Because we are expecting further clarification from HHS regarding this modification to the final rule to be released, this initial summary will only focus on facts taken from the final rule regarding "Entities Subject to the Rule." If you are a provider who has lawful authority to make the adjudications or commitment decisions, or an entity that serves as a repository you are subject to these changes.
Introduction
Last week, the Department of Health and Human Services (HHS) issued a final rule modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals who are subject to a Federal "mental health prohibitor" that disqualifies them from shipping, transporting, possessing, or receiving a firearm. The NICS is a national system maintained by the Federal Bureau of Investigation (FBI) to conduct background checks on persons who may be disqualified from receiving firearms based on Federally prohibited categories or State law.
Final Rule Facts
- The final rule is effective 30 days after the publication in the Federal Register.
This means the Final Rule will go into effect on or about February 6, 2016.
- Only covered entities with lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes, are permitted to disclose the information needed for these purposes.
The mental health prohibitor applies to the following:
Individuals who have been involuntarily committed to a mental institution for reasons such as mental illness or drug use;
- Individuals who have been found incompetent to stand trial or not guilty by reason of insanity; and
- Individuals who have been otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others, or unable to manage their own affairs as a result of marked subnormal intelligence, or mental illness, incompetence, condition or disease.
"We do not have sufficient data to determine the number of affected entities, but, based on the information available to us, we believe there would be very few.
- Covered entities in some states will not be affected because they currently do not face HIPAA barriers to reporting either because state law requires reporting or they have created hybrid entities.
- Importantly, the final rule permits only a small subset of HIPAA covered entities (i.e., those that perform the relevant mental health adjudications or repository functions) to use or disclose only limited, nonclinical information, for NICS purposes. This narrowly tailored permission permits these important uses or disclosures for public safety to occur while maintaining a separation between reporting functions and the mental health treatment a patient might be receiving.
If you are one of these very few entities (i.e., those that perform the relevant
mental health adjudications or repository functions):
- The small number of covered entities that are newly permitted to report to the NICS or a State repository under the rule can begin to report and may need to develop policies and procedures to do so
Covered entities this applies to include:
- A state agency or other entity designated by the state to report to the NICS;
- A state agency or other entity designated by the state which collects information to report to the NICS; and
- A court, board, commission or other lawful authority that makes the commitment or adjudication that causes an individual to be subject to the mental health prohibitor.
"We acknowledge that those entities that choose to begin reporting may wish to address this change in their HIPAA policies and procedures, as well as explain their procedures to office staff. However, the rule does not require any changes to existing HIPAA policies and procedures."
- With respect to training, the rule does not require workforce training beyond what is already required under the HIPAA Privacy and Security Rules.
- The rule does not permit the use or disclosure of any diagnostic or clinical information, or any other information about an individual that is not needed for NICS reporting purposes.
"We note that the Federal mental health prohibitor does not apply to all individuals with mental health conditions, but instead to a subset of individuals who have been involuntarily committed or determined by a lawful authority to be a danger to themselves or others, or unable to manage their own affairs, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease."
In conclusion
The Final Rule will go into effect the first week of February 2016. The Final Rule permits a limited number of HIPAA covered entities to report to the NICS the identities of individuals in a particular subcategory of persons who are currently prohibited by Federal law from possessing firearms. In other words, the Final Rule does not permit or require all treating providers to report information about their patients to the NICS. This Final Rule only applies to a select few covered entities that will need to report to the NICS or a State repository. Finally, if you are one of these select few entities you should only disclose select information subject to the Federal mental health prohibitor.
We expect HHS and States will provide additional clarification in the near future regarding this Final Rule. As always, we will keep you informed as we learn of these updates.
If you have any questions please do not hesitate to contact one of our professional consultants. Feel free to reach us by phone at 855-427-0427, or by email: [email protected].