[Federal Register Volume 79, Number 4 (Tuesday, January 7, 2014)]
[Proposed Rules]
[Pages 784-796]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2014-00055]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Part 164
Health Insurance Portability and Accountability Act (HIPAA)
Privacy Rule and the National Instant Criminal Background Check System
(NICS)
AGENCY: Office for Civil Rights, Department of Health and Human
Services.
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: The Department of Health and Human Services (HHS or ``the
Department'') is issuing this notice of proposed rulemaking to modify
the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Privacy Rule to expressly permit certain HIPAA covered entities to
disclose to the National Instant Criminal Background Check System
(NICS) the identities of individuals who are subject to a Federal
``mental health prohibitor'' that disqualifies them from shipping,
transporting, possessing, or receiving a firearm. The NICS is a
national system maintained by the Federal Bureau of Investigation (FBI)
to conduct background checks on persons who may be disqualified from
receiving firearms based on federally prohibited categories or State
law. Among the persons subject to the Federal mental health prohibitor
are individuals who have been involuntarily committed to a mental
institution; found incompetent to stand trial or not guilty by reason
of insanity; or otherwise have been determined by a court, board,
commission, or other lawful authority to be a danger to themselves or
others or to lack the mental capacity to contract or manage their own
affairs, as a result of marked subnormal intelligence or mental
illness, incompetency, condition, or disease. Under this proposal, only
covered entities with lawful authority to make adjudication or
commitment decisions that make individuals subject to the Federal
mental health prohibitor, or that serve as repositories of information
for NICS reporting purposes, would be permitted to disclose the
information needed for these purposes. This disclosure would be
restricted to limited demographic and certain other information and
would not include medical records, or any mental health information
beyond the indication that the individual is subject to the Federal
mental health prohibitor. HHS notes that the Department of Justice
(DOJ) has proposed clarifications to the regulatory definitions
relevant to the Federal mental health prohibitor. The DOJ proposal is
published elsewhere in this issue of the Federal Register. While
commenters should consider this proposed regulation in light of the
clarifications proposed in DOJ's proposal, we note that those
clarifications would not change how this proposed HIPAA permission
would operate.
DATES: Submit comments on or before March 10, 2014.
ADDRESSES: Written comments may be submitted through any of the methods
specified below. Please do not submit duplicate comments.
Federal eRulemaking Portal: You may submit electronic
comments at http://www.regulations.gov. Follow the instructions for
submitting electronic comments. Attachments should be in Microsoft
Word, WordPerfect, or Excel; however, we prefer Microsoft Word.
Regular, Express, or Overnight Mail: You may mail written
comments (one original and two copies) to the following address only:
U.S. Department of Health and Human Services, Office for Civil Rights,
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building,
Room 509F, 200 Independence Avenue SW., Washington, DC 20201.
Hand Delivery or Courier: If you prefer, you may deliver
(by hand or courier) your written comments (one original and two
copies) to the following address only: Office for Civil Rights,
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building,
Room 509F, 200 Independence Avenue SW., Washington, DC 20201. (Because
access to the interior of the Hubert H. Humphrey Building is not
readily available to persons without federal government identification,
commenters are encouraged to leave their comments in the mail drop
slots located in the main lobby of the building.)
Inspection of Public Comments: All comments received before the
close of the comment period will be available for public inspection,
including any personally identifiable or confidential business
information that is included in a comment. We will post comments
received before the close of the comment period at http://www.regulations.gov. Because
[[Page 785]]
comments will be made public, they should not include any sensitive
personal information, such as a person's social security number; date
of birth; driver's license number, State identification number or
foreign country equivalent; passport number; financial account number;
or credit or debit card number. Comments also should not include any
sensitive health information, such as medical records or other
individually identifiable health information, or any non-public
corporate or trade association information, such as trade secrets or
other proprietary information.
FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.
SUPPLEMENTARY INFORMATION:
I. Background
On January 16, 2013, President Barack Obama announced 23 executive
actions aimed at curbing gun violence across the nation. Those actions
include efforts by the Federal government to strengthen the national
background check system, and a specific commitment to ``[a]ddress
unnecessary legal barriers, particularly relating to the Health
Insurance Portability and Accountability Act, that may prevent States
from making information available to the background check system.'' The
National Instant Criminal Background Check System (NICS) is the system
used to determine whether a potential firearms recipient is statutorily
prohibited from possessing or receiving a firearm. The Department
developed this NPRM to propose a modification to the HIPAA Privacy Rule
to permit certain covered entities to disclose to the NICS the
identities of persons who are not allowed to possess or receive a
firearm because they are subject to the Federal mental health
prohibitor. The Department, through this NPRM, is soliciting public
input on various issues, including whether it should modify the HIPAA
Privacy Rule to permit covered entities to disclose to the NICS the
identities of persons prohibited by State law from possessing or
receiving a firearm for reasons related to mental health.
The National Instant Criminal Background Check System (NICS)
The Brady Handgun Violence Prevention Act of 1993, Public Law 103-
159, and its implementing regulations, are designed to prevent the
transfer of firearms by licensed dealers to individuals who are not
allowed to possess or receive them as a result of restrictions
contained in either the Gun Control Act of 1968, as amended (Title 18,
United States Code, Chapter 44), or State law. The Gun Control Act
identifies several categories (known as ``prohibitors'') of individuals
\1\ who are prohibited from engaging in the shipment, transport,
receipt, or possession of firearms, including convicted felons and
fugitives. Most relevant for the purposes of this NPRM is the Federal
mental health prohibitor, which, pursuant to Department of Justice
(DOJ) regulations, applies to individuals who have been involuntarily
committed to a mental institution, for reasons such as mental illness
or drug use; \2\ found incompetent to stand trial or not guilty by
reason of insanity; or otherwise have been adjudicated by a court,
board, commission, or other lawful authority to be a danger to
themselves or others or unable to manage their own affairs, as a result
of marked subnormal intelligence, or mental illness, incompetency,
condition, or disease.\3\
---------------------------------------------------------------------------
\1\ See 18 U.S.C. 922(g) and (n) and implementing regulations at
27 CFR 478.11 and 27 CFR 478.32.
\2\ The regulation, at 27 CFR 478.11, defines ``Committed to a
mental institution'' as: A formal commitment of a person to a mental
institution by a court, board, commission, or other lawful
authority. The term includes a commitment to a mental institution
involuntarily, commitment for mental defectiveness or mental
illness, as well as commitments for other reasons, such as for drug
use. The term does not include a person in a mental institution for
observation or a voluntary admission to a mental institution. Note
that DOJ has proposed clarifications to this regulatory language,
which are published elsewhere in this issue of the Federal Register.
\3\ The term used in the statute, ``adjudicated as a mental
defective,'' is defined by regulation to include: ``(a) A
determination by a court, board, commission, or other lawful
authority that a person, as a result of marked subnormal
intelligence, or mental illness, incompetency, condition, or
disease: (1) Is a danger to himself or to others; or (2) lacks the
mental capacity to contract or manage his own affairs.'' The term
includes a finding of insanity in a criminal case, and a finding of
incompetence to stand trial or a finding of not guilty by reason of
lack of mental responsibility pursuant to the Uniform Code of
Military Justice. 27 CFR 478.11. Note that DOJ has proposed
clarifications to this regulatory language, which are published
elsewhere in this issue of the Federal Register. We also note that
having ``marked subnormal intelligence or mental illness,
incompetency, condition, or disease,'' is one necessary element of a
determination that an individual (other than an individual who has
been involuntarily committed) is subject to the Federal mental
health prohibitor. To be subject to the Federal mental health
prohibitor, such an individual also must be adjudicated to pose a
danger to self or others or lack the mental capacity to contract or
manage their own affairs.
---------------------------------------------------------------------------
The Brady Act established the NICS to help enforce these
prohibitions, as well as State law prohibitions on the possession or
receipt of firearms.\4\ The NICS Index, a database administered by the
Federal Bureau of Investigation (FBI), collects and maintains certain
identifying information about individuals who are subject to one or
more Federal prohibitors and thus are ineligible to purchase
firearms.\5\ As of 2012, the NICS Index also contains information on
persons who are subject to State law prohibitions on the possession or
receipt of firearms. The minimum information required in a NICS Index
record consists of: The name of the ineligible individual; the date of
birth; sex; and codes indicating the applicable prohibitor, the
submitting entity, and the agency record supporting the prohibition.
For individuals subject to the Federal mental health prohibitor, only
the fact that the individual is subject to that prohibitor is submitted
to the NICS; underlying diagnoses, treatment records, and other
identifiable health information are not provided to or maintained by
the NICS. A NICS background check queries the NICS Index and certain
other national databases \6\ to determine whether a prospective buyer's
identifying information matches any prohibiting records contained in
the databases. The NICS Index can be accessed only for the limited
purposes authorized by regulation (see 28 CFR 25.6(j)) and cannot be
used for other purposes, including general law enforcement activities.
