HIPAA Modifications to Strengthen Firearm Background Checks
By John W. Greenleaf, III

As part of the President's recently announced initiative to strengthen background checks for firearm purchases, Health and Human Services (HHS) released a modification to the HIPAA regulations. According to HHS, this modification is designed to expressly permit certain covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of those individuals who, for mental health reasons, already are prohibited by federal law from having a firearm. HHS indicates that the modification better enables the reporting of the identities of prohibited individuals to the background check system.

The final rule purports to give states improved flexibility to ensure accurate but limited information is reported to the NICS. This rulemaking makes clear that, under the privacy rule, certain covered entities are permitted to disclose limited information to the NICS. The information that can be disclosed is the limited identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs—that is, only about those who are covered under the preexisting mental health prohibitor.

The new modification is, according to HHS, narrowly tailored to preserve the patient-provider relationship and ensure that individuals are not discouraged from seeking voluntary treatment. This rule applies only to a small subset of HIPAA covered entities that either make the mental health determinations that disqualify individuals from having a firearm or are designated by their states to report this information to NICS.

The rule does not apply to most treating providers. However, given the type of information covered, and given that mental health information is specially protected under Pennsylvania law (ie, Pennsylvania's laws governing the use/disclosure of mental health information is more stringent than HIPAA's Privacy Rule), it will be interesting to see if conflicts arise, and if they do, how courts resolve them. Generally, HIPAA defers to state laws that more strictly restrict the use and disclosure of particular types of health information, and in Pennsylvania, mental health information, drug and alcohol abuse information, and HIV/AIDS related information are all specially protected by state law. Thus, it can be expected that controversies will arise in which Pennsylvania law conflicts with this new HIPAA modification. Courts addressing such conflicts will have their hands full, and legal and mental health communities will be watching closely.

— John W. Greenleaf III is a member of the health care law practice group at McNees Wallace & Nurick. He advises hospitals, physician groups, nursing homes, and other health care providers on corporate matters and joint ventures.