Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On January 7, 2014, the U.S. Department of Health and Human Services (HHS) issued a notice of proposed rulemaking (NPRM) for the purpose of modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm.

As background, on January 16<sup>th</sup> of last year and in the wake of the tragedy at Sandy Hook Elementary School, President Obama announced twenty-three executive actions aimed at reducing gun violence across the nation.  Among other things, these actions included directives for the federal government to improve and strengthen its national background check system by removing “unnecessary legal barriers, particularly relating to [HIPAA], that may prevent states from making information available to the background check system.”

The NICS is a computerized background check system designed to respond within thirty seconds on most background check inquiries so that Federal Firearms Licensees can ascertain whether a potential firearms recipient is statutorily prohibited from possessing or receiving a firearm.  Categories of persons who may not possess or receive a firearm under federal and state law are broad and range from individuals who have been convicted of crimes punishable by imprisonment for a term exceeding one year to individuals who have been dishonorably discharged from the U.S. Armed Forces.  The mental health prohibitor category under NICS includes those who (i) are or have been involuntarily committed to a mental institution, (ii) are found to be incompetent to stand trial or not guilty by reason of insanity, or (iii) are otherwise determined by a court or other lawful authority to pose a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition or disease.

Records of individuals falling into the mental health prohibitor category generally originate in the criminal justice system or via court order and not from entities subject to HIPAA.  Nonetheless, HHS recognized as part of its NPRM that “there may be State agencies, boards, commissions, or other lawful authorities outside the court system that are involved in some involuntary commitments or mental health adjudications that make an individual subject to the Federal mental health prohibitor,” in light of the variety of state laws.  While exceptions to the HIPAA Privacy Rule may permit the disclosure of certain information concerning mental health status to the NICS, HHS reasoned that many states were nonetheless not reporting this essential information to NICS in part due to fears of violating the Privacy Rule.

To address this concern, HHS has proposed revisions to 45 C.F.R. § 164.512(k) by adding subpart (7).  This addition would expressly permit a covered entity to use or disclose protected health information for purposes of reporting to NICS the identity of an individual who is prohibited from owning a firearm under 18 U.S.C. 922(g)(4), subject to the following conditions:
<ol>
	<li>The covered entity must be a state agency or other entity that is or contains an entity that is (a) an entity designated by the state to report, or which collects information for purposes of reporting, on behalf of the state, to the NICS, or (b) a court, board, commission, or other lawful authority that makes the commitment or adjudication that causes an individual to become subject to 18 U.S.C. 922(g)(4); and</li>
	<li>The covered entity discloses the information to (a) the NICS, or (b) an entity designated by the state to report, or which collects information for purposes of reporting, on behalf of the state, to the NICS, and</li>
	<li>The covered entity (a) discloses only limited demographic and certain other information needed for purposes of reporting to the NICS and (b) does not disclose diagnostic or clinical information for such purposes.</li>
</ol>
HHS is seeking public comment on the proposed rule by March 10, 2014.  As a reminder, please note that where state law is more stringent than the federal rules, HIPAA will not preempt it.  State law is considered to be more stringent where it provides greater privacy protections for individuals’ identifiable health information or greater rights to individuals regarding that information.  Should the proposed rule become final, affected entities will need to evaluate applicable state law to confirm disclosures of protected health information to NICS are permissible.

For further information regarding this rule, please see our prior postings on this subject, which may be accessed on the <a href="https://www.dataprivacymonitor.com/">Data Privacy Monitor</a> by clicking <a href="https://www.dataprivacymonitor.com/hipaahitech/hipaa-gun-control-and-president-obamas-executive-actions-what-you-need-to-know/">here</a> and <a href="https://www.dataprivacymonitor.com/hipaahitech/hhs-considers-amending-hipaa-privacy-rule-to-permit-disclosure-of-mental-health-information-for-fire/">here</a>, respectively.

NICS and HIPAA: Where Mental Health Privacy and Gun Control Overlap; HHS Releases Notice of Proposed Rulemaking