Submission of Mental Health Records to
NICS and the HIPAA Privacy Rule
Edward C. Liu, Coordinator
Legislative Attorney
Erin Bagalman
Analyst in Health Policy
Vivian S. Chu
Legislative Attorney
C. Stephen Redhead
Specialist in Health Policy
April 15, 2013
Congressional Research Service
7-5700
www.crs.gov
R43040
CRS Report for Congress
Pr
epared for Members and Committees of Congress
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
Summary
Questions about the scope and efficacy of the background checks required during certain firearm
purchases have gained prominence following recent mass shootings. These background checks
are intended to identify whether potential purchasers are prohibited from purchasing or
possessing firearms due to one or more “prohibiting factors,” such as a prior felony conviction or
a prior involuntary commitment for mental health reasons. Operationally, such background
checks primarily use information contained within the National Instant Criminal Background
Check System (NICS) and a particular focus of the debate in Congress has been whether federal
privacy standards promulgated under the Health Insurance Portability and Accountability Act
(i.e., the HIPAA privacy rule) or state privacy laws are an obstacle to the submission of mental
health records to NICS.
Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally
defective or who have been committed to a mental institution are prohibited from possessing,
shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental
illness nor treatment for a mental illness is sufficient to qualify a person as “adjudicated as a
mental defective.” Rather, an individual’s “adjudication as a mental defective” relies upon a
determination or decision by a court, board, commission, or other lawful authority. The definition
of “committed to a mental institution” may apply only to inpatient settings. At least one federal
court has held that the Supreme Court’s recent recognition of an individual right to possess a
firearm suggests that some emergency hospitalization or commitment procedures, that may not
have as many procedural safeguards as formal commitment, should not be included within the
meaning of “involuntary commitment” for purposes of the GCA. In 2007, Congress passed the
NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make
additional grants to states to improve electronic access to records as well as to incentivize states
to turn over records of persons who would be prohibited from possessing or receiving firearms.
In 2012, the Government Accountability Office (GAO) reported that a variety of technological,
coordination, and legal (i.e., privacy) challenges limit the states’ ability to report mental health
records to NICS. The HIPAA privacy rule, which applies to most health care providers, regulates
the use or disclosure of protected health information. On February 14, 2013, HHS announced that
it will seek to amend the HIPAA privacy rule to remove any potential impediments to state
reporting of mental health records to NICS. The privacy rule is most relevant as a potential
obstacle where information used to generate mental health records on individuals prohibited from
gun possession under the GCA is held by health care providers in states that do not expressly
require disclosure of such records to NICS. Courts and health care providers that generate such
prohibiting mental health records may also be subject to state health privacy laws that may be
more restrictive than the HIPAA privacy rule.
Congressional Research Service
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
Contents
Prohibiting Mental Health Factors Under the Gun Control Act of 1968 ......................................... 1
Adjudication as a Mental Defective .......................................................................................... 2
Commitment to a Mental Institution ......................................................................................... 3
Emergency Admission or Hospitalization ........................................................................... 4
The National Instant Criminal Background Check System (NICS) ................................................ 5
NICS Improvement Amendments Act of 2007 .......................................................................... 6
State Reporting of Prohibiting Mental Health Records to NICS ............................................... 7
Impact of the HIPAA Privacy Rule on NICS Reporting ........................................................... 8
HIPAA Privacy Rule Overview ........................................................................................... 8
Interaction of HIPAA Privacy Rule and State Privacy Laws ............................................ 10
Figures
Figure 1. State Laws That Require or Authorize the Reporting of Mental Health Records
to NICS ....................................................................................................................................... 13
Contacts
Author Contact Information........................................................................................................... 14
Acknowledgments ......................................................................................................................... 14
Congressional Research Service
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
uestions about the scope and efficacy of the background checks required during certain
firearm purchases have gained prominence following recent mass shootings.1 These
Qbackground checks are intended to identify whether potential purchasers are prohibited
from purchasing or possessing firearms due to one or more “prohibiting factors,” such as a prior
felony conviction or a prior involuntary commitment for mental health reasons. If disqualifying
information surfaces during the background check, the transfer is not completed. Operationally,
such background checks primarily use information contained within the National Instant Criminal
Background Check System (NICS), maintained by the Federal Bureau of Investigation (FBI), and
a particular focus of the debate in Congress has been whether the HIPAA privacy rule or state
privacy laws are an obstacle to the population of NICS with prohibiting mental health records.
This report provides an overview of prohibiting mental health records under current federal law,
and distinguishes those records from other types of mental health information that would not
disqualify an individual from purchasing a firearm. This report also provides an overview of
NICS and discusses potential issues arising from state and federal medical privacy laws that may
impede states’ efforts to submit prohibiting mental health records to NICS.2
Prohibiting Mental Health Factors Under the Gun
Control Act of 1968
Under the Gun Control Act of 1968 (GCA)3, as amended, certain categories of persons are
prohibited from possessing, shipping, transporting, and receiving firearms and ammunition.4
These nine categories of persons who are prohibited include:
1. Persons convicted of a crime punishable by a term of imprisonment exceeding
one year;
2. Fugitives from justice;
3. Individuals who are unlawful users or addicts of any controlled substance;
4. Persons adjudicated to be mentally defective, or who have been committed to a
mental institution;
5. Aliens illegally or unlawfully in the United States, as well as those who have
been admitted pursuant to a nonimmigrant visa;
6. Individuals who have been discharged dishonorably from the Armed Forces;
7. Persons who have renounced United States citizenship;
8. Individuals subject to a pertinent court order; and
9. Persons who have been convicted of a misdemeanor domestic violence offense.5
1 See CRS Report R43004, Public Mass Shootings in the United States: Selected Implications for Federal Public
Health and Safety Policy, coordinated by Jerome P. Bjelopera.
