After receiving more than 2,000 comments to its April 2013 Advance Notice of Proposed Rulemaking, the Department of Health & Human Services ("HHS") has proposed to amend the HIPAA Privacy Rule to expressly permit certain covered entities to report to the National Instant Criminal Background Check System ("NICS") the identities of individuals who are prohibited by federal law, for mental health reasons, from possessing firearms (commonly referred to as the "mental health prohibitor").
The NICS is the system used to determine whether a potential firearms recipient is statutorily prohibited from possessing or receiving a firearm. The mental health prohibitor applies to individuals who have been (1) involuntarily committed to a mental institution; (2) found incompetent to stand trial or not guilty for reason of insanity; or (3) otherwise determined, through formal adjudication process, to have a severe mental condition that results in the individuals presenting a danger to themselves or others, or being incapable of managing their own affairs.
While most records related to involuntary commitments and mental health adjudications originate in entities affiliated with the criminal justice system (which are generally not subject to HIPAA), state entities outside the criminal justice system may also be involved. If these state entities are HIPAA-covered entities, or if a HIPAA-covered entity is the state repository for such records, then these records are subject to HIPAA.
Under the existing HIPAA Privacy Rule, there are circumstances where records subject to HIPAA may be reported to the NICS. For example, the Privacy Rule permits any covered entity to disclose information to the NICS to the extent such reporting is required by state law. In the absence of a state law requirement, however, reporting to the NICS is only permissible to the extent a covered entity designates itself as a hybrid-covered entity, and the relevant information is maintained and reported through the non-HIPAA regulated portion of that entity. As a result, OCR has cited concerns that the existing HIPAA Privacy Rule may be preventing some state entities (which likely perform both HIPAA-covered and non-covered functions) from reporting to the NICS the identities of individuals subject to the mental health prohibitor. Therefore, HHS has proposed to add to the Privacy Rule new provisions at 45 CFR § 164.512(k)(7), which would permit certain covered entities to disclose the minimum necessary demographic and other information for NICS reporting purposes.
Notably, this new permission would apply only to covered entities that function as repositories of information relevant to the federal mental health prohibitor on behalf of a state, or that are responsible for ordering the involuntary commitments or other adjudications that make an individual subject to the federal mental health prohibitor. Further, the new permission would strictly limit the information used or disclosed for NICS reporting purposes to the minimum necessary—HHS considers the minimum necessary information to include: (1) an individual's name; (2) an individual's date of birth; (3) an individual's sex; (4) a code or notation indicating that the individual is subject to the federal mental health prohibitor; (5) a code or notation representing the reporting entity; and (6) a code identifying the agency record supporting the prohibition. The new permission would not permit the use or disclosure of clinical or diagnostic information.
HHS is seeking comments related to the proposed rule. Comments may be submitted in writing, or electronically at www.regulations.gov, on or before March 10, 2014.
This article is presented for informational purposes only and is not intended to constitute legal advice.
