeed assert HIPAA claims. See, e.g., Blankenship v. Ethicon, Inc., 221 W.Va. 700, 656 S.E.2d 451 (2007) (dismissing claim for failure to comply with MPLA even though MPLA claim not expressly asserted). Accordingly, St. Mary's argues, the circuit court properly found R.K.'s claims were preempted.

St. Mary's further contends that HIPAA's preemption analysis applies to the current litigation and preempts R.K.'s state common-law causes of action. St. Mary's asserts that R.K.'s claims are contrary to, and less stringent than, standards adopted by Sections 1320d-1 through 1320d-3 of HIPAA5 and, therefore, are preempted.

1. HIPAA generally. HIPAA was adopted by Congress in 1996. It has been explained that

Ruder v. Pequea Valley Sch. Dist., 790 F.Supp.2d 377, 403 (E.D.Pa.2011). See also Morgan v. Sebelius, 694 F.3d 535, 538 (4th Cir.2012) ("Congress enacted the Health Insurance Portability and Accountability Act of 1996 (`HIPAA') ... `to combat waste, fraud, and abuse in health insurance and health care delivery.' Pub.L. No. 104-191, 110 Stat. 1936, 1936 (1996).").

HIPAA includes a

Tavares v. Lawrence & Mem'l Hosp., No. 3:11-CV-770 (CSH), 2012 WL 4321961, at *11 n. 24 (D.Conn. Sept. 20, 2012).

Relevant to the instant appeal, HIPAA also contains a preemption provision titled "Effect on State law," which provides, in relevant part, as follows:

42 U.S.C. § 1320d-7 (1996) (emphasis added).

Regulations promulgated to enforce the foregoing provision are found at 45 C.F.R. § 160.203(b), and state, in relevant part:

(Emphasis added).6

2. State-Law Claims not preempted by HIPAA. While the circuit court and the parties correctly have observed the absence of a plethora of precedent on the issue of HIPAA preemption of state-law claims, we have located sufficient authority to clearly demonstrate that HIPAA does not preempt state-law causes of action for the wrongful disclosure of health care information.

In Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn.Ct.App.2009), the plaintiff sought medical testing at the defendant's clinic for sexually-transmitted diseases because she had a new sex partner. A medical assistant, who happened to be related to Yath's husband, accessed Yath's medical file and subsequently shared sensitive medical information with others. The information was eventually disclosed to Yath's husband, from whom she was separated. After receiving a complaint, the clinic investigated and learned that Yath's medical file had been improperly accessed. Yath sued for the wrongful disclosure of her medical information. She asserted a variety of theories including the violation of a Minnesota statute7 by improperly disclosing information from her medical file. The trial court awarded the clinic summary judgment with regard to the statutory violation based upon its conclusion that the statute was preempted by HIPAA. The Court of Appeals of Minnesota disagreed and concluded that the statute was not preempted. In so finding, the appeals court reasoned as follows:

Yath v. Fairview Clinics, N.P., 767 N.W.2d at 49-50.

Although Yath involved a codified state law, we note that other courts have, subsequent to the adoption of HIPAA, allowed common-law actions for the wrongful disclosure of medical information to go forward in state court. For example, in Fanean v. Rite Aid Corporation of Delaware, Inc., 984 A.2d 812 (Del.Super.Ct.2009), Fanean's third amended complaint asserted various claims against Rite Aid based upon the wrongful disclosure to third parties of confidential medical information. Fanean's claims included: intentional infliction of emotional distress, negligent infliction of emotional distress, negligence, and breach of confidentiality.8 The court, without discussing even the possibility of HIPAA preemption, denied the defendant's motion to dismiss with regard to plaintiff's common-law claims, even though those claims were based upon the alleged wrongful disclosure of medical information.9 We believe the court's failure to discuss HIPAA in this context demonstrates that it was obvious to the court and to the parties that HIPAA simply did not preempt common-law claims based on wrongful disclosure of medical information. Other courts have similarly allowed common-law claims alleging wrongful disclosure of medical information. See Baum v. Keystone Mercy Health Plan, 826 F.Supp.2d 718, 721 (E.D.Pa.2011) (remanding to state court a case asserting claims including negligence and negligence per se based upon improper handling of personal health information, and commenting "[i]n spite of the fact that the personal data at the heart of this case is protected by HIPAA, this is a fairly straightforward state-law tort case"); Doe v. Southwest Cmty. Health Ctr., No. FSTCV085008345S, 2010 WL 3672342 (Conn.Super.Ct. Aug. 25, 2010) (denying summary judgment on negligence claim alleging failure to safeguard adequately the confidentiality of the plaintiff's protected health care information pursuant to duty imposed by common law and by HIPAA); Randi A.J. v. Long Island Surgi-Ctr., 46 A.D.3d 74, 842 N.Y.S.2d 558 (2007) (finding punitive damages proper in suit for wrongful disclosure of confidential medical information); Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 401, 715 N.E.2d 518, 523 (1999) (holding that, "in Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a third party of non-public medical information that a physician or hospital has learned within a physician-patient relationship");10 Fairfax Hosp. By and Through INOVA Health Sys. Hosps., Inc. v. Curtis, 254 Va. 437, 442, 492 S.E.2d 642, 645 (1997) (holding "in the absence of a statutory command to the contrary, or absent a serious danger to the patient or others, a health care provider owes a duty to the patient not to disclose information gained from the patient during the course of treatment without the patient's authorization, and that violation of this duty gives rise to an action in tort").

