Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Edward C. Liu, Coordinator Legislative Attorney Erin Bagalman Analyst in Health Policy Vivian S. Chu Legislative Attorney C. Stephen Redhead Specialist in Health Policy April 15, 2013 Congressional Research Service 7-5700 www.crs.gov R43040 CRS Report for Congress Prepared for Members and Committees of Congress Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Summary Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings. These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more “prohibiting factors,” such as a prior felony conviction or a prior involuntary commitment for mental health reasons. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS) and a particular focus of the debate in Congress has been whether federal privacy standards promulgated under the Health Insurance Portability and Accountability Act (i.e., the HIPAA privacy rule) or state privacy laws are an obstacle to the submission of mental health records to NICS. Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally defective or who have been committed to a mental institution are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental illness nor treatment for a mental illness is sufficient to qualify a person as “adjudicated as a mental defective.” Rather, an individual’s “adjudication as a mental defective” relies upon a determination or decision by a court, board, commission, or other lawful authority. The definition of “committed to a mental institution” may apply only to inpatient settings. At least one federal court has held that the Supreme Court’s recent recognition of an individual right to possess a firearm suggests that some emergency hospitalization or commitment procedures, that may not have as many procedural safeguards as formal commitment, should not be included within the meaning of “involuntary commitment” for purposes of the GCA. In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms. In 2012, the Government Accountability Office (GAO) reported that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states’ ability to report mental health records to NICS. The HIPAA privacy rule, which applies to most health care providers, regulates the use or disclosure of protected health information. On February 14, 2013, HHS announced that it will seek to amend the HIPAA privacy rule to remove any potential impediments to state reporting of mental health records to NICS. The privacy rule is most relevant as a potential obstacle where information used to generate mental health records on individuals prohibited from gun possession under the GCA is held by health care providers in states that do not expressly require disclosure of such records to NICS. Courts and health care providers that generate such prohibiting mental health records may also be subject to state health privacy laws that may be more restrictive than the HIPAA privacy rule. Congressional Research Service Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Contents Prohibiting Mental Health Factors Under the Gun Control Act of 1968 ......................................... 1 Adjudication as a Mental Defective .......................................................................................... 2 Commitment to a Mental Institution ......................................................................................... 3 Emergency Admission or Hospitalization ........................................................................... 4 The National Instant Criminal Background Check System (NICS) ................................................ 5 NICS Improvement Amendments Act of 2007.......................................................................... 6 State Reporting of Prohibiting Mental Health Records to NICS ............................................... 7 Impact of the HIPAA Privacy Rule on NICS Reporting ........................................................... 8 HIPAA Privacy Rule Overview ........................................................................................... 8 Interaction of HIPAA Privacy Rule and State Privacy Laws ............................................ 10 Figures Figure 1. State Laws That Require or Authorize the Reporting of Mental Health Records to NICS ....................................................................................................................................... 13 Contacts Author Contact Information........................................................................................................... 14 Acknowledgments ......................................................................................................................... 14 Congressional Research Service Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Q uestions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings.1 These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more “prohibiting factors,” such as a prior felony conviction or a prior involuntary commitment for mental health reasons. If disqualifying information surfaces during the background check, the transfer is not completed. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS), maintained by the Federal Bureau of Investigation (FBI), and a particular focus of the debate in Congress has been whether the HIPAA privacy rule or state privacy laws are an obstacle to the population of NICS with prohibiting mental health records. This report provides an overview of prohibiting mental health records under current federal law, and distinguishes those records from other types of mental health information that would not disqualify an individual from purchasing a firearm. This report also provides an overview of NICS and discusses potential issues arising from state and federal medical privacy laws that may impede states’ efforts to submit prohibiting mental health records to NICS.2 Prohibiting Mental Health Factors Under the Gun Control Act of 1968 Under the Gun Control Act of 1968 (GCA)3, as amended, certain categories of persons are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition.4 These nine categories of persons who are prohibited include: 1. Persons convicted of a crime punishable by a term of imprisonment exceeding one year; 2. Fugitives from justice; 3. Individuals who are unlawful users or addicts of any controlled substance; 4. Persons adjudicated to be mentally defective, or who have been committed to a mental institution; 5. Aliens illegally or unlawfully in the United States, as well as those who have been admitted pursuant to a nonimmigrant visa; 6. Individuals who have been discharged dishonorably from the Armed Forces; 7. Persons who have renounced United States citizenship; 8. Individuals subject to a pertinent court order; and 9. Persons who have been convicted of a misdemeanor domestic violence offense.5 1 See CRS Report R43004, Public Mass Shootings in the United States: Selected Implications for Federal Public Health and Safety Policy, coordinated by Jerome P. Bjelopera. 