Gun Control HIPAA Rule Changes

On January 5, 2016, President Obama announced a series of executive actions in an effort to reduce gun violence. Most of the announced actions are designed to beef up enforcement of existing laws and to ensure more gun sales are subject to background checks of the intended purchaser.

One of the components of the executive actions is designed to allow more accurate reporting of mental health issues of individuals submitting to background checks to purchase a firearm. This measure required a modification to existing HIPAA rules to allow supplying information that pertains to existing rules to exclude an individual.

Jocelyn Samuels, the Director for the US Health and Human Services Office for Civil Rights, states in a January 4 blog post:

“Specifically, this final rule gives States improved flexibility to ensure accurate but limited information is reported to the NICS. The rulemaking makes clear that, under the Privacy Rule, certain covered entities are permitted to disclose limited information to the NICS. The information that can be disclosed is the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs.”

The NICS to which Ms. Samuels refers is the National Instant Criminal Background Check System. NICS is, essentially, the federal database used to review criminal records (and other data) to determine if a firearm can legally be transferred to an individual by a federally licensed firearms dealer.
Individual healthcare providers and healthcare groups are not affected by this rule change at all.

The reaction to the announcement was swift, including specific criticism of the HIPAA implications from Tennessee Congresswoman Marsha Blackburn. According to a Newsmax article, Ms. Blackburn says:

“If he wants to waive this and say ‘well, we want family members to have access to this information,’ but he is doing this through executive order, then what keeps the CDC [Centers for Disease Control and Prevention] from getting that information?”

The language of the new rule has no mention of either family members or the CDC. Ms. Blackburn’s point is related to her suspicion the CDC, or some other entity, will gain undue access to privileged patient information that is currently excluded from sharing under HIPAA regulations.

The rule change specifically rules out any further expansion of “covered entities” that may use or disclose protected health information except for the singular purpose of reporting to the NICS. Could the CDC eventually become one of those entities reporting to the NICS? The language of the rule change seems to leave that open.

However, a significant distinction missed by Ms. Blackburn is that a larger quantity of privileged information would not be provided TO any other entity, government or otherwise. The revised language specifies a one-way flow to the NCIS to increase the accuracy of the data upon which background checks are based.

Diagnostic and clinical information is specifically excluded from being reported. The only information that may be reported to the NCIS is the limited demographic information required to accurately identify the individual involved and the other information that is specific to the reason that person should be excluded from purchasing a firearm.

The intent of the HIPAA rule change is to include reporting of situations whereby an individual is ALREADY excluded from purchasing a firearm. No additional restrictions are spelled out. Samuels, in her blog post, writes:

“The information that can be disclosed is the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs.”

Local agencies, including law enforcement and court systems, will now be enabled and expected to report only very specific information to the NICS to strengthen the veracity of the information in that database when deciding whether an individual should be sold a weapon.

Complying with the new actions is meeting some legislative resistance from state government. In Arizona, for example, a measure (HB 2024) has been introduced that would preclude any state or local entity in the state from cooperating with the new HIPAA rules. The bill, in fact, precludes cooperating with any federal rules not “passed by Congress”, which certainly excludes any executive order through the executive branch.

The level of increased effectiveness (in reducing gun violence) of these changes will, because reporting is not mandatory, be directly related to the level of cooperation from local courts and governments to share pertinent mental health information with the NCIS. Clearly, some localities will resist.

The new HIPAA rules become effective February 5, 2016.

(click here for Federal Register document with HIPAA changes)

MedTunnel is a free HIPAA compliant messaging service – which allows you to send messages, documents and images containing protected health information (PHI) – just like email and text messaging.  It allows providers and patients to communicate and exchange PHI using their computers and mobile devices. Visit us at www.medtunnel.com.