OPINION OF THE COURT
Belen, J.On this appeal we are principally asked to determine whether, in a proceeding pursuant to Mental Hygiene Law § 9.60 (hereinafter Kendra’s Law)1 for an order authorizing assisted outpatient treatment (hereinafter AOT), a physician may obtain clinical records without the subject individual’s authorization or without a court order under certain exceptions set forth in regulations promulgated under the Health Insurance Portability and Ac*54countability Act of 1996 (hereinafter HIPAA) (Pub L 104-191, 110 US Stat 1936 [1996], codified as amended in various sections of titles 18, 26, 29 and 42 of the United States Code; 45 CFR parts 160, 164 [hereinafter the HIPAA Privacy Rule]), and thereafter seek to introduce these records into evidence at a Kendra’s Law AOT proceeding. We find that HIPAA authorizes such disclosures to a physician as part of an AOT proceeding.
The petitioner Charles Barron, M.D., director of the Department of Psychiatry at Elmhurst Hospital Center (hereinafter Elmhurst), commenced this proceeding pursuant to Kendra’s Law for an order authorizing AOT for Miguel M., also known as Miquel M. (hereinafter Miguel M.). At the hearing before the Supreme Court held in accordance with Kendra’s Law (see Mental Hygiene Law § 9.60 [h]), Dr. Barron, in support of his petition, presented the testimony of Dr. Daniel Garza, the director of AOT at Elmhurst. In his direct testimony, Dr. Garza stated that among his duties as director of AOT at Elmhurst, he investigates and evaluates referrals to the Elmhurst AOT program. Dr. Garza explained that upon his evaluation of Miguel M. on October 19, 2007, and upon his review of clinical records of Miguel M.’s visits to Elmhurst dated January 18, 2007, and June 28, 2007, and the clinical records of Miguel M.’s hospitalization at Holliswood Hospital (hereinafter Holliswood) from June 29, 2007, through July 11, 2007, he diagnosed Miguel M. with schizoaffective disorder.
After the court received and marked the above clinical records into evidence as Dr. Barron’s exhibits, Dr. Barron’s counsel asked Dr. Garza how he came into the possession of Miguel M.’s clinical records from Elmhurst and Holliswood. He replied, “As part of the investigatory process under AOT, the office requests records from institutions that have treated the individuals under such investigations. We received these records [upon] a request for [Miguel M.] and the hospitalizations in question.” Upon further inquiry by Dr. Barron’s counsel, Dr. Garza explained that the clinical records identify Miguel M. by his full name, and at various places therein, the clinical records reference Miguel M.’s date of birth, his chart number at various institutions, his home address, his Medicaid number, and his Social. Security number. He further explained that personnel from the respective hospitals certified the authenticity of the clinical records. Dr. Barron’s counsel then moved to admit the records into evidence pursuant to CPLR 4518, the business records exception to the hearsay rule.
*55At that juncture, Miguel M.’s counsel made an oral motion in limine to preclude the admission of the clinical records into evidence and Dr. Garza’s testimony with respect thereto on the grounds, inter alia, that the records were obtained (1) in violation of HIPAA regulations since at the time they were obtained, Miguel M. was “living out in the community”; and (2) without a HIPAA-compliant authorization executed by Miguel M. The court then permitted Miguel M.’s counsel to conduct a voir dire examination of Dr. Garza, during which he testified that he was not the director of medical records for either of the hospitals, never obtained Miguel M.’s authorization to obtain the clinical records, and had not obtained a court order permitting him to obtain the clinical records.
Dr. Barron opposed the motion, arguing that the hospitals’ clinical records were admissible under CPLR 4518. The court interjected, explaining that Miguel M.’s motion did not contest the admissibility of the clinical records under CPLR 4518, but challenged “the legality of the process by which [Dr. Barron] obtained the records.” Dr. Barron then asserted that Dr. Garza was entitled to obtain Miguel M.’s clinical records under Mental Hygiene Law § 33.13 (c) (12). In response, Miguel M.’s counsel conceded that although the Mental Hygiene Law permitted Dr. Garza to obtain the records without a court order or Miguel M.’s authorization, HIPAA preempted those portions of the Mental Hygiene Law concerning AOT investigations. Thus, according to Miguel M.’s counsel, before Dr. Garza could lawfully obtain the hospitals’ clinical records, he was required to comply with the HIPAA Privacy Rule by obtaining either a court order or a HIPAA-compliant authorization executed by Miguel M. The court then adjourned the hearing and directed the parties to brief the issue.