---------------------------------------------------------------------------
\4\ See 28 CFR 25.1 through 25.11 (establishing NICS information
system specifications and processes) and 27 CFR part 478
(establishing requirements and prohibitions for commerce in firearms
and ammunition, including requirements related to conducting NICS
background checks).
\5\ Additionally, in 2012 the NICS Index began to include the
identities of persons who are prohibited from possessing or
acquiring firearms by State law, which in some cases may be more
restrictive than Federal law. See Statement Before the Senate
Judiciary Committee, Subcommittee on Crime and Terrorism at a
hearing entitled, ``THE FIX GUN CHECKS ACT: BETTER STATE AND FEDERAL
COMPLIANCE, SMARTER ENFORCEMENT'' (November 15, 2011), by David
Cuthbertson, Assistant Director, Criminal Justice Information
Services Division, Federal Bureau of Investigation. Testimony
available at: http://www.justice.gov/ola/testimony/112-1/11-15-11-fbi-cuthbertson-testimony-re-the-fix-gun-checks-act.pdf.
\6\ The other databases include the Interstate Identification
Index, which contains criminal history record information; and the
National Crime Information Center, which includes, e.g., information
on persons subject to civil protection orders and arrest warrants.
Additional information is available at, http://www.fbi.gov/about-us/cjis/nics/general-information/nics-overview.
---------------------------------------------------------------------------
The potential transfer of a firearm from a Federal Firearms
Licensee (FFL) to a prospective buyer proceeds as follows: First, the
prospective buyer is required to provide personal information on a
Firearms Transaction Record (ATF Form 4473). Unless the prospective
buyer has documentation that he or she qualifies for an exception to
the NICS background check
[[Page 786]]
requirement under 18 U.S.C. 922(t)(3),\7\ the FFL contacts the NICS--
electronically, by telephone, or through a State level point of
contact--and provides certain identifying information about the
prospective buyer from ATF Form 4473.\8\ Within about 30 seconds, the
FFL receives a response that the prospective firearm transfer may
proceed or is delayed. The transfer is delayed if the prospective
buyer's information matches a record contained in one of the databases
reviewed. If there is a match, a NICS examiner reviews the record to
determine whether the information it contains is, in fact, prohibiting,
and then either: (1) If the record does not contain prohibiting
information, advises the FFL to proceed with the transaction; (2) if
the record does contain prohibiting information, denies the transaction
(due to ineligibility); or (3) if it is unclear based solely on the
existing information in the record whether it is prohibiting, delays
the transaction pending further research.\9\ The NICS examiner does not
disclose the reason for the determination to the FFL (e.g., the FFL
would not learn that the individual was ineligible due to the Federal
mental health prohibitor). In case of a delay, if the NICS examiner
does not provide a final instruction to the FFL within three business
days of the initial background check request, the FFL may proceed with
the transaction if it chooses to do so.\10\
---------------------------------------------------------------------------
\7\ These exceptions are listed in the ATF regulation at 27 CFR
478.102(d). For example, a NICS check would not be required where
the potential recipient of a firearm has presented a valid State
permit or license, provided conditions at 27 CFR 478.102(d)(1) are
met.
\8\ The form collects the prospective buyer's name; demographic
information such as address, place and date of birth, gender,
citizenship, race and ethnicity; and ``yes'' or ``no'' answers to
questions about the person's criminal history and other potential
prohibitors. The form is available at http: //www.atf.gov/forms/download/atf-f-4473-1.pdf.
\9\ For example, a ``delay'' response may mean that further
research is required because potentially prohibitive criteria exist,
but the matched records are incomplete, See Federal Bureau of
Investigation (FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
\10\ Some States have waiting periods that also must be complied
with before a firearm may be transferred, regardless of whether a
proceed response from NICS is received by the FFL within three
business days.
---------------------------------------------------------------------------
Although FFLs are required in most cases to request a background
check through the NICS before transferring a firearm to a prospective
buyer,\11\ Federal law does not require State agencies to report to the
NICS the identities of individuals who are prohibited from purchasing
firearms, and not all States report complete information to the NICS or
the databases checked by it. Following the shooting at Virginia Tech
University in 2007, and other tragedies involving the illegal use of
firearms, Congress enacted the NICS Improvement Amendments Act (NIAA)
of 2008, Public Law 110-180. Among other provisions, the NIAA requires
Federal agencies to make accessible to the NICS the identities of
individuals known by the agencies to be subject to one or more
prohibitors, and it authorizes incentive grants for States to provide
such information when it is in their possession.\12\ In addition, some
States enacted legislation requiring the reporting of the identities of
ineligible individuals to databases accessible to the NICS or to a
State level repository responsible for submitting information to the
relevant databases. Although the States generally report criminal
history and related information to the appropriate FBI-maintained
databases that are checked by the NICS, many States continue to report
little if any information to the NICS Index, so the NICS does not have
access to complete information about all individuals who are subject to
one or more of the Federal prohibited categories or prohibited from
possessing or receiving firearms under State law.\13\
---------------------------------------------------------------------------
\11\ See 27 CFR 478.102. Exceptions to this requirement are
referenced in FN 7 above, and listed in the regulation at 27 CFR
478.102(d).
\12\ Eligibility for these grants is limited to States that have
implemented a relief from disabilities program for individuals who
are prohibited from possessing or receiving firearms for mental
health reasons. Such programs must provide that a State court,
board, commission, or other lawful authority shall grant the relief
if, based on the circumstances regarding the disabilities and the
person's record and reputation, the person is not likely to pose a
danger to public safety, and granting the relief would not be
contrary to the public interest. See Public Law 110-180, Section
105.
\13\ The same is true of the other two databases accessed during
a NICS Check, the III and NCIC. State participation and reporting to
those databases is also not required.
---------------------------------------------------------------------------
The HIPAA Privacy Rule and NICS Reporting
The Privacy Rule, promulgated under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle
F--Administrative Simplification, Public Law 104-191, establishes
federal protections to ensure the privacy and security of protected
health information and establishes an array of individual rights with
respect to one's own health information. HIPAA applies to covered
entities, which include health plans, health care clearinghouses, and
health care providers that conduct certain standard transactions (such
as billing insurance) electronically. HIPAA covered entities may only
use and disclose protected health information with the individual's
written authorization, or as otherwise expressly permitted or required
by the HIPAA Privacy Rule.
The Privacy Rule seeks to balance individuals' privacy interests
with important public policy goals including public health and safety.
In doing so, the Privacy Rule allows, subject to certain conditions and
limitations, uses and disclosures of protected health information
without individuals' authorization for certain law enforcement
purposes, to avert a serious threat to health or safety, and where
required by State or other law, among other purposes. See 45 CFR
164.512.
As stated above, individuals who are subject to the Federal mental
health prohibitor are ineligible to purchase a firearm because they
have been ``committed to a mental institution'' or ``adjudicated a
mental defective'', 18 U.S.C. 922(g)(4). DOJ regulations define these
categories to include persons who have been involuntarily committed to
a mental institution for reasons such as mental illness or drug use;
have been found incompetent to stand trial or not guilty by reason of
insanity; or otherwise have been adjudicated by a court, board,
commission, or other lawful authority to be a danger to themselves or
others or unable to manage their own affairs, as a result of marked
subnormal intelligence, or mental illness, incompetency, condition, or
disease.\14\ Records of individuals adjudicated as incompetent to stand
trial, or not guilty by reason of insanity, originate with entities in
the criminal justice system, and these entities are not HIPAA covered
entities. Likewise, involuntary civil commitments usually are made by
court order, and thus, records of such formal commitments typically
originate with entities in the justice system. In addition, many
adjudications determining that individuals pose a danger to themselves
or others, or are incapable of managing their own affairs, occur
through a legal process in the court system.
---------------------------------------------------------------------------
\14\ As noted above, DOJ has proposed clarifications to the
regulatory language relevant to these two categories; the DOJ
proposal is published elsewhere in this issue of the Federal
Register.
---------------------------------------------------------------------------
However, because of the variety of State laws, there may be State
agencies, boards, commissions, or other lawful authorities outside the
court system that are involved in some involuntary commitments or
mental health adjudications that make an individual subject to the
Federal mental health prohibitor. Moreover, we understand that some
States have designated repositories to collect and report to the
[[Page 787]]
NICS the identities of individuals subject to the Federal mental health
prohibitor. We currently do not have sufficient data to determine to
what extent any of these lawful authorities or repositories also may be
a HIPAA covered entity (e.g., a State health agency).
