This Whistleblower Act case concerns whether a state employee’s alleged report of a legal violation was made to an appropriate law-enforcement authority. The court of appeals held that a former employee of the Texas Health and Human Services Commission did not report to such'an authority. 483 S.W.3d 576, 582, 2015 WL 134686 (Tex.App.-Austin 2015). We disagree. Because the reported-to persons had power beyond internal discipline to regulate under or enforce the law allegedly violated, they were an appropriate law-enforcement authority under the Whistleblower Act. Accordingly, we reverse the court of appeals’ judgment and remand the case to that court, so it may consider the remaining contested elements of this Whistleblower claim.
Michael McMillen, an attorney, served as Deputy Counsel for the Commission’s Office of the Inspector General (OIG). In early 2011, Karen Nelson, a Deputy Inspector General for the Commission, asked McMillen to research the legality of the Commission’s practice of obtaining payments from certain recipients of Medicaid benefits. McMillen prepared a memorandum concluding the Commission’s actions lacked, legal justification. His memorandum, however, cited neither statutes nor case law.
McMillen submitted the memorandum to Nelson, who gave copies to other Deputy Inspectors General. McMillen asserts he made another’ report to the head of the OIG Internal Affairs Division, as well as to the Commission’s Executive Commissioner. In early 2012, McMillen was placed on administrative leave, and he was terminated several months later.
After being fired, McMillen sued the Commission and its Executive Commissioner in his official capacity under the Whistleblower. Act, which under certain circumstances waives a state entity’s immunity from suit for retaliatory discharge. Tex Gov’t Code § 554.0035. The Commission and its Executive Commissioner filed a plea to the jurisdiction, arguing that McMillen’s allegations were not sufficient to invoke the Act and waive immunity. Specifically, the Commission argued McMillen (1) did not allege a good-faith report of a violation of law, and (2) did not allege the report was to an appropriate law-enforcement authority. The trial court denied the Commission’s plea, but following the Commission’s interlocutory appeal, the court of appeals reversed. Id. at 579. The court of appeals focused on the second issue, concluding the Act could not *429protect McMillen because he did not report to an appropriate law-enforcement authority. Id. at 586. In the process, the court also considered whether the statutes McMillen points to prohibit the Commission’s program at issue. Id. at 584.
The Whistleblower Act protects “a public employee who in good faith reports a violation of law by the employing governmental entity or another public employee to an appropriate law enforcement authority.” Tex. Gov’t Code § 554.002(a). The reported-to authority is an appropriate law-enforcement authority if it is ■
a part of a state or local governmental entity or of the federal government that the employee in good faith believes is authorized to:'
(1) regulate ünder or enforce the law alleged to be violated in the report; or
(2) investigate or prosecute a violation of criminal law.
M§ 554.002(b).
To be in “good faith,” an employee’s belief about the reported-to authority’s powers must be “reasonable in light of the employee’s training and experience.” Tex. Dep’t of Tansp. v. Needham, 82 S.W.3d 314, 321 (Tex.2002). An authority’s power to discipline its own or investigate internally does not support a good-faith belief that it is an appropriate law-enforcement authority. Univ. of Tex. Sw. Med. Ctr. v. Gentilello, 398 S.W.3d 680, 686 (Tex.2013). Instead, the authority must have outward-looking powers. “[I]t must have authority to enforce, investigate, or prosecute violations of law against third parties outside of the entity itself, or it must have authority to promulgate regulations governing the conduct of such third parties.” Id. Under the Act, the authority’s power to “regulate under” or “enforce” must pertain to “the law alleged to be violated in the report.” Tex: Gov’t Code § 554.002(b)(1)/'
Because “the particular law the public employee reported violated is critical to the determination” of whether the authority is an , appropriate law-enforcement authority, we begin by examining the statutes McMillen asserts the Commission violated. Needham, 82 S.W.3d at 320. McMillen argues the following statutes prohibit the Commission’s program;, the Texas General Appropriations Act,, sections 32.039, and ,32.064 of the Texas Human Resources Code, and section 1396p(b) of Title 42 of the United States Code. McMillen does not explain how the General Appropriations Act or sections 32.039 and 32.064 of the Texas Human Resources Code prohibit the complained-of conduct. These statutes authorize specific agency action,,but McMillen does not address how they prohibit the Commission’s conduct he reported. >
We therefore turn to section 1396p(b) of Title 42 of the United States Cede. This statute generally prohibits any “adjustment or recovery-of any medical assistance correctly paid on behalf of an individual under the State plan,” with- limited exceptions under which “the State shall seek adjustment or recovery.” 42 U.S.C. § 1396p(b)(l). To the extent the State must seek recovery, it “may be made only after the death of the individual’s surviving spouse, if any.” Id. § 1396p(b)(2). Texas law incorporates this federal statute, requiring that the Commission’s “executive commissioner: shall ensure that' Medicaid implements 42 U.S.C. Section 1396p(b)(l).” Tex. Gov’t Code § 531.077(a). Based on the limited record before us, we agree with McMillen that section 1396p(b) relates to the Commission’s program at issue in this case, which allegedly involved attempting to recover Medicaid payments from certain beneficiaries.
