Submission of Mental Health Records to NICS and the HIPAA Privacy Rule

Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings. These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more “prohibiting factors,” such as a prior felony conviction or a prior involuntary commitment for mental health reasons. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS) and a particular focus of the debate in Congress has been whether federal privacy standards promulgated under the Health Insurance Portability and Accountability Act (i.e., the HIPAA Privacy Rule) or state privacy laws are an obstacle to the submission of mental health records to NICS.

Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally defective or who have been committed to a mental institution are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental illness nor treatment for a mental illness is sufficient to qualify a person as “adjudicated as a mental defective.” Rather, an individual’s “adjudication as a mental defective” relies upon a determination or decision by a court, board, commission, or other lawful authority. The definition of “committed to a mental institution” may apply only to inpatient settings. At least one federal court has held that the Supreme Court’s recent recognition of an individual right to possess a firearm suggests that some emergency hospitalization or commitment procedures, that may not have as many procedural safeguards as formal commitment, should not be included within the meaning of “involuntary commitment” for purposes of the GCA. In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms.

In 2012, the Government Accountability Office (GAO) reported that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states’ ability to report mental health records to NICS. The HIPAA Privacy Rule, which applies to most health care providers, regulates the use or disclosure of protected health information, and it has been perceived as a potential obstacle to sharing information with NICS, especially in states that do not expressly require disclosure of such records to NICS. Moreover, courts and health care providers that generate such prohibiting mental health records may also be subject to state health privacy laws that may be more restrictive than the HIPAA Privacy Rule.

In February 2013, the Department of Health and Human Services (HHS) announced its intention to amend the HIPAA Privacy Rule to remove any potential impediments to state reporting of some mental health records to NICS, and on January 7, 2014, HHS issued its proposed rule that would modify the HIPAA Privacy Rule. The Department of Justice (DOJ) also issued a proposed rule that would clarify the terms “adjudicated as a mental defective” and “committed to a mental institution.”

Submission of Mental Health Records to NICS and the HIPAA Privacy Rule

February 20, 2014 (R43040)

Summary

Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings. These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more "prohibiting factors," such as a prior felony conviction or a prior involuntary commitment for mental health reasons. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS) and a particular focus of the debate in Congress has been whether federal privacy standards promulgated under the Health Insurance Portability and Accountability Act (i.e., the HIPAA Privacy Rule) or state privacy laws are an obstacle to the submission of mental health records to NICS.

Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally defective or who have been committed to a mental institution are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental illness nor treatment for a mental illness is sufficient to qualify a person as "adjudicated as a mental defective." Rather, an individual's "adjudication as a mental defective" relies upon a determination or decision by a court, board, commission, or other lawful authority. The definition of "committed to a mental institution" may apply only to inpatient settings. At least one federal court has held that the Supreme Court's recent recognition of an individual right to possess a firearm suggests that some emergency hospitalization or commitment procedures, that may not have as many procedural safeguards as formal commitment, should not be included within the meaning of "involuntary commitment" for purposes of the GCA. In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms.

In 2012, the Government Accountability Office (GAO) reported that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states' ability to report mental health records to NICS. The HIPAA Privacy Rule, which applies to most health care providers, regulates the use or disclosure of protected health information, and it has been perceived as a potential obstacle to sharing information with NICS, especially in states that do not expressly require disclosure of such records to NICS. Moreover, courts and health care providers that generate such prohibiting mental health records may also be subject to state health privacy laws that may be more restrictive than the HIPAA Privacy Rule.

In February 2013, the Department of Health and Human Services (HHS) announced its intention to amend the HIPAA Privacy Rule to remove any potential impediments to state reporting of some mental health records to NICS, and on January 7, 2014, HHS issued its proposed rule that would modify the HIPAA Privacy Rule. The Department of Justice (DOJ) also issued a proposed rule that would clarify the terms "adjudicated as a mental defective" and "committed to a mental institution."


Submission of Mental Health Records to NICS and the HIPAA Privacy Rule

Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings.1 These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more "prohibiting factors," such as a prior felony conviction or a prior involuntary commitment for mental health reasons. If disqualifying information surfaces during the background check, the transfer is not completed. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS), maintained by the Federal Bureau of Investigation (FBI), and a particular focus of the debate in Congress has been whether the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule or state privacy laws are an obstacle to the population of NICS with prohibiting mental health records. On January 7, 2014, the Department of Justice (DOJ) issued a proposed rule that would clarify the existing regulations related to those who would qualify as "adjudicated as a mental defective" and who have been "committed to a mental institution" for purposes of the Gun Control Act of 1968.2 At the same time, the Department of Health and Human Services (HHS) issued a proposed rule that would clarify when entities that are regulated under HIPAA may share certain information with NICS.3

This report provides an overview of prohibiting mental health records under current federal law, and distinguishes those records from other types of mental health information that would not disqualify an individual from purchasing a firearm. This report also provides an overview of NICS and discusses potential issues arising from state and federal medical privacy laws that may impede states' efforts to submit prohibiting mental health records to NICS.4

Prohibiting Mental Health Factors Under the Gun Control Act of 1968

Under the Gun Control Act of 1968 (GCA)5, as amended, certain categories of persons are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition.6 These nine categories of persons who are prohibited include

  • 1. persons convicted of a crime punishable by a term of imprisonment exceeding one year;
  • 2. fugitives from justice;
  • 3. individuals who are unlawful users or addicts of any controlled substance;
  • 4. persons adjudicated to be mentally defective, or who have been committed to a mental institution;
  • 5. aliens illegally or unlawfully in the United States, as well as those who have been admitted pursuant to a nonimmigrant visa;
  • 6. individuals who have been discharged dishonorably from the Armed Forces;
  • 7. persons who have renounced United States citizenship;
  • 8. individuals subject to a pertinent court order; and
  • 9. persons who have been convicted of a misdemeanor domestic violence offense.7

Of these categories, only the fourth is primarily concerned with mental health issues.8 The sections below provide a more detailed discussion of the scope of this category's two sub-components: adjudication as a mental defective and commitment to a mental institution.

Adjudication as a Mental Defective

As noted above, the GCA prohibits individuals "adjudicated as a mental defective" from possessing, receiving, transferring, or transporting a firearm. The term, not defined in statute, has been interpreted in federal regulation as

(a) A determination by a court, board, commission, or other lawful authority that a person, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease:

(1) Is a danger to himself or to others; or

(2) Lacks the capacity to manage his own affairs.