2 This report is limited to a discussion of currently applicable law, and does not discuss proposals to revise the types of mental health records that would disqualify an individual from purchasing or possessing a firearm. 3 P.L. 90-618 (1968). 4 18 U.S.C. §922(g). Individuals who are under indictment for a felony are also prohibited from receiving or transporting firearms or ammunition. 18 U.S.C. §922(n). Congressional Research Service 1 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Of these categories, only the fourth is primarily concerned with mental health issues.6 The sections below provide a more detailed discussion of the scope of this category’s two subcomponents: adjudication as a mental defective and commitment to a mental institution. Adjudication as a Mental Defective As noted above, the GCA prohibits individuals “adjudicated as a mental defective” from possessing, receiving, transferring, or transporting a firearm. The term has been further defined by federal regulation as: (a) A determination by a court, board, commission, or other lawful authority that a person, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease: (1) Is a danger to himself or to others; or (2) Lacks the capacity to manage his own affairs. (b) The term shall include—(1) a finding of insanity by a court in a criminal case, and (2) those persons found incompetent to stand trial or found not guilty by lack of mental responsibility [under the Uniform Code of Military Justice].7 It is important to note that despite references to “mental illness” in the definition, neither a diagnosis of a mental illness nor treatment for a mental illness appears, by itself, to qualify a person as “adjudicated as a mental defective.”8 Thus, while a health care provider may provide to a third party (i.e., a court, board, commission, or other lawful authority) an assessment of an individual’s mental health for purposes of adjudication, the provision of mental health treatment alone is not considered a determination for purposes of being considered “adjudicated as a mental defective,” nor is treatment necessary for the determination. Rather, an individual’s “adjudication as a mental defective” relies upon a determination or decision by “a court, board, commission, or other lawful authority.” Physicians and other health care providers generally do not fall within this list of authorized decision-makers, with the exception of certain instances under state law where a health care provider may be authorized by statute to admit a patient to involuntary psychiatric treatment. A (...continued) 5 18 U.S.C. §922(g). 6 In the 113th Congress, Senator Lindsey Graham introduced S. 480, the NICS Reporting Improvement Act of 2013, that would revise 18 U.S.C. 922(g)(4) to replace references to “mental defective” with “mentally incompetent” and “mental institution” with “psychiatric hospital.” The bill would also expressly define the type of hearings that qualify for purposes of being “adjudicated mentally incompetent or ... committed to a psychiatric hospital.” A full discussion of the effects of these amendments is beyond the scope of this report. 7 27 C.F.R. §478.11. It is likely that any record that fits the definition under (b) would be related to criminal record histories that are more easily accessible by the states. However, it has been reported that a majority of states have low submission rates for the types of records that fall under subsection (a). MAIG Report. 8 See, e.g., U.S. v. Vertz, 102 F. Supp.2d 787, 788 (W.D. Mich. 2000), aff’d on other grounds, 40 Fed. Appx. 69 (6th Cir. 2002) (“Despite the extensive evidence of medical illness, for purposes of criminal liability under the federal firearms statute, it is not sufficient that the defendant has been diagnosed as mentally ill by his treating physicians. The statute specifically requires that the individual have been adjudicated as a mental defective or committed to a mental institution.”). Congressional Research Service 2 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule health care provider, under these circumstances, could potentially be considered an “other lawful authority,” who makes a determination which falls within the federal statute criminalizing firearms possession by an individual who is “adjudicated as a mental defective” or “committed to a mental institution.” See discussion below at “Emergency Admission or Hospitalization.” Whether the definition of “adjudicated as a mental defective” includes individuals who have been assigned fiduciaries to manage monetary benefits received from a federal agency is subject to interpretation, as illustrated by the different policies of the Department of Veterans Affairs (VA) and the Social Security Administration (SSA). In particular, the definition includes those who are determined “as a result of … condition …[to] lack[] the capacity to manage his own affairs.” Accordingly, VA policy requires that an individual who receives VA monetary benefits and who “lacks the mental capacity to manage his or her own financial affairs regarding disbursement of funds without limitation, and is either rated incompetent by VA or adjudged to be under legal disability by a court of competent jurisdiction” be assigned a fiduciary (who manages the money disbursed by VA) and be reported to NICS.9 SSA does