Adding yet another wrinkle to the nation’s contentious gun control debate, the U.S. Department of Health and Human Services (HHS) has released an Advance Notice of Proposed Rulemaking (ANPRM) soliciting information and public comment on possible amendments to the HIPAA Privacy Rule to permit disclosure of limited mental health information to the National Instant Criminal Background Check System (NICS). Stemming from the Obama Administration’s January 2013 plan to reduce gun violence, the ANPRM seeks to address “unnecessary legal barriers, particularly relating to [HIPAA], that may prevent states from making information available to the NICS.”
The NICS is the federal government’s background check system for the sale or transfer of firearms. Established under the Brady Handgun Violence Prevention Act, licensed gun dealers use the NICS to identify persons who are subject to one or more “prohibitors” under the Gun Control Act that make them ineligible to purchase firearms. One such prohibitor is the “mental health prohibitor,” which applies to persons who have been involuntarily committed to a mental institution, found incompetent to stand trial or not guilty by reason of insanity, or otherwise adjudicated as having a serious mental condition that results in their presenting a danger to themselves or to others or being unable to manage their own affairs.
States are not reporting mental health prohibitor information to the NICS because of HIPAA Privacy Rule concerns, according to the ANPRM. However, as the ANPRM points out, much of the mental health prohibitor information in question, such as records of individuals adjudicated as incompetent to stand trial, originates with entities in the criminal justice system that are not covered entities subject to the Privacy Rule. Additionally, the ANPRM specifically notes that NICS reporting would not fall under the Privacy Rule’s provisions permitting disclosures for law enforcement purposes (which apply to specific law enforcement inquiries) or to avert a serious threat to public safety (which require an imminent threat of harm).
HHS is considering whether to amend the Privacy Rule to expressly permit covered entities with information on persons subject to the mental health prohibitor to disclose their identities to the NICS subject to the minimum necessary rule (i.e., name, demographic information and codes identifying the reporting entity and the relevant prohibitor). No treatment records or other clinical or diagnostic information would be disclosed, and only those entities that are responsible for the adjudications underlying the mental health information prohibitor would be permitted to disclose the information.
The ANPRM includes a list of 15 questions on the nature and scope of the underreporting problem, the entities creating and/or maintaining data, the extent to which existing permissible disclosures are insufficient and additional methods of disseminating information concerning whether the Privacy Rule affects reporting to the NICS. In particular, HHS is seeking specific examples of situations where NICS reporting has been hindered by HIPAA requirements or where healthcare entities that both perform adjudications or involuntary commitments and provide mental health treatment are uncertain over how HIPAA applies to such reporting.
Comments regarding the Privacy Rule amendments and the information requested by HHS are due by June 7, 2013.
