In the aftermath of such incidents as the shootings at Virginia Tech and Newtown, HHS published guidance to remind covered entities that health care providers may, consistent with the HIPAA Privacy Rule, disclose protected health information (PHI), including from mental health records, to warn that persons may be at risk of harm because of a patient, when the provider believes that such warning is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others.
Today, HHS seeks information on whether the Privacy Rule inhibits State covered entities from reporting mental health bars to gun ownership/possession to the National Instant Criminal Background Check System (NICS), in its advance notice of proposed rulemaking, “HIPAA Privacy and the National Instant Criminal Background Check System.”
The Brady Handgun Violence Prevention Act of 1993, Public Law 103-159, established the NICS, to prevent the transfer of firearms to individuals who are not allowed to possess them under the Gun Control Act of 1968. Among the categories of individuals who are prohibited from possessing firearms are the “mental health prohibitors”: (1) involuntary commitment to a mental institution, (2) determination of incompetence to stand trial or a verdict of not guilty by reason of insanity, or (3) determinations/adjudication of a serious mental condition in which the individual presents a danger to themselves or others, or of being incapable of managing his or her own affairs. HHS notes that most such determinations or adjudications are made by the justice system, whether civil or criminal and, thus, that the Privacy Rule would not affect the ability of the State court system to report this information to the NICS.
However, HHS postulates that, because of the variety of State laws, there may be State agencies, boards, or commissions outside the court system that are involved in some involuntary commitments or mental health adjudications, or that are charged under state law with collecting and reporting to NICS the identities of individuals subject to mental health prohibitors – and that may be covered entities or constitute part of a covered entity, although HHS lacks data on the matter. If such a situation exists, HHS notes that the records of such determinations would be subject to the Privacy Rule, but could be disclosed to NICS if (1) the State has a law requiring such reporting, or (2) the State agency, as a covered entity that has both covered (health care) and non-covered (non-health care) functions, elects hybrid status and, thus, is not be required to comply with the Privacy Rule with respect to its adjudicative or data repository functions. HHS notes, however, that many States are not reporting essential mental health prohibitor information to NICS – in a 2012 report, GAO noted that a number of States had contributed fewer than 10 reports on mental health prohibitors to the NICS – and that concerns have been raised that the Privacy Rule may prevent certain States from making reports to the NICS.
Accordingly, through a series of fifteen questions in the ANPRM, HHS seeks information on State participation in NICS reporting and related issues. HHS states that it is considering whether there should be an express HIPAA Privacy Rule permission for certain covered entities that order involuntary commitments, perform mental health adjudications, or are State-designated repositories for NICS reporting purposes to disclose limited information to the NICS about the individual (name, demographic information such as date of birth, reporting entity identifier, and relevant type of prohibitor). The responses to the ANPRM will inform its considerations.
The notice can be located at http://www.gpo.gov/fdsys/pkg/FR-2013-04-23/pdf/2013-09602.pdf. Comments on the ANPRM are due June 7, 2013.
Written by Paula Stannard, Counsel, Privacy & Data Security, HIPAA Privacy & Security | Alston & Bird LLP