not appear to have a comparable policy for representative payees (i.e., individuals who have been assigned a fiduciary to manage their SSA monetary benefits). In a letter to the Vice President, the National Council on Disability (NCD) urges him to avoid any proposal to link the Social Security Administration’s database of representative payees with the FBI’s National Instant Criminal Background Check System (NICS). Whatever merits such a proposal might seem to present, such benefits are outweighed by the inaccurate and discriminatory inference that would result: equating the need for assistance in managing one’s finances with a presumption of incapacity in other areas of life.... NCD recommends you ensure that the selection of a representative payee continues to have no implication on other areas of rights beyond financial decision-making.10 Commitment to a Mental Institution The term “committed to a mental institution” is defined through regulation as A formal commitment of a person to a mental institution by a court, board, commission, or other lawful authority. The term includes a commitment to a mental institution involuntarily. The term includes commitment for mental defectiveness or mental illness. It also includes commitments for other reasons, such as for drug use. The term does not include a person in a mental institution for observation or a voluntary admission to a mental institution.11 9 DEPARTMENT OF VETERANS AFFAIRS, “Privacy Act of 1974; System of Records,” 76 Fed. Reg. 14119, 14122 (Mar. 15, 2011). Pursuant to NIAA, the VA provides notice to veterans who may fall under the firearms disqualification, and the agency has established an administrative procedure that provides veterans with the ability to request relief from their firearms disability. See MR21-1MR VA Manual, Part III, Subpart v, Chapter 9 Section B, available at, http://www.benefits.va.gov/WARMS/M21_1MR1.asp; DEPARTMENT OF VETERANS AFFAIRS, Fast Letter to Regional Offices Re: Processing Requests for Relief from the Reporting Requirements of the National Instant Criminal Background Check System (NICS), available at https://docs.google.com/document/d/ 11ETxpq4dJiiJYcSD8KYXtVTIOhKSqg5hAilxjNQ43OY/edit?pli=1. 10 Letter from Jonathan M. Young, Chairman, National Council on Disability, to Joseph Robinette Biden, Jr., Vice President, United States of America, January 11, 2013, http://www.ncd.gov/publications/2013/Jan142013. Legislation to prevent these types of VA records from being transferred to NICS has been introduced in the 113th Congress. See, e.g., H.R. 577 and S. 572, Veterans Second Amendment Protection Act (113th Cong., 1st sess.). In other words, these bills would allow veterans who have been appointed a fiduciary to keep their firearms. 11 27 C.F.R. §478.11. Congressional Research Service 3 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule The use of the term “institution” suggests that the definition of “committed to a mental institution” may apply only to inpatient settings. The question of whether the definition applies to outpatient commitment was raised following the Virginia Tech shooting in 2007 (see textbox). In either case, the definition explicitly excludes “voluntary admission,” and so would not apply to individuals voluntarily seeking treatment for mental illness in any setting.12 Emergency Admission or Hospitalization As noted above, state law may authorize a health care provider to admit a patient to involuntary psychiatric treatment, particularly in emergency situations for a brief duration. In these limited instances, it is possible that a health care provider would be considered an “other lawful authority,” and the patient receiving involuntary psychiatric treatment would fall within the definition of “committed to a mental institution” for purposes of the GCA. For example, in United States v. Waters, the U.S. Court of Appeals for the Second Circuit held that the involuntary hospitalization of an alleged mentally ill individual pursuant to New York state law14 met the definition of an “involuntary commitment” for purposes of the GCA, even though the hospitalization was ordered by the director of a hospital upon the certification of two physicians.15 However, at least one federal court has held that the Supreme Court’s recent recognition of Example:Virginia Tech Shooting of April 16, 2007 On April 16, 2007, a student at Virginia Tech, Seung Hui Cho, shot and killed 32 students and faculty and wounded 17 more before killing himself. More than a year prior to the shootings, a series of events led to a commitment hearing for involuntary admission on December 14, 2005. At the hearing the special justice ruled that Cho “presents an imminent danger to himself as a result of mental illness” and ordered outpatient treatment. Following the shooting, a review determined that Cho had been ineligible to purchase a gun under federal law because he “had been judged to be a danger to himself and ordered to outpatient treatment.” The review further determined that “Virginia law did not clearly require that persons such as Cho—who had been ordered into out-patient treatment but not committed to an institution—be reported to the [NICS] database.” On April 30, 2007, the Governor of Virginia issued Executive Order 50, requiring that any involuntary treatment order, whether inpatient or outpatient, be reported to the NICS. In 2008, the state legislature codified this requirement.13 Sources: Virginia Tech Review Panel, Mass Shootings at Virginia Tech: April 16, 2007, August 2007, http://www.governor.virginia.gov/tempcontent/ techPanelReport-docs/FullReport.pdf and Virginia Executive Order No. 50, (April 30, 2007), http://www.lva.virginia.gov/public/EO/ eo50%282007%29.pdf. 12 The Judge David L. Bazelon Center for Mental Health Law, an advocacy organization that opposes involuntary outpatient commitment, has compiled a summary of state statutes allowing involuntary outpatient commitments; the summary includes a comparison with inpatient commitment statutes. See http://www.bazelon.org/LinkClick.aspx? fileticket=CBmFgyA4i-w%3D&tabid=324. For more about involuntary commitment, see National Conference of State Legislatures, Screening and Entry into Mental Health Treatment: Balancing Help for the Individual and the Community, http://www.ncsl.org/issues-research/health/screening-and-entry-into-mental-health-treatment.aspx or National Conference of State Legislatures, Mental Health: What are the issues surrounding involuntary treatment?, http://www.ncsl.org/issues-research/health/mental-health-faq.aspx#issues. 13 VA. CODE ANN. §37.2-819. 14 N.Y. MENTAL HYG. LAW §9.27. 15 U.S. v. Waters, 23 F.3d 29 (2d Cir. 1994). See also U.S. v. Vertz, 102 F. Supp. 2d at 787 (“prior hospitalization, which was supported by a second psychiatrist’s certification, qualified as a commitment to a mental institution”). But see U.S. v. Giardina, 861 F.2d 1334 (5th Cir. 1988) (temporary, emergency detentions for treatment of mental disorders or difficulties, which did not lead to formal commitments under state law, did not constitute the commitment envisioned by the GCA). Congressional Research Service 4 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule an individual right to possess a firearm in District of Columbia v. Heller,16 suggests that some emergency hospitalization or commitment procedures should not be included within the meaning of “involuntary commitment” for purposes of the GCA. In United States v. Rehlander, the U.S. Court of Appeals for the First Circuit (First Circuit) considered a Maine law which provides authority for the brief, but involuntary, detention of individuals in mental institutions on the basis of a medical provider’s examination and certification that the individual is mentally ill and poses a likelihood of serious harm.17 In pre-Heller cases, the First Circuit had held that this emergency hospitalization under Maine law qualified as “involuntary commitment” under the GCA.18 However, because the procedures under state law were ex parte19 and did not have additional procedural safeguards, the court held that construing the emergency hospitalization procedures to qualify as “involuntary commitment” under the GCA post-Heller would risk depriving individuals of their right to bear arms without sufficient due process. Therefore, the appellate court overturned its earlier decisions and held that such emergency hospitalizations were not “involuntary commitments.” The National Instant Criminal Background Check System (NICS) Under the Brady Handgun Violence Prevention Act of 1993 (Brady Act), the Attorney General was required to establish a computerized system to facilitate background checks on individuals seeking to acquire firearms from federally licensed firearms dealers.20 The National Instant Criminal Background Check System (NICS) was activated in 1998 and is administered by the Federal Bureau of Investigation (FBI). Through NICS, federal firearms licensees submit background checks on prospective transferees to the FBI, which queries other databases – including the National Crime Information Center (NCIC), the Interstate Identification Index (III), and the NICS index – to determine if the transferees are disqualified from receiving firearms.21 According to the FBI, records in the NICS Index are voluntarily provided by local, state, tribal, and federal agencies, and it “contains [disqualifying records] that may not be available in the NCIC or the III of persons prohibited from receiving firearms under federal or state law.”22 The Brady Act authorized the Attorney General to “secure directly from any [federal] department or agency of the United States” information on persons for whom receipt of a firearm would 16 554 U.S. 570 (2008). U.S. v. Rehlander, 666 F.3d 45 (1st Cir. 2012). 18 U.S. v. Chamberlain, 159 F.3d 656 (1st Cir. 1998) and U.S. v. Holt, 464 F.3d 101 (1st Cir. 2006). 19 The term ex parte refers to a legal proceeding brought by one person in the absence of and without representation or notification of other parties. 20 P.L. 103-159, §103 (1994) [hereinafter Brady Act]. 21 The NCIC is a database of documented criminal justice information that is made available to law enforcement and authorized agencies, with the goal of assisting law enforcement in apprehending fugitives, finding missing persons, locating stolen property, and further protecting law enforcement personnel and the public. The III, or “Triple I,” is a computerized criminal history index pointer system that the FBI maintains so that records on persons arrested and convicted of felonies and serious misdemeanors at either the federal or state level can be shared nationally. See Federal Bureau of Investigation, National Instant Criminal Background Check System 2011 Operations Report, available at http://www.fbi.gov/about-us/cjis/nics/reports/2011-operations-report/operations-report-2011. 22 See Federal Bureau of Investigation, Criminal Justice Information Services, National Instant Criminal Background Check System Index Brochure, available at http://www.fbi.gov/about-us/cjis/nics/general-information/nics-index. 17 Congressional Research Service 5 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule violate federal or state law. The act does not mandate that federal agencies disclose these records, rather it mandates that “upon request of the Attorney General, the head of such department or agency shall furnish such information to the system.”23 With respect to states, which are not required to submit records to NICS, the Brady Act provided grants to “improv[e] State record systems and the sharing ... of the records ... required by the Attorney General under [the Brady Act].”24 However, it did not mandate that states turn over any specific records, even upon request. NICS Improvement Amendments Act of 2007 In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms under 18 U.S.C. §922(g) or (n), with an emphasis on providing accurate records relating to those who are prohibited under (g)(4) (“adjudicated as a mental defective”) or (g)(9) (“convicted in any court of a misdemeanor crime of domestic violence”).25 Moreover, it mandates that the Department of Homeland Security make available to the Attorney General any records that are related to being a prohibited possessor under federal law.26 For federal agencies, NIAA