The Department of Health and Human Services (HHS) has published its final rule for amending the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The Privacy Rule was modified to inform doctors and other covered entities that it is not a violation to report certain types of data to the National Instant Criminal Background Check System (NICS).
The newly amended Privacy Rule is scheduled to take effect February 5, 2016. Under the new rule, covered entities will be allowed to disclose certain information pertaining to patients' mental health to the NICS. The Federal Bureau of Investigation (FBI) will then cross-reference background checks for firearms with this database, determining which applicants should be approved and which ones should be rejected.
Only patients who are classified as a “federal mental health prohibitor” may have their data transmitted to the NICS via the newly amended Privacy Rule. This includes patients who were involuntarily committed to a mental institution; patients found incompetent to stand trial; patients who were determined by the court or other lawful authority to be a danger to themselves or others.
Furthermore, the information which covered entities are allowed to disclose to the NICS is limited. This includes patients' names, birth dates and gender. It does not give covered entities the authority to disclose clinical health information.
It's important to note, however, that 30 states have already passed laws that not only allow, but require, covered entities to disclose this information to the NICS. The new Privacy Rule simply expands this tactic so that covered entities in the remaining states may disclose the information.
In a blog post announcing the news, the OCR Director explained that the information covered entities are allowed to disclose is “minimum.”
“The information that can be disclosed is the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others, or to lack the mental capacity to manage their own affairs," wrote Office for Civil Rights (OCR) Director Jocelyn Samuels.
The new rule only permits disclosure either directly to the NICS or to an official entity designated by the state in which the covered entity practices. This means you cannot disclose patient information to law enforcement personnel; it must be disclosed directly to the NICS or a state-designated entity.