Even in circumstances where records are subject to HIPAA--for
example, where the record of an involuntary commitment or mental health
adjudication originates with a HIPAA covered entity, or the HIPAA
covered entity is the State repository for such records--there are ways
in which the Privacy Rule permits the reporting to the NICS. In
particular, the Privacy Rule permits the covered entity to disclose the
information to the NICS to the extent the State has enacted a law
requiring (not merely authorizing) such reporting.\15\ Alternatively,
where there is no State law requiring reporting, the Privacy Rule
permits a HIPAA covered entity that performs both health care and non-
health care functions (e.g., NICS reporting) to become a hybrid entity
and thus, have the HIPAA Privacy Rule apply only to its health care
functions. The entity achieves hybrid entity status by designating its
health care components as separate from other components, documenting
that designation, and implementing policies and procedures to prevent
unauthorized access to protected health information by the entity's
non-covered components. Thus, an entity that has designated itself a
hybrid entity, in accordance with the Privacy Rule,\16\ can report
prohibitor information through its non-HIPAA covered NICS reporting
unit without restriction under the Privacy Rule.
---------------------------------------------------------------------------
\15\ See 45 CFR 164.512(a). Note that disclosures for NICS
purposes would not fall under the Privacy Rule's provisions
permitting disclosures for law enforcement purposes (which apply to
specific law enforcement inquiries) or to avert a serious threat to
health or safety (which require an imminent threat of harm). See 45
CFR 164.512(f) and (j).
\16\ See 45 CFR 164.103, 164.105.
---------------------------------------------------------------------------
However, many States still are not reporting to the NICS essential
information on persons prohibited from possessing firearms for reasons
related to mental health. Thus, concerns have been raised that the
HIPAA Privacy Rule's restrictions on covered entities' disclosures of
protected health information may be preventing certain States from
reporting the relevant information to the NICS. Further, in July 2012,
the U.S. Government Accountability Office (GAO) reported to Congress on
the results of a survey of six States that it had assessed as part of a
performance audit of the progress made by DOJ and the States in
implementing the NIAA.\17\ In the report, the GAO wrote that, ``. . .
officials from 3 of the 6 States we reviewed said that the absence of
explicit State-level statutory authority to share mental health records
was an impediment to making such records available to NICS.'' \18\ The
report also stated that, although the number of records provided by the
States to the NICS had increased by 800 percent between 2004 and 2011,
this increase was largely due to efforts by only 12 States. The report
raised the possibility that States that do not report to the NICS the
identities of individuals who are prohibited from possessing firearms
for reasons related to mental health may experience challenges to
reporting related to the HIPAA Privacy Rule.
---------------------------------------------------------------------------
\17\ See GAO-12-684, Gun Control: Sharing Promising Practices
and Assessing Incentives Could Better Position Justice to Assist
States in Providing Records for Background Checks.
\18\ We note that the GAO Report uses the term ``mental health
records'' to refer to identifying information on individuals who are
subject to the Federal mental health prohibitor. To avoid implying
that mental health records are collected by NICS, the Department
uses the terms ``identities,'' ``information,'' or ``data'' in place
of ``mental health records.'' GAO-12-684, p. 12.
---------------------------------------------------------------------------
II. The ANPRM
Background
On April 23, 2013, the Department published an Advance Notice of
Proposed Rulemaking (ANPRM) requesting public input on these issues (78
FR 23872). The ANPRM explained that the Department was considering
creating an express permission in the HIPAA Privacy Rule for reporting
information relevant to the Federal mental health prohibitor to the
NICS by those HIPAA covered entities responsible for involuntary
commitments or the adjudications that would subject individuals to the
Federal mental health prohibitor, or that are otherwise designated by
the States to report to the NICS. In the ANPRM, the Department
indicated that such an amendment might produce clarity regarding the
Privacy Rule and help make it as simple as possible for States to
report the identities of such individuals to the NICS.
The ANPRM stated that, in crafting the elements of an express
permission, the Department would consider limiting the information to
be disclosed to the minimum information necessary for NICS purposes,
such as the names of the individuals who are subject to the Federal
mental health prohibitor, demographic information such as dates of
birth, and codes identifying the reporting entity and the relevant
prohibitor. We indicated that the NICS does not include, and we would
not consider permitting the disclosure of, an individual's treatment
record or any other clinical or diagnostic information for this
purpose. In addition, we would consider permitting disclosures for NICS
purposes only by those covered entities that order involuntary
commitments, perform relevant mental health adjudications, or are
otherwise designated as State repositories for NICS reporting purposes.
To inform our efforts to address any issues in this area, we
requested comments on a series of questions concerning the nature and
scope of the problem of underreporting. The questions included:
The nature and extent of States' participation in NICS
reporting;
To what extent HIPAA is perceived as a barrier to
reporting, and specific examples of situations in which reporting to
the NICS is hindered by HIPAA requirements;
Steps States may have taken to address HIPAA challenges
for reporting, including any statutory or regulatory changes at the
State level;
Whether States had designated any HIPAA covered agencies
as repositories of information for NICS reporting purposes and, if so,
how the States have addressed HIPAA requirements while reporting;
Whether certain HIPAA covered entities in the States have
authority to order involuntary commitments or perform other
adjudications that make an individual subject to the Federal mental
health prohibitor;
Whether additional, non-HIPAA related barriers to
reporting exist;
Whether there are privacy protections in place for data
collected for NICS reporting purposes, and whether or how State public
records laws would apply to the information;
Whether creating an express permission would have
implications for treatment, and whether there would be ways to mitigate
any unintended consequences of creating such a permission; and
How HHS could disseminate information or provide
additional guidance on the HIPAA Privacy Rule to address confusion
about HIPAA that may affect reporting to the NICS.
We requested comments from all stakeholders on these issues,
including HIPAA covered entities; agencies of State, territorial, and
tribal governments; law enforcement officials; individuals; and
consumer advocates and groups.
[[Page 788]]
III. Public Comments on the ANPRM
Introduction
The Department received over 2,050 comments in response to the
ANPRM. Commenters included individuals, State agencies, health care
providers, professional organizations, consumer advocacy groups, and
other stakeholders.
Individuals generally expressed concern that the NICS, the Federal
mental health prohibitor, and the contemplated HIPAA permission, would
infringe on their Second Amendment right to bear arms and the right to
be afforded due process of law under the U.S. Constitution
Many individual commenters, as well as health care providers,
organizations representing providers, and consumer advocacy groups,
emphasized the importance of protecting individuals' health information
privacy and raised concerns regarding the possible adverse consequences
an express permission could have on the patient-provider treatment
relationship and individuals' willingness to seek needed mental health
care. Other commenters supported the proposal as removing a perceived
barrier to an important and necessary public safety measure. Four State
agencies and several organizations representing State officials and
State-based professional organizations responded to the specific
questions in the ANPRM regarding how NICS reporting occurs in those
specific States and their perceptions of HIPAA-related barriers or
other challenges related to NICS reporting. We discuss these comments,
along with others, in more detail below.
Summary of Comments and Responses
A. Concerns Regarding the NICS and the Federal Mental Health Prohibitor
As noted above, a majority of individual commenters voiced general
concern that NICS reporting would lead to infringements on individuals'
rights to bear arms and to receive due process of law under the
Constitution. Some commenters voiced opposition to any restriction on
their right to bear arms.
Many commenters raised concerns with the Federal mental health
prohibitor category itself. Some, while supportive of the general
proposition that individuals who pose a risk of harm to themselves or
others should not have access to firearms, expressed concern that the
Federal mental health prohibitor was overly broad and would result in
individuals being reported to the NICS Index who do not pose a threat
to society. A number of these commenters expressed concern regarding
the standard used to determine whether individuals should be reported
to the NICS, including those adjudicated as ``lack[ing] the mental
capacity to contract or manage his own affairs'' under 27 CFR 478.11.
Several commenters were especially concerned that the prohibitor might
include individuals who are adjudicated as temporarily unable to
independently manage their Veterans or Supplemental Security Income
(SSI) benefits.
Further, many commenters asserted that mental illness is not an
effective predictor of gun violence, and that there is no direct
correlation between reporting individuals with mental illnesses to the
NICS Index and a reduction in gun violence. Several commenters added
that studies have shown that individuals with mental disorders are more
likely to be the victims of violent crime by others than the
perpetrators. In addition, some commenters specifically objected to
individuals that fall within the Federal mental health prohibitor being
reported to the NICS on the grounds that the NICS is a ``criminal''
database.
Many commenters expressed concerns about whether individuals who
are subject to the Federal mental health prohibitor receive due
process. For example, many individuals were concerned that an
individual would be reported to the NICS without a formal adjudication
through the judicial system. A few commenters argued that any
determination that would subject an individual to the Federal mental
health prohibitor should include a review by one or more mental health
professionals. In general, commenters urged the Department to allow
reporting of only those involuntary commitments that involve due
process of law.