(b) The term shall include—(1) a finding of insanity by a court in a criminal case, and (2) those persons found incompetent to stand trial or found not guilty by lack of mental responsibility [under the Uniform Code of Military Justice].9

It is important to note that despite references to "mental illness" in the definition, neither a diagnosis of a mental illness nor treatment for a mental illness appears, by itself, to qualify a person as "adjudicated as a mental defective."10 Thus, while a health care provider may provide to a third party (i.e., a court, board, commission, or other lawful authority) an assessment of an individual's mental health for purposes of adjudication, the provision of mental health treatment alone is not considered a determination for purposes of being considered "adjudicated as a mental defective," nor is treatment necessary for the determination. Rather, an individual's "adjudication as a mental defective" relies upon a determination or decision by "a court, board, commission, or other lawful authority."

Physicians and other health care providers generally do not fall within this list of authorized decision-makers, with the exception of certain instances under state law where a health care provider may be authorized by statute to admit a patient to involuntary psychiatric treatment. A health care provider, under these circumstances, could potentially be considered an "other lawful authority," who makes a determination which falls within the federal statute criminalizing firearms possession by an individual who is "adjudicated as a mental defective" or "committed to a mental institution." See discussion below at "Emergency Admission or Hospitalization."

Whether the definition of "adjudicated as a mental defective" includes individuals who have been assigned fiduciaries to manage monetary benefits received from a federal agency is subject to interpretation, as illustrated by the different policies of the Department of Veterans Affairs (VA) and the Social Security Administration (SSA). In particular, the definition includes those who are determined "as a result of … condition … [to] lack[] the capacity to manage his own affairs." Accordingly, VA policy requires that an individual who receives VA monetary benefits and who "lacks the mental capacity to manage his or her own financial affairs regarding disbursement of funds without limitation, and is either rated incompetent by VA or adjudged to be under legal disability by a court of competent jurisdiction" be assigned a fiduciary (who manages the money disbursed by VA) and be reported to NICS.11

In contrast, SSA does not appear to have a comparable policy for representative payees (i.e., individuals who have been assigned a fiduciary to manage their SSA monetary benefits). In a letter to the Vice President, the National Council on Disability (NCD) urges him to

avoid any proposal to link the Social Security Administration's database of representative payees with the FBI's National Instant Criminal Background Check System (NICS). Whatever merits such a proposal might seem to present, such benefits are outweighed by the inaccurate and discriminatory inference that would result: equating the need for assistance in managing one's finances with a presumption of incapacity in other areas of life.... NCD recommends you ensure that the selection of a representative payee continues to have no implication on other areas of rights beyond financial decision-making.12

Commitment to a Mental Institution

The term "committed to a mental institution" is defined through regulation as

A formal commitment of a person to a mental institution by a court, board, commission, or other lawful authority. The term includes a commitment to a mental institution involuntarily. The term includes commitment for mental defectiveness or mental illness. It also includes commitments for other reasons, such as for drug use. The term does not include a person in a mental institution for observation or a voluntary admission to a mental institution.13

The use of the term "institution" suggests that the definition of "committed to a mental institution" may apply only to inpatient settings. The question of whether the definition applies to outpatient commitment was raised following the Virginia Tech shooting in 2007 (see textbox). In either case, the definition explicitly excludes "voluntary admission," and so would not apply to individuals voluntarily seeking treatment for mental illness in any setting.14 As discussed below, DOJ has proposed a rule that would amend this term to clarify that both inpatient and outpatient commitments are covered.

Example: Virginia Tech Shooting of April 16, 2007

On April 16, 2007, a student at Virginia Tech, Seung Hui Cho, shot and killed 32 students and faculty and wounded 17 more before killing himself. More than a year prior to the shootings, a series of events led to a commitment hearing for involuntary admission on December 14, 2005. At the hearing the special justice ruled that Cho "presents an imminent danger to himself as a result of mental illness" and ordered outpatient treatment. Following the shooting, a review determined that Cho had been ineligible to purchase a gun under federal law because he "had been judged to be a danger to himself and ordered to outpatient treatment." The review further determined that "Virginia law did not clearly require that persons such as Cho—who had been ordered into out-patient treatment but not committed to an institution—be reported to the [NICS] database." On April 30, 2007, the Governor of Virginia issued Executive Order 50, requiring that any involuntary treatment order, whether inpatient or outpatient, be reported to NICS. In 2008, the state legislature codified this requirement.15

Sources: Virginia Tech Review Panel, Mass Shootings at Virginia Tech: April 16, 2007, August 2007, http://www.governor.virginia.gov/tempcontent/techPanelReport-docs/FullReport.pdf and Virginia Executive Order No. 50 (April 30, 2007), http://www.lva.virginia.gov/public/EO/eo50%282007%29.pdf.

Emergency Admission or Hospitalization

As noted above, state law may authorize a health care provider to admit a patient to involuntary psychiatric treatment, particularly in emergency situations for a brief duration. In these limited instances, it is possible that a health care provider would be considered an "other lawful authority," and the patient receiving involuntary psychiatric treatment would fall within the definition of "committed to a mental institution" for purposes of the GCA. For example, in United States v. Waters, the U.S. Court of Appeals for the Second Circuit held that the involuntary hospitalization of an alleged mentally ill individual pursuant to New York state law16 met the definition of an "involuntary commitment" for purposes of the GCA, even though the hospitalization was ordered by the director of a hospital upon the certification of two physicians.17

However, at least one federal court has held that the Supreme Court's recent recognition of an individual right to possess a firearm in District of Columbia v. Heller,18 suggests that some emergency hospitalization or commitment procedures should not be included within the meaning of "involuntary commitment" for purposes of the GCA. In United States v. Rehlander, the U.S. Court of Appeals for the First Circuit (First Circuit) considered a Maine law which provides authority for the brief, but involuntary, detention of individuals in mental institutions on the basis of a medical provider's examination and certification that the individual is mentally ill and poses a likelihood of serious harm.19 In pre-Heller cases, the First Circuit had held that this emergency hospitalization under Maine law qualified as "involuntary commitment" under the GCA.20 However, because the procedures under state law were ex parte21 and did not have additional procedural safeguards, the court held that construing the emergency hospitalization procedures to qualify as "involuntary commitment" under the GCA post-Heller would risk depriving individuals of their right to bear arms without sufficient due process. Therefore, the appellate court overturned its earlier decisions and held that such emergency hospitalizations were not "involuntary commitments."