When the parties returned to court three weeks later, upon their oral argument and trial memoranda, the court issued an oral decision and subsequent written order denying Miguel M.’s oral motion in limine and admitting the hospitals’ clinical records into evidence. At the outset of its decision, the court held that it did not need to reach the issue of whether HIPAA preempted the Mental Hygiene Law with respect to the disclosure of a subject individual’s clinical records during AOT investigations, since HIPAA authorized the disclosure of clinical records during an AOT investigation even without an authorization or court order. Addressing first whether disclosure of Miguel M.’s clinical records by the hospitals to Dr. Garza had *56been permitted under 45 CFR 164.512 (a) (1), the court noted that such regulation provided that “[a] covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law” (45 CFR 164.512 [a] [1]). Moreover, as the court noted, the regulation requires a covered entity, in making disclosures “required by law” in judicial and administrative proceedings, such as an AOT proceeding, to receive “satisfactory assurance . . . from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request” or that “reasonable efforts have been made by such party to secure a qualified protective order” (45 CFR 164.512 [e] [1] [ii] [A], [B]). Since it found no evidence that either Dr. Barron or Dr. Garza provided such assurances to either hospital, the court held that the disclosures to Dr. Garza were not proper under 45 CFR 164.512 (a) (1).
The court then turned to the issue of whether the disclosures to Dr. Garza were proper under 45 CFR 164.512 (b) (1) (i). In pertinent part, that provision states:
“A covered entity may use or disclose protected health information without the written authorization of the individual. . .
“for the public health activities and purposes . . . to . . .
“[a] public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions” (emphasis added).
The court held that Dr. Garza qualified as a “public health authority” as that phrase is defined in 45 CFR 164.501, and that the AOT program and a director of an AOT program qualified as a “public health intervention” and “public health investigation” as those phrases are used in 45 CFR 164.512 (b) (1) (i). Accordingly, because the disclosures to Dr. Garza were authorized under 45 CFR 164.512 (b) (1) (i), the court held that *57the subject clinical records were admissible and, therefore, denied Miguel M.’s motion in limine to preclude the admission of such records and related testimony.2
At the continued hearing, the court, over Miguel M.’s “continuing objection,” received the subject clinical records into evidence. Continuing his direct testimony, Dr. Garza testified that based on his evaluation of Miguel M. and his review of Miguel M.’s clinical records, which he received from the two hospitals, Miguel M. met the criteria for AOT:
“[Miguel M.] had two hospitalizations over the last three years, due to noncompliance with treatment, specifically from January 18th through February the 12th of this year [2007]. He was hospitalized at Elmhurst after noncompliance with his outpatient medications, becoming irrational, agitated, hearing voices, believing that he was God, and exhibiting bizarre behavior, putting magazines in the refrigerator.
“Another hospitalization took place initially at Elmhurst and with a transfer to Holliswood Hospital beginning on June 28, [2007], ending July 11, [2007]. Having again become noncompliant with his oral medications, becoming . . . agitated, screaming, chanting in Spanish, and expressing suicidal ideation.”
Dr. Garza further explained that upon reviewing with Miguel M. the details of each hospitalization, Miguel M. admitted that before each hospitalization, he had not complied with his prescribed medication regimen. Dr. Garza explained that the treatment plan he formulated for Miguel M., which he opined was the least restrictive, “will consist of visits by the assertive community treatment team, with a frequency of at least six times per month, providing case management services, medication management services, individual therapy, urine toxicology screens, blood tests for his medication, and prescriptions for his medications.”
At the conclusion of the hearing, the court granted the petition, finding “that the petitioner has shown by clear and convincing evidence that Miguel M.[ ] does meet the eligibility requirements set forth under [Kendra’s Law and] that the treat*58ment plan that has been proposed is the least restrictive that is available.”
Thereafter, by order and judgment (one paper) dated December 13, 2007, the Supreme Court granted the petition and, inter alia, directed Miguel M. to receive and accept AOT for a period of six months beginning from that date, i.e., until June 13, 2008. Miguel M. appeals from the order and judgment, bringing up for review the Supreme Court’s denial of his oral motion in limine to preclude the admission into evidence of his clinical records from Elmhurst and Holliswood, and Dr. Garza’s testimony with respect thereto. We affirm.