State officials and many other commenters emphasized the importance
of establishing mechanisms to remove an individual's name from the NICS
when the basis for their inclusion no longer applies. Some of these
commenters also expressed concern about the difficulty, including the
cost and time involved, of getting an erroneous submission removed from
the NICS database. Several commenters noted that individuals whose
conditions or circumstances change would not have a process to seek
removal from the NICS.
A few commenters suggested that, in addition to the minimum
information currently needed to report an individual to the NICS,
covered entities should also be permitted to disclose the date of the
disqualifying event. This, they asserted, would make it easier for
individuals to determine whether the report was made erroneously.
We acknowledge the concerns of these commenters. However, this
proposed rule would not affect the scope of the NICS or the Federal
mental health prohibitor. Rather, the rule is intended to address
perceptions that HIPAA creates a barrier to entities reporting
information to the NICS. More specifically, it would create a way in
which covered entities involved in reporting or collecting NICS data
may disclose, consistent with the Privacy Rule, the information needed
for NICS reporting. It will not expand the categories of prohibited
persons or modify other Federal or State laws pertaining to firearms
purchases, but would be limited to those covered entities that
currently perform the adjudications that make individuals subject to
the Federal mental health prohibitor, or that collect information
regarding such adjudications on behalf of a State.
Further, the Department clarifies that the proposed HIPAA
permission for NICS reporting would be limited to reporting of
individuals who are subject to the Federal mental health prohibitor, as
defined in Federal law and regulations. DOJ regulations state that this
would not include individuals in a mental institution for observation
or admitted voluntarily. See 27 CFR 478.11 (Definitions).\19\ Thus,
individuals who are subject to the Federal mental health prohibitor are
afforded the opportunity for judicial review or other due process.
---------------------------------------------------------------------------
\19\ DOJ has proposed clarifications to 27 CFR 478.11. The DOJ
proposal is published elsewhere in this issue of the Federal
Register. The proposed regulatory text would not alter this aspect
of the definition of ``committed to a mental institution.''
---------------------------------------------------------------------------
We acknowledge the commenters' concerns with respect to
opportunities for remediation and note that individuals who believe
they are wrongly denied the purchase of a firearm can visit https://forms.fbi.gov/nics-appeals-request-form to find out more information
and appeal their denial. Further, some States have implemented programs
providing for relief from disabilities under the Federal mental health
prohibitor. Relief from disabilities is a process by which an
individual, who would otherwise be prohibited from purchasing a firearm
under the Federal mental health prohibitor, may apply to the lawful
authority in the State where the commitment or adjudication occurred
for relief. The lawful authority must grant relief if it can be
established that the circumstances regarding the disability and the
applicant's record and reputation are such that the applicant
[[Page 789]]
will not be likely to act in a manner dangerous to public safety, and
the granting of relief would not be contrary to the public interest.
States' processes for granting relief vary.
B. Comments Regarding NICS Reporting Barriers and Creating an Express
Permission in the HIPAA Privacy Rule
1. State Processes for Reporting to the NICS
Health agencies from three States responded to the ANPRM's specific
questions regarding NICS reporting in those States. An official from
the Washington State Department of Social and Health Services explained
that a HIPAA covered State agency had been responsible for reporting to
the NICS until 2009, when a new State law transferred reporting
responsibility to the State's Administrative Office of the Courts.
Officials from the Colorado Department of Health Care Policy and
Financing and the North Carolina Department of Health and Human
Services stated that non-HIPAA covered entities in those States are
responsible for reporting to the NICS (the State Bureau of
Investigation and the county Clerks of Court, respectively). Three of
the State agency commenters added that entities in their States also do
not experience any other, non-HIPAA related, barriers to reporting to
the NICS.
2. Creating an Express Permission
Two of the State agency commenters agreed with our statement in the
ANPRM that creating an express permission in HIPAA for disclosures to
the NICS would resolve any perceived ambiguity and be generally
beneficial. Several other commenters agreed, and asserted that an
individual's right to the privacy of his or her medical records should
not be placed ahead of the safety and welfare of the population as a
whole. A few commenters noted that HIPAA was intended to protect the
privacy of individuals' health information, not to protect individuals
from being identified as potential threats to others.
In addition, the Law Center to Prevent Gun Violence reported that,
while a majority of States have enacted laws relating to reporting
information to the NICS or a State repository, HIPAA continues to be
cited as a perceived barrier to reporting to the NICS in a number of
States. This commenter suggested that the perception of a barrier may
arise because HIPAA's permission for uses and disclosures that are
required by law would not permit HIPAA covered entities to disclose
information for NICS purposes in States that have enacted laws
authorizing, but not requiring, such reporting. Further complicating
disclosures to the NICS, according to this commenter, is the fact that
at least eleven States rely, at least in part, on a mental health
facility to report information on individuals in a prohibited category.
This commenter reported that all of those States have statutes
requiring such reporting, but noted that some of the State laws only
require reporting to State repositories, and not to the NICS database.
Finally, the National Center for State Courts asserted that reporting
to the NICS by entities in a State's judicial system can be challenging
due to varying interpretations as to whether or when HIPAA may affect
such reporting. This commenter felt an express permission under HIPAA
would help resolve this perceived ambiguity.
Some commenters agreed that, if a permission were created, HIPAA's
minimum necessary provisions should apply to any disclosures for
reporting to the NICS database. These commenters appreciated the
Department's assurance that an individual's treatment record, or any
other clinical or diagnostic information, is not needed for the NICS,
and we would not consider permitting the disclosure of such information
under a proposed rule.
In addition, several commenters urged that any HIPAA exception be
limited to reporting of ``commitments'' as defined by 27 CFR 478.11, as
these commenters noted, there exists a great variance under State law
as to what constitutes a commitment. Several commenters requested
clarification on what constitutes a commitment under the Federal mental
health prohibitor. One commenter specifically urged the Department to
not amend the HIPAA Privacy Rule until the DOJ revises the Gun Control
Act regulations to clarify the standards under which an individual
becomes subject to a statutory prohibitor.\20\
---------------------------------------------------------------------------
\20\ We note that DOJ has proposed clarifications to the
relevant regulations defining the categories of persons who are
prohibited from possessing firearms. The DOJ proposal is published
elsewhere in this issue of the Federal Register.
---------------------------------------------------------------------------
A number of commenters argued that the proposed permission was
unnecessary, some agreeing with the ANPRM's statement that HIPAA's
existing permissions (e.g., for uses and disclosures required by State
law) largely permit NICS reporting to take place. However, it should be
noted that several commenters expressed, and thus may have based their
comments on, the misconception that the Privacy Rule's permission to
disclose for public health purposes, law enforcement purposes, or to
prevent a serious and imminent threat, currently allow for disclosures
to the NICS. As we noted in the ANPRM, NICS reporting would not be
consistent with the conditions the HIPAA Privacy Rule places on such
uses and disclosures. See conditions listed at 45 CFR 164.512(b), (f),
and (j).
Many commenters believed a change to the Privacy Rule to be
unnecessary because the information generally is reported to the NICS
by non-HIPAA covered entities. One commenter pointed out that, even in
States that allow mental health providers to commit individuals without
prior adjudication, in which case a HIPAA covered provider might be the
sole possessor of certain information related to the Federal mental
health prohibitor, such information eventually must be shared with the
court system, usually within a designated timeframe. This commenter and
others argued that it would be more appropriate for a court system,
rather than providers, to report information for NICS purposes. A few
commenters suggested that, where records relevant to the Federal mental
health prohibitor are not available to a judicial agency, another State
agency or a State's Office of Attorney General should be responsible
for reporting.
Some commenters were opposed to the creation of any express
permission. Many mental health advocates and individual commenters
voiced concern that an express HIPAA permission for reporting to the
NICS information relevant to the Federal mental health prohibitor would
reinforce and exacerbate the stigma surrounding mental illness. In
addition, many commenters expressed concern that creating an express
permission to disclose information for NICS purposes would harm the
patient-provider relationship and discourage some individuals from
seeking needed mental health treatment, due to fear that their doctor
might disclose otherwise confidential communications about particularly
sensitive information, such as mental health treatment information.
Some commenters expressed particular concern that a change to the
Privacy Rule would adversely affect veterans by deterring individuals
with post traumatic stress disorder (PTSD) and other mental health
issues from seeking mental health services for fear of losing their
firearms.
After considering the comments we received, we agree that the
creation of an express permission in the HIPAA Privacy Rule to disclose
information relevant to the Federal mental health prohibitor for NICS
purposes is
[[Page 790]]
necessary to address ambiguity and ensure relevant information can be
reported for this important public safety purpose. Thus, as discussed
more fully below, we propose to permit certain covered entities to
disclose limited information for NICS reporting purposes.