clarifies the standard for adjudication and commitments related to mental health. It provides that no department may provide any such record if the record has been set aside or the individual has been released from treatment; the person has been found by the court or board to no longer suffer from the condition that was the basis of the adjudication or commitment; or the adjudication or commitment is based solely on a medical finding of disability, without opportunity to be heard by a court or board.27 It also requires agencies that do make such determinations to establish a program that permits a person to apply for relief from the disabilities imposed under §922(g)(4).28 With respect to states, NIAA allows a state to be eligible for a two year waiver of the matching requirement in the National Criminal History Improvements Grant program, established under the Brady Act, if the state provides at least 90% of the records relevant to determining whether a person is disqualified from possessing a firearm under federal or applicable state law.29 To be eligible for such a waiver, other requirements include providing updates to NICS regarding any record that should be modified or removed from the system, and more detailed information regarding those who are convicted of a misdemeanor crime of domestic violence or adjudicated as a mental defective under federal law. NIAA also provides the Attorney General discretion to award additional grants for purposes of assisting states with upgrading information identification technologies for firearms disability determinations as long as they have implemented a relief from 23 Brady Act, §103(e). Brady Act, §106. This program is known as the National Criminal History Improvement Program (NCHIP). This program is administered by the Department of Justice Bureau of Justice Statistics (BJS). See http://bjs.gov/index.cfm? ty=tp&tid=47. 25 P.L. 110-180, §§102-104, 301 (2007) [hereinafter NIAA]. 26 NIAA, §101(b). 27 NIAA, §101(c)(1). 28 NIAA, §101(c)(2). 29 NIAA, §102. 24 Congressional Research Service 6 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule disabilities program that meets certain requirements.30 This grant program is known as the NICS Act Record Improvement Program (NARIP).31 If a state has received a waiver or an additional grant under NIAA, the act imposes penalties for non-compliance.32 The act mandates reductions in Department of Justice Byrne Justice Assistance Grant funds and permits the Attorney General to make discretionary reduction of these funds if a state does not comply with eligibility requirements of NIAA.33 State Reporting of Prohibiting Mental Health Records to NICS In 2012, five years after the NIAA was enacted, the Government Accountability Office (GAO) released a report that examined states’ progress in reporting mental health records to the NICS databases.34 It is important to keep in mind that the “mental health records” reported to NICS include only individual identifiers and no actual medical information. However, as discussed in more detail below, the preparation and submission of such records by health departments and health care facilities involves the use of patient information and thus is subject to federal and, in many instances, state health privacy laws. GAO found that the total number of mental health records that states made available to NICS databases increased approximately nine-fold from about 126,000 to 1.2 million between 2004 and 2011. However, this increase largely reflected the efforts of 12 states. According to GAO, almost half of all states increased the number of mental health records they reported by fewer than 100 over the same time period. Both DOJ and state officials told GAO that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states’ ability to report mental health records. Technological challenges include updating aging computer systems and integrating existing record systems. Several states reported using their NARIP grant funding to automate the collection and transmission of records. DOJ officials further emphasized that the technological challenges are particularly salient for mental health records because these records originate from numerous sources within the state—such as courts, private hospitals, and state offices of mental health—and are not typically captured by any single state agency. For example, records that involve involuntary commitments to a mental institution typically originate in entities located throughout a state and outside the scope of law enforcement, and therefore a state may lack processes to automatically make these records available to the FBI.35 The fact that mental health records often originate in hospitals and health departments, which are typically not connected to law enforcement agencies that make the majority of records available to NICS, presents challenges in getting all the relevant entities to collaborate. As an example, 30 NIAA, §§103, 105. This program is also administered by the Department of Justice’s BJS. See http://bjs.gov/index.cfm?ty=tp&tid=49. 32 NIAA, §104. 33 For more information on the Byrne Justice Assistance Grant program, see CRS Report RS22416, Edward Byrne Memorial Justice Assistance Grant (JAG) Program, by Nathan James. 34 U.S. Government Accountability Office, Gun Control: Sharing Promising Practices and Assessing Incentives Could Better Position Justice to Assist States in Providing Records for Background Checks, GAO-12-684, July 16, 2012, http://www.gao.gov/assets/600/592452.pdf. 35 Id. at 11-12. 31 Congressional Research Service 7 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule GAO cited an April 2012 report by the state of Illinois, Office of the Auditor General, which found that for 2010, approximately 114,000 mental health records were maintained in nursing homes, private hospitals, state mental health facilities, and circuit courts. However, only about 5,000 records were reported to NICS because of a lack of coordination and other challenges. Citing privacy concerns, officials in three of the six states reviewed by GAO reported that the absence of explicit statutory authority to share mental health records was an impediment to NICS reporting.36 In a November 2011 report on NICS reporting, Mayors Against Illegal Guns (MAIG) drew conclusions that are broadly similar to those of GAO.37 MAIG interviewed officials in all 50 states and the District of Columbia and found that state reporting of mental health records to NICS is impeded by a complex set of obstacles including technological and logistical problems, privacy concerns, insufficient funding, and a lack of leadership. The MAIG report noted that even among states with strong reporting programs, there is considerable variation in the number and type of mental health records submitted to NICS. It found that states that have significantly improved their reporting in the past few years share a number of common attributes including the ability to commit funding to their efforts and effective political leadership. MAIG also found a strong association between reporting levels and enactment of state laws that require or authorize agencies to report their records. According to MAIG, nine of the 10 states that had the greatest increase in records submitted to NICS between September 2010 and October 2011 have laws or policies requiring or permitting sharing mental health records with NICS. Impact of the HIPAA Privacy Rule on NICS Reporting Officials in approximately half of the states told MAIG that state health privacy laws as well as the privacy rule promulgated by the Department of Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA) were potential obstacles to NICS reporting. In some states, officials cited privacy concerns as the primary impediment to reporting. HIPAA Privacy Rule Overview The HIPAA privacy rule established a set of federal standards to help safeguard the privacy of personal health information.38 Those standards include certain individual privacy rights, such as the right of access to one’s health information and the right to request corrections, as well as limitations on the use or disclosure of personal health information. The rule applies to (1) health plans;39 (2) health care clearinghouses;40 and (3) health care providers who transmit health 36 Id. at 12. Mayors Against Illegal Guns, Fatal Gaps: How Missing Records in the Federal Background Check System Put Guns in the Hand of Killers, November 2011, http://www.mayorsagainstillegalguns.org/downloads/pdf/ maig_mimeo_revb.pdf. MAIG is a coalition of mayors from more than 900 cities and towns across the United States, co-chaired by New York City’s Mayor Michael Bloomberg and Boston’s Mayor Thomas Marino. The coalition shares best practices, develops policies, and supports legislation at all levels of government to reduce the distribution of, and access to, illegal and military-style firearms in U.S. cities and towns. 38 The HIPAA privacy rule, and accompanying general administrative and enforcement requirements, are codified at 45 C.F.R. Part 160 and Part 164, Subparts A and E. 39 Health plans include any individual or group plan that provides or pays for medical care. The term encompasses both private and government plans. Health maintenance organizations (HMOs) and high-risk pools are specifically covered. Most employee health benefit plans are covered. See 45 C.F.R. §160.103. 37 Congressional Research Service 8 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule information electronically in connection with one of the HIPAA-covered financial or administrative transactions.41 These persons and organizations are collectively referred to as covered entities. The privacy rule covers protected health information (PHI) in any form that is created or received by a covered entity. PHI is defined as individually identifiable information that relates to the past, present, or future physical or mental health of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.42 In the broadest sense, the privacy rule prohibits a covered entity from using or disclosing PHI except as expressly permitted or required by the rule.43 As briefly outlined below, the rule describes a range of circumstances under which it is permissible to use or disclose PHI. In all such instances covered entities can choose whether to use or disclose PHI based on their professional ethics and best judgment. The rule specifies only two circumstances when a covered entity is required to disclose PHI. A covered entity must disclose PHI to: (1) the individual who is the subject of the information, (i.e., patient right of access), and (2) HHS officials investigating potential violations of the rule.44 Generally, covered entities may use or disclose PHI for the purposes of treatment, payment, and other routine health care operations with few restrictions.45 Under other specific circumstances (e.g., disclosures to family members and friends), the rule requires covered entities to give the individual the opportunity to object to the disclosure (i.e., opt out).46 Importantly, the rule also permits the use or disclosure of PHI for several specified “national priority purposes” that are not directly connected to the treatment of the individual.47 These uses and disclosures are permitted by the rule in recognition of the important uses made of health information outside of the health care context. They include the following uses and disclosures: (...continued) 40 Health care clearinghouse is a term of art under the privacy rule. It refers to an entity (e.g., claims processor) that translates health information received from other entities either to or from the standard format that is required for electronic transactions. See 45 C.F.R. §160.103. 41 Health care providers include any person (e.g., physician, nurse, pharmacist) or entity (e.g., hospital, clinic) that furnishes, bills, or is paid for health care in the normal course of business. To be a covered entity, a provider must conduct one or more of the HIPAA-specified transactions, such as verifying insurance coverage or filing a health claim, by transmitting health information electronically in a standard format (i.e., the provider must include certain information and use specified codes for diagnosis and treatment) required by HIPAA. Providers that rely on third-party billing services to conduct such electronic transactions on their behalf are also covered under the privacy rule. Providers that operate solely on a paper basis and do not submit insurance claims electronically are not subject to the rule. See 45 C.F.R. §160.103. 