As an initial matter, as Miguel M. correctly concedes, since the six-month period of AOT in the order and judgment appealed from expired on June 13, 2008, we would ordinarily be precluded from considering the issues presented by this appeal on the ground of mootness (see Saratoga County Chamber of Commerce v Pataki, 100 NY2d 801, 810-811 [2003], cert denied 540 US 1017 [2003]; Matter of David C., 69 NY2d 796, 798 [1987]; Matter of Hearst Corp. v Clyne, 50 NY2d 707, 714 [1980]; Matter of Geraldine P., 27 AD3d 755 [2006]; Matter of Fernando L., 13 AD3d 450 [2004]; Matter of McCue, 281 AD2d 420 [2001]). However, we agree with Miguel M. that the issues raised on this appeal warrant invoking an exception to the mootness doctrine. First, the issues presented likely will be repeated, either between these parties, given Miguel M.’s chronic mental illness, or among others who are the subjects of AOT petitions. Second, the issues raised herein typically will evade review since an order authorizing AOT under Kendra’s Law expires six months from the date of the order unless extended by further court order (see Mental Hygiene Law § 9.60 [j] [2]; [k]). And third, the issues raised, which involve a matter of first impression, are substantial and novel inasmuch as they require a balancing of the privacy rights of individuals with mental illness with considerations of public safety (see Matter of Chenier v Richard W., 82 NY2d 830, 832 [1993]; Matter of Hearst Corp. v Clyne, 50 NY2d at 714-715; City of New York v Maul, 59 AD3d 187, 191 [2009]; Matter of Manhattan Psychiatric Ctr., 285 AD2d 189, 191 [2001]).
Turning to the merits, the HIPAA Privacy Rule, in pertinent part, defines a “covered entity” as “[a] health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter” (45 CFR 160.103). “Disclosure” is defined as “the release, *59transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information” (45 CFR 160.103). As pertinent to the matter at bar, HIPAA regulations permit a covered entity to disclose “protected health information without the written authorization of the individual” or without giving the individual the opportunity “to agree or object” under certain circumstances (45 CFR 164.512), such as to “[a] public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability . . . including . . . the conduct of public health surveillance, public health investigations, and public health interventions” (45 CFR 164.512 [b] [1] [i] [emphasis added]). For the reasons set forth below, we find that as the director of AOT at Elmhurst, Dr. Garza qualifies as a “public health authority,” and that an AOT investigation qualifies as a “public health investigation” or a “public health intervention” and, thus, the hospitals’ disclosure of Miguel M.’s clinical records as part of Dr. Barron’s AOT investigation was proper under HIPAA.
The HIPAA Privacy Rule defines a “public health authority” as
“an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate” (45 CFR 164.501 [emphasis added]).
Here, Dr. Garza testified that his duties as the director of AOT for Elmhurst include investigating and evaluating referrals to the AOT program. Moreover, one of the underlying purposes of Kendra’s Law is to protect the public from persons with mental illness who live in the community but who have not proven compliant with their prescribed medication regimen, and who thereby pose a possible danger to public health and safety (see L 1999, ch 408, § 2; Matter of K.L., 1 NY3d 362, 367 [2004]). Additionally, under the Mental Hygiene Law, a director of a hospital AOT program is authorized to obtain the clinical records of mentally ill individuals as part of AOT investigations (see Mental Hygiene Law §§ 9.60, 33.13 [c] [12]). Accordingly, *60Dr. Garza, in his capacity as the director of AOT at Elmhurst, which is a program created to further one of the primary purposes of Kendra’s Law—protecting the public health and safety—qualifies as a “public health authority” under HIPAA.
Turning then to the question of whether an AOT investigation qualifies as a “public health investigation” or a “public health intervention,” we note that, unlike the specific definition of “public health authority,” HIPAA does not explicitly define either of those terms. “[I]n the absence of any controlling statutory definition,” we construe words and phrases “in accordance with their plain, ordinary, functional meanings” (Matter of Village of Chestnut Ridge v Howard, 92 NY2d 718, 723 [1999], citing McKinney’s Cons Laws of NY, Book 1, Statutes § 232; see Matter of Brown v New York State Racing & Wagering Bd., 60 AD3d 107, 115-116 [2009]; Matter of Vernon Woods Dev. Corp. v Pucillo, 134 AD2d 597 [1987]). Further, in interpreting those terms under HIPAA, we seek to effectuate the legislative intent (see Patrolmen’s Benevolent Assn. of City of N.Y. v City of New York, 41 NY2d 205, 208 [1976]; Hakimi v Cantwell Landscaping & Design, Inc., 50 AD3d 848, 850 [2008]; Matter of Elgut v County of Suffolk, 1 AD3d 512, 513 [2003]).
