HHS Announces Proposed Rule Amending the HIPAA Privacy Rule for Reporting to the National Instant Criminal Background Check System

On January 3, 2014, the Department of Health & Human Services (HHS) announced a Notice of Proposed Rulemaking (NPRM) to revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit certain covered entities to disclose specific information about individuals subject to the Federal mental health prohibitor to the National Instant Criminal Background Check System (NICS). HHS stated the purpose of this amendment is to help “strengthen the federal background check system to keep guns out of potentially dangerous hands,” by removing legal barriers under HIPAA that may prevent reporting relevant information to the NICS. This NPRM follows an Advance Notice of Proposed Rulemaking (ANPRM) issued on April 23, 2013.

The NICS is a national system used to conduct background checks on individuals who may be disqualified from purchasing or receiving firearms based on federally prohibited categories or state law. One such category is the Federal mental health prohibitor, which includes “individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition or disease.” The NPRM notes that the Department of Justice has proposed clarifications to the regulatory language defining the Federal mental health prohibitor.

The proposed amendment to the Privacy Rule would create a new category of permitted disclosures in 45 CFR 164.512(k), which regulates uses and disclosures for specialized government functions. The new section 164.512(k)(7) would permit HIPAA covered entities that perform the commitments or adjudications that make individuals subject to the Federal mental health prohibitor, or that act as repositories of NICS records on behalf of a state to use and disclose certain information for NICS reporting purposes. These select covered entities would be permitted to disclose “only the limited demographic and certain other information needed for purposes of reporting to the [NICS].” 45 CFR 164.512(k)(7)(iii)(A). HHS explains in the preamble that this includes the “individual’s name; date of birth; sex; a code or notation indicating that the individual is subject to the Federal mental health prohibitor; a code or notation representing the reporting entity; and a code identifying the agency record supporting the prohibition.” Covered entities would not be permitted to disclose clinical or diagnostic information, medical records or other identifiable health information. Covered entities could disclose the information directly to the NICS or to an entity designated by a state as a data repository for NICS reporting purposes.

Because the proposed rule focuses on covered entities that actually perform the commitments or adjudication, it does not affect most treating providers or covered entities that only engage in treatment functions. Further, this modification would permit, not require, the specified covered entities to disclose information. This permission would not extend to prohibitors other than the Federal mental health prohibitor listed at 18 U.S.C. 922(g).

In the NPRM, HHS straddles the competing concerns raised by the more than 2,050 comments HHS received in response to the ANPRM. Commentators voiced concerns that the proposed HIPAA permission would infringe on an individual’s Second Amendment right to bear arms and the right to due process under the Constitution, noting that the Federal mental health prohibitor is overly broad, and that mental illness is not an effective predictor of gun violence. Other commentators noted concerns about the impact on the patient-provider treatment relationship and willingness to seek mental health treatment. Other commenters supported the proposal as an important measure for public safety.

In responding to these concerns, HHS highlighted the desire to balance the expressed concerns against the need for reducing real or perceived barriers to reporting information to the NICS, to better protect the public’s health and safety. HHS emphasized the limited permission provided under the proposed amendment and explained that the proposed amendment would not affect the scope of the NICS, would not expand to other categories of prohibited persons in regards to firearms purchases, and that individuals subject to the Federal mental health prohibitor would have the opportunity to obtain judicial review or other due process.

The proposed amendment would not include any additional notification requirements to individuals whose information was disclosed and would not require covered entities to change their Notice of Privacy Practices.

HHS is soliciting comments on various issues addressed in the NPRM, including whether the permission should be broadened to include reporting individuals subject to state firearms prohibitions and if additional (non-clinical) identifying information should be reported.

Laura A. Feldman
Vickie B. Ahlers