Health Information Compliance Alert

Understand the rules and requirements surrounding the federal mental health prohibitor.

The barrage of shooting rampages that have occurred in recent years have highlighted the need for better systems in identifying and preventing certain individuals with mental health issues from purchasing firearms. This issue raises serious HIPAA privacy concerns, however, and the federal government is now changing key regulations to overcome these problems. Here’s what you need to know to comply with the new regs.

On Jan. 6, the U.S. Department of Health and Human Services (HHS) published the final rule, entitled “Health Insurance Portability and Accountability Act (HIPAA) Privacy rule and the National Instant Criminal Background Check System (NICS).” The rule aims to break down HIPAA-related regulatory barriers to reporting individuals who should not possess firearms due to mental health issues.

The final rule effectively modifies the HIPAA Privacy Rule §164.512, adding a new section (k)(7) to allow use or disclosure of protected health information (PHI) for purposes of reporting to the NICS the identity of an individual who is prohibited from possessing a firearm, according to Jim Sheldon-Dean, founder and director of compliance services for Lewis Creek Systems LLC in Charlotte, VT.

What is the Federal Mental Health Prohibitor?

If an individual is prohibited from possessing a firearm due to psychological issues, this effectively means that the individual is subject to the “federal mental health prohibitor.” The federal mental health prohibitor “applies only where an individual has been voluntarily committed or otherwise has received a relevant adjudication from a court, board, commission, or other lawful authority,” attorney Teresa Locke of Holland & Hart LLP explained in a Jan. 8 blog posting.

Specifics: The Gun Control Act of 1968 established the federal mental health prohibitor, and the U.S. Department of Justice (DOJ) issued associated implementing regulations, according to Locke. The federal mental health prohibitor disqualifies certain individuals from shipping, transporting, possessing, or receiving a firearm. The individuals subject to the prohibitor include those who have been:

1. Involuntarily committed to a mental health institution;
2. Found incompetent to stand trial or not guilty by reason of insanity; or
3. Otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others, or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease.

Stick to Only the Necessary Data

Although the regulatory text doesn’t specify exactly which data elements or PHI you may disclose, the preamble provides clarification on this point, according to Locke. HHS generally considers the following information as necessary for the purposes of reporting to the NICS:

1. The individual’s name;
2. The individual’s date of birth;
3. The individual’s sex;
4. A code or notation indicating that the individual is subject to the federal mental health prohibitor;
5. A code or notation representing the reporting entity; and
6. A code identifying the agency record supporting the prohibition.

To exclude “false matches” in certain instances, you may need to provide additional information such as the individual’s Social Security number, state of residence, height, weight, place of birth, eye color, hair color, and race, Locke added.

Important: Also, “disclosures may include only the limited demographic and certain other information needed for purposes of reporting to the NICS, and may not include diagnostic or clinical information,” Sheldon-Dean notes.

Understand Key Limitations in the Rule

“The new category of permitted disclosures is very limited in scope, applying only to a specific subset of HIPAA covered entities [CEs] who, under narrow circumstances, may provide discrete personal health information to the NICS,” Locke explained. Specifically, the new rule is limited in key areas such as who has permission to disclose and who may receive the information.

The new rule applies only to CEs involved in ordering involuntary commitments or other adjudications that make an individual subject to the federal mental health prohibitor, Locke noted. The rule does not apply to disclosures about individuals who are subject to state-only mental health prohibitors.

Perhaps most importantly, the new rule does not apply to individuals in a psychiatric facility for observation or who have been admitted voluntarily, Locke said. This means that “the new rule does not create a permission for most treating providers to disclose PHI about their own patients for these purposes.”

Also, the rule effectively limits who may receive this information to NICS or to designated NICS repositories, stated healthcare attorney Elizabeth Hodge with Akerman LLP in a Jan. 11 analysis for the law firm. The new rule does not give you permission to disclose this information “for other law enforcement purposes unless another provision in the Privacy Rule permits such disclosure.”

Bottom Line: Don’t Report All Your Mentally Ill Patients

Takeaway: “While it is important to understand what the final rule does, it may be more important for healthcare providers to know what the final rule does not do,” Hodge said. The final rule does not:

• Affect most healthcare providers who treat individuals with mental illness — the final rule applies only to those CEs with authority to make the adjudications or commitment decisions that subject an individual to the federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes;
• Create a requirement to disclose — it only creates permission to disclose;
• Create permission for most treating providers to report information about their patients to the NICS; nor
• Change who is subject to the federal mental health prohibitor.

Resource: The final rule appeared in the Jan. 6 Federal Register, which you can access at www.federalregister.gov/articles/2016/01/06/2015-33181/health-insurance-portability-and-accountability-act-hipaa-privacy-rule-and-the-national-instant.