A number of factors compel our conclusion that an AOT investigation qualifies as either a “public health investigation” or a “public health intervention.” First, while one purpose of Kendra’s Law is to protect individuals with mental illness by “ ‘restoring] patients’ dignity, and . . . enabling] mentally ill persons to lead more productive and satisfying lives’ ” (Matter of K.L., 1 NY3d at 367, quoting L 1999, ch 408, § 2), its other purpose seeks to protect public health and safety by “reducing the risk of violence posed by mentally ill patients who refuse to comply with necessary treatment” (Matter of K.L., 1 NY3d at 367). Second, an AOT investigation and any resulting mandatory treatment plan is not only a proper exercise of the State’s general police power “ ‘to protect the community from the dangerous tendencies of some who are mentally ill’ ” (id. at 370, quoting Addington v Texas, 441 US 418, 426 [1979]), but also a proper use of the State’s “parens patriae power to provide care to its citizens who are unable to care for themselves because of mental illness” (Matter of K.L., 1 NY3d at 370). In light of the dual purpose of Kendra’s Law in protecting both individuals with mental illness and the general public, and given that an AOT investigation is in accordance with the State’s police and parens patriae powers, we conclude that an AOT investigation *61qualifies as a “public health investigation” or a “public health intervention” under 45 CFR 164.512 (b) (1) (i). Accordingly, the hospitals’ disclosure of Miguel M.’s clinical records to Dr. Garza, an AOT director, to determine Miguel M.’s need for AOT, was proper under HIPAA.
Although we find that the disclosure of Miguel M.’s clinical records to Dr. Garza was proper under HIPAA, we further note that even if HIPAA did not authorize such disclosure, there is no merit to Miguel M.’s contention that HIPAA preempts the Mental Hygiene Law with respect to AOT investigations. The Supremacy Clause of the United States Constitution, which provides, inter alia, that federal laws “shall be the supreme Law of the Land” (US Const, art VI, cl 2), “vests in Congress the power to supersede not only State statutory or regulatory law but common law as well” (Guice v Charles Schwab & Co., 89 NY2d 31, 39 [1996], cert denied 520 US 1118 [1997]). Ultimately, preemption is a question of legislative intent (see Barnett Bank of Marion Cty., N. A. v Nelson, 517 US 25, 30 [1996]; Guice v Charles Schwab & Co., 89 NY2d at 39). Preemption may be established in three ways: (1) through express language in the federal statute (hereinafter express preemption); (2) implicitly because federal legislation is so comprehensive that it can be inferred that Congress intended to fully occupy the subject matter (hereinafter field preemption); or (3) through conflicts between federal and state laws or when the state law acts as an obstacle to accomplishing Congress’s purpose and objective in enacting the federal legislation (hereinafter implied conflict preemption) (see Barnett Bank of Marion Cty., N. A. v Nelson, 517 US at 31; Lorillard Tobacco Co. v Reilly, 533 US 525, 541 [2001]; Guice v Charles Schwab & Co., 89 NY2d at 39; Bantum v American Stock Exch., LLC, 7 AD3d 551, 552 [2004]). Here, in contending that HIPAA preempts that portion of Kendra’s Law which permits disclosures of clinical records obtained during AOT investigations, Miguel M. appears to invoke express preemption or implied conflict preemption. Specifically, according to Miguel M., preemption occurs because Mental Hygiene Law § 33.13 is both contrary to and less stringent than HIPAA regulations since it authorizes the disclosure of a subject individual’s clinical records without either a court order or the subject individual’s authorization. We disagree.
