OPINION OF THE COURT
Chief Judge Lippman.At issue is the enforceability of a subpoena duces tecum issued by respondent New York State Commission of Correction (the Commission) commanding Elmhurst Hospital, a health care facility operated by petitioner New York City Health and Hospitals Corporation (HHC), to produce its records respecting its care and treatment of one Carlos Frazier, who, at the time of his premortem hospitalization at the Elmhurst facility, was a correctional inmate in the custody of the City of New York. In the proceedings resulting in this appeal, the Commission’s subpoena was quashed upon the ground that it sought material shielded from disclosure by the physician-patient privilege. We *242now hold that this was error—that the records sought were not properly withheld from the Commission by reason of the asserted privilege and that the subpoena should be enforced.
Respondent Commission is constitutionally charged with the oversight of all correctional facilities in this state (NY Const, art XVII, § 5). Within the Commission there is a Medical Review Board (the Board) (Correction Law § 43) composed in significant part of duly licensed medical doctors, including a board certified pathologist and psychiatrist (Correction Law § 43 [1]). First among the Board’s statutorily assigned functions, powers and duties is the ‘ ‘ [i] nvestigat[ion] and review [of] the cause and circumstances surrounding the death of any inmate of a correctional facility” (Correction Law § 47 [1] [a]). The Board, relatedly, has broad investigative powers: it is given access to any correctional facility in which an inmate has died and the authority to order an autopsy, even where one has already been performed (Correction Law § 47 [1] [b], [c]). At the conclusion of its postmortem review, the Board must issue a report containing recommendations respecting the prevention of future similarly eventuated inmate deaths (Correction Law § 47 [1] [d]). The Board is separately required to report to the Commission generally “on the condition of systems for the delivery of medical care to inmates of correctional facilities and where appropriate [to] recommend such changes as it shall deem necessary and proper to improve the quality and availability of such medical care” (Correction Law § 47 [1] [e]).
In discharging its mandate to investigate the death of any inmate of a correctional institution, the Board not infrequently has occasion to request the medical records of inmates who, during their final illnesses, were transferred to and treated at noncorrectional health care facilities in accordance with 9 NYCRR 7010.2 (g), 7503.1 (a) and 7651.13. To enable the Board’s postmortem review in these situations the Commission, the Chairman of which “may request and receive” from any state or local agency or public authority the “information and data” (Correction Law § 44 [4]) necessary to the performance of its duties, has used its broad power “to issue and enforce” subpoenas and to examine witnesses “under oath, in accordance with and pursuant to [the] civil practice law and rules” (Correction Law § 46 [2]).
This proceeding arises from the Medical Review Board’s statutorily required investigation into the causes and circumstances surrounding the death of prison inmate Carlos Frazier. Mr. Frazier died subsequent to transfers from the City facility *243where he was incarcerated to Elmhurst Hospital and from there to Bellevue Hospital, his final destination. As is here relevant, the Commission served upon the records department of Elmhurst Hospital a subpoena duces tecum requesting Mr. Frazier’s medical records. Responding to the subpoena on the hospital’s behalf, HHC refused to turn over the sought records. Frazier, it pointed out, had been treated at Elmhurst in a nonprison unit, and, in view of that circumstance, it was HHC’s contention that the Commission had no special entitlement to his records, which HHC claimed were shielded from disclosure by the physician-patient privilege (CPLR 4504).1
HHC thereafter brought the present motion pursuant to CPLR 2304 to quash the Commission’s subpoena. To the extent presently relevant, HHC in addition to alleging that it was precluded from turning over the Elmhurst records by the physician-patient privilege, claimed that under the Privacy Rule (45 CFR parts 160, 164) of the Health Insurance Portability and Accountability Act (HIPAA) (Pub L 104-191, 110 US Stat 1936 [1996] [codified as amended in scattered sections of titles 18, 26, 29 and 42 of the United States Code]), its disclosure of the sought records was not required.
Supreme Court agreed with HHC to the extent of holding in separate decisions that HIPAA permitted, but did not require, HHC’s surrender of the sought records absent authorization from Mr. Frazier’s personal representative, and that the records were privileged from disclosure pursuant to CPLR 4504. The court rejected the Commission’s contention that Correction Law §§ 46 and 47 impliedly created an exception to the statutory doctor-patient privilege asserted on Mr. Frazier’s behalf by HHC.2
*244The Appellate Division affirmed (76 AD3d 453 [2010]). While terming the Commission’s investigative objectives “laudable,” it found that the clinical records sought were subject to the statutory privilege. The court noted that there was no public interest exception to the privilege. Exceptions, it said, were to be made, if at all, by the Legislature (76 AD3d 453, 455 [2010]). Inasmuch as the Legislature had not enacted an express exception in favor of the Commission, the court held that the Commission’s subpoena was properly quashed.
This Court granted respondent permission to appeal (16 NY3d 708 [2011]), and we now reverse.