*430Assuming, without deciding, that McMillen made a good-faith report of section 1396p(b)’s violation to the OIG, we hold that the OIG is an appropriate law-enforcement authority. Under the statute in effect when McMillen made the reports and filed suit, the Commission, “through [its] office of inspector general, is responsible for the investigation of fraud and abuse in the provision of health and human services and the enforcement of state law relating to the provision of those services.” Act of June 2, 2003, 78th Leg., R.S., ch. 198, § 2.19(a), sec. 531.102(a), 2003 Tex. Gen. Laws 611, 651 (amended 2013) (current version at Tex. Gov’t Code § 531.102(a)). Much of the OIG’s powers extend to investigating fraud by providers and recipients. See Tex Gov’t Code § 531.102(f)(2). Yet the OIG also has power to ensure “enforcement of state law relating to the provision of’ health and human services. Id. § 531.102(a). And state law mandates that the Commission’s “executive commissioner shall ensure that Medicaid implements 42 U.S.C. Section 1396p(b)(l).” Id. § 531.077(a). Accordingly, the Commission has authority to ensure compliance with section 1396p(b).
This authority extends far beyond the Commission itself. See id. § 531.102. To be sure, any OIG action regarding section 1396p(b) will probably be internal and focus on the Commission’s actions, but only because section 1396p(b) by its very nature governs state recovery of Medicaid benefits, and the Commission is the agency responsible for this. To the extent other Texas agencies violate section 1396p(b), the OIG also has power to enforce the law. In other words, the inward focus of the OIG’s enforcement of section 1396p(b) flows from section 1396p(b)’s aim, not from any limitations on the OIG’s authority to enforce the law against violations outside the Commission. Put more simply, the OIG generally has authority regarding those who handle funds contrary to the laws the OIG is charged with enforcing, whether or not the violators are within the Commission. The OIG is an appropriate law-enforcement authority.
The Commission emphasizes our statement in Gentilello that “only the United States Secretary of Health and Human Services (HHS Secretary) can ‘regulate under’ or ‘enforce’ Medicare/Medicaid rules.” Gentilello, 398 S.W.3d at 685. That case, however, concerned an employee’s internal report to a university department chair who lacked outward-looking law-enforcement authority. Id. Unlike the OIG in this case, the department chair in Gentilello had power only to ensure internal compliance with certain Medicare and Medicaid requirements. Id. But here, the OIG also has outward-looking powers. As we have held before, an appropriate authority “include[s] someone within an OIG or even an OIG within the same agency as the whistleblower, so long as the OIG has outward-looking law-enforcement authority.” Tex. Dep’t of Human Servs. v. Okoli, 440 S.W.3d 611, 617 (Tex.2014).
McMillen reported to an appropriate law-enforcement authority. Therefore, without hearing oral argument, we grant the petition for review, reverse the court of appeals’ judgment, and remand the case to the court of appeals for further proceedings consistent with this opinion. See Tex. R. Arp. P. 59.1.