Governance & Risk Management , HIPAA/HITECH , Privacy
HIPAA Privacy Rule Modified for Gun Background Checks
But Most Providers Won't Be Affected by the ChangeA modification to the HIPAA Privacy Rule designed to help identify those who are prohibited, for specific mental health reasons, from having a firearm will have little impact on most healthcare providers because it's so narrow in scope.
See Also: Using the Netskope HIPAA Mapping Guide
The change, which is slated to take effect next month, permits only a small subset of HIPAA covered entities to disclose to the National Instant Criminal Background Check System the identities of individuals who are already prohibited by federal law from having a firearm.
"Specifically, this final rule gives states improved flexibility to ensure accurate but limited information is reported to the NICS," said Jocelyn Samuels, director of the Department of Health and Human Services' Office for Civil Rights in an announcement about the change posted on the HHS website.
NICS is the federal database that stores information about individuals prohibited by law from possessing firearms. Those include felons, those convicted of domestic violence and individuals involuntarily committed to a mental institution or found to be a danger to themselves or others, or unable to manage their affairs due to a mental health condition, according to HHS.
The final rule modification is slated to be printed on Jan. 6 in the Federal Register. The rule change takes effect on Feb. 5.
Gun Control Measures
The modification to the HIPAA Privacy Rule comes as President Obama on Jan. 5 announced a series of executive actions in an effort to reduce gun violence. The actions are designed to make more gun sales subject to background checks and beef up enforcement of existing laws.
The FBI is overhauling its background check system to "make it more effective and efficient," the White House noted. Also, the Social Security Administration will begin the rulemaking process to include information in the background check system about beneficiaries who are prohibited from possessing a firearm for mental health reasons.
In explaining why the change to the HIPAA Privacy Rule was needed, the White House says: "Although states generally report criminal history information to NICS, many continue to report little information about individuals who are prohibited by federal law from possessing or receiving a gun for specific mental health reasons. Some state officials raised concerns about whether such reporting would be precluded by the HIPAA Privacy Rule."
Samuels said the rulemaking "makes clear that, under the Privacy Rule, certain covered entities are permitted to disclose limited information to the NICS. The information that can be disclosed is the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs."
The rule does not allow reporting of diagnostic, clinical, or other mental health treatment information, Samuels stressed.
"The new modification is carefully and narrowly tailored to preserve the patient-provider relationship and ensure that individuals are not discouraged from seeking voluntary treatment," she said. "This rule applies only to a small subset of HIPAA covered entities that either make the mental health determinations that disqualify individuals from having a firearm or are designated by their states to report this information to NICS. The rule does not apply to most treating providers."
Limited Impact
Because of its narrow scope, the change to the HIPAA Privacy Rule will have "very limited impact," says privacy attorney Adam Greene of the law firm Davis Wright Tremaine.
"Entities within the criminal justice system report to NICS when someone has been involuntary committed or received a certain adjudication related to mental health," he explains. "Healthcare providers, health plans and healthcare clearinghouses do not have reporting obligations under NICS. Rather, a small number of government covered entities may be part of agencies that make reports under NICS, and there was confusion related to whether HIPAA blocked those agencies from reporting to NICS. This rule clarifies that HIPAA does not interfere with those agencies reporting to NICS."
But one privacy advocate is concerned the modification could have negative consequences. "The effect will be to discourage even more people from seeking mental health treatment," says Deborah Peel, M.D. , a practicing psychoanalyst and founder and chair of the advocacy group Patient Privacy Rights. "The language HHS uses cannot easily be understood by the public - they have no idea who 'HIPAA covered entities' are for example.
"So many people are already wary of seeking treatment if their doctors or health professionals use electronic records, which they know are likely to be breached and will be widely disclosed," Peel says. "This rule will certainly discourage gun owners ... from seeking mental health treatment; all that they will hear is that mental health treatment can [land] them onto a list that goes to the government and might prevent them from buying firearms. The idea that a 'narrow subset' will be affected is simply too complex a message for the public to hear - all they will know is that people seeking mental health treatment will be reported to a federal database and limit their rights."
Lengthy Process
The rule change has been in the making for almost two years. On April 23, 2013, the Federal Register published OCR's advance notice of rulemaking, seeking public input on how HIPAA may prevent some states from reporting information to NICS and ways these barriers can be addressed without discouraging mental health patients from seeking treatment (see Amending HIPAA for Background Checks).
Among public comments submitted, some mental health provider organizations urged that the modification of the rule be limited.
"The patient-physician relationship is an integral part of mental illness treatment and should be protected," wrote a representative from the Psychiatric Society of Delaware. "Physicians and other treating providers should not be involved in NICS reporting, and the PSD agrees with narrowly defining the scope of HIPAA-covered entities with permission to report to NICS to only covered entities with lawful authority to make adjudication or commitment decisions that make individuals subject to the federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes."