On January 6, as part of President Obama’s executive action to combat gun violence, HHS promulgated a final regulation modifying the HIPAA Privacy Rule to allow certain HIPAA covered entities to disclose limited information to the National Instant Criminal Background Check System (NICS). We previously discussed the proposed rule here.
Background: The NICS, maintained by the Federal Bureau of Investigation (FBI), is the national database used to conduct background checks on persons who may be disqualified from receiving firearms based on federal or state law. Federal law identifies several categories of potential disqualifiers, known as “prohibitors” including a federal mental health prohibitor. By statute, the federal mental health prohibitor applies to individuals who have been committed to a mental institution or adjudicated as a mental defective. The Department of Justice has promulgated regulations that defines these categories to include the following individuals:
- individuals committed to a mental institution for reasons such as mental illness or drug use;
- individuals found incompetent to stand trial or not guilty by reason of insanity, or
- individuals who have been otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease.
However, there is currently no federal law that requires state agencies to report data to the NICS, including the identity of individuals who are subject to the mental health prohibitor. HHS believes that HIPAA poses a potential barrier to such reporting. Under current law, HIPAA only permits covered entities (e.g., state mental health agencies) to disclose such information to the NICS in limited circumstances: when the entity is a “hybrid” entity under HIPAA (and the Privacy Rule does not apply to these functions) or when state law otherwise requires disclosure, and thus disclosure is permitted under HIPAA’s “required by law” category.
Continue Reading HHS Issues Final Rule on HIPAA and Firearm Background Check Reporting