2 This report is limited to a discussion of currently applicable law, and does not discuss proposals to revise the types of
mental health records that would disqualify an individual from purchasing or possessing a firearm.
3 P.L. 90-618 (1968).
4 18 U.S.C. §922(g). Individuals who are under indictment for a felony are also prohibited from receiving or
transporting firearms or ammunition. 18 U.S.C. §922(n).
Congressional Research Service
1
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
Of these categories, only the fourth is primarily concerned with mental health issues.6 The
sections below provide a more detailed discussion of the scope of this category’s two sub-
components: adjudication as a mental defective and commitment to a mental institution.
Adjudication as a Mental Defective
As noted above, the GCA prohibits individuals “adjudicated as a mental defective” from
possessing, receiving, transferring, or transporting a firearm. The term has been further defined
by federal regulation as:
(a) A determination by a court, board, commission, or other lawful authority that a person, as
a result of marked subnormal intelligence, or mental illness, incompetency, condition, or
disease:
(1) Is a danger to himself or to others; or
(2) Lacks the capacity to manage his own affairs.
(b) The term shall include—(1) a finding of insanity by a court in a criminal case, and (2)
those persons found incompetent to stand trial or found not guilty by lack of mental
responsibility [under the Uniform Code of Military Justice].7
It is important to note that despite references to “mental illness” in the definition, neither a
diagnosis of a mental illness nor treatment for a mental illness appears, by itself, to qualify a
person as “adjudicated as a mental defective.”8 Thus, while a health care provider may provide to
a third party (i.e., a court, board, commission, or other lawful authority) an assessment of an
individual’s mental health for purposes of adjudication, the provision of mental health treatment
alone is not considered a determination for purposes of being considered “adjudicated as a mental
defective,” nor is treatment necessary for the determination. Rather, an individual’s “adjudication
as a mental defective” relies upon a determination or decision by “a court, board, commission, or
other lawful authority.”
Physicians and other health care providers generally do not fall within this list of authorized
decision-makers, with the exception of certain instances under state law where a health care
provider may be authorized by statute to admit a patient to involuntary psychiatric treatment. A
(...continued)
5 18 U.S.C. §922(g).
6 In the 113th Congress, Senator Lindsey Graham introduced S. 480, the NICS Reporting Improvement Act of 2013,
that would revise 18 U.S.C. 922(g)(4) to replace references to “mental defective” with “mentally incompetent” and
“mental institution” with “psychiatric hospital.” The bill would also expressly define the type of hearings that qualify
for purposes of being “adjudicated mentally incompetent or ... committed to a psychiatric hospital.” A full discussion of
the effects of these amendments is beyond the scope of this report.
7 27 C.F.R. §478.11. It is likely that any record that fits the definition under (b) would be related to criminal record
histories that are more easily accessible by the states. However, it has been reported that a majority of states have low
submission rates for the types of records that fall under subsection (a). MAIG Report.
8 See, e.g., U.S. v. Vertz, 102 F. Supp.2d 787, 788 (W.D. Mich. 2000), aff’d on other grounds, 40 Fed. Appx. 69 (6th
Cir. 2002) (“Despite the extensive evidence of medical illness, for purposes of criminal liability under the federal
firearms statute, it is not sufficient that the defendant has been diagnosed as mentally ill by his treating physicians. The
statute specifically requires that the individual have been adjudicated as a mental defective or committed to a mental
institution.”).
Congressional Research Service
2
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
health care provider, under these circumstances, could potentially be considered an “other lawful
authority,” who makes a determination which falls within the federal statute criminalizing
firearms possession by an individual who is “adjudicated as a mental defective” or “committed to
a mental institution.” See discussion below at “Emergency Admission or Hospitalization.”
Whether the definition of “adjudicated as a mental defective” includes individuals who have been
assigned fiduciaries to manage monetary benefits received from a federal agency is subject to
interpretation, as illustrated by the different policies of the Department of Veterans Affairs (VA)
and the Social Security Administration (SSA). In particular, the definition includes those who are
determined “as a result of … condition …[to] lack[] the capacity to manage his own affairs.”
Accordingly, VA policy requires that an individual who receives VA monetary benefits and who
“lacks the mental capacity to manage his or her own financial affairs regarding disbursement of
funds without limitation, and is either rated incompetent by VA or adjudged to be under legal
disability by a court of competent jurisdiction” be assigned a fiduciary (who manages the money
disbursed by VA) and be reported to NICS.9 SSA does not appear to have a comparable policy for
representative payees (i.e., individuals who have been assigned a fiduciary to manage their SSA
monetary benefits). In a letter to the Vice President, the National Council on Disability (NCD)
urges him to
avoid any proposal to link the Social Security Administration’s database of representative
payees with the FBI’s National Instant Criminal Background Check System (NICS).
Whatever merits such a proposal might seem to present, such benefits are outweighed by the
inaccurate and discriminatory inference that would result: equating the need for assistance in
managing one’s finances with a presumption of incapacity in other areas of life.... NCD
recommends you ensure that the selection of a representative payee continues to have no
implication on other areas of rights beyond financial decision-making.10
Commitment to a Mental Institution
The term “committed to a mental institution” is defined through regulation as
A formal commitment of a person to a mental institution by a court, board, commission, or
other lawful authority. The term includes a commitment to a mental institution involuntarily.
The term includes commitment for mental defectiveness or mental illness. It also includes
commitments for other reasons, such as for drug use. The term does not include a person in a
mental institution for observation or a voluntary admission to a mental institution.11
9 DEPARTMENT OF VETERANS AFFAIRS, “Privacy Act of 1974; System of Records,” 76 Fed. Reg. 14119, 14122 (Mar.
15, 2011). Pursuant to NIAA, the VA provides notice to veterans who may fall under the firearms disqualification, and
the agency has established an administrative procedure that provides veterans with the ability to request relief from
their firearms disability. See MR21-1MR VA Manual, Part III, Subpart v, Chapter 9 Section B, available at,
http://www.benefits.va.gov/WARMS/M21_1MR1.asp; DEPARTMENT OF VETERANS AFFAIRS, Fast Letter to Regional
Offices Re: Processing Requests for Relief from the Reporting Requirements of the National Instant Criminal
Background Check System (NICS), available at https://docs.google.com/document/d/
11ETxpq4dJiiJYcSD8KYXtVTIOhKSqg5hAilxjNQ43OY/edit?pli=1.
10 Letter from Jonathan M. Young, Chairman, National Council on Disability, to Joseph Robinette Biden, Jr., Vice
President, United States of America, January 11, 2013, http://www.ncd.gov/publications/2013/Jan142013. Legislation
to prevent these types of VA records from being transferred to NICS has been introduced in the 113th Congress. See,
e.g., H.R. 577 and S. 572, Veterans Second Amendment Protection Act (113th Cong., 1st sess.). In other words, these
bills would allow veterans who have been appointed a fiduciary to keep their firearms.
11 27 C.F.R. §478.11.
Congressional Research Service
3
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
The use of the term “institution” suggests that the definition of “committed to a mental
institution” may apply only to inpatient settings. The question of whether the definition applies to
outpatient commitment was raised following the Virginia Tech shooting in 2007 (see textbox). In
either case, the definition explicitly excludes “voluntary admission,” and so would not apply to
individuals voluntarily seeking treatment for mental illness in any setting.12
Example: Virginia Tech Shooting of April
Emergency Admission or
16, 2007
Hospitalization
On April 16, 2007, a student at Virginia Tech, Seung Hui
Cho, shot and killed 32 students and faculty and
As noted above, state law may authorize a
wounded 17 more before killing himself. More than a
health care provider to admit a patient to
year prior to the shootings, a series of events led to a
involuntary psychiatric treatment, particularly
commitment hearing for involuntary admission on
in emergency situations for a brief duration. In
December 14, 2005. At the hearing the special justice
ruled that Cho “presents an imminent danger to himself
these limited instances, it is possible that a
as a result of mental illness” and ordered outpatient
health care provider would be considered an
treatment. Fol owing the shooting, a review determined
“other lawful authority,” and the patient
that Cho had been ineligible to purchase a gun under
receiving involuntary psychiatric treatment
federal law because he “had been judged to be a danger
to himself and ordered to outpatient treatment.” The
would fall within the definition of “committed
review further determined that “Virginia law did not
to a mental institution” for purposes of the
clearly require that persons such as Cho—who had been
GCA. For example, in United States v. Waters,
ordered into out-patient treatment but not committed
the U.S. Court of Appeals for the Second
to an institution—be reported to the [NICS] database.”
Circuit held that the involuntary
On April 30, 2007, the Governor of Virginia issued
Executive Order 50, requiring that any involuntary
hospitalization of an alleged mentally ill
treatment order, whether inpatient or outpatient, be
individual pursuant to New York state law14
reported to the NICS. In 2008, the state legislature
met the definition of an “involuntary
codified this requirement.13
commitment” for purposes of the GCA, even
Sources: Virginia Tech Review Panel, Mass Shootings at
though the hospitalization was ordered by the
Virginia Tech: April 16, 2007, August 2007,
director of a hospital upon the certification of
http://www.governor.virginia.gov/tempcontent/
two physicians.15
techPanelReport-docs/FullReport.pdf and Virginia
Executive Order No. 50, (April 30, 2007),
http://www.lva.virginia.gov/public/EO/
However, at least one federal court has held
eo50%282007%29.pdf.
that the Supreme Court’s recent recognition of
12 The Judge David L. Bazelon Center for Mental Health Law, an advocacy organization that opposes involuntary
outpatient commitment, has compiled a summary of state statutes allowing involuntary outpatient commitments; the
summary includes a comparison with inpatient commitment statutes. See http://www.bazelon.org/LinkClick.aspx?
fileticket=CBmFgyA4i-w%3D&tabid=324. For more about involuntary commitment, see National Conference of State
Legislatures, Screening and Entry into Mental Health Treatment: Balancing Help for the Individual and the
Community, http://www.ncsl.org/issues-research/health/screening-and-entry-into-mental-health-treatment.aspx or
National Conference of State Legislatures, Mental Health: What are the issues surrounding involuntary treatment?,
http://www.ncsl.org/issues-research/health/mental-health-faq.aspx#issues.
