On January 6, 2016, the U.S. Department of Health and Human Services (HHS) released a modification to the Health Insurance Portability and Accountability Act (HIPAA) removing barriers to reporting federal mental health prohibitor status for gun background check purposes. The new section, 45 C.F.R. § 164.512(k)(7), allows a covered entity to use or disclose protected health information (PHI) to report the identity of an individual to the National Instant Criminal Background Check System (NICS) if the individual is subject to 18 U.S.C. § 922(g)(4), which prohibits individuals from firearm possession by categorizing them with a federal mental health prohibitor. NICS is the Federal Bureau of Investigation’s system used to determine, within 30 seconds, whether prospective buyers are eligible to buy firearms. The federal mental health prohibitor category consists of individuals who have been involuntarily committed to a mental institution or adjudicated as a mental defective. These individuals are prohibited from shipping, transporting, receiving, or possessing any firearm or ammunition.
A Narrowly Tailored Permission
The initial January 2013 proposed changes caused concern because of potential conflicts with state laws. However, this modification is drafted with tight definitions of the types of covered entities that are allowed to disclose PHI, entities to which the disclosures may be made, types of individuals whose information may be disclosed, and the information that may be disclosed.
Not all covered entities may disclose PHI for NICS purposes. The only covered entities that are permitted to disclose the information are state agencies or other entities that are or contain entities designated by a state to report or collect information for reporting on behalf of a state to NICS or courts, boards, commissions, or other lawful authorities that make the commitment or adjudication that causes an individual to be federally prohibited under 18 U.S.C. § 922(g)(4). PHI can only be disclosed to NICS, or to an entity designated by a state to report, or to one which collects information for the purposes of reporting, on behalf of a state, to NICS. HHS expressly notes that there is no permission or exception created for uses or disclosures to law enforcement through the modification.
Though there is no list of permitted data elements, HHS specifies that the disclosure is restricted to limited demographic and certain other information needed for NICS purposes. Information that is considered within the modification includes only name, date of birth, sex, a code or notation indicating the individual is subject to the federal mental health prohibitor, a code or notation representing the reporting agency, and a code identifying the agency record supporting the prohibition. Some additional fields, such as height, weight, Social Security number, age, place of birth, state of residence, eye color, hair color, and race may be provided to help eliminate incorrect matches. HHS prohibits any disclosure of diagnostic or clinical information, from medical records or other sources, and any mental health information beyond the indication that the individual is subject to the federal mental health prohibitor.
Consequences for Covered Entities
The modification to HIPAA is not a significant disruption for the majority of covered entities, as noted by HHS, as most covered entities do not act as NICS data repositories or adjudicate or commit individuals. If a covered entity is not the type of covered entity specifically listed in the HIPAA modification, there is no permissible disclosure of mental health information for the purposes of reporting to NICS.
For those covered entities that fall within the definition provided in the modification, it is important to follow the exact data element suggestions provided by HHS. Further, even though the modification is narrowly tailored, HIPAA does not pre-empt more stringent state laws. It is still vital that covered entities check state law provisions pertinent to mental health information uses and disclosures prior to disclosing information to NICS under HIPAA.
For further information regarding this modification, please see our prior postings below.
