"HHS Modifies HIPAA In An Attempt to Address Gun Violence"
On January 6, 2016, the Department of Health and Human Services (HHS) issued a Final Rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals who are subject to the “Federal mental health prohibitor,” which disqualifies them from possessing or receiving a firearm. NICS is a database maintained by the Federal Bureau of Investigation (FBI) to conduct background checks on individuals who may be prohibited from possessing or receiving a firearm. Under federal law, individuals subject to the mental health prohibitor include persons who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs.
This Final Rule does not apply to most treating providers, but only those covered entities that order involuntary commitments or make other adjudications that subject individuals to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes. These specific covered entities are permitted, but not required, to disclose relevant information to NICS about individuals subject to the Federal mental health prohibitor, even if they are not a HIPAA hybrid entity or required under State law to report. The information that can be disclosed is limited to demographic and other information necessary for NICS reporting. This Final Rule explicitly prohibits a covered entity from disclosing diagnostic or clinical information from medical records. Further, the Final Rule does not modify the Federal mental health prohibitor in any way, nor does it permit disclosure of the identity of individuals subject only to a mental health prohibitor under State law.
HHS believes that this limited permission granted to certain covered entities protects the “patient-provider relationship,” and maintains a balance between “an individual’s privacy interests” and the “public safety interest in reporting certain information to the NICS.” HHS also noted that this rule does not single out individuals suffering from mental illness because it only permits the reporting of information regarding individuals “subject to the Federal mental health prohibitor,” and does not apply against individuals who voluntarily seek treatment for mental illness. This Final Rule was published in the Federal Register as 81 Fed. Reg. 382, and is effective on February 5, 2016.
Key Takeaways
This Final Rule is unlikely to impact many covered entities, but will help ensure that relevant information may be provided to the NICS firearm background check database. Now, state health agencies, as well as other covered entities lawfully charged with making Federal mental health prohibitor determinations will not have to worry about violating HIPAA if they report such a determination to NICS. This is true even if the covered entity is in a state that does not have a mandatory reporting obligation, and even when the covered entity has not created a HIPAA hybrid entity, in which it was permitted to report under its non-healthcare component. It is important to remember that this Final Rule only applies to reporting the identity of an individual who is subject to a Federal mental health prohibitor, not someone who is only subject to a State mental health prohibitor, which may have different criteria than the Federal mental health prohibitor.