Healthcare providers concerned about HIPAA compliance and firearms background checks have received further clarification on when it is possible for PHI to be disclosed. A new rule has been finalized by the Obama administration that permits healthcare providers to disclose certain elements of Protected Health Information to the FBI as part of its firearms background check program, amending the Health Insurance Portability and Accountability Act Privacy Rule.
New Rule Finalized Covering HIPAA and Firearms Background Checks
Attempts have been made by the Obama administration to introduce stricter gun control laws following the Newtown Conn., shootings which claimed the lives of 20 schoolchildren and 6 members of staff in 2012. The shootings re-ignited the debate about gun control and the need for a universal system of background checks to make it harder for individuals with diagnosed mental health problems to purchase automatic weapons.
The report on the shootings, published on November 25, 2013, concluded that the shooter, 20-year old Adam Lanza, suffered “significant mental health issues that affected his ability to live a normal life and to interact with others.”
Proposed legislative changes to curb gun violence failed to make it past congress. As a result, Obama is looking to bring about changes by issuing an executive order and bypassing congress. The introduction of stricter background checks on the sale of firearms is crucial to Obama’s plans.
Mental health records have been submitted to the FBI since the shootings, and according to Everytown for Gun Safety, the provision of these data has prevented 6,000 individuals suffering from mental health issues from purchasing firearms.
While mental health information is being disclosed under certain circumstances, HIPAA and firearms background checks are not compatible; hence the need for a change to HIPAA’s Privacy Rule.
Under HIPAA, the disclosure of Protected Health Information to a third party is only permissible if prior authorization has been obtained from the patient in writing, unless data have first been de-identified.
The final rule adds a limited express permission in the HIPAA Privacy Rule which will allow healthcare providers to report the names of patients suffering from mental health conditions. The new rule only permits a very limited amount of data to be disclosed to the National Instant Criminal Background Check System (NICS). The rule change only applies to individuals who are currently not permitted to own a firearm for mental health reasons, under existing Federal laws.
The new rule only applies to some HIPAA-covered entities. The HHS points out “The rule does not apply to most treating providers and does not allow reporting of diagnostic, clinical, or other mental health treatment information.” The rule affects only a small subset of covered entities that make determinations about mental health conditions, that would disqualify a person from owning a firearm.