The Department of Health and Human Services (HHS) is proposing revisions to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to create more flexibility for reporting individuals to the National Instant Criminal Background Check System (NICS). We attach the April 23, 2013, advance notice of proposed rulemaking. Comments on the proposed rules are due to HHS by June 7, 2013.
On January 16, 2013, President Obama signed 23 Executive Actions which endeavor to reduce gun violence in the United States. They contain a specific commitment to “[a]dress unnecessary legal barriers, particularly relating to the Health Insurance Portability and Accountability Act, which may prevent states from making information available to the background check system.” The NICS Index, established under the Brady Act (PL 103-159) and administered by the Federal Bureau of Investigation, allows the collection and maintenance of information about individuals who are subject to one or more “federal prohibitors” (which is described in 18 U.S.C. § 992(d) and applies to individuals who have been imprisoned for more than one year, persons who are known fugitives of justice, persons being unlawful users of controlled substances, illegal aliens, etc.). Such persons are ineligible to purchase firearms. While the NICS Index includes information identifying the applicable federal prohibitor (as well as identifying information such as date of birth and regional location), it does not include information such as underlying diagnoses, treatment records, and other identifiable health information.
The major component of the HHS proposed rule attempts to resolve conflicts and concerns regarding the “mental health prohibitor,” which disqualifies persons who meet its guidelines from possessing a firearm. The mental health prohibitor applies to those persons who have been involuntarily committed to a mental institution, found incompetent to stand trial or not guilty by reason of insanity, who have been deemed through a formal adjudication process to have a severe mental condition that results in those individuals presenting a danger to themselves or others, or being incapable of managing their own affairs. The HHS is considering amending the HIPAA Privacy rule to include express permission allowing covered entities to report limited mental health prohibitor information on such persons to NICS. The HHS is also soliciting suggestions on the best ways to disseminate information on HIPAA policies to state level entities that originate or maintain information that may be reported to NICS. Finally, HHS is soliciting input on how to avoid the adverse consequences for individuals seeking needed mental health services by creating an express permission to report information to NICS.
The HHS asserts in this proposed rule that there are limited circumstances when HIPAA covered entities would face a potential conflict. In most cases, records that contain the relevant information about individuals who would be subject to the mental health prohibitor would be held by criminal justice system entities, not HIPAA covered entities. However, due to state laws, Protected Health Information (PHI) may be held by a HIPAA covered entity such as a state health agency. In those cases, there are ways in which the Privacy Rule still permits reporting to the NICS. Specifically, the Privacy Rule permits disclosure to the NICS to the extent allowable by the state law. In the case where there is no state law requiring reporting, the Privacy Rule allows a HIPAA covered state entity to become a hybrid agency which performs both health care and non-health care functions (e.g. NICS reporting), and can disclose prohibitor information through its non-HIPAA covered NICS reporting unit without restriction under the Privacy Rule. However, many states do not report mental health prohibitor information to the NICS due to lack of a state law requiring NICS disclosures, and do not utilize the option of creating a hybrid entity due to administrative or other challenges.
The HHS is considering making the above-mentioned amendment to the Privacy Rule to allow express permission, and asserts that it might simplify the reporting of identities of prohibited individuals to NICS. If the express permission were to be included, HHS would aspire to limit the data necessary for NICS to exclude the individual’s treatment record or other diagnostic or clinical information. The required information would be limited to verifying that the individual meets the criteria to be excluded by the mental health prohibitor, the individual’s name, birthday, and other coded identifying information.
If you have questions regarding this proposed rule or would like assistance with developing comments, please contact us at the information below.
