March 9, 2016
By Joseph Kelley*
The U.S. Department of Health and Human Services (HHS) has issued a final rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (Privacy Rule) to facilitate the mental health screening of prospective firearm purchasers. The change is part of the Obama Administration’s set of executive actions, announced in January 2013, designed to curb gun violence. The new rule is intended to remove barriers presented by the Privacy Rule to the reporting of individuals with “mental health prohibitors” to the National Instant Criminal Background System (NICS).
The Gun Control Act of 1968 (Gun Control Act) and implementing regulations issued by the U.S. Department of Justice (DOJ) disqualify certain categories (known as “prohibitors”) of individuals from shipping, transporting, possessing, or receiving firearms. Individuals subject to the “mental health prohibitor” include those who have been “committed to a mental institution” or “adjudicated as a mental defective.”1 DOJ regulations define these categories to include persons who: (1) have been involuntarily committed to a mental institution, for reasons such as mental illness or drug use; (2) have been found incompetent to stand trial or not guilty by reason of insanity; or (3) otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or unable to manage their own affairs, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease.
The Brady Handgun Violence Prevention Act of 1993 (Brady Gun Law) established the NICS in order to enforce the prohibitions under the Gun Control Act and state law on the possession or receipt of firearms. The NICS, a database administered by the Federal Bureau of Investigation, contains identifying information regarding individuals subject to prohibitors. For a person subject to a federal mental health prohibitor, the NICS contains certain basic identifying information; it does not contain detailed mental health information such as diagnosis or treatment records.
Although the Brady Gun Law requires federally licensed firearm dealers in most cases to conduct an NICS check on each prospective buyer, the law does not require state agencies to report to NICS information regarding individuals subject to a federal or state prohibitor, including the mental health prohibitor. Rather, such reports are voluntary under federal law.
In the Rulemaking, HHS clarifies that the Privacy Rule, as it existed prior to this Rulemaking, should not have prohibited reports to the NICS in most cases. Involuntary commitments and other mental health adjudications typically proceed through the court system rather than through HIPAA-covered entities. Moreover, covered entities involved in NICS reporting have the option of establishing themselves as hybrid entities and making disclosures consistent with the Privacy Rule as it existed prior to this Rulemaking.
Despite these permissible disclosure avenues, HHS recognizes that the Privacy Rule may have contributed to the underreporting of mental health prohibitors to the NICS. It cites a 2012 U.S. Government Accountability Office report suggesting that the Privacy Rule presented challenges to states in reporting mental health prohibitors to the NICS.
Accordingly, through the Rulemaking, HHS has created an express permission in the Privacy Rule for reporting mental health prohibitor information to the NICS. It does so by adding a new provision at 45 CFR 164.512(k)(7), which permits certain entities to disclose limited information for NICS reporting purposes.
First, the new exception permits disclosures only by entities that order involuntary commitments or other mental health adjudications, or those that act as state repositories for mental health prohibitor information. The new Rule does not, HHS notes, establish permission for most treating providers to disclose protected health information (PHI) regarding their own patients.
The new rule further only permits these adjudicatory and repository bodies to report PHI either to the NICS or a state-designated repository.
Finally, the new Rule limits the type of information that may be disclosed pursuant to the new exception to that limited demographic and other information necessary for NICS reporting purposes. The Rule expressly excludes the reporting of diagnostic or clinical information from coverage under the new exception. The Rule also does not create an express permission for reporting PHI of individuals subject to a state-only mental health prohibitor.
The new rule follows an Advance Notice of Proposed Rulemaking dated April 23, 2013 and a Notice of Proposed Rulemaking of January 7, 2014. The final rule was published on January 6, 2016 and became effective February 5, 2016.
We would like to thank Joseph T. Kelley, III (Kelley Partners Ltd., Philadelphia, PA) and Barbara J. Zabawa (Center for Health Law Equity LLC, McFarland, WI) for respectively authoring and reviewing this email alert.
1 18 U.S.C. 922(g)(4).