DOJ Proposal to Amend "Adjudicated as a Mental Defective" and "Committed to a Mental Institution"

On January 7, 2014, DOJ issued a notice of its proposed rule to amend the definitions of "adjudicated as a mental defective" and "committed to a mental institution."22 The term "adjudicated as a mental defective" is currently composed of two subsections. The proposed amendment primarily makes changes to the second subsection, which currently provides that the term includes (1) a finding of insanity by a court in a criminal case, and (2) a finding of incompetency to stand trial or a finding of not guilty by lack of mental responsibility pursuant to the Uniform Code of Military Justice.23 The proposed rule would amend this part to clarify that the term applies to all courts, not only the military judicial system, that determine an individual to be not guilty by reason of insanity in a criminal case, or guilty but mentally ill, or incompetent to stand trial in a criminal case. Furthermore, the proposed rule adds a third subsection, which would clarify that the term "adjudicated as a mental defective" does not include any person adjudicated but who has subsequently received relief from disability pursuant to federal law (18 U.S.C. §925(c)) or under a state program authorized by federal law. In addition, the term would not include any person who is adjudicated by a federal agency if the adjudication meets certain conditions.24 These include if (1) the record has been set aside or the individual has been released from treatment; (2) the person has been found by the court or board to no longer suffer from the condition that was the basis of the adjudication or commitment; or (3) the adjudication or commitment is based solely on a medical finding of disability, without opportunity to be heard by a court or board.25

The second term, "committed to a mental institution," currently covers formal commitments, including those which are involuntary, of a person to a mental institution for mental defectiveness or illness by a court, board, commission, or other lawful authority. It also currently includes commitments for other reasons, including drug use, but does not include a person who is in a mental institution either voluntarily or only for observation. DOJ's proposed rule would maintain the existing definition but amend it to reflect that such commitments include "an involuntary commitment to a mental institution for inpatient or outpatient treatment."26 The term would continue to exclude those who are in a mental institution solely for observation or evaluation, as well as those who have voluntarily admitted themselves. The proposed rule clarifies that the term also excludes persons undergoing voluntary outpatient treatment. In its notice, DOJ explains that "temporary admission for observation" would not be included under the term unless it "turns into a qualifying commitment as a result of formal commitment by a court, board, commission or other lawful authority."27 This explanation and the proposed minor changes to the definition would seem to strongly suggest that emergency hospitalizations, as discussed above, are to be excluded. However, the proposed rule does not appear to include explicit language that could provide more guidance to the states or the courts regarding the types of involuntary commitments made by physicians, who are acting as an "other lawful authority," that would be included under the term.

Lastly, in its notice, DOJ commented that it is seeking comment on whether it should include commitments or adjudications that occurred when the person was under the age of 18.28

The National Instant Criminal Background Check System (NICS)

Under the Brady Handgun Violence Prevention Act of 1993 (Brady Act), the Attorney General was required to establish a computerized system to facilitate background checks on individuals seeking to acquire firearms from federally licensed firearms dealers.29 The National Instant Criminal Background Check System (NICS) was activated in 1998 and is administered by the Federal Bureau of Investigation (FBI). Through NICS, federal firearms licensees submit background checks on prospective transferees to the FBI, which queries other databases—including the National Crime Information Center (NCIC), the Interstate Identification Index (III), and the NICS index—to determine if the transferees are disqualified from receiving firearms.30 According to the FBI, records in the NICS Index are voluntarily provided by local, state, tribal, and federal agencies, and it "contains [disqualifying records] that may not be available in the NCIC or the III of persons prohibited from receiving firearms under federal or state law."31

The Brady Act also authorized the Attorney General to "secure directly from any [federal] department or agency of the United States" information on persons for whom receipt of a firearm would violate federal or state law. The act does not mandate that federal agencies disclose these records, rather it mandates that "upon request of the Attorney General, the head of such department or agency shall furnish such information to the system."32 With respect to states, which are not required to submit records to NICS, the Brady Act provided grants to "improv[e] State record systems and the sharing ... of the records ... required by the Attorney General under [the Brady Act]."33 However, it did not mandate that states turn over any specific records, even upon request.

NICS Improvement Amendments Act of 2007 (NIAA)

In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms under 18 U.S.C. §922(g) or (n), with an emphasis on providing accurate records relating to those who are prohibited under (g)(4) ("adjudicated as a mental defective") or (g)(9) ("convicted in any court of a misdemeanor crime of domestic violence").34 Moreover, it mandates that the Department of Homeland Security make available to the Attorney General any records that are related to being a prohibited possessor under federal law.35

Federal Agencies and NIAA

For federal agencies, NIAA clarifies the standard for adjudication and commitments related to mental health. It provides that no department may provide any such record if (1) the record has been set aside or the individual has been released from treatment; (2) the person has been found by the court or board to no longer suffer from the condition that was the basis of the adjudication or commitment; or (3) the adjudication or commitment is based solely on a medical finding of disability, without opportunity to be heard by a court or board.36 It also requires agencies that do make such determinations to establish a program that permits a person to apply for relief from the disabilities imposed under §922(g)(4).37

In January 2013, President Obama issued a memorandum directing all federal agencies to coordinate with the Attorney General in order to provide to NICS any relevant records, including criminal histories and information related to persons prohibited from possessing firearms for mental health reasons.38 One year later, the White House announced that since 2013 federal agencies have made over 1.2 million additional records available to NICS.39

States and NIAA

With respect to states, NIAA allows a state to be eligible for a two year waiver of the matching requirement in the National Criminal History Improvements Grant program, established under the Brady Act, if the state provides at least 90% of the records relevant to determining whether a person is disqualified from possessing a firearm under federal or applicable state law.40 To be eligible for such a waiver, other requirements include providing updates to NICS regarding any record that should be modified or removed from the system, and more detailed information regarding those who are convicted of a misdemeanor crime of domestic violence or adjudicated as a mental defective under federal law.

NIAA also provides the Attorney General discretion to award additional grants for purposes of assisting states with upgrading information identification technologies for firearms disability determinations as long as they have implemented a relief from disabilities program that meets certain requirements.41 This grant program is known as the NICS Act Record Improvement Program (NARIP).42 If a state has received a waiver or an additional grant under NIAA, the act imposes penalties for non-compliance.43 The act mandates reductions in Department of Justice Byrne Justice Assistance Grant funds and permits the Attorney General to make discretionary reduction of these funds if a state does not comply with eligibility requirements of NIAA.44

State Reporting of Prohibiting Mental Health Records to NICS

In 2012, five years after the NIAA was enacted, the Government Accountability Office (GAO) released a report that examined states' progress in reporting mental health records to the NICS databases.45 The "mental health records" reported to NICS include only individual identifiers and no actual medical information. However, as discussed in more detail below, the preparation and submission of such records by health departments and health care facilities involves the use of patient information and thus is subject to federal and, in many instances, state health privacy laws.

