Obama Administration expands the HIPAA Privacy Rule, Adding Permitted Disclosure

On January 6, 2016, in a dramatic national press conference, President Obama announced several actions by his administration to address gun violence in the US. One of these actions is a long-planned modification to the Health Insurance Portability and Accountability Act (HIPAA). The same day, the Department of Health and Human Services (HHS) published a Final Rule adding a permitted disclosure to the HIPAA Privacy Rule, which expressly permits a limited number of Covered Entities to disclose protected health information (PHI) of certain individuals to the National Instant Criminal Background Check System (NICS). The modification is aimed at removing one barrier to expanding the quality of the information in NICS, which is used by firearms vendors to disqualify potential purchasers who are federally barred from owning firearms. 

The change in the Privacy Rule is an addition to a list of exceptions that allow Covered Entities to disclose PHI without authorization from patients. It applies to a narrow subset of individuals who are prohibited by Federal law from having firearms under the "Federal mental health prohibitor," established under the Gun Control Act of 1968. This includes individuals who have been (1) involuntarily committed to a mental institution; (2) found incompetent to stand trial or not guilty by reason of insanity; or (3) otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease.

The final rule is quite narrow, and does not apply to the vast majority of Covered Entities. Only Covered Entities with lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes, may disclose PHI on these individuals to NICS. The scope of information that may be disclosed is equally narrow, and includes only basic demographic information needed to identify applicable individuals. In fact, the rule specifically prohibits the disclosure of diagnostic or clinical information, from medical records or other sources, and any mental health information beyond the indication that the individual is subject to the Federal mental health prohibitor.

It is important to note that this change in law does not REQUIRE these Covered Entities to report this information to NICS. Federal law does not require State agencies to report to the NICS the identities of individuals who are prohibited from purchasing firearms under either Federal or State prohibitors, and not all States report complete information to the NICS or the databases checked by it. Contact an attorney to determine whether this reporting applies to you and/or may be required by your State's laws.