42 45 C.F.R. §160.103. 43 45 C.F.R. §164.502(a) 44 Id. 45 45 C.F.R. §164.506. 46 45 C.F.R. §164.510. 47 45 C.F.R. §164.512. Congressional Research Service 9 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule • Required by law. Covered entities may use or disclose PHI to the extent that such use or disclosure is required by (federal or state) law and the disclosure complies with and is limited to the relevant requirements of such law.48 • Law enforcement purposes. Covered entities may disclose PHI to law enforcement officials for certain specified law enforcement purposes.49 • Averting a serious threat to health or safety. Consistent with applicable law and standards of ethical conduct, a health care provider may use or disclose PHI if the provider in good faith believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.50 • Specialized government functions. Covered entities may use or disclose PHI for several specified essential government functions.51 For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered entities must obtain a patient’s written authorization. As discussed above, prohibiting mental health records under the GCA are typically generated by the courts that adjudicate persons as mentally defective, and by the courts and health care providers that involuntarily commit individuals to mental health facilities. While courts are not covered entities and are not subject to the HIPAA privacy rule, health care providers such as hospitals and state health departments are covered by the privacy rule and, therefore, may not use or disclose PHI for the purpose of NICS reporting without express permission under the rule. As described below, it is necessary to look to the states to determine whether such permission exists. Interaction of HIPAA Privacy Rule and State Privacy Laws Although the HIPAA privacy rule provides a federal floor with respect to the uses and disclosures of PHI, the overall scope of the privacy rule may be modulated by state law. If a state requires covered entities to disclose prohibiting mental health records to NICS, the HIPAA privacy rule does not prohibit that disclosure.52 Therefore, the privacy rule is most relevant as a potential obstacle where prohibiting mental health records are held by covered entities in a state that does not require disclosure of such records to NICS. This would be the case even if the state expressly allowed, but did not explicitly require, disclosure of prohibiting mental health records to NICS because merely permissive state laws are insufficient to exempt disclosure from the HIPAA privacy rule. It should also be noted that both types of entities—courts and health care providers—may also be subject to state health privacy laws that may be more protective of individually identifiable health information than the HIPAA privacy rule and other state-level requirements and policies. State 48 45 C.F.R. §164.512(a) 45 C.F.R. §164.512(f) 50 45 C.F.R. §164.512(j). On January 15, 2013, the HHS Office for Civil Rights issued a letter to health care providers in which he reminded them of the privacy rule’s “duty to warn” provision, which permits the disclosure of patient information to avert threats to health or safety. See http://www.hhs.gov/ocr/office/lettertonationhcp.pdf. 51 45 C.F.R. §164.512(k) 52 Id. 49 Congressional Research Service 10 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule laws that are more protective of privacy include those that prohibit or restrict a use or disclosure that would otherwise be permitted under the privacy rule, and those that provide individuals with greater access to their own health information. This final section of the report provides a basic overview of the different types of state privacy laws that may impact the sharing of prohibiting mental health records with NICS. Figure 1 summarizes state laws that address the reporting of mental health records for use in firearm purchaser background checks. Twenty-three states have NICS reporting mandates.53 These laws require courts and, in some instances, mental health facilities to report (1) to NICS directly, or (2) to a state agency that in turn reports to NICS. As noted above, the HIPAA privacy rule would not bar the mandated disclosures in these states. Note that in one of the states— Delaware—reporting by mental health facilities takes the place of court reporting (see Figure 1). Seven states have laws that authorize, but do not require, reporting to NICS.54 In these states that do not mandate reporting, HIPAA-covered entities do not appear to have permission under the privacy rule to use or disclose PHI for the purpose of preparing and reporting mental health records to NICS. Absent a state reporting mandate, it is not clear that there are any other provisions in the privacy rule that provide such permission. None of the three other national priority purposes in the privacy rule discussed earlier (under “HIPAA Privacy Rule Overview”) address reporting to federal databases for the purposes of future background checks. The disclosure of PHI for law enforcement purposes has to be (1) as required by law; (2) pursuant to various specified judicial and administrative processes and procedures such as court orders, subpoenas, and summonses; or (3) in response to one of several other specified law enforcement activities.55 The privacy rule’s provisions authorizing the use or disclosure of PHI for various specialized government functions list a number of specific activities, none of which includes reporting information to the NICS databases.56 Finally, the rule’s provisions that permit the use and disclosure of PHI to avert a serious threat to health or safety focus on two types of situations, neither of which appears to include NICS reporting. The first permits the disclosure of PHI to a person or persons reasonably able to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The second concerns alerting law enforcement authorities about an individual involved in a violent crime or who has escaped from prison or lawful custody.57 An additional eight states collect mental health records pursuant to state law, but these laws do not address NICS reporting.58 Again, without a NICS reporting mandate, HIPAA-covered entities do not appear to have permission under the privacy rule to use PHI for the purpose of reporting 53 AL, CO, CT, DE, GA, ID, IL, IN, IA, KS, KY, ME, MN, NV, NC, ND, NY, OR, TN, TX, WA, WI, and VA; see Figure 1. 