It is important to note that a mental health diagnosis does not, in
itself, make an individual subject to the Federal mental health
prohibitor, which requires an involuntary commitment or adjudication
that the individual poses a danger to self or others or lacks the
mental capacity to contract or manage their own affairs. For example,
with respect to the Federal mental health prohibitor, concerns about
veterans being reported to the NICS based solely on a diagnosis of PTSD
are misplaced. Still, we acknowledge commenters' concerns about
possible detrimental effects of an express NICS disclosure provision on
individuals' relationships with their health care providers, or on
individuals' willingness to seek care in the first place. We agree that
encouraging individuals to obtain appropriate treatment is critical to
both individuals' health and the public's safety. Therefore, we have
narrowly drawn this proposed permission such that it would not apply to
the vast majority of treating health care providers, who do not perform
the formal involuntary commitments or other adjudications that make an
individual subject to the Federal mental health prohibitor, and do not
serve as repositories of information about such commitments and
adjudications. Those health care providers do not report to the NICS
currently and this would not change under the proposed rule.
The Department has carefully tailored the proposed permission to
generally apply to entities that are not directly involved in treatment
to minimize any potential adverse unintended consequences, such as
discouraging individuals from seeking mental health treatment due to
concerns that their provider might report them to the NICS. Instead, as
we explain more fully below in the description of the rule, only those
HIPAA covered entities that conduct the involuntary commitments or
other adjudications that make an individual subject to the Federal
mental health prohibitor, or that serve as repositories of information
about such adjudications, would be permitted to rely on the proposed
express permission to disclose information for NICS reporting
purposes.\21\
---------------------------------------------------------------------------
\21\ We note that other provisions of the HIPAA Privacy Rule
that permit covered entities to disclose information for public
policy purposes remain in effect. Thus, where a HIPAA covered
entity, including an entity not falling within the proposed
provision, is required by law to disclose to the NICS, such
disclosures would continue to be permitted under the Privacy Rule.
---------------------------------------------------------------------------
The Department is soliciting comment on whether the permission
should instead be broad enough to also include reporting of persons to
the NICS who are subject to State firearm prohibitions, in light of the
many State laws that restrict firearms possession for mental health
related reasons. It is possible that extending the permission in this
way would expand the number of potential reporting entities to include
more covered entities that provide treatment. We describe the potential
implications of expanding the scope of the permission to include State
law prohibitors more fully below.
In addition, the proposed provision would permit those entities to
disclose only the minimum necessary information for NICS reporting
purposes. NICS does not access or maintain diagnostic or clinical
information, so such information would not be considered the minimum
necessary. The Department is soliciting comment on whether to permit
the disclosure of certain additional identifying information (but not
to include diagnostic or clinical information) that would help the NICS
make accurate matches or rule out matches based on the additional
information. These additional identifiers are discussed below in the
description of the proposed rule.
We believe that the proposed change would appropriately protect and
preserve individuals' privacy interests, the patient-provider
relationship, and the public's health and safety. We emphasize that
most covered entities, including treating providers who do not also
perform formal involuntary commitments or other adjudications that make
an individual subject to the Federal mental health prohibitor, as well
as business associates, will not be disclosing information about
individuals directly to the NICS under this proposal. We expect most
reporting to continue to be done by the judicial system. However, where
the judicial system lacks the information needed, or where the judicial
system is not the appropriate entity to report individuals to the NICS,
this proposal, if finalized, will give States and covered entities
additional flexibility to ensure accurate information is reported to
the NICS.
C. Other Comments
1. Privacy, Security, and Uses of NICS Information
A few commenters requested information on whether information in
the NICS can be accessed by government officials for purposes other
than firearm purchase background checks. In addition, some commenters
raised concerns regarding the privacy and security protections afforded
to information reported to the NICS, including protections for that
information when held by States and while in transit.
The relevant regulations permit NICS background checks in
conjunction with the transfer of a firearm, issuance of firearm or
explosives permits or licenses, as well as in conjunction with ATF
civil or criminal law enforcement investigations relating to the Gun
Control Act or National Firearms Act. See 28 CFR 25.6(j).\22\ The NICS
cannot be used for purposes beyond those articulated in the governing
regulations, including for general law enforcement activities.
---------------------------------------------------------------------------
\22\ See Gun Control Act, 18 U.S.C. Chapter 44; National
Firearms Act, 26 U.S.C. Chapter 53; see also 28 CFR 25.6(j), 63 FR
58303, 58308-58309.
---------------------------------------------------------------------------
The DOJ regulations make clear that FFLs can initiate NICS
background checks only in connection with a firearm transaction
requiring a NICS background check. FFLs are prohibited from initiating
a query to the NICS for any other purpose. Further, when an individual
prohibited from possessing a firearm attempts to obtain a firearm from
an FFL, the FFL receives a response indicating only that the transfer
has been denied or delayed pending further review, but does not have
access to information about the applicable prohibitor or any other
additional information regarding the reason for the delay or denial.
With respect to the privacy and security of information reported
for NICS purposes, the DOJ has established policies and procedures for
ensuring the privacy and security of NICS data in its possession,
including physical security and safeguards, such as access
restrictions. Further, the DOJ requires State and local law enforcement
agencies involved in conducting background checks to observe certain
security policies and procedures when processing NICS background
checks.
Finally, in response to a question in the ANPRM about the
confidentiality of information that has been collected by a repository
for NICS reporting, several commenters, including officials from North
Carolina, Washington, and
[[Page 791]]
Colorado, indicated that the individually identifiable information
collected for NICS reporting could not be made publicly available under
State public records laws. Further, we note that to the extent a HIPAA
covered entity is maintaining and reporting information relevant to the
Federal mental health prohibitor that is protected health information
(including demographic information), such entities must continue to
protect the information in accordance with the HIPAA Privacy and
Security Rules, which includes ensuring appropriate safeguards to
protect the information as it is maintained and transmitted.
2. Improving the Current Mental Health System and Enforcement of Other
Laws
Several commenters recommended better tracking of firearms and
better enforcement of existing laws in place of a HIPAA modification.
Other commenters urged the Department to focus on improving the current
mental health care system in order to reduce gun violence associated
with mental illness.
The Department continues to support efforts by the Administration
to dispel stigmas relating to mental illness and to encourage
individuals to seek voluntary mental health treatment. With the
implementation of the Affordable Care Act, millions of Americans who
did not previously have coverage will receive coverage for mental
health services. Additionally, the Administration has improved access
to mental health services for veterans and has supported initiatives to
train more mental health professionals and help educators recognize
students showing signs of mental illness and refer them to appropriate
services.
3. Application of a HIPAA Permission to Other Prohibitors
Several commenters requested clarification on whether disclosures
for NICS reporting under the proposed rule would be limited to the
Federal mental health prohibitor or if covered entities could disclose
protected health information related to any of the Federal prohibitors
under the Gun Control Act. Some other commenters recommended that the
Department amend the HIPAA Privacy Rule to expressly permit such
reporting with respect to all of the Federal prohibitors. A few
commenters also urged the Department to extend any express permission
under the HIPAA Privacy Rule for NICS reporting to include prohibitor
categories that State laws have enacted, which may extend beyond the
Federal prohibitors. Some commenters suggested creating a provision
permitting reporting related to other factors they perceive as
associated with gun violence, such as domestic violence and substance
abuse.
The Department does not propose to expand the proposed permission
to apply to information about individuals who are subject to the other
prohibitors listed at 18 U.S.C. 922. HIPAA covered entities are
unlikely to have information related to the other Federal prohibitors,
with the possible exception of the drug use prohibitor, for which we
understand criminal records to be the primary source of information for
the NICS. We note that, to the extent that individuals' drug use
results in their being involuntarily committed, those individuals would
be subject to the Federal mental health prohibitor and this proposed
permission would apply.
Some States have enacted their own laws prohibiting the possession
or receipt of firearms for reasons related to mental health and may
prohibit the purchase or possession of a firearm by additional
individuals who are not otherwise subject to the Federal mental health
prohibitor. For example, some States may temporarily prohibit firearm
possession by individuals who have voluntarily committed themselves to
inpatient treatment, which currently does not make an individual
subject to the Federal mental health prohibitor. As noted above, some
States currently collect and report to the NICS the identities of
individuals who are subject to State prohibitors, as well as the
Federal prohibitors. To the extent that States have enacted their own
prohibitions related to mental health, State law may also reduce
barriers by requiring reporting to the NICS by those making the mental
health assessments that make individuals subject to a State
prohibition. However, the Department requests comment on whether HIPAA
is perceived as a barrier to reporting to the NICS information about
individuals who are subject to State law firearm prohibitions and
whether the final rule should address this barrier.
