Responding to several executive actions taken by President Obama this year, the U.S. Department of Health and Human Services (HHS) issued a final rule[i] effectuating regulations that already existed around gun laws and reporting requirements. The regulations legally disqualify certain individuals with mental health histories from transporting, possessing or receiving a firearm.[ii]
Prior to the final rule, HIPAA lacked the practical means of identifying those individuals. Because of this, the firearm prohibition regulation essentially was toothless.[iii]
Under the final rule from HHS, providers and others are in fact permitted to disclose certain, otherwise private health information under HIPAA—without patient authorization—to the National Instant Criminal Background Check System (NICS) maintained by the Federal Bureau of Investigation. Prior to the final rule, the HIPAA Privacy Rule[iv] permitted disclosure of individually identifiable health information, or “protected health information” (PHI), without written authorization from the patient only in certain specific circumstances such as law enforcement situations or threat of immediate health or safety.
None of the HIPAA exceptions permitted disclosure to the NICS without authorization.
Many clinical providers err on the side of caution when considering disclosing PHI. Seeking authorization from patients for these purposes is often burdensome, harmful to the patient-provider relationship, ineffective and a deterrent to care.[v] Hence, the firearm prohibition law was largely without effect until the final rule was promulgated recently.[vi]
The final rule is intended to mitigate the perception to individuals seeking help for mental health issues that their private mental health information may be exposed to authorities or that seeking help might preclude them from exercising their Second Amendment rights to keep and bear arms. HHS acknowledged a careful balance was required between encouraging mental health treatment and patient privacy with public safety concerns. To achieve this balance—and incidentally, likely prevent Second Amendment constitutional challenges[vii]—HHS narrowly tailored the scope of the proposed rule. The department also intended to satisfy the compelling governmental interest for public safety.
For instance, according to HHS, the final rule will not apply to all entities that handle mental health patient information because that would have been too broad of a sweep. It could have resulted in discrimination against persons with mental health disorders that have no causal relation to an increased risk of violence or misusing a firearm.
HHS limited the type of qualifying entities permitted to disclose patient information without authorization to the background check system. Such qualified entities include, but are not limited to:
- Entities that are “designated by the state;”
- Repositories of information for NICS reporting purposes; or
- Certain entities with lawful authority that determine whether individuals are subject to the firearm prohibition or that collect information for the purpose of disclosing private health information to NICS.
These qualifying entities include state agencies, boards, commissions or other lawful authorities, state level repositories, hybrid entities (performing a combination of healthcare and adjudicative functions or NICS reporting), or any covered entity in a state that requires disclosure to NICS or its repositories.[viii] Some states have specifically designated repositories. Yet, repositories and qualified entities may be a broad term states use to identify any entity with information relevant for NICS purposes.
Under the final rule, each state may designate the types of entities that are permitted to disclose PHI to NICS without patient authorization. Due to the final rule and the HHS comments, there may be an increase in requests for PHI for NICS reporting purposes. This is especially likely in those states where a repository is “required” under state law to collect and report identities of those subject to the firearm prohibition.[ix]
A covered entity includes healthcare providers under HIPAA. Entities should be prepared to determine when disclosure without authorization is appropriate. The status or designation of the entity, however, is not the only consideration.
The final rule does not apply to individuals in a psychiatric facility who have been admitted voluntarily or for observation because it would otherwise discourage voluntary treatment. The final rule does apply to those committed involuntarily or involved in mental health “adjudications.”
The information to be disclosed for applicable circumstances will include only the name, gender, date of birth and identifying codes.
Politically, the perceived balance struck was appreciated by the American Medical Assn. and American Psychiatric Assn., as each entity expressed more support for the final rule than the prior proposed rules.[x] Yet, HHS may have left some room for states to broaden, or attempt to broaden, application of the final rule.