54 AZ, FL, MO, NE, NJ, PA, and WV; see Figure 1. In some cases, whether state law requires disclosure to NICS may be ambiguous. For example, New Jersey state law currently prohibits disclosure of commitment records disclosure except as needed to comply with the data reporting provisions of the NIAA or the Brady Act, but it is not clear that either of those laws impose any such requirements. The state is currently considering Assembly Bill No. 3717, which would amend state law to explicitly require reporting of institutionalized persons to NICS. http://www.njleg.state.nj.us/ 2012/Bills/A4000/3717_I1.HTM 55 45 C.F.R. §164.512(k) 56 45 C.F.R. §164.512(k) 57 45 C.F.R. §164.512(j) 58 AR, CA, HI, MA, MD, MI, OH and UT; see Figure 1. Congressional Research Service 11 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule mental health records to the federal databases. These states include California, which despite the absence of a NICS reporting mandate, has one of the best NICS reporting rates for mental health records. In part this is because of a state law that requires mental health facilities to report mental health records to the California Department of Justice (DOJ). That requirement effectively removes HIPAA as an impediment to such reporting by HIPAA-covered entities. While state law is silent on DOJ reporting to NICS, California has developed a reporting infrastructure and entered into an agreement with the federal government to report mental health records to NICS. Finally, 13 states are without laws requiring or authorizing the collection or reporting of mental health records for use in firearm purchaser background checks, either at the state or federal level. Once again, HIPAA-covered entities in these states that are in possession of disqualifying mental health records appear to lack the authority under the privacy rule to report such information to NICS. On February 14, 2013, in response to the President’s instruction to address any potential legal barriers to NICS reporting, HHS announced that it will seek to amend the HIPAA privacy rule to remove any potential impediments to state reporting of mental health records to NICS.59 The HHS Office for Civil Rights (OCR), which administers and enforces the privacy rule, plans to issue an advance notice of proposed rulemaking (ANPRM) to solicit public comment on this issue prior to proposing any changes to the privacy rule.60 While a detailed examination of state-level activities is beyond the scope of this report, it should be emphasized that many states collect and use mental health records (and other relevant information) pursuant to state law or policies for their own background checks of firearm purchases. Some states are “Point-Of-Contact” (POC) states, meaning that the state agency is responsible for electronically accessing NICS and for implementing and maintaining their own Brady NICS program.61 Often times a POC state will run the background check against the state’s own records, some of which may not be in NICS. In some instances, background checks conducted by POCs may be more stringent than non-POC states because they have access to more access to disqualifying records. In addition, these states could be more thorough in their background checks because statutory prohibitions on firearm possession in these states sometimes exceed the federal prohibitions under the Brady Act. However, unlike the nationwide NICS background checks, state-level checks do not capture prohibited individuals who cross state lines to purchase long guns. 59 HIPAA provides the HHS Secretary with authority to modify the privacy standards, as determined appropriate, but not more frequently than once every 12 months. Any addition or modification to a standard must “be completed in a manner that minimizes the disruption and cost of compliance.” 42 U.S.C. §1320d–3(b)(1). 60 Kendra Casey Plank, “HIPAA Privacy Rule Changes Could Ease Sharing of Mental Health Records by States,” Bloomberg BNA, Health Care Daily Report, February 15, 2013. 61 See Federal Bureau of Investigation, National Instant Criminal Background Check System- Participation Map, available at, http://www.fbi.gov/about-us/cjis/nics/general-information/participation-map. Congressional Research Service 12 Figure 1. State Laws That Require or Authorize the Reporting of Mental Health Records to NICS As of January 1, 2013 Source: Prepared by CRS based on a review and analysis of laws in all 50 states and the District of Columbia that address the reporting of mental health records for use in firearm purchaser background checks. Note: CRS’s characterization of state laws is in broad agreement with a similar analysis by the Law Center to Prevent Gun Violence—a nonprofit organization that advocates for gun-control legislation and provides legal expertise and information on U.S. gun laws—but with one key difference. Whereas the Law Center characterized Virginia as a state that authorizes but does not require reporting to NICS, CRS concluded that Virginia’s law requires NICS reporting. The Law Center’s analysis is available at http://smartgunlaws.org/mental-health-reporting-policy-summary/. CRS-13 Submission of Mental Health Records to NICS and the HIPAA Privacy Rule Author Contact Information Edward C. Liu, Coordinator Legislative Attorney eliu@crs.loc.gov, 7-9166 Vivian S. Chu Legislative Attorney vchu@crs.loc.gov, 7-4576 Erin Bagalman Analyst in Health Policy ebagalman@crs.loc.gov, 7-5345 C. Stephen Redhead Specialist in Health Policy credhead@crs.loc.gov, 7-2261 Acknowledgments Alex C. Engler, Research Associate, prepared the figure in this report. Congressional Research Service 14