Although the NICS has a role in helping to enforce State firearms
prohibitions intended to keep firearms out of the hands of certain
individuals for reasons related to mental health, the NICS Index
currently does not contain information about all individuals who are
subject to such prohibitions. The Department seeks comment on whether
the proposed permission should be broadened to include information
relevant to those State law prohibitions, as well as information
relevant to the Federal mental health prohibitor. Expanding the
permission would ensure that relevant State law prohibitor information
could be reported to NICS in States that do not otherwise require the
reporting. At the same time, however, there are implications to
expanding the permission to encompass State law prohibitors, which may
be broader than the Federal mental health prohibitor. For example, if
more entities in States with their own prohibitors have the authority
to make determinations that subject individuals to a firearms
prohibition, there would be an increased likelihood that more treating
providers would be permitted to report information to the NICS. In
addition, there may be State laws that prohibit the possession or
receipt of a firearm by individuals with particular mental health
diagnoses or an assessment of ``dangerousness'' with correspondingly
different procedural protections for individuals. The Department is
seeking comment on whether these concerns are borne out in any States
and whether the proposed permission should be broadened to include
information relevant to those State law prohibitions.
4. Notice
A few commenters asked whether individuals would be notified if
their provider disclosed their protected health information for NICS
reporting purposes. If such notification were not required, commenters
recommended that there be a way for individuals to find out that their
provider disclosed their information for such purposes. One commenter
asked whether covered entities would be required to revise their Notice
of Privacy Practices to inform individuals that the entities might make
disclosures for NICS reporting purposes.
We are not proposing new notification requirements.\23\ Further,
the Department would not require covered entities to revise their
Notices of Privacy Practices to specifically reference this new
provision. Existing notices that more generally refer to the types of
disclosures each covered entity is permitted to make, including
disclosures for the public policy purposes under 45 CFR 164.512, would
suffice.
---------------------------------------------------------------------------
\23\ We note that individuals who have tried to purchase a
firearm and been denied can appeal to the FBI (and, in some States,
to the NICS Point of Contact for the State), and learn the reason
for the denial, if they believe they have been erroneously reported.
---------------------------------------------------------------------------
5. HHS Authority
Several commenters argued that any amendment to HIPAA to provide an
express permission for reporting to the NICS database should be passed
by
[[Page 792]]
Congress, not created by HHS. These commenters argued that the
Administration would overstep its authority if it adopted a regulatory
change that Congress chose not to enact and that this would violate the
principle of separation of powers. Additionally, several commenters
argued that under the principle of federalism, regulation of firearms
should be left to the States.
We note that Congress, when it enacted HIPAA, provided the
Department with general authority to determine the permissible uses and
disclosures of covered entities and modify the HIPAA standards as
appropriate. It is under this authority that the Department has
proposed to modify the Privacy Rule to permit certain disclosures for
the purpose of NICS reporting.
6. Additional Guidance
Several commenters asked for additional guidance materials,
training, and other outreach efforts from the Department to help
covered entities, State agency officials, State legislatures, and State
judiciaries better understand HIPAA's permitted and required
disclosures. Some commenters specifically cited HIPAA as a perceived
barrier to State legislatures passing laws requiring NICS reporting due
to misconceptions about HIPAA preempting State law, and requested that
the Department conduct outreach to explain HIPAA's preemption
provisions. Other commenters urged the Department to increase its
outreach efforts to encourage individuals to seek voluntary mental
health services.
The Department anticipates issuing guidance to both address
misconceptions (e.g., such as the perception that HIPAA is a barrier to
State legislatures passing laws requiring reporting) and to help
covered entities comply with the rule. With respect to the latter, we
intend to work with DOJ to issue additional guidance on the categories
within the Federal mental health prohibitor,\24\ variations in State
law, and when and how the HIPAA permission would apply. We will
continue to evaluate additional areas that may benefit from further
guidance.
---------------------------------------------------------------------------
\24\ We note that DOJ has proposed clarifications to the
regulatory definitions relevant to the Federal mental health
prohibitor. The DOJ proposal is published elsewhere in this issue of
the Federal Register.
---------------------------------------------------------------------------
Finally, the Department will continue its efforts to increase
access to, and utilization of, needed mental health care services.
IV. Overview of the Proposed Rule
We are proposing to revise 45 CFR 164.512 of the Privacy Rule by
adding a new category of permitted disclosures to 45 CFR 164.512(k),
which addresses uses and disclosures for specialized government
functions. The new provisions at (k)(7) would permit certain covered
entities to disclose the minimum necessary demographic and other
information for NICS reporting purposes, which would not include
clinical, diagnostic, or other mental health information.
There is a strong public safety need for this information to be
accessible to the NICS, and some States are currently under-reporting
or not reporting this information at all. From what we understand, and
what we have heard from commenters, most of the information relevant to
the Federal mental health prohibitor is held by entities that are not
covered by HIPAA. For those few HIPAA covered entities that may be
involved in the relevant commitments or adjudications, the Privacy Rule
contains paths for disclosure, but these do not appear to be
sufficient. Therefore, we propose to add another, narrowly tailored,
permission for HIPAA covered entities that perform the commitments or
adjudications that make individuals subject to the Federal mental
health prohibitor, or that act as repositories of NICS records on
behalf of a State, to use and disclose certain information for NICS
reporting purposes. To the extent that some covered entities may
perform adjudicatory or repository functions in States that have not
enacted laws requiring reporting to the NICS, and a subset of those may
be unable to achieve hybrid entity status for administrative or other
reasons, this permission would remove a barrier to their reporting and
provide clarity. Importantly, the proposed permission would focus on
those entities performing the relevant commitment, adjudicatory or
repository functions, not on those performing solely treatment
functions.
We note that the proposed modification to the Privacy Rule would
merely permit, and not require, covered entities to report to the NICS.
In addition, it would not place additional limitations on or otherwise
affect the currently existing permitted uses and disclosures of
protected health information under the Privacy Rule. Thus, for example,
the Rule's current permissions for uses and disclosures required by
other law, including State law, would remain unchanged, as would
provisions permitting uses and disclosures for law enforcement purposes
as part of a specific investigation, or to avert a serious and imminent
threat. See 45 CFR 164.512(a), (f), and (j).
V. Description of the Proposed Rule
The following describes the specific provisions of the proposed
rule. Those interested in commenting on the proposed rule can assist
the Department by preceding discussion of any particular topic with a
citation or reference to the aspect of the proposed rule being
discussed. While we request comment on several specific questions, we
welcome comments on any aspect of the proposed rule.
General Rule
Paragraph (k)(7) would permit uses and disclosures of protected
health information for purposes of reporting to the NICS or a State-
designated entity the identities of individuals who are subject to the
Federal mental health prohibitor under 18 U.S.C. 922(g)(4), provided
the conditions in the remaining paragraphs under (k)(7) are met. We do
not intend with this paragraph to require formal designations by the
States, but we would expect States to be able to identify the
responsible entity. We request comment on whether the proposed language
encompasses all entities that are responsible for reporting to, or
otherwise collecting information for, the NICS on behalf of the States.
The proposed permission would not permit covered entities to use or
disclose the protected health information of individuals who are
subject to one or more of the other prohibitors listed at 18 U.S.C.
922(g), as the lack of an express HIPAA permission for reporting
information relevant to the Federal mental health prohibitor is a
limited problem and we have not heard that there is a similar issue
with respect to the other prohibitors. Thus, for example, a covered
entity would not be able to use this permission to use or disclose
information about an individual who is an unlawful user of or addicted
to any controlled substance (18 U.S.C. 922(g)(3)), except to the extent
the individual is also subject to the Federal mental health prohibitor.
We note that other laws may impact disclosures related to the other
prohibitors, including 18 U.S.C. 922(g)(3).
We propose to limit the permission to uses and disclosures about
individuals who are subject to the Federal mental health prohibitor. As
discussed above, we request comment on the scope of the permission,
specifically with regard to whether the permission should be
[[Page 793]]
broadened to allow covered entities to disclose the identities of
individuals who are prohibited by Federal or State law from possessing
or receiving firearms for reasons related to mental health.
Applicability
Paragraph (k)(7)(i) would apply the express permission only to
covered entities that function as repositories of information relevant
to the Federal mental health prohibitor on behalf of a State, or that
are responsible for ordering the involuntary commitments or other
adjudications that make an individual subject to the Federal mental
health prohibitor. The Federal prohibitor regulations define an
involuntary commitment as a formal commitment of a person to a mental
institution by a court, board, commission, or other lawful authority.
It does not apply to individuals in a psychiatric facility for
observation or who have been admitted voluntarily. The other applicable
adjudications include determinations by a court, board, commission, or
other lawful authority that persons are a danger to themselves or
others, or lack the mental capacity to contract or manage their own
affairs, as a result of marked subnormal intelligence, or mental
illness, incompetency, condition, or disease. See 27 CFR 478.11
(Definitions).\25\ This NPRM refers to the involuntary commitments and
other applicable adjudications as, collectively, ``adjudications that
make an individual subject to the Federal mental health prohibitor.''
---------------------------------------------------------------------------
\25\ Note that DOJ has proposed clarifications to this
regulation; the DOJ proposal is published elsewhere in this issue of
the Federal Register.
