by Teresa Locke, Holland & Hart LLP

On Tuesday, January 6, 2016, the U.S. Department of Health and Human Services (the Department) issued a final rule, effective February 5, modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit – but not require – certain HIPAA covered entities to disclose to the National Instant Criminal Background System (NICS) certain personal health information (PHI) related to individuals who are subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. Among the persons subject to the Federal mental health prohibitor established under the Gun Control Act of 1968 and implementing regulations issued by the U.S. Department of Justice are individuals who have been: (a) involuntarily committed to a mental institution; (b) found incompetent to stand trial or not guilty by reason of insanity; or (c) otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease. Fearing that States might not be fully reporting relevant information to the NCIS because of actual or perceived barriers related to HIPAA, the Department enacted the revision to the Privacy Rule by adding a new category of permitted disclosures to 45 CFR 164.512(k). The new rule is narrowly tailored to appropriately balance public safety goals with important patient privacy interests to ensure that individuals are not discouraged from seeking voluntary treatment for mental health issues.

The new category of permitted disclosures is very limited in scope, applying only to a specific subset of HIPAA covered entities who, under narrow circumstances, may provide discrete personal health information to the NICS. Specifically, the new rule is limited in three ways. First, it applies only to covered entities involved in ordering involuntary commitments or other adjudications that make an individual subject to the Federal mental health prohibitor. It does not apply to disclosures about individuals who are subject to state-only mental health prohibitors. Moreover, the Federal mental health prohibitor does not apply to individuals in a psychiatric facility for observation or who have been admitted voluntarily. Thus, the new rule does not create a permission for most treating providers to disclose PHI about their own patients for these purposes. The Department recognized that encouraging voluntary treatment is critical to ensuring positive outcomes for individuals’ health as well as the public’s safety. The new rule was designed to balance that goal with public safety interests served by the NICS. Continue reading →