On Tuesday, January 6, 2016, the U.S. Department of Health and Human Services (the Department) issued a final rule, effective February 5, modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit – but not require – certain HIPAA covered entities to disclose to the National Instant Criminal Background System (NICS) certain personal health information (PHI) related to individuals who are subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. Among the persons subject to the Federal mental health prohibitor established under the Gun Control Act of 1968 and implementing regulations issued by the U.S. Department of Justice are individuals who have been: (a) involuntarily committed to a mental institution; (b) found incompetent to stand trial or not guilty by reason of insanity; or (c) otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease. Fearing that States might not be fully reporting relevant information to the NCIS because of actual or perceived barriers related to HIPAA, the Department enacted the revision to the Privacy Rule by adding a new category of permitted disclosures to 45 CFR 164.512(k). The new rule is narrowly tailored to appropriately balance public safety goals with important patient privacy interests to ensure that individuals are not discouraged from seeking voluntary treatment for mental health issues.

The new category of permitted disclosures is very limited in scope, applying only to a specific subset of HIPAA covered entities who, under narrow circumstances, may provide discrete personal health information to the NICS. Specifically, the new rule is limited in three ways. First, it applies only to covered entities involved in ordering involuntary commitments or other adjudications that make an individual subject to the Federal mental health prohibitor. It does not apply to disclosures about individuals who are subject to state-only mental health prohibitors. Moreover, the Federal mental health prohibitor does not apply to individuals in a psychiatric facility for observation or who have been admitted voluntarily. Thus, the new rule does not create a permission for most treating providers to disclose PHI about their own patients for these purposes. The Department recognized that encouraging voluntary treatment is critical to ensuring positive outcomes for individuals’ health as well as the public’s safety. The new rule was designed to balance that goal with public safety interests served by the NICS.

Second, the new rule limits the permitted recipients of the disclosure. The PHI may be disclosed only directly to the NICS or to an entity designated by the state as a repository of data for purposes of reporting to the NICS. This limit was placed in order to prevent disclosure to, for example, law enforcement agencies that do not operate as repositories of data for purposes of reporting to the NICS.

Third, the new category of permitted disclosures limits the information to be disclosed to only what is needed for purposes of reporting to the NICS. Although the regulatory text does not specify which data elements may be disclosed, the preamble clarifies that the following is generally considered the information needed for purposes of reporting to the NICS: (1) the name of the individual; (2) date of birth; (3) sex; (4) a code or notation indicating that the individual is subject to the Federal mental health prohibitor; (5) a code or notation representing the reporting entity; and (6) a code identifying the agency record supporting the prohibition. The regulation text expressly provides that the modification does not permit the use or disclosure of clinical or diagnostic information for NICS reporting purposes. Additionally, the following information may be required in certain instances to exclude false matches: Social Security number, state of residence, height, weight, place of birth, eye color, hair color, and race.

In sum, it is important for providers and HIPAA-covered entities to understand that the new rule does not create a broad permission for treating providers to report information about their patients to the NICS. Rather, the rule is narrowly tailored to permit limited disclosures of select information about individuals who are subject to the Federal mental health prohibitor, which applies only where an individual has been involuntarily committed or otherwise has received a relevant adjudication from a court, board, commission, or other lawful authority. Moreover, the rule does not create a requirement to disclose; it only gives permission for disclosure. Although the new rule is permissive rather than mandatory, the Department hopes that providing express permission by regulation will remove any HIPAA-related barriers to reporting that may exist and thereby improve reporting rates in states that historically have reported little or no Federal mental health prohibitor data to the NICS.