13 VA. CODE ANN. §37.2-819.
14 N.Y. MENTAL HYG. LAW §9.27.
15 U.S. v. Waters, 23 F.3d 29 (2d Cir. 1994). See also U.S. v. Vertz, 102 F. Supp. 2d at 787 (“prior hospitalization,
which was supported by a second psychiatrist’s certification, qualified as a commitment to a mental institution”). But
see U.S. v. Giardina, 861 F.2d 1334 (5th Cir. 1988) (temporary, emergency detentions for treatment of mental disorders
or difficulties, which did not lead to formal commitments under state law, did not constitute the commitment
envisioned by the GCA).
Congressional Research Service
4
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
an individual right to possess a firearm in District of Columbia v. Heller,16 suggests that some
emergency hospitalization or commitment procedures should not be included within the meaning
of “involuntary commitment” for purposes of the GCA. In United States v. Rehlander, the U.S.
Court of Appeals for the First Circuit (First Circuit) considered a Maine law which provides
authority for the brief, but involuntary, detention of individuals in mental institutions on the basis
of a medical provider’s examination and certification that the individual is mentally ill and poses
a likelihood of serious harm.17 In pre-Heller cases, the First Circuit had held that this emergency
hospitalization under Maine law qualified as “involuntary commitment” under the GCA.18
However, because the procedures under state law were ex parte19 and did not have additional
procedural safeguards, the court held that construing the emergency hospitalization procedures to
qualify as “involuntary commitment” under the GCA post-Heller would risk depriving
individuals of their right to bear arms without sufficient due process. Therefore, the appellate
court overturned its earlier decisions and held that such emergency hospitalizations were not
“involuntary commitments.”
The National Instant Criminal Background Check
System (NICS)
Under the Brady Handgun Violence Prevention Act of 1993 (Brady Act), the Attorney General
was required to establish a computerized system to facilitate background checks on individuals
seeking to acquire firearms from federally licensed firearms dealers.20 The National Instant
Criminal Background Check System (NICS) was activated in 1998 and is administered by the
Federal Bureau of Investigation (FBI). Through NICS, federal firearms licensees submit
background checks on prospective transferees to the FBI, which queries other databases –
including the National Crime Information Center (NCIC), the Interstate Identification Index (III),
and the NICS index – to determine if the transferees are disqualified from receiving firearms.21
According to the FBI, records in the NICS Index are voluntarily provided by local, state, tribal,
and federal agencies, and it “contains [disqualifying records] that may not be available in the
NCIC or the III of persons prohibited from receiving firearms under federal or state law.”22
The Brady Act authorized the Attorney General to “secure directly from any [federal] department
or agency of the United States” information on persons for whom receipt of a firearm would
16 554 U.S. 570 (2008).
17 U.S. v. Rehlander, 666 F.3d 45 (1st Cir. 2012).
18 U.S. v. Chamberlain, 159 F.3d 656 (1st Cir. 1998) and U.S. v. Holt, 464 F.3d 101 (1st Cir. 2006).
19 The term ex parte refers to a legal proceeding brought by one person in the absence of and without representation or
notification of other parties.
20 P.L. 103-159, §103 (1994) [hereinafter Brady Act].
21 The NCIC is a database of documented criminal justice information that is made available to law enforcement and
authorized agencies, with the goal of assisting law enforcement in apprehending fugitives, finding missing persons,
locating stolen property, and further protecting law enforcement personnel and the public. The III, or “Triple I,” is a
computerized criminal history index pointer system that the FBI maintains so that records on persons arrested and
convicted of felonies and serious misdemeanors at either the federal or state level can be shared nationally. See Federal
Bureau of Investigation, National Instant Criminal Background Check System 2011 Operations Report, available at
http://www.fbi.gov/about-us/cjis/nics/reports/2011-operations-report/operations-report-2011.
22 See Federal Bureau of Investigation, Criminal Justice Information Services, National Instant Criminal Background
Check System Index Brochure, available at http://www.fbi.gov/about-us/cjis/nics/general-information/nics-index.
Congressional Research Service
5
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
violate federal or state law. The act does not mandate that federal agencies disclose these records,
rather it mandates that “upon request of the Attorney General, the head of such department or
agency shall furnish such information to the system.”23 With respect to states, which are not
required to submit records to NICS, the Brady Act provided grants to “improv[e] State record
systems and the sharing ... of the records ... required by the Attorney General under [the Brady
Act].”24 However, it did not mandate that states turn over any specific records, even upon request.
