Healthcare Law Blog

HHS Finalizes Exception to HIPAA Privacy Rule for Firearm Background Checks

In January of 2016, the Department of Health & Human Services (“HHS”) issued a final rule modifying the HIPAA Privacy Rule.[1] This modification allows certain covered entities to disclose the identities of certain individuals to the National Instant Criminal Background Check System (“NICS”), a database maintained by the FBI. The information disclosed by the entities would pertain to an individual’s mental health, preventing those subject to a federal “mental health prohibitor” from possessing or receiving a firearm. Such a disclosure naturally creates a tension in the patient-provider relationship, however, and critics contend it could potentially discourage mentally ill individuals from seeking treatment.

[1] 45 C.F.R. §164 (2016)

The federal mental health prohibitor is a disqualification from owning or possessing a firearm under the Gun Control Act of 1968.[1] It restricts those who have been involuntarily committed; found incompetent to stand trial or not guilty by reason of insanity; determined by a court, board, commission or other lawful authority to be a danger to themselves or others; or found to lack the mental capacity to contract or manage their own affairs.

In order to address concerns of patient privacy and a chilling effect on mental health services, HHS says it narrowly tailored this permissive disclosure by limiting which covered entities can disclose the information, to whom the protected health information (“PHI”) could be disclosed, and the scope of the information permissibly disclosed. Only covered entities that function as repositories of information relevant to the federal mental health prohibitor on behalf of a state or are responsible for adjudicating whether an individual should be involuntary committed or otherwise meet the federal mental health prohibitor are subject to the final rule – in other words, mostly state agencies. The information reported can only be disclosed to the NICS or to an entity designated by a state to collect the information for the purpose of reporting it to the NICS. Finally, the only information that may be disclosed is limited demographic information necessary for reporting to the NICS.

HHS is attempting to walk a fine line with this regulation, balancing the privacy rights of individuals seeking mental health treatment with a public safety mission to add a tool to the arsenal of those seeking to keep firearms out of the hands of the mentally ill. The basic premise of the regulation is that only individuals who have been involuntarily committed or received some other relevant adjudication that would serve to trigger the federal mental health prohibitor will be reported to the NICS. HHS declined to extend the rule to state mental health prohibitors in the interest of protecting privacy and limiting the scope of the regulation so as not to discourage individuals with mental illness from seeking treatment.

The final rule took effect on February 5, 2016, and there are two important items to consider: First, this regulation does not create a duty to report, but rather an exception to the HIPAA Privacy Rule so that the applicable covered entities may report this information. Second, it is important to note that HIPAA does not preempt more strident state privacy laws, so covered entities that are permitted to disclose information under the his HIPAA exception may still run afoul of state law.  For more information on this final regulation and how it may apply to your HIPAA covered entity, contact the attorneys at McBrayer.

Lisa English Hinkle is a Member of McBrayer law.  Ms. Hinkle concentrates her practice area in health care law and is located in the firm’s Lexington office.  She can be reached at lhinkle@mcbrayerfirm.com or at
(859) 231-8780, ext. 1256. 

Services may be performed by others.

This article does not constitute legal advice.

[1] 18 U.S.C. 44