The Department of Health and Human Services (HHS or “the Department”) is issuing this notice of proposed rulemaking to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals who are subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. The NICS is a national system maintained by the Federal Bureau of Investigation (FBI) to conduct background checks on persons who may be disqualified from receiving firearms based on federally prohibited categories or State law. Among the persons subject to the Federal mental health prohibitor are individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease. Under this proposal, only covered entities with lawful authority to make adjudication or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes, would be permitted to disclose the information needed for these purposes. This disclosure would be restricted to limited demographic and certain other information and would not include medical records, or any mental health information beyond the indication that the individual is subject to the Federal mental health prohibitor. HHS notes that the Department of Justice (DOJ) has proposed clarifications to the regulatory definitions relevant to the Federal mental health prohibitor. The DOJ proposal is published elsewhere in this issue of the Federal Register. While commenters should consider this proposed regulation in light of the clarifications proposed in DOJ’s proposal, we note that those clarifications would not change how this proposed HIPAA permission would operate.
This honestly won’t do much, because my understand that it’s state privacy laws, not federal, that prevent many of the states that don’t report from reporting.