The physician-patient privilege exists to protect important policies—namely, uninhibited and candid communication between patients and medical professionals, the accurate recording of confidential information and the protection of patients’ reasonable privacy expectations (see Matter of Grand Jury Investigation in N.Y. County, 98 NY2d at 531-533). Nonetheless, the privilege, which owes its existence solely to legislative enactment in derogation of the common law (id. at 529), is justified exclusively by these policies, and where they will not be advanced by the privilege’s assertion and there are countervailing legislatively sanctioned policies and practices militating in favor of disclosure, exceptions to the privilege, we have held, may be implied. In Matter of Camperlengo v Blum (56 NY2d 251 [1982]), we implied such an exception to allow the State Department of Social Services to subpoena otherwise privileged medical records from a health care provider in pursuance of a Medicaid fraud investigation. We noted in relevant part that,
“[although there is no express statutory exception to the privilege for Medicaid-related records, the Federal and State record-keeping and reporting requirements evidence a clear intention to abrogate the physician-patient privilege to the extent necessary to satisfy the important public interest in seeing that Medicaid funds are properly applied. Of course, this exception to the privilege is intended to be no broader than necessary for effective oversight of the Medicaid program” (id. at 255-256).
While we have since Camperlengo held that there is no general public interest exception to the physician-patient privilege (People v Sinski, 88 NY2d 487, 492 [1996]) and that there is no categorical exception for grand jury subpoenas (Matter of Grand *245Jury Investigation in N.Y. County, 98 NY2d at 531-533), what is claimed by the Commission here is not a general exception that would compromise the policy objectives underlying the privilege, but a specific, narrow exception reasonably and indeed practically necessarily to be implied, as per Camperlengo, from the Legislature’s express provisions detailing the Commission’s responsibilities and powers, particularly with respect to investigating inmate deaths through its Medical Review Board.
It is plain that the Legislature intended for the Board to have plenary authority to “[investigate and review the cause and circumstances surrounding the death of any inmate of a correctional facility” (Correction Law § 47 [1] [a] [emphasis added]). In granting this authority, the Legislature cannot be supposed to have allowed that the thoroughness of the Board’s inquiry would vary with the site of an inmate’s premortem medical care—that the inquiry respecting the death of an inmate who in the period preceding his or her death was treated in a prison or a prison unit in a hospital would be conducted with the benefit of a full medical record,3 whereas one respecting an inmate who had received premortem treatment in a nonprison unit would have to be performed without such a record in the event that a waiver of the physician-patient privilege could not be obtained.
Countenancing such an obviously unintended and unreasonable disparity would, moreover, not serve any justifying purpose of the privilege. The prospect of a confidential postmortem review (see Public Officers Law § 89 [2] [b] [ii]; § 96) of an inmate’s medical record should have no untoward effect upon the physician-patient relationship. Even if it did, however, the Legislature has provided that all inmate deaths must be reviewed and the extent of the authorized review, even without the records here claimed to be subject to the physician-patient privilege, is so great as to render the effect of the abrogation of that privilege in this context relatively insignificant with respect to the interests the privilege properly safeguards. The Medical Review Board, as noted, must, pursuant to express statutory command, have at its disposal all of the medical records of a deceased inmate generated in any correctional facility. *246It must, in addition, be afforded a report of the autopsy necessarily to be performed in the event of an inmate death (County Law § 671 [1]; § 674 [5]; § 677 [6]) and is authorized itself to command the performance of an additional autopsy (Correction Law § 47 [1] [c]). In light of the Legislature’s authorization of such broad and intrusive investigative authority, there is no plausible contention that there is some residual privacy, record keeping or treatment interest effectively to be vindicated by asserting the privilege. To the extent that interests protected by the privilege are implicated, they have already been irretrievably affected given the investigative powers expressly committed by the Legislature to the Commission and its Medical Review Board.
Finally, although HHC presses its argument based on the HIPAA Privacy Rule as an alternative ground for affirmance, the Privacy Rule does not prohibit disclosure of the sought records. The Rule specifically allows for disclosures “required by law” (45 CFR 164.512 [a]; see Arons v Jutkowitz, 9 NY3d 393, 414 [2007]), and included under that heading are disclosures pursuant to “subpoenas . . . issued by ... an administrative body authorized to require the production of information” (45 CFR 164.103). The subpoena at bar, the validity of which we now uphold as against petitioner’s claim of privilege, falls comfortably within this description.
Accordingly, the order of the Appellate Division should be reversed, with costs, and the petition dismissed.
Judges Ciparick, Graffeo, Read, Smith, Pigott and Jones concur.
Order reversed, etc.
. CPLR 4504 (a) provides, in pertinent part:
“[u]nless the patient waives the privilege, a person authorized to practice medicine, registered professional nursing [or] licensed practical nursing . . . shall not be allowed to disclose any information which he [or she] acquired in attending a patient in a professional capacity, and which was necessary to enable him [or her] to act in that capacity. The relationship of a physician and patient shall exist between a medical corporation . . . and the patients to whom [it] . . . render [s] professional medical services.”
. It is not disputed that the physician-patient privilege may be asserted by a hospital on its patient’s behalf (see Matter of Grand Jury Investigation in N.Y. County, 98 NY2d 525, 528 [2002]).
. It is, in this connection, clear that the Commission “must be granted access . . . to all books, records, and data pertaining to any correctional facility” and may require “the officers or employees of a correctional facility [to provide] any information deemed necessary for the purpose of carrying out the commission’s functions, powers and duties” (Correction Law § 46 [1]).