---------------------------------------------------------------------------
Our understanding is that lawful authority for performing such
adjudications and repository functions rests, for the most part, with
entities that operate outside the scope of HIPAA. However, in the
interest of public safety, we want to ensure that relevant
adjudications can be reported in the small subset of States in which
HIPAA covered entities may make, or collect and report records of,
these determinations.
In permitting only entities involved in these adjudicatory or
repository/reporting functions to use or disclose Federal mental health
prohibitor information for NICS purposes, the proposal would not create
a permission for most treating providers to disclose protected health
information about their own patients for these purposes. We agree with
the commenters who argued that encouraging voluntary treatment is
critical to ensuring positive outcomes for individuals' health as well
as the public's safety. We also agree with the many commenters who
asserted that non-health care entities should and currently do bear
primary responsibility for collection and reporting of information
relevant to the Federal mental health prohibitor in most States.
However, where a HIPAA covered entity is a board, commission, or other
lawful authority that makes adjudications that result in individuals
being subject to the Federal mental health prohibitor, we believe those
entities are most likely to hold records of the relevant adjudications.
We request public comment on the extent to which some States may
have vested responsibility for Federal mental health prohibitor
reporting in HIPAA covered entities, to what extent records needed for
NICS reporting are created or maintained by covered entities, and
whether there are circumstances in which health care providers would
need to report the identity of an individual subject to the Federal
mental health prohibitor to a State designated records repository or
directly to the NICS. We also request comment on the types of
additional guidance from OCR and/or the NICS that would be helpful for
understanding to which covered entities, and under what circumstances,
the proposed permission would apply.
Recipients of Information Disclosures
Paragraph (k)(7)(ii) would provide that a covered entity identified
in (k)(7)(i) may use or disclose Federal mental health prohibitor
information for NICS purposes either directly to the NICS or to an
entity designated by the State as a repository of data for purposes of
reporting to the NICS. By clearly delimiting the permitted recipients
of such disclosures, the rule would ensure that covered entities do not
exceed the intended scope of the permission by disclosing information
relevant to the Federal mental health prohibitor to, for example, law
enforcement agencies that do not operate as repositories of data for
purposes of reporting to the NICS. Again, as stated above, the Privacy
Rule's existing permissions to use or disclose protected health
information for specific law enforcement investigations, as provided in
45 CFR 164.512(f), would remain unchanged. We request comment on
whether there are States in which a type of entity not described in
this proposed paragraph is responsible for NICS reporting and needs to
be able to receive NICS data from a HIPAA covered entity.
Limitations on the Information Used or Disclosed
Paragraph (k)(7)(iii) would strictly limit the information used or
disclosed for NICS reporting purposes to the minimum necessary for such
purposes. The Privacy Rule requires uses and disclosures of protected
health information to be limited to the minimum necessary for their
intended purpose, and in the proposed regulation text, we make clear
that only limited demographic and other information would constitute
the minimum necessary for NICS reporting. At this time, we would
consider the minimum necessary information to include an individual's
name; date of birth; sex; a code or notation indicating that the
individual is subject to the Federal mental health prohibitor; a code
or notation representing the reporting entity; and a code identifying
the agency record supporting the prohibition. The proposed modification
would not permit the use or disclosure of clinical or diagnostic
information for NICS reporting purposes. We request comment on whether,
and in what circumstances, HIPAA covered entities or other entities
such as courts currently report to a records repository or directly to
the NICS information that is not listed in the proposed paragraph.
We are also considering permitting the disclosure of some or all
the following additional data elements, which are optional fields for a
NICS Index entry, as part of the minimum necessary for NICS reporting
purposes: Social Security number, place of birth, State of residence,
height, weight, eye color, hair color, and race. From what we
understand, these elements are not included in every NICS record, but
often are used to confirm that a prospective firearm recipient matches
a record searched by the NICS or to eliminate ``false positive''
background check results. We request public comment on this issue.
VI. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact statement in compliance with
Executive Order 12866 (September 1993, Regulatory Planning and Review),
Executive Order 13563 (January 2011, Improving Regulation and
Regulatory Review), the Regulatory Flexibility Act (RFA) (September 19,
1980, Pub. L. 96-354), the Unfunded Mandates Reform Act of 1995 (UMRA)
(March 22, 1995, Pub. L. 104-4), and Executive Order 13132 on
Federalism.
[[Page 794]]
1. Executive Order 12866 and Executive Order 13563
Executive Orders 12866 and 135643 direct agencies to assess all
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). Executive
Order 135634 emphasizes the importance of quantifying both costs and
benefits, of reducing costs, of harmonizing rules, and of promoting
flexibility. This rule has been designated a ``significant regulatory
action'' although not economically significant, under section 3(f) of
Executive Order 12866. Accordingly, this rule has been reviewed by the
Office of Management and Budget.
A regulatory impact analysis must be prepared for all major rules
that have economically significant effects ($100 million or more in any
one year) or adversely affect in a material way the economy, a sector
of the economy, productivity, competition, jobs, the environment,
public health or safety, or State, local, or tribal government or
communities (58 FR 51741). Because the proposed rule does not contain
any new requirements for covered entities, we estimate that the rule
will be cost neutral. We request comment on our assumptions and
information on the nature of any unanticipated costs that covered
entities may incur as a result of the rule.
Although we expect the economic impact of the rule, including non-
quantifiable costs and savings discussed in the regulatory analysis
below, to be less than $100 million annually, we nevertheless conducted
an analysis of the costs of the proposed rule.
2. Entities Subject to the Rule
This proposed rule would apply only to covered entities that are
responsible for ordering involuntary commitments or conducting other
adjudications that make individuals subject to a Federal prohibition
against possessing firearms under 18 U.S.C. 922(g)(4) (the Federal
mental health prohibitor), or that are otherwise designated by a State
to report the identities of such individuals to the NICS. We do not
have sufficient data to determine the number of affected entities, but,
based on the information available to us, we believe there would be
very few. Our understanding is that, for the most part, formal
adjudications and repository functions of this nature are conducted by
entities, such as court systems or law enforcement agencies, that are
not covered by HIPAA. We welcome public comment on the number of
covered entities that might be affected by this rule.
B. Why is this rule needed?
This proposed rule is needed to ensure that, where HIPAA covered
entities make adjudications causing individuals to become subject to
the Federal mental health prohibitor, or serve as repositories of
records of such adjudications on behalf of States, those covered
entities can report the identities of those individuals to the NICS.
Specific permission under the Privacy Rule for these disclosures is
necessary to the extent that some States have not enacted laws
requiring reporting to the NICS, but a covered entity in the State is
nevertheless responsible for such reporting. Importantly, the proposed
rule would permit only a small subset of HIPAA covered entities (i.e.,
those that perform the relevant mental health adjudications or
repository functions) to use or disclose only limited, non-clinical
information, for NICS purposes. This narrowly tailored permission would
permit these important uses or disclosures for public safety to occur
while maintaining a separation between reporting functions and the
mental health treatment a patient might be receiving.
C. Qualitative Analysis of Unquantified Costs
The rule would be cost neutral with respect to HIPAA covered
entities. The rule would not require entities that already have a NICS
reporting process in place to change their current system and would not
create new reporting or recordkeeping requirements for any covered
entity. The small number of covered entities that would be newly
permitted to report to the NICS or a State repository under the rule
could begin reporting and may need to develop policies and procedures
to do so. As the Privacy Rule only allows the use or disclosure of
information, and does not require it, any resulting burden of reporting
and associated procedures is attributable to the Federal statutory
mental health prohibitor and the NICS system itself. See 28 CFR Part
25, Subpart A (http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/Title28/28cfr25_main_02.tpl ). We acknowledge that those
entities that choose to begin reporting may wish to address this change
in their HIPAA policies and procedures, as well as explain their
procedures to office staff. However, the rule would not require any
changes to existing HIPAA policies and procedures. In addition, with
respect to training, the rule would not require workforce training
beyond what is already required under the HIPAA Privacy and Security
Rules, and we do not expect that such entities that choose to report
under the rule would do more than ensure that their office staff have
copies of the new policies and procedures. We request comment on these
assumptions and on the number of entities that might begin to report to
the NICS for the first time, if any.