Under the HIPAA Privacy Rule, “[a] standard, requirement, or implementation specification adopted under this subchapter *62that is contrary to a provision of State law preempts the provision of State law” (45 CFR 160.203 [emphasis added]). HIPAA regulations provide that a state law is “contrary” to a HIPAA standard, requirement, or specification as occurring when “[a] covered entity would find it impossible to comply with both the State and federal requirements” or “[t]he provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives” of HIPAA’s so-called administrative simplification procedures (45 CFR 160.202 [emphasis added]). In essence, “the [HIPAA] Privacy Rule sets out a floor of federal privacy protections whereby state laws that are ‘contrary’ to the Privacy Rule are preempted unless a specific exception applies” (Arons v Jutkowitz, 9 NY3d 393, 414 [2007]).
Significantly, the HIPAA Privacy Rule specifically excepts from the scope of its preemption provision, among other things, circumstances in which “[t]he provision of State law, including State procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention” (45 CFR 160.203 [c] [emphasis added]). As discussed above, an AOT investigation qualifies as a “public health investigation” or a “public health intervention” under HIPAA (45 CFR 164.512 [b] [1] [i]). Therefore, we conclude that AOT investigations are specifically excepted from HIPAA’s preemption provision. Moreover, given that the disclosures of Miguel M.’s clinical records to Dr. Garza were authorized under both HIPAA and the Mental Hygiene Law (see 45 CFR 164.501,164.512 [b] [1] [i]; Mental Hygiene Law §§ 9.60, 33.13 [c] [12]), compliance with both is not impossible and, thus, it cannot be said that the Mental Hygiene Law is “contrary” to HIPAA.
In light of our conclusion, we need not reach the petitioner’s remaining contention that the disclosure of Miguel M.’s clinical records by Elmhurst and Holliswood to Dr. Garza was appropriate on the ground that the AOT investigation constituted “treatment” under the HIPAA Privacy Rule (see 45 CFR 160.103 [defining, inter alia, “(h)ealth care”], 164.501 [defining, among other things, “(t)reatment”], 164.506 [c] [2] [authorizing a covered entity’s disclosure of “protected health information for treatment activities of a health care provider”]).
Finally, because Miguel M.’s clinical records from Elmhurst and Holliswood were properly disclosed to Dr. Garza as part of the AOT investigation, Dr. Garza’s testimony with respect to *63such records also was admissible. Additionally, upon our review of the record, we find that Dr. Barron established, by clear and convincing evidence, that Miguel M. met the standard under Kendra’s Law supporting the Supreme Court’s determination to issue an ACT order, and further find that the ACT sought was the least restrictive treatment appropriate and feasible for Miguel M. (see Mental Hygiene Law § 9.60 [c], [e] [2] [i]; [j] [2]; Matter of K.L., 1 NY3d at 367-368; Matter of Anthony F., 306 AD2d 345 [2003]; Matter of Manhattan Psychiatric Ctr., 285 AD2d at 196).
Accordingly, the order and judgment is affirmed.
Mastro, J.P., Batkin and Dickerson, JJ., concur.
Ordered that the order and judgment is affirmed, without costs or disbursements.
. The law was named after Kendra Webdale, a young woman who, on January 3, 1999,
“was pushed to her death before an oncoming subway train by a man diagnosed with paranoid schizophrenia who had neglected to take his prescribed medication. Responding to this tragedy, the Legislature enacted Mental Hygiene Law § 9.60 (L 1999, ch 408 . . .), thereby joining nearly 40 other states in adopting a system of assisted outpatient treatment (AOT) pursuant to which psychiatric patients unlikely to survive safely in the community without supervision may avoid hospitalization by complying with court-ordered mental health treatment” (Matter of K.L., 1 NY3d 362, 366 [2004]).
The legislative findings underlying Kendra’s Law set forth, in pertinent part,
“there are mentally ill persons who are capable of living in the community with the help of family, friends and mental health professionals, but who, without routine care and treatment, may relapse and become violent or suicidal, or require hospitalization. . . .
“The legislature further finds that some mentally ill persons, because of their illness, have great difficulty taking responsibility for their own care, and often reject the outpatient treatment offered to them on a voluntary basis. Family members and caregivers often must stand by helplessly and watch their loved ones . . . decompensate. Effective mechanisms for accomplishing these ends include[, among other things,] the establishment of assisted outpatient treatment as a mode of treatment” (L 1999, ch 408, § 2).
. Inasmuch as it determined that the disclosures to Dr. Garza were proper under the HIPAA Privacy Rule, the court did not address whether the disclosures were proper under the Mental Hygiene Law.