NICS Improvement Amendments Act of 2007
In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes
the Attorney General to make additional grants to states to improve electronic access to records as
well as to incentivize states to turn over records of persons who would be prohibited from
possessing or receiving firearms under 18 U.S.C. §922(g) or (n), with an emphasis on providing
accurate records relating to those who are prohibited under (g)(4) (“adjudicated as a mental
defective”) or (g)(9) (“convicted in any court of a misdemeanor crime of domestic violence”).25
Moreover, it mandates that the Department of Homeland Security make available to the Attorney
General any records that are related to being a prohibited possessor under federal law.26
For federal agencies, NIAA clarifies the standard for adjudication and commitments related to
mental health. It provides that no department may provide any such record if the record has been
set aside or the individual has been released from treatment; the person has been found by the
court or board to no longer suffer from the condition that was the basis of the adjudication or
commitment; or the adjudication or commitment is based solely on a medical finding of
disability, without opportunity to be heard by a court or board.27 It also requires agencies that do
make such determinations to establish a program that permits a person to apply for relief from the
disabilities imposed under §922(g)(4).28
With respect to states, NIAA allows a state to be eligible for a two year waiver of the matching
requirement in the National Criminal History Improvements Grant program, established under the
Brady Act, if the state provides at least 90% of the records relevant to determining whether a
person is disqualified from possessing a firearm under federal or applicable state law.29 To be
eligible for such a waiver, other requirements include providing updates to NICS regarding any
record that should be modified or removed from the system, and more detailed information
regarding those who are convicted of a misdemeanor crime of domestic violence or adjudicated
as a mental defective under federal law. NIAA also provides the Attorney General discretion to
award additional grants for purposes of assisting states with upgrading information identification
technologies for firearms disability determinations as long as they have implemented a relief from
23 Brady Act, §103(e).
24 Brady Act, §106. This program is known as the National Criminal History Improvement Program (NCHIP). This
program is administered by the Department of Justice Bureau of Justice Statistics (BJS). See http://bjs.gov/index.cfm?
ty=tp&tid=47.
25 P.L. 110-180, §§102-104, 301 (2007) [hereinafter NIAA].
26 NIAA, §101(b).
27 NIAA, §101(c)(1).
28 NIAA, §101(c)(2).
29 NIAA, §102.
Congressional Research Service
6
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
disabilities program that meets certain requirements.30 This grant program is known as the NICS
Act Record Improvement Program (NARIP).31 If a state has received a waiver or an additional
grant under NIAA, the act imposes penalties for non-compliance.32 The act mandates reductions
in Department of Justice Byrne Justice Assistance Grant funds and permits the Attorney General
to make discretionary reduction of these funds if a state does not comply with eligibility
requirements of NIAA.33
State Reporting of Prohibiting Mental Health Records to NICS
In 2012, five years after the NIAA was enacted, the Government Accountability Office (GAO)
released a report that examined states’ progress in reporting mental health records to the NICS
databases.34 It is important to keep in mind that the “mental health records” reported to NICS
include only individual identifiers and no actual medical information. However, as discussed in
more detail below, the preparation and submission of such records by health departments and
health care facilities involves the use of patient information and thus is subject to federal and, in
many instances, state health privacy laws.
GAO found that the total number of mental health records that states made available to NICS
databases increased approximately nine-fold from about 126,000 to 1.2 million between 2004 and
2011. However, this increase largely reflected the efforts of 12 states. According to GAO, almost
half of all states increased the number of mental health records they reported by fewer than 100
over the same time period.
Both DOJ and state officials told GAO that a variety of technological, coordination, and legal
(i.e., privacy) challenges limit the states’ ability to report mental health records. Technological
challenges include updating aging computer systems and integrating existing record systems.
Several states reported using their NARIP grant funding to automate the collection and
transmission of records. DOJ officials further emphasized that the technological challenges
are particularly salient for mental health records because these records originate from
numerous sources within the state—such as courts, private hospitals, and state offices of
mental health—and are not typically captured by any single state agency. For example,
records that involve involuntary commitments to a mental institution typically originate in
entities located throughout a state and outside the scope of law enforcement, and therefore a
state may lack processes to automatically make these records available to the FBI.35
The fact that mental health records often originate in hospitals and health departments, which are
typically not connected to law enforcement agencies that make the majority of records available
to NICS, presents challenges in getting all the relevant entities to collaborate. As an example,
30 NIAA, §§103, 105.
31 This program is also administered by the Department of Justice’s BJS. See http://bjs.gov/index.cfm?ty=tp&tid=49.
32 NIAA, §104.
33 For more information on the Byrne Justice Assistance Grant program, see CRS Report RS22416, Edward Byrne
Memorial Justice Assistance Grant (JAG) Program, by Nathan James.
34 U.S. Government Accountability Office, Gun Control: Sharing Promising Practices and Assessing Incentives Could
Better Position Justice to Assist States in Providing Records for Background Checks, GAO-12-684, July 16, 2012,
http://www.gao.gov/assets/600/592452.pdf.
35 Id. at 11-12.
Congressional Research Service
7
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
GAO cited an April 2012 report by the state of Illinois, Office of the Auditor General, which
found that for 2010, approximately 114,000 mental health records were maintained in nursing
homes, private hospitals, state mental health facilities, and circuit courts. However, only about
5,000 records were reported to NICS because of a lack of coordination and other challenges.