GAO found that the total number of mental health records that states made available to NICS databases increased approximately nine-fold from about 126,000 to 1.2 million between 2004 and 2011. However, this increase largely reflected the efforts of 12 states. According to GAO, almost half of all states increased the number of mental health records they reported by fewer than 100 over the same time period.

Both DOJ and state officials told GAO that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states' ability to report mental health records. Technological challenges include updating aging computer systems and integrating existing record systems. Several states reported using their NARIP grant funding to automate the collection and transmission of records. DOJ officials further emphasized that the technological challenges

are particularly salient for mental health records because these records originate from numerous sources within the state—such as courts, private hospitals, and state offices of mental health—and are not typically captured by any single state agency. For example, records that involve involuntary commitments to a mental institution typically originate in entities located throughout a state and outside the scope of law enforcement, and therefore a state may lack processes to automatically make these records available to the FBI.46

The fact that mental health records often originate in hospitals and health departments, which are typically not connected to law enforcement agencies that make the majority of records available to NICS, presents challenges in getting all the relevant entities to collaborate. As an example, GAO cited an April 2012 report by the state of Illinois, Office of the Auditor General, which found that for 2010, approximately 114,000 mental health records were maintained in nursing homes, private hospitals, state mental health facilities, and circuit courts. However, only about 5,000 records were reported to NICS because of a lack of coordination and other challenges. Citing privacy concerns, officials in three of the six states reviewed by GAO reported that the absence of explicit statutory authority to share mental health records was an impediment to NICS reporting.47

In a November 2011 report on NICS reporting, Mayors Against Illegal Guns (MAIG) drew conclusions that are broadly similar to those of GAO.48 MAIG interviewed officials in all 50 states and the District of Columbia and found that state reporting of mental health records to NICS is impeded by a complex set of obstacles including technological and logistical problems, privacy concerns, insufficient funding, and a lack of leadership. The MAIG report noted that even among states with strong reporting programs, there is considerable variation in the number and type of mental health records submitted to NICS. It found that states that have significantly improved their reporting in the past few years share a number of common attributes including the ability to commit funding to their efforts and effective political leadership. MAIG also found a strong association between reporting levels and enactment of state laws that require or authorize agencies to report their records. According to MAIG, nine of the 10 states that had the greatest increase in records submitted to NICS between September 2010 and October 2011 have laws or policies requiring or permitting sharing mental health records with NICS.

Impact of the HIPAA Privacy Rule on NICS Reporting

Officials in approximately half of the states told MAIG that state health privacy laws as well as the Privacy Rule promulgated by the Department of Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA) were potential obstacles to NICS reporting. In some states, officials cited privacy concerns as the primary impediment to reporting.

HIPAA Privacy Rule Overview

The HIPAA Privacy Rule established a set of federal standards to help safeguard the privacy of personal health information.49 Those standards include certain individual privacy rights, such as the right of access to one's health information and the right to request corrections, as well as limitations on the use or disclosure of personal health information. The rule applies to (1) health plans;50 (2) health care clearinghouses;51 and (3) health care providers who transmit health information electronically in connection with one of the HIPAA-covered financial or administrative transactions.52 These persons and organizations are collectively referred to as covered entities.

The Privacy Rule covers protected health information (PHI) in any form that is created or received by a covered entity. PHI is defined as individually identifiable information that relates to the past, present, or future physical or mental health of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.53

In the broadest sense, the Privacy Rule prohibits a covered entity from using or disclosing PHI except as expressly permitted or required by the rule.54 As briefly outlined below, the rule describes a range of circumstances under which it is permissible to use or disclose PHI. In all such instances covered entities can choose whether to use or disclose PHI based on their professional ethics and best judgment. The rule specifies only two circumstances when a covered entity is required to disclose PHI. A covered entity must disclose PHI to (1) the individual who is the subject of the information (i.e., patient right of access), and (2) HHS officials investigating potential violations of the rule.55 For a discussion on the proposed modification to the HIPAA Privacy Rule, see "HHS Proposal to Amend HIPAA Privacy Rule."

Generally, covered entities may use or disclose PHI for the purposes of treatment, payment, and other routine health care operations with few restrictions.56 Under other specific circumstances (e.g., disclosures to family members and friends), the rule requires covered entities to give the individual the opportunity to object to the disclosure (i.e., opt out).57 Importantly, the rule also permits the use or disclosure of PHI for several specified "national priority purposes" that are not directly connected to the treatment of the individual.58 These uses and disclosures are permitted by the rule in recognition of the important uses made of health information outside of the health care context. They include the following uses and disclosures:

  • Required by law. Covered entities may use or disclose PHI to the extent that such use or disclosure is required by (federal or state) law and the disclosure complies with and is limited to the relevant requirements of such law.59
  • Law enforcement purposes. Covered entities may disclose PHI to law enforcement officials for certain specified law enforcement purposes.60
  • Averting a serious threat to health or safety. Consistent with applicable law and standards of ethical conduct, a health care provider may use or disclose PHI if the provider in good faith believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.61
  • Specialized government functions. Covered entities may use or disclose PHI for several specified essential government functions.62

For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered entities must obtain a patient's written authorization.

As discussed above, prohibiting mental health records under the GCA are typically generated by the courts that adjudicate persons as mentally defective, and by the courts and health care providers that involuntarily commit individuals to mental health facilities. While courts are not covered entities and are not subject to the HIPAA Privacy Rule, health care providers such as hospitals and state health departments are covered by the Privacy Rule and, therefore, may not use or disclose PHI for the purpose of NICS reporting without express permission under the rule. As described below, it is necessary to look to the states to determine whether such permission exists.