Finally, we note that, contrary to finding state common-law claims preempted by HIPAA, several courts have found that a HIPAA violation may be used either as the basis for a claim of negligence per se, or that HIPAA may be used to supply the standard of care for other tort claims. See, e.g., I.S. v. Washington Univ., No. 4:11CV235SNLJ, 2011 WL 2433585, at *2 (E.D.Mo. June 14, 2011) ("[T]he Court finds that Count III may stand as a state claim for negligence per se despite its exclusive reliance upon HIPAA."); K.V. v. Women's Healthcare Network, LLC, No. 07-0228-CV-W-DW, 2007 WL 1655734, (W.D.Mo. June 6, 2007) (concluding that negligence per se claim based on HIPAA violation was a state-law claim); Harmon v. Maury County, TN, No. 1:05 CV 0026, 2005 WL 2133697, at *3, *4 (M.D.Tenn. Aug. 31, 2005) (remanding case asserting negligence per se based on HIPAA violation to state court, observing that "HIPAA's provisions do not completely preempt state law and expressly preserve state laws that are not inconsistent with its terms," and concluding that "Plaintiffs' claims fall within that broad class of state law claims based on federal regulations in the state court.... Thus, the Plaintiffs' motion to remand should be granted."); Doe v. Southwest Cmty. Health Ctr., No. FSTCV085008345S, 2010 WL 3672342 (denying summary judgment on negligence claim alleging failure to safeguard adequately the confidentiality of the plaintiff's protected health care information pursuant to duty imposed by common law and by HIPAA); Acosta v. Byrum, 180 N.C. App. 562, 568, 638 S.E.2d 246, 251 (2006) ("Here, defendant has been placed on notice that plaintiff will use... HIPAA to establish the standard of care. Therefore, plaintiff has sufficiently pled the standard of care in her complaint.").

Based upon the foregoing authority, we conclude that state common-law claims for the wrongful disclosure of medical or personal health information are not inconsistent with HIPAA. Rather, as observed by the court in Yath, such state-law claims compliment HIPAA by enhancing the penalties for its violation and thereby encouraging HIPAA compliance. Accordingly, we now hold that common-law tort claims based upon the wrongful disclosure of medical or personal health information are not preempted by the Health Insurance Portability and Accountability Act of 1996.

The instant action was dismissed pursuant to St. Mary's 12(b)(6) motion. It is well established that "[t]he trial court, in appraising the sufficiency of a complaint on a Rule 12(b)(6) motion, should not dismiss the complaint unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief. Conley v. Gibson, 355 U.S. 41, 45-46[, 78 S.Ct. 99, 102, 2 L.Ed.2d 80, 84] (1957)." Syl. pt. 3, Chapman v. Kane Transfer Co., Inc., 160 W.Va. 530, 236 S.E.2d 207 (1977). Because we find that R.K.'s state law claims for the wrongful disclosure of his medical and personal health information are not preempted by HIPAA, the dismissal of his claims on preemption grounds was in error. Thus, we reverse the circuit court's order insofar as it dismissed R.K.'s claims.

B. St. Mary's Cross Appeal and The Medical Professional Liability Act

St. Mary's asserts a cross-appeal claiming that the trial court incorrectly concluded that R.K.'s allegations fell outside the Medical Professional Liability Act (hereinafter "the MPLA"), and, therefore, R.K. was not required to comply with the MPLA pre-suit requirements of a notice of claim and screening certificate of merit.11

In denying St. Mary's motion to dismiss based on R.K.'s failure to comply with the MPLA, the circuit court observed that

St. Mary's contends that R.K.'s claims clearly fall within the definition of "health care" pursuant to W. Va.Code § 55-7B-2(e) (2006) (Repl.Vol.2008).12 In this regard, notes St. Mary's, R.K. has alleged that, while he was hospitalized at St. Mary's, certain employees "inappropriately accessed" his "medical records" and then "disseminated and disclosed such information." St. Mary's submits that the gathering, utilization, and protection of medical records has always been an integral part of health care, and, therefore, R.K.'s claims fall squarely within the MPLA.