Citing privacy concerns, officials in three of the six states reviewed by GAO reported that the
absence of explicit statutory authority to share mental health records was an impediment to NICS
reporting.36
In a November 2011 report on NICS reporting, Mayors Against Illegal Guns (MAIG) drew
conclusions that are broadly similar to those of GAO.37 MAIG interviewed officials in all 50
states and the District of Columbia and found that state reporting of mental health records to
NICS is impeded by a complex set of obstacles including technological and logistical problems,
privacy concerns, insufficient funding, and a lack of leadership. The MAIG report noted that even
among states with strong reporting programs, there is considerable variation in the number and
type of mental health records submitted to NICS. It found that states that have significantly
improved their reporting in the past few years share a number of common attributes including the
ability to commit funding to their efforts and effective political leadership. MAIG also found a
strong association between reporting levels and enactment of state laws that require or authorize
agencies to report their records. According to MAIG, nine of the 10 states that had the greatest
increase in records submitted to NICS between September 2010 and October 2011 have laws or
policies requiring or permitting sharing mental health records with NICS.
Impact of the HIPAA Privacy Rule on NICS Reporting
Officials in approximately half of the states told MAIG that state health privacy laws as well as
the privacy rule promulgated by the Department of Health and Human Services (HHS) under the
Health Insurance Portability and Accountability Act (HIPAA) were potential obstacles to NICS
reporting. In some states, officials cited privacy concerns as the primary impediment to reporting.
HIPAA Privacy Rule Overview
The HIPAA privacy rule established a set of federal standards to help safeguard the privacy of
personal health information.38 Those standards include certain individual privacy rights, such as
the right of access to one’s health information and the right to request corrections, as well as
limitations on the use or disclosure of personal health information. The rule applies to (1) health
plans;39 (2) health care clearinghouses;40 and (3) health care providers who transmit health
36 Id. at 12.
37 Mayors Against Illegal Guns, Fatal Gaps: How Missing Records in the Federal Background Check System Put Guns
in the Hand of Killers, November 2011, http://www.mayorsagainstillegalguns.org/downloads/pdf/
maig_mimeo_revb.pdf. MAIG is a coalition of mayors from more than 900 cities and towns across the United States,
co-chaired by New York City’s Mayor Michael Bloomberg and Boston’s Mayor Thomas Marino. The coalition shares
best practices, develops policies, and supports legislation at all levels of government to reduce the distribution of, and
access to, illegal and military-style firearms in U.S. cities and towns.
38 The HIPAA privacy rule, and accompanying general administrative and enforcement requirements, are codified at 45
C.F.R. Part 160 and Part 164, Subparts A and E.
39 Health plans include any individual or group plan that provides or pays for medical care. The term encompasses both
private and government plans. Health maintenance organizations (HMOs) and high-risk pools are specifically covered.
Most employee health benefit plans are covered. See 45 C.F.R. §160.103.
Congressional Research Service
8
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
information electronically in connection with one of the HIPAA-covered financial or
administrative transactions.41 These persons and organizations are collectively referred to as
covered entities.
The privacy rule covers protected health information (PHI) in any form that is created or received
by a covered entity. PHI is defined as individually identifiable information that relates to the past,
present, or future physical or mental health of an individual; the provision of health care to an
individual; or the past, present, or future payment for the provision of health care to an
individual.42
In the broadest sense, the privacy rule prohibits a covered entity from using or disclosing PHI
except as expressly permitted or required by the rule.43 As briefly outlined below, the rule
describes a range of circumstances under which it is permissible to use or disclose PHI. In all
such instances covered entities can choose whether to use or disclose PHI based on their
professional ethics and best judgment. The rule specifies only two circumstances when a covered
entity is required to disclose PHI. A covered entity must disclose PHI to: (1) the individual who is
the subject of the information, (i.e., patient right of access), and (2) HHS officials investigating
potential violations of the rule.44
Generally, covered entities may use or disclose PHI for the purposes of treatment, payment, and
other routine health care operations with few restrictions.45 Under other specific circumstances
(e.g., disclosures to family members and friends), the rule requires covered entities to give the
individual the opportunity to object to the disclosure (i.e., opt out).46 Importantly, the rule also
permits the use or disclosure of PHI for several specified “national priority purposes” that are not
directly connected to the treatment of the individual.47 These uses and disclosures are permitted
by the rule in recognition of the important uses made of health information outside of the health
care context. They include the following uses and disclosures:
(...continued)
40 Health care clearinghouse is a term of art under the privacy rule. It refers to an entity (e.g., claims processor) that
translates health information received from other entities either to or from the standard format that is required for
electronic transactions. See 45 C.F.R. §160.103.
41 Health care providers include any person (e.g., physician, nurse, pharmacist) or entity (e.g., hospital, clinic) that
furnishes, bills, or is paid for health care in the normal course of business. To be a covered entity, a provider must
conduct one or more of the HIPAA-specified transactions, such as verifying insurance coverage or filing a health claim,
by transmitting health information electronically in a standard format (i.e., the provider must include certain
information and use specified codes for diagnosis and treatment) required by HIPAA. Providers that rely on third-party
billing services to conduct such electronic transactions on their behalf are also covered under the privacy rule.
