Today, the US Department of Health & Human Services (HHS) publishes a proposed rule in the Federal Register by which it seeks to encourage reporting of persons with mental health bars to gun ownership/possession to the National Instant Criminal Background Check System (NICS). It proposes to do so by revising the HIPAA Privacy Rule to permit certain covered entities to report certain limited protected health information (PHI) to the NICS on such individuals.
As we previously blogged, with respect to the HHS Advanced Notice of Proposed Rulemaking (ANPRM) on the subject, the Brady Handgun Violence Prevention Act of 1993, Public Law 103-159, established the NICS, to prevent the transfer of firearms to individuals who are not allowed to possess them under the Gun Control Act of 1968. Among the categories of individuals who are prohibited from possessing firearms under the law pursuant to regulations promulgated by the Department of Justice (DOJ) are the “mental health prohibitors”: (1) involuntary commitment to a mental institution, (2) determination of incompetence to stand trial or a verdict of not guilty by reason of insanity, or (3) determinations/adjudication of a serious mental condition in which the individual presents a danger to themselves or others, or of being incapable of managing his or her own affairs. Although the judicial system, civil or criminal, makes the vast majority of such adjudications, HHS had postulated that there might be State agencies, boards, or commissions outside the court system that are involved in some involuntary commitments or mental health adjudications, or that are charged under state law with collecting and reporting to NICS the identities of individuals subject to mental health prohibitors – and that may be covered entities or constitute part of a covered entity.
Under the HIPAA Privacy Rule, covered entities – health plans, certain health care providers, and health care clearinghouses – may only use and disclose PHI pursuant to the written authorization of the individual or as expressly permitted or required under the Privacy Rule. HHS proposes to amend the Privacy Rule to add an additional permission – under the category of permitted uses and disclosures of PHI for “specialized government functions” – to permit certain State agencies or other entities that happen to be HIPAA covered entities to disclose limited demographic information (and certain other information needed for NICS reporting) on individuals who are subject to a federal mental health prohibitor to NICS. In order to be able to utilize the proposed permission, the covered entity would have to be a State agency or other entity that is designated by the State to report (or which collects information for reporting on behalf of the State) to the NICS, or a court, board, commission or other authority that makes commitments or adjudications that cause individuals to be subject to a mental health prohibitor. Such an entity would be permitted to disclose only limited demographic and certain other information needed for purposes of NICS reporting – and would not be permitted to disclose diagnostic or clinical information. And such disclosures would be permitted only to the NICS or to an entity designated by the State to report (or to collect information for purposes of reporting, on behalf of the State) to the NICS.
In proposing the amendment to the Privacy Rule, HHS notes a July 2012 GAO report that raised the possibility that States not reporting individuals subject to a mental health prohibitor to the NICS may experience challenges in reporting related to the Privacy Rule. HHS reports that it received more than 2,050 comments on the April 2013 ANPRM. Health agencies from three States submitted comments responding to specific ANPRM questions on NICS reporting. It does not appear that the agencies identified any HIPAA-related barriers to reporting to the NICS. However, two of the agencies – as well as several other commenters – agreed with HHS that an express HIPAA Privacy Rule permission would resolve any perceived ambiguity and would be generally beneficial. HHS acknowledges concerns about the NICS and the federal mental health prohibitor (relating to, among other things, due process for the individuals subject to reporting to the NICS under such prohibitor), as well as concerns that creating an express permission to disclose PHI for NICS purposes would harm the patient-provider relationship and discourage people from seeking mental health treatment. In response to these and other concerns, HHS emphasizes the narrowness of the proposed NICS permission, as outlined above. Nevertheless, HHS also seeks comments on whether the proposed permission should be broadened to permit reporting to NICS of individuals subject to State firearm prohibitions for mental health related reasons (but notes that such an expansion could increase the number of potential reporting entities to include more covered health care providers). HHS also seeks comment on the scope of PHI that should be permitted to be reported to the NICS.
Also in today’s Federal Register is a proposed rule issued by DOJ’s Bureau of Alcohol, Tobacco, Firearms and Explosives which would amend the definitions of the statutory terms “adjudicated as a mental defective” and “committed to a mental institution” – included in the regulations establishing the mental health prohibitors. The proposed amendment to the definition of the term “adjudicated as a mental defective” would clarify that such term includes persons found incompetent to stand trial or not guilty by reason of mental disease or defect, lack of mental responsibility or insanity, and/or found guilty but mentally ill. The proposal would clarify that federal, state, local, and military courts are the recognized lawful authorities to make such determinations in criminal cases, and seeks comment on whether the term should include adjudications that occurred when the individual was under 18 years of age. The proposed amendment to the term “committed to a mental institution” would clarify that it applies to involuntary inpatient or outpatient treatment, but would not apply to voluntary admission to a mental institution or temporary admission for observation.
The HHS proposed rule can be found at http://www.gpo.gov/fdsys/pkg/FR-2014-01-07/pdf/2014-00055.pdf; comments on the HHS proposed rule are due March 10, 2014. The DOJ proposed rule can be found at http://www.gpo.gov/fdsys/pkg/FR-2014-01-07/pdf/2014-00039.pdf; comments on the DOJ proposed rule are due April 7, 2014.
Written by Paula Stannard, Counsel, Privacy & Data Security, HIPAA Privacy & Security | Alston & Bird LLP