On Jan. 6, the Department of Health and Human Services (HHS) issued a final rule adding a new exception to the HIPAA regulations. The rule allows certain covered entities to report limited information about individuals to the National Instant Criminal Background Check System (NICS), the database maintained by the FBI for conducting background checks, to determine whether an individual is prohibited from possessing firearms.

Federal law prohibits licensed dealers from transferring firearms to individuals who are not allowed to possess firearms due to a number of specific reasons known as “prohibitors.” One such prohibitor is the mental health prohibitor, which applies to the following:

• Individuals who have been involuntarily committed to a mental institution for reasons such as mental illness or drug use;
• Individuals who have been found incompetent to stand trial or not guilty by reason of insanity; and
• Individuals who have been otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others, or unable to manage their own affairs as a result of marked subnormal intelligence, or mental illness, incompetence, condition or disease.

The new HIPAA exception only applies to the following covered entities:

• A state agency or other entity designated by the state to report to the NICS;
• A state agency or other entity designated by the state which collects information to report to the NICS; and
• A court, board, commission or other lawful authority that makes the commitment or adjudication that causes an individual to be subject to the mental health prohibitor.

The new HIPAA exception allows the covered entities specified above to report to NICS limited demographic information about the individual and the fact that the individual is subject to the mental health prohibitor. The exception does not allow the reporting of diagnosis or other clinical information.

Like many exceptions under HIPAA, the new rule permits, but does not require, such a report. The final rule does not change any of the HIPAA preemption provisions, which means that if a state law prohibits such disclosures, there is no conflict in laws since the covered entity could comply with both HIPAA and the state law by not reporting the information to the NICS. Conversely, if a state law requires such reporting, the covered entity can comply with both the state law and HIPAA.

While some states have laws with mental health prohibitors that are different than the federal law, the HIPAA exception only applies to the federal mental health prohibitor.

Because this law is narrowly drawn, it will not apply to the vast majority of institutional and individual providers who provide mental health treatment to individuals.