Interaction of HIPAA Privacy Rule and State Privacy Laws

Although the HIPAA Privacy Rule provides a federal floor with respect to the uses and disclosures of PHI, the overall scope of the Privacy Rule may be modulated by state law. If a state requires covered entities to disclose prohibiting mental health records to NICS, the HIPAA Privacy Rule does not prohibit that disclosure.63 Therefore, the Privacy Rule is most relevant as a potential obstacle where prohibiting mental health records are held by covered entities in a state that does not require disclosure of such records to NICS. This would be the case even if the state expressly allowed, but did not explicitly require, disclosure of prohibiting mental health records to NICS because merely permissive state laws are insufficient to exempt disclosure from the HIPAA Privacy Rule. As discussed below, HHS has proposed amendments to the HIPAA Privacy Rule that would permit disclosure to NICS where a state has a permissive disclosure law.

It should also be noted that both types of entities—courts and health care providers—may also be subject to state health privacy laws that may be more protective of individually identifiable health information than the HIPAA Privacy Rule and other state-level requirements and policies. State laws that are more protective of privacy include those that prohibit or restrict a use or disclosure that would otherwise be permitted under the Privacy Rule, and those that provide individuals with greater access to their own health information. This final section of the report provides a basic overview of the different types of state privacy laws that may impact the sharing of prohibiting mental health records with NICS.

Figure 1 summarizes state laws, as of January 1, 2013, that address the reporting of mental health records for use in firearm purchaser background checks. Twenty-three states have NICS reporting mandates.64 These laws require courts and, in some instances, mental health facilities to report (1) to NICS directly, or (2) to a state agency that in turn reports to NICS. As noted above, the HIPAA Privacy Rule would not bar the mandated disclosures in these states. Note that in one of the states—Delaware—reporting by mental health facilities takes the place of court reporting (see Figure 1).

Seven states have laws that authorize, but do not require, reporting to NICS.65 In these states that do not mandate reporting, HIPAA-covered entities do not appear to have permission under the Privacy Rule to use or disclose PHI for the purpose of preparing and reporting mental health records to NICS. Absent a state reporting mandate, it is not clear that there are any other provisions in the Privacy Rule that provide such permission.

None of the three other national priority purposes in the Privacy Rule discussed earlier (under "HIPAA Privacy Rule Overview") address reporting to federal databases for the purposes of future background checks. The disclosure of PHI for law enforcement purposes has to be (1) as required by law; (2) pursuant to various specified judicial and administrative processes and procedures such as court orders, subpoenas, and summonses; or (3) in response to one of several other specified law enforcement activities.66 The Privacy Rule's provisions authorizing the use or disclosure of PHI for various specialized government functions list a number of specific activities, none of which includes reporting information to the NICS databases.67 Finally, the rule's provisions that permit the use and disclosure of PHI to avert a serious threat to health or safety focus on two types of situations, neither of which appears to include NICS reporting. The first permits the disclosure of PHI to a person or persons reasonably able to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The second concerns alerting law enforcement authorities about an individual involved in a violent crime or who has escaped from prison or lawful custody.68

An additional eight states collect mental health records pursuant to state law, but these laws do not address NICS reporting.69 Again, without a NICS reporting mandate, HIPAA-covered entities do not appear to have permission under the Privacy Rule to use PHI for the purpose of reporting mental health records to the federal databases. These states include California, which despite the absence of a NICS reporting mandate, has one of the best NICS reporting rates for mental health records. In part this is because of a state law that requires mental health facilities to report mental health records to the California Department of Justice (DOJ). That requirement effectively removes HIPAA as an impediment to such reporting by HIPAA-covered entities. While state law is silent on DOJ reporting to NICS, California has developed a reporting infrastructure and entered into an agreement with the federal government to report mental health records to NICS.

Finally, 13 states are without laws requiring or authorizing the collection or reporting of mental health records for use in firearm purchaser background checks, either at the state or federal level. Once again, HIPAA-covered entities in these states that are in possession of disqualifying mental health records appear to lack the authority under the Privacy Rule to report such information to NICS.

While a detailed examination of state-level activities is beyond the scope of this report, it should be emphasized that many states collect and use mental health records (and other relevant information) pursuant to state law or policies for their own background checks of firearm purchases. Some states are "Point-Of-Contact" (POC) states, meaning that the state agency is responsible for electronically accessing NICS and for implementing and maintaining their own Brady NICS program.70 Often times a POC state will run the background check against the state's own records, some of which may not be in NICS. In some instances, background checks conducted by POCs may be more stringent than non-POC states because they have access to more access to disqualifying records. In addition, these states could be more thorough in their background checks because statutory prohibitions on firearm possession in these states sometimes exceed the federal prohibitions under the Brady Act. However, unlike the nationwide NICS background checks, state-level checks do not capture prohibited individuals who cross state lines to purchase long guns.

HHS Proposal to Amend HIPAA Privacy Rule

On January 7, 2014, HHS's Office for Civil Rights (OCR), which administers and enforces the Privacy Rule, issued a proposed rule that would modify the HIPAA Privacy Rule "to expressly permit certain HIPAA covered entities to disclose" to NICS the identities of certain individuals who are subject to the mental health disqualification under the GCA.71

Relying on its authority under HIPAA, which provides HHS with discretion to modify the privacy standards as appropriate but not more than once a year,72 HHS proposes to add a new, narrowly tailored provision to the Privacy Rule that would expressly "permit [not require] certain covered entities to disclose the minimum necessary demographic and other information for NICS reporting purposes, which would not include clinical, diagnostic, or other mental health information" (emphasis added).73 The modification is meant to "produce clarity regarding the Privacy Rule and help make it as simple as possible for States to report the identities of such individuals to the NICS."74 It would not affect the currently existing permitted uses and disclosures of PHI under the Privacy Rule, as discussed above.75

The rule would allow only HIPAA-covered entities to report individuals who are prohibited under the federal mental health prohibitor (18 U.S.C. §922(g)(4)) and not for other disqualifying factors under the GCA. In other words, a covered entity would not be permitted to disclose identifying information to NICS for an individual who is prohibited from possessing a firearm under 18 U.S.C. §922(g)(3)—that is, an unlawful user of, or a person who is addicted to, any controlled substance—except to the extent that such drug use is connected to being "committed to a mental institution."76 HHS also notes that states may have a broader mental health prohibition related to firearms, and that information related to these state prohibitors may not be reported to NICS.77 HHS also seeks comment from states related to the scope of the proposed rule on whether HIPAA is currently perceived as a barrier to reporting to NICS about individuals who are subject to state law firearm prohibitions and whether the final rule should address this aspect.78 HHS explains, however, that broadening the scope to also encompass state law mental health prohibitors could increase the likelihood that more treating providers would be permitted to report information to NICS. As currently drafted, the new provision primarily aims to cover HIPAA-covered entities performing the relevant commitment, adjudicatory, or repository functions, and not those performing solely treatment functions.79

