As part of President Obama's continuing efforts to reduce gun violence, the Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) to remove unnecessary legal barriers under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule that may prevent states from reporting certain information to the National Instant Criminal Background Check System (NICS). The NICS helps to ensure that guns are not sold to those prohibited by law from having them; including felons, those convicted of domestic violence, and individuals involuntarily committed to a mental institution. To date, background checks have prevented over two million guns from falling into the wrong hands. However, the background check system is only as effective as the information that is available to it. According to a 2012 Government Accountability Office report, 17 states had submitted fewer than 10 records of individuals prohibited for mental health reasons. Additional records have been submitted over the past year as a result of federal and state actions, but there is more work to be done.
On April 23, 2013, the Department published an Advance Notice of Proposed Rulemaking requesting the public's input on how HIPAA may affect some states' ability to report to the NICS and ways in which these barriers could be addressed without discouraging individuals from seeking mental health services. Over 2,000 comments were received from individuals, state agencies, health care providers, professional organizations, consumer advocacy groups, and other stakeholders. The NPRM that was announced would modify the HIPAA Privacy Rule to permit certain HIPAA-covered entities to disclose to the NICS the identities of persons prohibited by federal law from possessing or receiving a firearm for reasons related to mental health.
The proposal would give states and certain covered entities added flexibility to ensure accurate but limited information is reported to the NICS, which would not include clinical, diagnostic, or other mental health information. Instead, certain covered entities would be permitted to disclose the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs. Importantly, the proposed permission focuses on those entities performing relevant commitments, adjudications, or data repository functions. The proposed modifications would merely permit, and not require, covered entities to report to the NICS. In addition, the proposed rule would not change the existing permitted uses and disclosures of protected health information under the HIPAA Privacy Rule.