On Jan. 6, 2016, to much national attention, the U.S. Department of Health and Human Services issued a Final Rule modifying certain portions of the HIPAA Privacy Rule, in particular those relating to the National Instant Criminal Background Check System (NICS). The modifications allow certain HIPAA “covered entities” to disclose limited information to NICS about individuals who, for specific mental health reasons, are prohibited from possessing or purchasing a firearm. The modifications took effect on Feb. 5, 2016.

The NICS is a national system maintained by the Federal Bureau of Investigation. It categorizes individuals who, by federal statute, are ineligible to purchase or possess a firearm. Under federal law, several categories (prohibitors) of individuals are ineligible to ship, transport, possess, or receive a firearm. In particular, the “mental health prohibitor” applies to any individual who has been:

• Involuntarily committed to a mental institution, for reasons such as mental illness or drug use;

• Found incompetent to stand trial or not guilty by reason of insanity; or 

• Determined by a court, board, commission or other lawful authority to be a danger to themselves or unable to manage their own affairs. This determination could be made as a result of marked subnormal intelligence, or mental illness, incompetency, condition or disease.

Whether or not a HIPAA covered entity is required to be responsible for NICS reporting is a matter of state law. In Wisconsin, the Wisconsin Department of Justice is solely responsible for reporting information to NICS regarding those individuals who have been involuntarily committed to a mental institution. Individual providers are not required (or permitted) to engage in such reporting.

As a result, the recent modifications to the Privacy Rule should have no impact on Wisconsin providers. Likewise, other related HIPAA provisions – such as those allowing providers to disclose limited patient information to appropriate law enforcement officers when there is reasonable cause to believe the patient poses a “serious and imminent” danger to himself/herself or the community – remain unaffected. However, given the current political climate and the media attention afforded to these recent changes, we suspect many patients will have questions and will want to be reassured that their sensitive mental health information remains protected in the same fashion as it was prior to the new rule.