concur in a separate memorandum by Tom, J.P., as follows: The Attorney General issued the subject subpoena in the course of an investigation of financial impropriety and mismanagement at respondent nursing home, as well as possible patient abuse (see Public Health Law § 2803-c). The Attorney General’s office is empowered to apply to enjoin such fraudulent or illegal activities, to take proof and to issue subpoenas “[i]n connection with any such application” (Executive Law § 63 [12]). The Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 USC § 1320d et seq.) authorizes the production of medical records where they are reasonably related to a “legitimate law enforcement inquiry” (45 CFR 164.512 [f] [1] [ii] [C] [1]; see Matter of La Belle Creole Intl., S.A. v Attorney-General of State of N.Y., 10 NY2d 192, 196-197 [1961]).
We agree with Supreme Court that when investigating possible violations of law at a health related facility (see e.g. 42 USC § 1320a-7b), the Attorney General’s office functions as a “health oversight agency” within the meaning of HIPAA (45 CFR 164.501, 164.512 [d]). The Attorney General has demonstrated “authority, relevancy, and some basis for inquisitorial *202action” (Matter of A’Hearn v Committee on Unlawful Practice of Law of N.Y. County Lawyers’ Assn., 23 NY2d 916, 918 [1969], cert denied 395 US 959 [1969]), and except where “the futility of the process to uncover anything legitimate is inevitable or obvious or where the information sought is utterly irrelevant to any proper inquiry” a subpoena will not be quashed (Anheuser-Busch, Inc. v Abrams, 71 NY2d 327, 331-332 [1988] [internal quotation marks and citations omitted]). Finally, we note that the requirement of Executive Law § 63 (12) that a party under investigation “engage in repeated fraudulent or illegal acts” refers to the party operating the business, here respondent nursing home, not to a person in its care. While the subpoenaed records involve incidents of patient misconduct, they reflect respondent’s failure to protect the rights guaranteed to patients under Public Health Law § 2803-c. Thus, we regard the incidents as relevant to, and indicative of, the overall pattern of mismanagement under investigation, not as mere isolated lapses in patient care.