Providers that operate solely on a paper basis and do not submit insurance claims electronically are not subject to the
rule. See 45 C.F.R. §160.103.
42 45 C.F.R. §160.103.
43 45 C.F.R. §164.502(a)
44 Id.
45 45 C.F.R. §164.506.
46 45 C.F.R. §164.510.
47 45 C.F.R. §164.512.
Congressional Research Service
9
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
• Required by law. Covered entities may use or disclose PHI to the extent that
such use or disclosure is required by (federal or state) law and the disclosure
complies with and is limited to the relevant requirements of such law.48
• Law enforcement purposes. Covered entities may disclose PHI to law
enforcement officials for certain specified law enforcement purposes.49
• Averting a serious threat to health or safety. Consistent with applicable law
and standards of ethical conduct, a health care provider may use or disclose PHI
if the provider in good faith believes the use or disclosure is necessary to
prevent or lessen a serious and imminent threat to the health or safety of a
person or the public.50
• Specialized government functions. Covered entities may use or disclose PHI
for several specified essential government functions.51
For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered
entities must obtain a patient’s written authorization.
As discussed above, prohibiting mental health records under the GCA are typically generated by
the courts that adjudicate persons as mentally defective, and by the courts and health care
providers that involuntarily commit individuals to mental health facilities. While courts are not
covered entities and are not subject to the HIPAA privacy rule, health care providers such as
hospitals and state health departments are covered by the privacy rule and, therefore, may not use
or disclose PHI for the purpose of NICS reporting without express permission under the rule. As
described below, it is necessary to look to the states to determine whether such permission exists.
Interaction of HIPAA Privacy Rule and State Privacy Laws
Although the HIPAA privacy rule provides a federal floor with respect to the uses and disclosures
of PHI, the overall scope of the privacy rule may be modulated by state law. If a state requires
covered entities to disclose prohibiting mental health records to NICS, the HIPAA privacy rule
does not prohibit that disclosure.52 Therefore, the privacy rule is most relevant as a potential
obstacle where prohibiting mental health records are held by covered entities in a state that does
not require disclosure of such records to NICS. This would be the case even if the state expressly
allowed, but did not explicitly require, disclosure of prohibiting mental health records to NICS
because merely permissive state laws are insufficient to exempt disclosure from the HIPAA
privacy rule.
It should also be noted that both types of entities—courts and health care providers—may also be
subject to state health privacy laws that may be more protective of individually identifiable health
information than the HIPAA privacy rule and other state-level requirements and policies. State
48 45 C.F.R. §164.512(a)
49 45 C.F.R. §164.512(f)
50 45 C.F.R. §164.512(j). On January 15, 2013, the HHS Office for Civil Rights issued a letter to health care providers
in which he reminded them of the privacy rule’s “duty to warn” provision, which permits the disclosure of patient
information to avert threats to health or safety. See http://www.hhs.gov/ocr/office/lettertonationhcp.pdf.
51 45 C.F.R. §164.512(k)
52 Id.
Congressional Research Service
10
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
laws that are more protective of privacy include those that prohibit or restrict a use or disclosure
that would otherwise be permitted under the privacy rule, and those that provide individuals with
greater access to their own health information. This final section of the report provides a basic
overview of the different types of state privacy laws that may impact the sharing of prohibiting
mental health records with NICS.
Figure 1 summarizes state laws that address the reporting of mental health records for use in
firearm purchaser background checks. Twenty-three states have NICS reporting mandates.53
These laws require courts and, in some instances, mental health facilities to report (1) to NICS
directly, or (2) to a state agency that in turn reports to NICS. As noted above, the HIPAA privacy
rule would not bar the mandated disclosures in these states. Note that in one of the states—
Delaware—reporting by mental health facilities takes the place of court reporting (see Figure 1).
Seven states have laws that authorize, but do not require, reporting to NICS.54 In these states that
do not mandate reporting, HIPAA-covered entities do not appear to have permission under the
privacy rule to use or disclose PHI for the purpose of preparing and reporting mental health
records to NICS. Absent a state reporting mandate, it is not clear that there are any other
provisions in the privacy rule that provide such permission.
None of the three other national priority purposes in the privacy rule discussed earlier (under
“HIPAA Privacy Rule Overview”) address reporting to federal databases for the purposes of
future background checks. The disclosure of PHI for law enforcement purposes has to be (1) as
required by law; (2) pursuant to various specified judicial and administrative processes and
procedures such as court orders, subpoenas, and summonses; or (3) in response to one of several
other specified law enforcement activities.55 The privacy rule’s provisions authorizing the use or
disclosure of PHI for various specialized government functions list a number of specific
activities, none of which includes reporting information to the NICS databases.56 Finally, the
rule’s provisions that permit the use and disclosure of PHI to avert a serious threat to health or
safety focus on two types of situations, neither of which appears to include NICS reporting. The
first permits the disclosure of PHI to a person or persons reasonably able to prevent or lessen a
serious and imminent threat to the health or safety of a person or the public. The second concerns
alerting law enforcement authorities about an individual involved in a violent crime or who has
escaped from prison or lawful custody.57
An additional eight states collect mental health records pursuant to state law, but these laws do
not address NICS reporting.58 Again, without a NICS reporting mandate, HIPAA-covered entities
do not appear to have permission under the privacy rule to use PHI for the purpose of reporting
53 AL, CO, CT, DE, GA, ID, IL, IN, IA, KS, KY, ME, MN, NV, NC, ND, NY, OR, TN, TX, WA, WI, and VA; see
Figure 1.
