As we previously reported, President Obama has made it a priority to improve the National Instant Criminal Background Check System (“NICS”).  Last week, more than eight months after the issuance of a advance notice of proposed rulemaking, the Office for Civil Rights issued a Notice of Proposed Rulemaking (the “Proposed Rule”) that seeks to strengthen the NCIS by amending the HIPAA Privacy Rule to specifically allow reporting to the NICS. 

The NCIS Index, administered by the FBI, is the federal database listing individuals who are prohibited by federal statute from possessing or receiving a firearm.  One category of individuals so prohibited are persons who have been involuntarily committed to a mental institution, found incompetent to stand trial, or have been adjudicated  to be a danger to themselves or others as a result of mental illness (often referred to as the “mental health prohibitor”).  There have been reports that states are not reporting information about individuals subject to the mental health prohibitor and that the HIPAA Privacy Rule may be one barrier to such reporting.   

The Proposed Rule would revise 42 C.F.R. § 164.512 of the Privacy Rule to add a new category of permitted disclosures for NCIS reporting purposes.  The proposed new paragraph (k)(7) of 42 C.F.R. § 164.512 is narrowly tailored and would apply only to covered entities that are designated by the state to report or collect information for the NICS and to boards or commissions that make commitment determinations.  The Proposed Rule would also only allow reporting directly to NCIS or to a state agency responsible for reporting to NCIS.  Finally, the Proposed Rule would allow only the disclosure of the minimum amount of information needed for reporting to NICS and would prohibit the disclosure of diagnostic or clinical information about the individual.

Unlike the current exception in the Privacy Rule permitting the use or disclosure of protected health information (PHI) about victims of abuse, neglect, or domestic violence (45 C.F.R. § 164.512(c)), the NCIS exception would not require informing the individual that a disclosure has been made. 

The Proposed Rule would permit, but not require, covered entities to report to the NICS.  It would not affect the currently existing permitted uses and disclosures of PHI under the Privacy Rule.

Comments on the Proposed Rule can be submitted to http://www.regulations.gov/ and will be due 60 days following the January 7, 2014 publication of the notice in the Federal Register, or approximately early March 2014.