HIPAA won't prevent disclosure to oversight agency