Other areas where HHS seeks public comment for purposes of the final rule include

  • whether there are states in which a type of entity not described in the proposed paragraph is responsible for NICS reporting and is one that needs to be able to receive NICS data from HIPAA-covered entities;
  • whether, and in what circumstances, HIPAA-covered entities or other entities such as courts currently report to a records repository or directly to NICS information that is not listed in the proposed rule;
  • what types of additional data elements—such as Social Security number, place of birth, state of residence, physical description—that HHS may permit disclosure of for purposes of reporting to NICS; and
  • the types of additional guidance that OCR and/or NICS could issue that would be helpful for understanding the proposed rule.80

Should the proposed amendments to the HIPAA Privacy Rule become final, there may be a gradual increase in the number of records shared with NICS by covered entities. It should be noted, however, that states may still lack the infrastructure, capital, or political support to establish a system that allows records to be shared with NICS or an appropriate repository that shares with NICS.81

Conclusion

During the past few years, questions have arisen with respect to the efficacy of the federal background check that is required for certain firearm transfers. Of particular congressional focus is whether enough records of individuals who are prohibited by federal law from firearm possession because they have been "adjudicated as a mental defective" are being shared with NICS, the system through which background checks are generally conducted. In particular, the question has become whether the HIPAA Privacy Rule or state privacy laws are an obstacle to the population of NICS with prohibiting mental health records.

Although the HIPAA Privacy Rule currently allows disclosure of information where state law expressly requires disclosure of records to NICS, some state officials have reported that they view state health privacy laws and the HIPAA Privacy Rule as potential obstacles to NICS reporting. In response to these concerns, HHS proposed a rule that would modify the HIPAA Privacy Rule "to expressly permit [but not require] certain HIPAA covered entities to disclose" to NICS the identities of individuals who are subject to the mental health disqualification under federal firearms law. Interestingly, HHS seeks comments from states on whether its proposed rule should also permit HIPAA-covered entities to share records with NICS regarding individuals who are prohibited from firearm possession due to mental health reasons under state firearms laws, the coverage of which may be broader than the federal mental health prohibitor.

Another question long unaddressed and unclear to states is whether the term "committed to a mental institution" includes individuals who are ordered by a court, board, or other lawful authority to receive outpatient treatment. To clarify this, DOJ also has proposed a rule that would clarify that the term includes both mandatory inpatient and outpatient commitments. Due to the perceived barriers under the HIPAA Privacy Rule, as well as uncertainties in the relevant federal definitions, states have been reluctant to share relevant mental health records with NICS. With clarifications in these areas under way, states could ultimately turn over more relevant records to NICS, though some may still be hindered by deficiencies in their technological capacity to share such records with NICS.

Figure 1. State Laws That Require or Authorize the Reporting of Mental Health Records to NICS

As of January 1, 2013

Source: Prepared by CRS based on a review and analysis of laws in all 50 states and the District of Columbia that address the reporting of mental health records for use in firearm purchaser background checks.

Note: CRS's characterization of state laws is in broad agreement with a similar analysis by the Law Center to Prevent Gun Violence—a nonprofit organization that advocates for gun-control legislation and provides legal expertise and information on U.S. gun laws—but with one key difference. Whereas the Law Center characterized Virginia as a state that authorizes but does not require reporting to NICS, CRS concluded that Virginia's law requires NICS reporting. The Law Center's analysis is available at http://smartgunlaws.org/mental-health-reporting-policy-summary/.

Author Contact Information

[author name scrubbed], Coordinator, Legislative Attorney ([email address scrubbed], [phone number scrubbed])
[author name scrubbed], Analyst in Health Policy ([email address scrubbed], [phone number scrubbed])
[author name scrubbed], Legislative Attorney ([email address scrubbed], [phone number scrubbed])
[author name scrubbed], Specialist in Health Policy ([email address scrubbed], [phone number scrubbed])

Acknowledgments

Alex C. Engler, Research Associate, prepared the figure in this report.

Footnotes

1.

See CRS Report R43004, Public Mass Shootings in the United States: Selected Implications for Federal Public Health and Safety Policy, coordinated by [author name scrubbed].

2.

Dep't of Justice, Amended Definition of "Adjudicated as a Mental Defective" and "Committed to a Mental Institution," 79 Fed. Reg. 774 (January 7, 2014) [hereinafter DOJ Proposed Rule].

3.

Dep't of Health & Human Services, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the National Instant Background Check System (NICS), 79 Fed. Reg. 784 (January 7, 2014) [hereinafter HHS Proposed Rule].

4.

This report is limited to a discussion of currently applicable law, and does not discuss proposals to revise the types of mental health records that would disqualify an individual from purchasing or possessing a firearm.

5.

P.L. 90-618 (1968) codified at 18 U.S.C. §§921 et seq.

6.

18 U.S.C. §922(g). Individuals who are under indictment for a felony are also prohibited from receiving or transporting firearms or ammunition. 18 U.S.C. §922(n).

7.

18 U.S.C. §922(g).

8.

In the 113th Congress, Senator Lindsey Graham introduced S. 480, the NICS Reporting Improvement Act of 2013, that would revise 18 U.S.C. §922(g)(4) to replace references to "mental defective" with "mentally incompetent" and "mental institution" with "psychiatric hospital." The bill would also expressly define the type of hearings that qualify for purposes of being "adjudicated mentally incompetent or ... committed to a psychiatric hospital." A full discussion of the effects of these amendments is beyond the scope of this report.

9.

27 C.F.R. §478.11. It is likely that any record that fits the definition under (b) would be related to criminal record histories that are more easily accessible by the states. However, it has been reported that a majority of states have low submission rates for the types of records that fall under subsection (a). MAIG Report.

10.

See, e.g., U.S. v. Vertz, 102 F. Supp.2d 787, 788 (W.D. Mich. 2000), aff'd on other grounds, 40 Fed. Appx. 69 (6th Cir. 2002) ("Despite the extensive evidence of medical illness, for purposes of criminal liability under the federal firearms statute, it is not sufficient that the defendant has been diagnosed as mentally ill by his treating physicians. The statute specifically requires that the individual have been adjudicated as a mental defective or committed to a mental institution.").

11.

