In response to the Obama Administration’s executive actions to reduce gun violence, on January 4, 2016, the U.S. Department of Health and Human Services’ Office of Civil Rights (OCR) issued a final rule, which modifies the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule that previously prevented states from making information available to the National Instant Criminal Background Check System (NICS). Effective February 5, 2015, certain HIPAA covered entities are now expressly permitted to disclose to the NICS the identities of individuals who are subject to the “mental health prohibitor” that disqualifies them from shipping, transporting, possessing or receiving a firearm.

It is important to note that the final rule (1) does not apply to most health care providers, (2) allows only limited demographic and certain other information needed for the purposes of reporting to the NICS and (3) specifically prohibits the disclosure of diagnostic or clinical information from medical records or other sources.

The NICS is a computerized system maintained by the Federal Bureau of Investigation (FBI) to conduct background checks on individuals who may be disqualified from receiving firearms based on federally prohibited categories or state law. The “mental health prohibitor” category precludes individuals from shipping, transporting, possessing or receiving firearms who: (1) are or have been involuntarily committed to a mental institution for reasons such as mental illness or drug use; (2) are found to be incompetent to stand trial or not guilty by reason of insanity; or (3) are otherwise determined by a court or other lawful authority to pose a danger to themselves or others or unable to manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition or disease.

There are exceptions to the HIPAA Privacy Rule that permit disclosure of certain information concerning mental health status to the NICS. However, OCR acknowledged that many covered entities were not reporting this information to the NICS and concerns were raised that the HIPAA Privacy Rule might be preventing certain states from reporting the relevant information. As a result, OCR amended the HIPAA regulations to add a provision at 45 C.F.R. section 164.512(k)(7) to expressly permit certain covered entities to disclose the identity of an individual who is subject to the federal mental health prohibitor, subject to the following conditions:

1. The covered entity must be a state agency or other entity that is or contains an entity that is (a) an entity designated by the state to report, or which collects information for purposes or reporting, on behalf of the state, to the NICS; or (b) a court, board, commission, or other lawful authority that makes the commitment or adjudication that causes an individual to become subject to the mental health prohibitor; and

2. The covered entity discloses the information only to (a) the NICS; or (b) an entity designated by the state to report, or which collects information for purposes of reporting, on behalf of the state, to the NICS; and

3. The covered entity (a) discloses only limited demographic and certain other information needed for purposes of reporting to the NICS; and (b) does not disclose diagnostic or clinical information for such purposes.