382

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

Air Emissions Standards of
Performance for New Sewage Sludge
Incinerators§ 62.6917 Identification of plan—negative
declaration.

Letter from the Nebraska Departmentof Environmental Quality received
December 6, 2012, certifying that there
are no Sewage Sludge Incinerator units
subject to 40 CFR part 60, subpart
MMMM.
[FR Doc. 2015–33292 Filed 1–5–16; 8:45 am]
BILLING CODE 6560–50–P

DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
45 CFR Part 164
Health Insurance Portability andAccountability Act (HIPAA) Privacy
Rule and the National Instant Criminal
Background Check System (NICS)
AGENCY: Office for Civil Rights,

Department of Health and Human
Services.
ACTION: Final rule.

wgreen on DSK2VPTVN1PROD with RULES

SUMMARY: The Department of Health andHuman Services (HHS or ‘‘theDepartment’’) is issuing this final rule tomodify the Health Insurance Portability
and Accountability Act of 1996 (HIPAA)
Privacy Rule to expressly permit certain
HIPAA covered entities to disclose to
the National Instant Criminal
Background Check System (NICS) the
identities of individuals who are subject
to a Federal ‘‘mental health prohibitor’’that disqualifies them from shipping,transporting, possessing, or receiving afirearm. The NICS is a national system
maintained by the Federal Bureau of
Investigation (FBI) to conduct
background checks on persons who may
be disqualified from receiving firearms
based on Federally prohibited categories
or State law. Among the persons subject
to the Federal mental health prohibitor
established under the Gun Control Act
of 1968 and implementing regulations
issued by the Department of Justice(DOJ) are individuals who have been
involuntarily committed to a mental
institution; found incompetent to standtrial or not guilty by reason of insanity;or otherwise have been determined by acourt, board, commission, or otherlawful authority to be a danger tothemselves or others or to lack themental capacity to contract or manage
their own affairs, as a result of marked
subnormal intelligence or mental
illness, incompetency, condition, or

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

disease. Under this final rule, only
covered entities with lawful authority tomake the adjudications or commitment
decisions that make individuals subject
to the Federal mental health prohibitor,or that serve as repositories of
information for NICS reporting
purposes, are permitted to disclose theinformation needed for these purposes.
The disclosure is restricted to limited
demographic and certain otherinformation needed for NICS purposes.
The rule specifically prohibits thedisclosure of diagnostic or clinicalinformation, from medical records orother sources, and any mental healthinformation beyond the indication thatthe individual is subject to the Federal
mental health prohibitor.
DATES: Effective date: This final rule iseffective on February 5, 2016.
FOR FURTHER INFORMATION CONTACT:
Andra Wicks, 202–205–2292.
SUPPLEMENTARY INFORMATION:
I. Background
On January 16, 2013, President Barack
Obama announced 23 executive actions
aimed at curbing gun violence acrossthe nation. Those actions include efforts
by the Federal government to strengthen
the national background check system,
and a specific commitment to ‘‘[a]ddress
unnecessary legal barriers, particularly
relating to the Health Insurance
Portability and Accountability Act, thatmay prevent States from making
information available to the backgroundcheck system.’’ The National InstantCriminal Background Check System(NICS) is the system used to determine
whether a potential firearms recipient isstatutorily prohibited from possessing or
receiving a firearm. The Department
proposed, and now finalizes, amodification to the HIPAA Privacy Ruleto permit certain covered entities todisclose to the NICS the identities of
persons who are not allowed to possessor receive a firearm because they are
subject to the Federal mental healthprohibitor.
The National Instant Criminal
Background Check System (NICS)
The Brady Handgun ViolencePrevention Act of 1993, Public Law
103–159 (Brady Gun Law), and its
implementing regulations, are designed
to prevent the transfer of firearms bylicensed dealers to individuals who are
not allowed to possess or receive themas a result of restrictions contained ineither the Gun Control Act of 1968, as
amended (Title 18, United States Code,
Chapter 44), or State law. The Gun
Control Act identifies several categories(known as ‘‘prohibitors’’) of