R.K. responds that the circuit court correctly found that the MPLA does not govern his claims. He submits that the alleged disclosure and dissemination of his confidential information does not fall within the meaning of "health care," and, therefore, the MPLA does not apply.

This Court previously has held that,

Syl. pt. 3, Boggs v. Camden-Clark Mem'l Hosp. Corp., 216 W.Va. 656, 609 S.E.2d 917 (2004) (finding claims of fraud, spoliation of evidence, or negligent hiring were not related to "medical professional liability" or "health care services," and, thus, not MPLA claims).

The Court's holding in Boggs was revisited in Syllabus point 4 of Gray v. Mena, wherein the Court held:

218 W.Va. 564, 625 S.E.2d 326 (2005). In Gray, the circuit court dismissed the action based upon the plaintiff's failure to follow the pre-suit requirements of the MPLA. This Court agreed that the MPLA applied, and noted that the defendant physician would "most certainly argue that his actions were necessary to a complete diagnosis and investigation of the complaints presented to him by [Plaintiff Gray]." Gray, 218 W.Va. at 570, 625 S.E.2d at 332. Nevertheless, this Court found dismissal was a disproportionately harsh sanction under the particular circumstances presented. Consequently, the case was remanded for the lower court to require compliance with MPLA.

Most recently, this Court held the following with regard to the issue of whether the MPLA applied to a certain cause of action:

Syl. pt. 4, Blankenship v. Ethicon, Inc., 221 W.Va. 700, 656 S.E.2d 451 (2007).

Syl. pt. 5, id. In Blankenship, the plaintiffs filed suit for injuries caused by the implantation of contaminated sutures but did not expressly assert an MPLA claim or comply with the pre-suit requirements thereof. The circuit court dismissed their claims due to the plaintiffs' failure to comply with the pre-suit requirements of the MPLA. This Court agreed that the MPLA applied, regardless of the fact that it was not expressly pled.13

Examining the factual circumstances in which this Court has found the MPLA to apply, we agree with the circuit court that the allegations asserted in the instant case, which pertain to the improper disclosure of medical records, does not fall within the MPLA's definition of "health care," and, therefore, the MPLA does not apply. Accordingly, we affirm the circuit court's order insofar as it refused St. Mary's motion to dismiss for failure to comply with the pre-suit requirements of the MPLA.

IV.

CONCLUSION

For the reasons stated in the body of this opinion, we reverse the order of the Circuit Court of Cabell County, entered May 9, 2011, insofar as it granted St. Mary's 12(b)(6) motion to dismiss based upon its conclusion that R.K.'s state-law claims were preempted by the federal Health Insurance Portability and Accountability Act of 1996. However, we affirm the order to the extent that it found that R.K.'s claims did not fall under the West Virginia Medical Professional Liability Act.

Reversed, in part; Affirmed, in part; and Remanded.

Justice McHUGH, deeming himself disqualified, did not participate.

Judge MARKS, sitting by temporary assignment.

Chief Justice KETCHUM dissents and reserves the right to file a dissenting opinion.

KETCHUM, Chief Justice, dissenting.

I believe the plaintiff's causes of action are preempted by HIPAA.

There is no doubt that HIPAA preempts state laws that are inconsistent with its provisions, other than laws that provide more stringent protections than HIPAA. Laws that create obstacles to HIPAA's purposes are also preempted. See 42 U.S.C.A. § 1320d-7. West Virginia has not adopted any standards or factors to be used in determining whether a cause of action, based on State statute or common law, creates an obstacle to, or is less stringent than, HIPAA.

Reviewing how other jurisdictions have approached this issue, I would adopt the standards set forth in Smith v. American Home Products Corp. Wyeth-Ayerst Pharmaceutical, 372 N.J.Super. 105, 855 A.2d 608 (2003). After exploring the HIPAA statutes and regulations, the superior court set forth five factors that courts should examine:

Smith, 372 N.J.Super. at 128, 855 A.2d at 622.

Applying these factors to the causes of action alleged in the plaintiff's complaint, I find that they are inconsistent with HIPAA. HIPAA specifically provides for penalties, punishment and an administrative mechanism for compensation for privacy violations. See e.g., 42 U.S.C.A. § 1320d-5 and 45 C.F.R. § 160.404. A lawsuit for damages under our statutes or common law creates an obstacle to the purposes and objectives of HIPAA. Such lawsuits are, therefore, preempted by HIPAA.

I respectfully dissent.