Department of Veterans Affairs, "Privacy Act of 1974; System of Records," 76 Fed. Reg. 14119, 14122 (March 15, 2011). Pursuant to NIAA, the VA provides notice to veterans who may fall under the firearms disqualification, and the agency has established an administrative procedure that provides veterans with the ability to request relief from their firearms disability. See MR21-1MR VA Manual, Part III, Subpart v, Chapter 9 Section B, available at http://www.benefits.va.gov/WARMS/M21_1MR1.asp; Department of Veterans Affairs, Fast Letter to Regional Offices Re: Processing Requests for Relief from the Reporting Requirements of the National Instant Criminal Background Check System (NICS), available at https://docs.google.com/document/d/11ETxpq4dJiiJYcSD8KYXtVTIOhKSqg5hAilxjNQ43OY/edit?pli=1.

12.

Letter from Jonathan M. Young, Chairman, National Council on Disability, to Joseph Robinette Biden, Jr., Vice President, United States of America, January 11, 2013, http://www.ncd.gov/publications/2013/Jan142013. Legislation to prevent these types of VA records from being transferred to NICS has been introduced in the 113th Congress. See, e.g., H.R. 577 and S. 572, Veterans Second Amendment Protection Act (113th Cong., 1st sess.). In other words, these bills would allow veterans who have been appointed a fiduciary to keep their firearms.

13.

27 C.F.R. §478.11.

14.

The Judge David L. Bazelon Center for Mental Health Law, an advocacy organization that opposes involuntary outpatient commitment, has compiled a summary of state statutes allowing involuntary outpatient commitments; the summary includes a comparison with inpatient commitment statutes. See http://www.bazelon.org/LinkClick.aspx?fileticket=CBmFgyA4i-w%3D&tabid=324. For more about involuntary commitment, see National Conference of State Legislatures, Screening and Entry into Mental Health Treatment: Balancing Help for the Individual and the Community, http://www.ncsl.org/issues-research/health/screening-and-entry-into-mental-health-treatment.aspx or National Conference of State Legislatures, Mental Health: What are the issues surrounding involuntary treatment?, http://www.ncsl.org/issues-research/health/mental-health-faq.aspx#issues.

15.

Va. Code Ann. §37.2-819.

16.

N.Y. Mental Hyg. Law §9.27.

17.

U.S. v. Waters, 23 F.3d 29 (2d Cir. 1994). See also U.S. v. Vertz, 102 F. Supp. 2d at 787 ("prior hospitalization, which was supported by a second psychiatrist's certification, qualified as a commitment to a mental institution"). But see U.S. v. Giardina, 861 F.2d 1334 (5th Cir. 1988) (temporary, emergency detentions for treatment of mental disorders or difficulties, which did not lead to formal commitments under state law, did not constitute the commitment envisioned by the GCA).

18.

554 U.S. 570 (2008).

19.

U.S. v. Rehlander, 666 F.3d 45 (1st Cir. 2012).

20.

U.S. v. Chamberlain, 159 F.3d 656 (1st Cir. 1998) and U.S. v. Holt, 464 F.3d 101 (1st Cir. 2006).

21.

The term ex parte refers to a legal proceeding brought by one person in the absence of and without representation or notification of other parties.

22.

DOJ Proposed Rule, 79 Fed. Reg. 777.

23.

27 C.F.R. §478.11. The first subsection would remain relatively unchanged under the proposed rule.

24.

DOJ Proposed Rule, 79 Fed. Reg. 777.

25.

These three conditions are from Section 101(c)(1) of the NICS Improvement Amendments Act of 2007. See also "Federal Agencies and NIAA."

26.

DOJ noted that at least one court concluded that the plain language of the statute includes both inpatient and outpatient treatment because the statute requires commitment to a mental institution, not commitment in a mental institution. United States v. B.H., 466 F. Supp. 2d 1139, 1147 (N.D. Iowa 2006).

27.

DOJ Proposed Rule, 79 Fed. Reg. 776.

28.

DOJ Proposed Rule, 79 Fed. Reg. 775. The comment period closes on April 7, 2014.

29.

P.L. 103-159, §103 (1994) [hereinafter Brady Act].

30.

The NCIC is a database of documented criminal justice information that is made available to law enforcement and authorized agencies, with the goal of assisting law enforcement in apprehending fugitives, finding missing persons, locating stolen property, and further protecting law enforcement personnel and the public. The III, or "Triple I," is a computerized criminal history index pointer system that the FBI maintains so that records on persons arrested and convicted of felonies and serious misdemeanors at either the federal or state level can be shared nationally. See Federal Bureau of Investigation, National Instant Criminal Background Check System 2011 Operations Report, available at http://www.fbi.gov/about-us/cjis/nics/reports/2011-operations-report/operations-report-2011.

31.

See Federal Bureau of Investigation, Criminal Justice Information Services, National Instant Criminal Background Check System Index Brochure, available at http://www.fbi.gov/about-us/cjis/nics/general-information/nics-index.

32.

Brady Act, §103(e).

33.

Brady Act, §106. This program is known as the National Criminal History Improvement Program (NCHIP). This program is administered by the Department of Justice Bureau of Justice Statistics (BJS). See http://bjs.gov/index.cfm?ty=tp&tid=47.

34.

P.L. 110-180, §§102-104, 301 (2007) [hereinafter NIAA].

35.

NIAA, §101(b).

36.

NIAA, §101(c)(1).

37.

NIAA, §101(c)(2).

38.

Presidential Memorandum, Improving Ability of Relevant Executive Branch Records to the National Instant Criminal Background Check System (January 16, 2013), available at http://www.whitehouse.gov/the-press-office/2013/01/16/presidential-memorandum-improving-availability-relevant-executive-branch.

39.

White House Press Release, Fact Sheet: Strengthening the Federal Background Check System to Keep Hands Out of Potentially Dangerous Hands (January 3, 2014), available at http://www.whitehouse.gov/the-press-office/2014/01/03/fact-sheet-strengthening-federal-background-check-system-keep-guns-out-p.

40.

NIAA, §102.

41.

NIAA, §§103, 105.

42.

This program is also administered by the Department of Justice's BJS. See http://bjs.gov/index.cfm?ty=tp&tid=49.

43.

NIAA, §104.

44.

For more information on the Byrne Justice Assistance Grant program, see CRS Report RS22416, Edward Byrne Memorial Justice Assistance Grant (JAG) Program, by [author name scrubbed].

45.

