On January 4, 2016, the U.S. Department of Health and Human Services (HHS) issued a final rule that modifies the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. This modification expressly allows certain covered entities to disclose to the National Instant Criminal Background Check System (NICS), without consent, the identities of individuals who, for mental health reasons, are prohibited by Federal law from possessing a firearm. The final rule coincides with several executive actions to address gun control that were announced by the Obama Administration on January 5, 2016.

Current Federal law prohibits certain categories of individuals from receiving or possessing firearms. The Federal “mental health prohibitor” applies to those individuals who have (1) been involuntarily committed to a mental health institution; (2) found incompetent to stand trial or not guilty by reason of insanity; or (3) otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or unable to manage their own affairs, as a result of marked subnormal intelligence, or mental illness, incompetency, condition or disease.  According to HHS, the final rule serves an important public safety interest by potentially increasing reporting by states that historically have not disclosed Federal mental health prohibitor data to NICS due to existing Privacy Rule disclosure restrictions.

The final rule adopts the proposed amendment to the Privacy Rule that HHS previously announced in an April 23, 2013 Advance Notice of Proposed Rulemaking and seeks to balance public safety concerns with individuals’ privacy rights by:

• Limiting who has permission to disclose: Only those covered entities that order involuntary commitments or make other adjudications that subject individuals to the Federal mental health prohibitor, or that serve as repositories of such information for NICS reporting purposes, may disclose to the NICS that an individual is subject to the Federal mental health prohibitor.
• Limiting who may receive the information: Covered entities with permission may disclose the required protected health information (PHI) only to the NICS or to designated NICS repositories. The information may not be disclosed for other law enforcement purposes unless another provision in the Privacy Rule permits such disclosure.
•  Limiting what information is disclosed: Disclosures are limited to demographic or other information necessary for NICS reporting, e.g., name, date of birth, sex, the submitting entity, the agency record supporting the prohibition, and the code(s) indicating the applicable prohibitor. Covered entities may not share diagnoses or treatment records, nor may they share that an individual is subject to a State law mental health prohibitor.

While it is important to understand what the final rule does, it may be more important for healthcare providers to know what the final rule does not do:

• It does not affect most healthcare providers who treat individuals with mental illness – the final rule applies only to those covered entities with authority to make the adjudications or commitment decisions that subject an individual to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes.
• It does not create a requirement to disclose – it only creates permission to disclose.
• It does not create permission for most treating providers to report information about their patients to the NICS.
• It does not change who is subject to the Federal mental health prohibitor.

The final rule will be effective February 5, 2016. For more information, covered entities may read the complete final rule here.