On January 6, 2015, the Office for Civil Rights (OCR) of the United States Department of Health and Human Services (HHS) issued a final rule modifying certain provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The modifications grant to certain covered entities a narrowly tailored permission to disclose limited information concerning individuals subject to the Federal mental health prohibitor, as needed for National Instant Criminal Background Check System (NICS) reporting.

The Brady Handgun Violence Prevention Act of 1993 (Brady Gun Law) identifies categories (i.e., “prohibitors”) of individuals who are prohibited from transporting, receiving, or possessing firearms. The Federal mental health prohibitor applies to individuals who have been involuntarily committed for reasons such as drug use; found incompetent to stand trial by reason of insanity; or are otherwise determined by a court or other lawful authority to be a danger to themselves or others.

Under the current HIPAA framework, avenues exist for HIPAA covered entities to report to NICS without obtaining an individual’s prior authorization. Despite these existing reporting avenues, concerns have been raised that the HIPAA Privacy Rule’s restrictions on covered entities disclosing protected health information (PHI) deter States from reporting essential mental health information to the NICS.

Accordingly, OCR finalizes its proposals first outlined in the January 7, 2014 Notice of Proposed Rulemaking (NPRM) to grant expanded, yet limited, permission to certain covered entities to report to the NICS information on individuals subject to the Federal mental health prohibitor, as follows:

  • The final rule narrowly defines which covered entities may use and disclose PHI for purposes of NICS reporting. Only those covered entities that function as repositories of information relevant to the Federal mental health prohibitor on behalf of a State, or covered entities that are responsible for ordering involuntary commitments or other adjudications that make a person subject to the Federal mental health prohibitor, may report to the NICS.

 

  • The final rule clearly delineates who may receive Federal mental health prohibitor information. The covered entity may disclose Federal mental health prohibitor information for NICS purposes, and only directly to the NICS or to an entity designated by a State as a repository of data for purposes of NICS reporting.

 

  • The final rule specifies what information about individuals may be used or disclosed. Only that information needed for NICS reporting (e.g., name, a code signifying that the individual is subject to the Federal mental health prohibitor, a code signifying the reporting entity) may be used or disclosed. Covered entities are prohibited from disclosing diagnostic, clinical, or other mental health information beyond this scope.

 

  • The final rule outlines the scope of the limited permission. Covered entities may only use and disclose the PHI of individuals subject to the Federal mental health prohibitor, and not the PHI of individuals who may be subject to other Federal prohibitors.

OCR intends the modifications outlined in the final rule to reduce any administrative burdens for criminal background check reporting, thus enabling more accurate and complete reporting to the NICS.

 

*Blake Walsh is admitted only in Tennessee. Her practice is supervised by principals of the firm admitted in the District of Columbia.