To the extent that the rule would permit some covered entities to
report to the NICS for the first time, there may be an increase in the
number of individuals whose identities are newly included in the NICS
and who are denied a firearm transfer as a result. As a result, there
may be a concomitant increase in applications for relief from
disabilities in states that provide such a relief program. However, any
burden to individuals completing and submitting the relief application
form is attributed to the procedures established by the State where the
commitment or adjudication occurred. The procedures for applying for
relief in States that have established mental health relief from
disabilities programs pursuant to the NICS Improvement Amendments Act
of 2007 vary. We received a number of comments on the ANPRM asserting
that creating an express permission in the Privacy Rule for NICS
reporting would discourage individuals from seeking needed mental
health care. We appreciate these concerns and agree with commenters who
asserted that individuals' health and the public's safety are best
served by encouraging appropriate treatment. We also recognize that
discouraging treatment could increase the burden of untreated mental
conditions to individuals, in the form of increased suffering and loss
of productivity; to the health care system, when individuals with
untreated mental illness need emergency hospitalization, for example;
and to the public's safety. However, the majority of these commenters
expressed the mistaken belief that the proposed permission would allow
or require mental health care providers to report diagnostic or
clinical information to the NICS. Many of these commenters also voiced
concern that an express permission under HIPAA would potentially
increase burdens on providers. Although one commenter suggested that an
express permission under HIPAA would help lessen concerns about
provider liability for disclosures related to NICS reporting, many more
commenters expressed concern that
[[Page 795]]
creating an express permission might lead providers to over report
their patients due to a fear of liability for failing to report a
patient who later commits an act of gun violence.
As explained above, we have carefully and narrowly tailored the
proposed rule to apply only to a small number of covered entities that
may be responsible for the adjudications that make an individual
subject to the Federal mental health prohibitor, or that serve as
repositories of data about such adjudications. As such, the proposed
rule generally would maintain a separation between treatment functions
and NICS reporting functions. In addition, the rule would not permit
the use or disclosure of any diagnostic or clinical information, or any
other information about an individual that is not the minimum necessary
for NICS reporting purposes. Because of these strict limitations on the
permitted uses and disclosures, we believe that individuals would not
be dissuaded from seeking needed mental health care services as a
result of the proposed rule. We welcome comment on this assumption.
Finally, we recognize the intangible burden to individuals of the
stigma associated with mental health conditions. We again emphasize, as
we did in the ANPRM, that individuals with treated mental health
conditions as a group have not been shown to pose an increased risk of
gun violence against others compared with the general population, and
are in fact more likely to be victims of violence than other members of
the general population. We note further that the Federal mental health
prohibitor does not apply to all individuals with mental health
conditions, but instead a subset of individuals who have been
involuntarily committed or otherwise adjudicated to be a danger to
themselves or others, or unable to manage their own affairs, as a
result of marked subnormal intelligence, or mental illness,
incompetency, condition, or disease. With this proposed rule, the
Department is not adopting or endorsing the idea that individuals with
mental health conditions pose a danger to society. Rather, the rule
would permit a limited number of HIPAA covered entities to report to
the NICS the identities of individuals in a particular subcategory of
persons who are currently prohibited by Federal law from possessing
firearms. This permission would facilitate the enforcement of
prohibitions that were established by the Gun Control Act. Therefore,
we do not expect that this proposed rule would exacerbate stigma
associated with mental health conditions.
We request comment on this assumption and on any other costs that
may be associated with the rule.
D. Qualitative Analysis of Unquantified Benefits
While we believe that there may be benefits to public safety as a
result of the rule, we are not able to monetize the value of such
benefits.
For example, the rule may result in increased reporting to the NICS
of individuals who may pose a risk of gun violence related to a serious
mental health condition. To the extent that this rule would permit
covered entities to report those individuals' identities for NICS
purposes, resulting in denial of firearms to those who are prohibited
from possessing firearms under Federal law, the rule would provide a
public safety benefit. However, we do not have information about
whether, or how many, covered entities would begin to report or
increase reporting to the NICS as a result of the rule.
An additional benefit of the rule would be to alleviate the
concerns of State lawmakers who, according to a handful of commenters,
may be reluctant to pursue legislation requiring entities to report
Federal mental health prohibitor information for NICS purposes because
of a misconception that the HIPAA Privacy Rule would preempt such
requirements. As explained more fully above, the Privacy Rule permits
uses and disclosures that are required by law. To the extent that State
lawmakers harbor this misconception, this rule would serve both to
clarify HIPAA's preemption provisions and provide an avenue for NICS
reporting that may obviate a need to enact legislation at the State
level.
We welcome comment on any of these issues.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The RFA requires agencies to analyze and consider options for
reducing regulatory burden if a rule will impose a significant burden
on a substantial number of small entities. The act requires the head of
the agency to either certify that the rule would not impose such a
burden or perform a regulatory flexibility analysis and consider
alternatives to lessen the burden. For the reasons explained more fully
above in the summary of costs and benefits, it is not expected that the
rule would result in compliance costs for covered entities of any size
because the rule would not impose new requirements.
2. Unfunded Mandates Reform Act
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipated costs and benefits before
issuing any rule whose mandates would require spending in any one year
$100 million in 1995 dollars, updated annually for inflation. In 2013,
that threshold is approximately $150 million dollars. UMRA does not
address the total cost of a rule. Rather, it focuses on certain
categories of cost, mainly those ``Federal mandate'' costs resulting
from: (1) Imposing enforceable duties on State, local, or Tribal
governments, or on the private sector; or (2) increasing the stringency
of conditions in, or decreasing the funding of, State, local, or Tribal
governments under entitlement programs. As this proposed rule would not
impose enforceable duties or affect entitlement programs, UMRA does not
require us to prepare an analysis of the costs and benefits of the
rule. Nonetheless, we have done so in accordance with Executive Orders
12866 and 13563, and present this analysis in sections C and D above.
3. Federalism
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a rule that imposes substantial
direct requirement costs on State and local governments, preempts State
law, or otherwise has Federalism implications.
The Federalism implications of the HIPAA Privacy and Security Rules
were assessed as required by Executive Order 13132 and published as
part of the preambles to the final rules on December 28, 2000 (65 FR
82462, 82797) and February 20, 2003 (68 FR 8334, 8373), respectively.
This proposed rule would not impose requirements, or any associated
costs, on State and local governments. Regarding preemption, the
preamble to the final Privacy Rule explained that the HIPAA statute
dictates the relationship between State law and Privacy Rule
requirements. Therefore, the Privacy Rule's existing preemption
provisions do not raise Federalism issues, and these provisions would
not be affected by this proposed rule. In addition, we again emphasize
that the proposed modification to the rule would not require covered
entities to make disclosures that are prohibited by State law, nor
would it prevent disclosures required by State law. For these reasons,
the rule would not have Federalism implications.
[[Page 796]]
F. Accounting Statement
Whenever a rule is considered a significant rule under Executive
Order 12866, we are required to develop an accounting statement
indicating the costs associated with the rule. As explained above in
the RIA, we expect that the rule would be cost neutral. However, we
invite comment on potential costs associated with the rule, including
costs to covered entities that choose to amend written HIPAA policies
and procedures or train staff.
VII. Collection of Information Requirements
This proposed rule does not contain new requirements for
information collections (i.e., reporting, recordkeeping, and third-
party disclosures) under the Paperwork Reduction Act.
List of Subjects in 45 CFR Part 164
Administrative practice and procedure, Computer technology,
Electronic information system, Electronic transactions, Employer
benefit plan, Health, Health care, Health facilities, Health insurance,
Health records, Hospitals, Medicaid, Medical research, Medicare,
Privacy, Reporting and recordkeeping requirements, and Security.
For the reasons set forth in the preamble, the Department of Health
and Human Services proposes to amend 45 CFR Subtitle A, Subchapter C,
part 164, as set forth below:
PART 164--SECURITY AND PRIVACY
0
1. The authority citation for part 164 continues to read as follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264,
Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and
secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.
0
2. Amend Sec. 164.512 by adding paragraph (k)(7) to read as follows:
Sec. 164.512 Uses and disclosures for which an authorization or
opportunity to agree or object is not required.
* * * * *
(k) * * *
(7) National Instant Criminal Background Check System. A covered
entity may use or disclose protected health information for purposes of
reporting to the National Instant Criminal Background Check System the
identity of an individual who is prohibited from possessing a firearm
under 18 U.S.C. 922(g)(4), provided the covered entity:
(i) Is a State agency or other entity that is, or contains an
entity that is:
(A) An entity designated by the State to report, or which collects
information for purposes of reporting, on behalf of the State, to the
National Instant Criminal Background Check System; or
(B) A court, board, commission, or other lawful authority that
makes the commitment or adjudication that causes an individual to
become subject to 18 U.S.C. 922(g)(4).
(ii) Discloses the information to:
(A) The National Instant Criminal Background Check System; or
(B) An entity designated by the State to report, or which collects
information for purposes of reporting, on behalf of the State, to the
National Instant Criminal Background Check System; and
(iii) (A) Discloses only the limited demographic and certain other
information needed for purposes of reporting to the National Instant
Criminal Background Check System; and
(B) Does not disclose diagnostic or clinical information for such
purposes.
* * * * *
Dated: December 31, 2013.
Kathleen Sebelius,
Secretary.
[FR Doc. 2014-00055 Filed 1-3-14; 4:15 pm]
BILLING CODE 4153-01-P