By Anna Kraus
On January 7, 2014, the Department of Health and Human Services (HHS) published a notice of proposed rulemaking to modify the HIPAA Privacy Rule to expressly allow certain disclosures to the National Instant Criminal Background Check System (NICS). As we previously reported, this was one of the executive actions in President Obama’s plan to reduce gun violence, which was released in January 2013.
Background: The NICS is the federal government’s system for conducting background checks on individuals who may be disqualified from receiving firearms under federal law (i.e., subject to a federal “mental health prohibitor”). This includes individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise determined, through a formal adjudication process, to have a severe mental condition that results in the individual’s presenting a danger to themselves or others or being incapable of managing their own affairs.
In April 2013, HHS released an advance notice of proposed rulemaking (ANPRM) requesting public comment on whether HIPAA creates a barrier to States reporting mental health prohibitor information to the NICS. (See our previous post on the ANRPM here.) After receiving over 2,050 comments in response to the ANPRM, HHS elected to proceed with creating an express permission in the HIPAA Privacy Rule for NICS reporting.
HHS’s Proposal: The proposed rule would modify 45 C.F.R. § 164.512(k)(7) to expressly permit the use or disclosure of protected health information for purposes of reporting to the NICS the identity of an individual subject to the mental health prohibitor.
The provision applies only to certain covered entities who are involved in adjudicatory or reporting functions related to the NICS. Specifically, it applies to a covered entity that is also:
- A State agency;
- An entity designated by the State to report, or collect information for reporting, on behalf of the State to the NICS; or
- A court, board, commission, or other lawful authority that makes the commitment or adjudication that causes a person to be subject to the mental health prohibitor.
HHS acknowledged that most of these entities will not be covered entities. In the interest of public safety, however, HHS wanted to ensure that any entities that are HIPAA covered entities can use or disclose protected health information for NICS reporting.
Importantly, the covered entity may disclose only “the limited demographic and certain other information needed for purposes of reporting to” the NICS. It may not disclose any “diagnostic or clinical information.” Proposed § 164.512(k)(7)(iii)(A). HHS is soliciting comment on whether disclosure of certain additional identifiers that are optional for NICS reporting, such as Social Security number and place of birth, should also be permitted.
The information may be disclosed to the NICS or to an entity designated by the State to report, or collect information for reporting, on behalf of the State to the NICS.
HHS is accepting comments on the proposed rule through March 10, 2014. In addition, HHS said it expects to issue further guidance to address misconceptions about HIPAA and the NICS and assist covered entities in complying with the rule.