U.S. Government Accountability Office, Gun Control: Sharing Promising Practices and Assessing Incentives Could Better Position Justice to Assist States in Providing Records for Background Checks, GAO-12-684, July 16, 2012, available at http://www.gao.gov/assets/600/592452.pdf.

46.

Id. at 11-12.

47.

Id. at 12.

48.

Mayors Against Illegal Guns, Fatal Gaps: How Missing Records in the Federal Background Check System Put Guns in the Hand of Killers, November 2011, available at http://www.mayorsagainstillegalguns.org/downloads/pdf/maig_mimeo_revb.pdf. MAIG is a coalition of mayors from more than 900 cities and towns across the United States, co-chaired by New York City Mayor Michael Bloomberg and Boston Mayor Thomas Menino. The coalition shares best practices, develops policies, and supports legislation at all levels of government to reduce the distribution of, and access to, illegal and military-style firearms in U.S. cities and towns.

49.

The HIPAA privacy rule, and accompanying general administrative and enforcement requirements, are codified at 45 C.F.R. Part 160 and Part 164, Subparts A and E.

50.

Health plans include any individual or group plan that provides or pays for medical care. The term encompasses both private and government plans. Health maintenance organizations (HMOs) and high-risk pools are specifically covered. Most employee health benefit plans are covered. See 45 C.F.R. §160.103.

51.

Health care clearinghouse is a term of art under the privacy rule. It refers to an entity (e.g., claims processor) that translates health information received from other entities either to or from the standard format that is required for electronic transactions. See 45 C.F.R. §160.103.

52.

Health care providers include any person (e.g., physician, nurse, pharmacist) or entity (e.g., hospital, clinic) that furnishes, bills, or is paid for health care in the normal course of business. To be a covered entity, a provider must conduct one or more of the HIPAA-specified transactions, such as verifying insurance coverage or filing a health claim, by transmitting health information electronically in a standard format (i.e., the provider must include certain information and use specified codes for diagnosis and treatment) required by HIPAA. Providers that rely on third-party billing services to conduct such electronic transactions on their behalf are also covered under the privacy rule. Providers that operate solely on a paper basis and do not submit insurance claims electronically are not subject to the rule. See 45 C.F.R. §160.103.

53.

45 C.F.R. §160.103.

54.

45 C.F.R. §164.502(a).

55.

Id.

56.

45 C.F.R. §164.506.

57.

45 C.F.R. §164.510.

58.

45 C.F.R. §164.512.

59.

45 C.F.R. §164.512(a).

60.

45 C.F.R. §164.512(f).

61.

45 C.F.R. §164.512(j). On January 15, 2013, HHS's Office for Civil Rights issued a letter to health care providers in which he reminded them of the privacy rule's "duty to warn" provision, which permits the disclosure of patient information to avert threats to health or safety. See http://www.hhs.gov/ocr/office/lettertonationhcp.pdf.

62.

45 C.F.R. §164.512(k).

63.

Id.

64.

AL, CO, CT, DE, GA, ID, IL, IN, IA, KS, KY, ME, MN, NV, NC, ND, NY, OR, TN, TX, WA, WI, and VA; see Figure 1.

65.

AZ, FL, MO, NE, NJ, PA, and WV; see Figure 1. In some cases, whether state law requires disclosure to NICS may be ambiguous. For example, New Jersey state law currently prohibits disclosure of commitment records disclosure except as needed to comply with the data reporting provisions of the NIAA or the Brady Act, but it is not clear that either of those laws impose any such requirements. The state is currently considering Assembly Bill No. 3717, which would amend state law to explicitly require reporting of institutionalized persons to NICS. See http://www.njleg.state.nj.us/2012/Bills/A4000/3717_I1.HTM.

66.

45 C.F.R. §164.512(k).

67.

Id.

68.

45 C.F.R. §164.512(j).

69.

AR, CA, HI, MA, MD, MI, OH and UT; see Figure 1.

70.

See Federal Bureau of Investigation, National Instant Criminal Background Check System- Participation Map, available at http://www.fbi.gov/about-us/cjis/nics/general-information/participation-map.

71.

DHS Proposed Rule, 79 Fed. Reg. 784. OCR had announced its intention to amend the rule in February 2013. See Kendra Casey Plank, "HIPAA Privacy Rule Changes Could Ease Sharing of Mental Health Records by States," Bloomberg BNA, Health Care Daily Report (February 15, 2013). In April 2013, OCR issued an advance notice of proposed rulemaking requesting public input on these issues. 78 Fed. Reg. 23872 (April 23, 2013).

72.

Any addition or modification to a standard must "be completed in a manner that minimizes the disruption and cost of compliance." 42 U.S.C. §1320d–3(b)(1).

73.

HHS Proposed Rule, 79 Fed. Reg. 792.

74.

HHS Proposed Rule, 79 Fed. Reg. 787.

75.

In its notice, HHS explains the various ways that reporting to NICS may occur under the existing HIPAA Privacy Rule. As already described in this report, disclosure to NICS is permitted to the extent a state has enacted a law requiring (not merely authorizing) such reporting. For states where there is no such law, HHS explains that reporting is still permitted under the HIPAA Privacy Rule because the rule permits a HIPAA-covered entity to achieve a hybrid status whereby it performs both health care and non-health care related functions (e.g., NICS reporting). A hybrid entity can designate its health care components as separate from other components, document that designation, and implement policies and procedures to prevent unauthorized access to PHI by the entity's non-covered components. Through its non-HIPAA-covered reporting unit, an entity with hybrid status can report to NICS prohibitor information without restriction under the Privacy Rule. HHS Proposed Rule, 79 Fed. Reg. 787.

76.

HHS Proposed Rule, 79 Fed. Reg. 792. The term "committed to a mental institution" includes commitment to a mental institution "for other reasons, such as for drug use." 27 C.F.R. §478.11

77.

For example, some states may prevent an individual from possessing a firearm if he has a particular mental health diagnosis or an assessment of "dangerousness" with correspondingly different procedural protections for individuals, or some states may temporarily prohibit firearm possession by an individual who has voluntarily committed himself to inpatient treatment. Such diagnoses may not, or treatments are not, included in reporting under the federal mental health prohibition as defined in 27 C.F.R. §478.11. HHS Proposed Rule, 79 Fed. Reg. 791.

78.

HHS Proposed Rule, 79 Fed. Reg. 791, 792.

79.

HHS Proposed Rule, 79 Fed. Reg. 794.

80.

The comment period closes March 10, 2014.

81.

See supra "State Reporting of Prohibiting Mental Health Records to NICS."