Back to the Network Blog

Gun Control: Changes to the HIPAA Privacy Rule for Disclosures to the National Instant Criminal Background Check System

posted on Thu, Jan 21 2016 9:01 am by Jennifer Bernstein

In the midst of several high profile mass shootings in the United States by individuals with mental illness, the National Instant Criminal Background Check System (NICS) and states’ participation in the system has been placed under a microscope. In particular, the 2007 Virginia Tech shootings raised questions about how the gunman was able to obtain firearms given his history of mental illness. Many changes in law and regulation since the 2007 shooting reflect a greater push to increase the number of records in the NICS database in order to combat gun violence and mass shooting incidents.

The NICS Improvement Amendments Act of 2007 was enacted to, among other things, provide incentives for states to make more records available for use during firearm-related background checks. But a 2012 U.S. Government Accountability Office (GOA) Report found that between 2004 and 2011, over half of all states had submitted less than 100 mental health records of individuals prohibited from owning a firearm under federal and state law to NICS. Most mental health records in NICS were attributable to the efforts of only 12 states. The GOA report found that technological, legal, and other challenges limited the states’ ability to share mental health records.

One of those legal challenges was the belief that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule restricted states and HIPAA covered entities from sharing mental health records with NICS. On January 16, 2013, the Obama Administration released Now Is the Time, a comprehensive plan to reduce gun violence. The plan includes Gun Violence Reduction Executive Actions that outline how the Administration would implement the plan. One of the Executive Actions states, “Address unnecessary legal barriers, particularly relating to the Health Insurance Portability and Accountability Act, that may prevent states from making information available to the background check system.”

In response to the comprehensive plan, on January 7, 2014, the U.S. Department of Health and Human Services (HHS) released a notice of proposed rulemaking and elicited public comments on a rule related to the HIPAA Privacy Rule and NICS.HHS reviewed public comments submitted in response to the proposed rulemaking and on January 4, 2016, HHS issued a final rule to modify HIPAA.

The final rule expressly permits certain HIPAA covered entities to disclose to NICS the identities of individuals who are disqualified from possessing a firearm based on federally prohibited categories or state law for certain mental health reasons. Persons subject to the Federal mental health "prohibitor" established under the Gun Control Act of 1968 include:

  1. Individuals who have been involuntarily committed to a mental institution;
  2. Individuals found incompetent to stand trial or not guilty by reason of insanity; or
  3. Individuals that otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition or disease.

The new modification is carefully and narrowly tailored to preserve the patient-provider relationship, protect privacy and ensure that individuals are not discouraged from seeking voluntary treatment. As such, the information disclosed to NICS must adhere to the minimum necessary rule. This means that only information necessary to satisfy the particular purpose of identifying individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs should be disclosed. Thus diagnostic, clinical, or other mental health treatment information is excluded from disclosure to NICS under the new modification.

Finally, under the modification, not all covered entities have the authority to disclose information to the NICS. This rule applies only to a small subset of HIPAA covered entities that either make the mental health determinations that disqualify individuals from having a firearm or are designated by their States to report information to NICS. It is important to note that this may include state or local public health departments or state mental health authorities. It is important to speak with your public health attorney to understand your organization's responsibilities under this new rule, which takes effect February 5 of this year.

This blog post was developed by Jennifer Bernstein, Senior Attorney, at the Network for Public Health Law – Mid-States region at the University of Michigan School of Public Health.

The Network for Public Health Law provides information and technical assistance on issues related to public health. The legal information and assistance provided in this post does not constitute legal advice or legal representation. For legal advice, readers should consult a lawyer in their state. 

Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not necessarily represent the views of, and should not be attributed to, RWJF.

blog comments powered by Disqus