54 AZ, FL, MO, NE, NJ, PA, and WV; see Figure 1. In some cases, whether state law requires disclosure to NICS may
be ambiguous. For example, New Jersey state law currently prohibits disclosure of commitment records disclosure
except as needed to comply with the data reporting provisions of the NIAA or the Brady Act, but it is not clear that
either of those laws impose any such requirements. The state is currently considering Assembly Bill No. 3717, which
would amend state law to explicitly require reporting of institutionalized persons to NICS. http://www.njleg.state.nj.us/
2012/Bills/A4000/3717_I1.HTM
55 45 C.F.R. §164.512(k)
56 45 C.F.R. §164.512(k)
57 45 C.F.R. §164.512(j)
58 AR, CA, HI, MA, MD, MI, OH and UT; see Figure 1.
Congressional Research Service
11
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
mental health records to the federal databases. These states include California, which despite the
absence of a NICS reporting mandate, has one of the best NICS reporting rates for mental health
records. In part this is because of a state law that requires mental health facilities to report mental
health records to the California Department of Justice (DOJ). That requirement effectively
removes HIPAA as an impediment to such reporting by HIPAA-covered entities. While state law
is silent on DOJ reporting to NICS, California has developed a reporting infrastructure and
entered into an agreement with the federal government to report mental health records to NICS.
Finally, 13 states are without laws requiring or authorizing the collection or reporting of mental
health records for use in firearm purchaser background checks, either at the state or federal level.
Once again, HIPAA-covered entities in these states that are in possession of disqualifying mental
health records appear to lack the authority under the privacy rule to report such information to
NICS.
On February 14, 2013, in response to the President’s instruction to address any potential legal
barriers to NICS reporting, HHS announced that it will seek to amend the HIPAA privacy rule to
remove any potential impediments to state reporting of mental health records to NICS.59 The
HHS Office for Civil Rights (OCR), which administers and enforces the privacy rule, plans to
issue an advance notice of proposed rulemaking (ANPRM) to solicit public comment on this
issue prior to proposing any changes to the privacy rule.60
While a detailed examination of state-level activities is beyond the scope of this report, it should
be emphasized that many states collect and use mental health records (and other relevant
information) pursuant to state law or policies for their own background checks of firearm
purchases. Some states are “Point-Of-Contact” (POC) states, meaning that the state agency is
responsible for electronically accessing NICS and for implementing and maintaining their own
Brady NICS program.61 Often times a POC state will run the background check against the state’s
own records, some of which may not be in NICS. In some instances, background checks
conducted by POCs may be more stringent than non-POC states because they have access to
more access to disqualifying records. In addition, these states could be more thorough in their
background checks because statutory prohibitions on firearm possession in these states sometimes
exceed the federal prohibitions under the Brady Act. However, unlike the nationwide NICS
background checks, state-level checks do not capture prohibited individuals who cross state lines
to purchase long guns.
59 HIPAA provides the HHS Secretary with authority to modify the privacy standards, as determined appropriate, but
not more frequently than once every 12 months. Any addition or modification to a standard must “be completed in a
manner that minimizes the disruption and cost of compliance.” 42 U.S.C. §1320d–3(b)(1).
60 Kendra Casey Plank, “HIPAA Privacy Rule Changes Could Ease Sharing of Mental Health Records by States,”
Bloomberg BNA, Health Care Daily Report, February 15, 2013.
61 See Federal Bureau of Investigation, National Instant Criminal Background Check System- Participation Map,
available at, http://www.fbi.gov/about-us/cjis/nics/general-information/participation-map.
Congressional Research Service
12
Figure 1. State Laws That Require or Authorize the Reporting of Mental Health Records to NICS
As of January 1, 2013
Source: Prepared by CRS based on a review and analysis of laws in all 50 states and the District of Columbia that address the reporting of mental health records for use in
firearm purchaser background checks.
Note: CRS’s characterization of state laws is in broad agreement with a similar analysis by the Law Center to Prevent Gun Violence—a nonprofit organization that
advocates for gun-control legislation and provides legal expertise and information on U.S. gun laws—but with one key difference. Whereas the Law Center characterized
Virginia as a state that authorizes but does not require reporting to NICS, CRS concluded that Virginia’s law requires NICS reporting. The Law Center’s analysis is available
at http://smartgunlaws.org/mental-health-reporting-policy-summary/.
CRS-13
Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
Author Contact Information
Edward C. Liu, Coordinator
Vivian S. Chu
Legislative Attorney
Legislative Attorney
eliu@crs.loc.gov, 7-9166
vchu@crs.loc.gov, 7-4576
Erin Bagalman
C. Stephen Redhead
Analyst in Health Policy
Specialist in Health Policy
ebagalman@crs.loc.gov, 7-5345
credhead@crs.loc.gov, 7-2261
Acknowledgments
Alex C. Engler, Research Associate, prepared the figure in this report.
Congressional Research Service
14