PO 00000

Frm 00012

Fmt 4700

Sfmt 4700

individuals 1 who are prohibited fromengaging in the shipment, transport,
receipt, or possession of firearms,
including convicted felons andfugitives. Most relevant for the purposesof this rule is the Federal mental healthprohibitor, which, pursuant to
Department of Justice (DOJ) regulations,applies to individuals who have been
involuntarily committed to a mental
institution, for reasons such as mental
illness or drug use; 2 found incompetentto stand trial or not guilty by reason of
insanity; or otherwise determined by acourt, board, commission, or otherlawful authority to be a danger tothemselves or others or unable tomanage their own affairs, as a result ofmarked subnormal intelligence, or
mental illness, incompetency,
condition, or disease.3 4
The Brady Gun Law established the
NICS to help enforce these prohibitions,as well as State law prohibitions on thepossession or receipt of firearms.5 The
NICS Index, a database administered by
the Federal Bureau of Investigation(FBI), collects and maintains certain
identifying information about
individuals who are subject to one ormore Federal prohibitors and thus whoare ineligible to purchase firearms. As of
2012, the NICS Index also contains
information on persons who are subject
to State law prohibitions on thepossession or receipt of firearms.6 The
1 See 18 U.S.C. 922(g) and (n) and implementing
regulations at 27 CFR 478.11 and 27 CFR 478.32.
2 The regulation, at 27 CFR 478.11, defines‘‘Committed to a mental institution’’ as a formal
commitment to the institution by a court or otherlawful authority. The term does not apply to aperson voluntarily admitted to a mental institution
or in a mental institution merely for observation.
3 The term used in the statute is ‘‘adjudicated asa mental defective. The term includes a finding of
insanity in a criminal case, and a finding ofincompetence to stand trial or a finding of not
guilty by reason of lack of mental responsibility
pursuant to the Uniform Code of Military Justice.
27 CFR 478.11.
4 This rule refers to the involuntary commitments
and other applicable adjudications as, collectively,‘‘adjudications that make an individual subject to
the Federal mental health prohibitor.’’
5 See Public Law 103–159, 18 U.S.C. 921–925,
and implementing regulations at 28 CFR 25.1
through 25.11 (establishing NICS information
system specifications and processes) and 27 CFRpart 478 (establishing requirements andprohibitions for commerce in firearms andammunition, including requirements related to
conducting NICS background checks); and 42
U.S.C. 3759(b) (allocating a percentage of certain
DOJ funds for State reporting of NICS data).
6 See Statement Before the Senate Judiciary
Committee, Subcommittee on Crime and Terrorism
at a hearing entitled, ‘‘THE FIX GUN CHECKS ACT:BETTER STATE AND FEDERAL COMPLIANCE,
SMARTER ENFORCEMENT’’ (November 15, 2011),
by David Cuthbertson, Assistant Director, Criminal
Justice Information Services Division, Federal
Bureau of Investigation. Testimony available at:
http://www.justice.gov/ola/testimony/112-1/11-1511-fbi-cuthbertson-testimony-re-the-fix-gun-checks-

E:\FR\FM\06JAR1.SGM

06JAR1Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

wgreen on DSK2VPTVN1PROD with RULES

minimum information required in a
NICS Index record consists of: The
name of the ineligible individual; thedate of birth; sex; and codes indicating
the applicable prohibitor, the submitting
entity, and the agency record supporting
the prohibition (e.g., an order for
involuntary commitment). For
individuals subject to the Federal
mental health prohibitor, only the factthat the individual is subject to thatprohibitor is submitted to the NICS;
underlying diagnoses, treatment
records, and other identifiable healthinformation are not provided to or
maintained by the NICS. A NICS
background check queries the NICS
Index and certain other national
databases 7 to determine whether aprospective buyer’s identifying
information matches any prohibiting
records contained in the databases. The
NICS Index can be accessed only for thelimited purposes authorized byregulation (see 28 CFR 25.6(j)) andcannot be used for other purposes,
including general law enforcement
activities.
The potential transfer of a firearmfrom a Federal Firearms Licensee (FFL)
to a prospective buyer proceeds asfollows: First, the prospective buyer isrequired to provide personal
information on a Firearms Transaction
Record (ATF Form 4473). Unless theprospective buyer has documentationthat he or she qualifies for an exception
to the NICS background checkrequirement under 18 U.S.C. 922(t)(3),8
the FFL contacts the NICS—
electronically, by telephone, or througha State level point of contact—andprovides certain identifying information
about the prospective buyer from ATF
Form 4473.9
The FFL then receives a response thatthe prospective firearm transfer may
act.pdf. We note also that State law may be more
restrictive than Federal law in some cases.
7 The other databases include the Interstate
Identification Index, which contains criminal
history record information; and the National Crime
Information Center, which includes, e.g.,
information on persons subject to civil protection
orders and arrest warrants. Additional information
is available at, http://www.fbi.gov/about-us/cjis/
nics/general-information/nics-overview.
8 These exceptions are listed in the Bureau of
Alcohol, Tobacco, Firearms and Explosives (ATF)
regulation at 27 CFR 478.102(d). For example, a
NICS check would not be required where thepotential recipient of a firearm has presented avalid State permit or license, provided conditions
at 27 CFR 478.102(d)(1) are met.
9 The form collects the prospective buyer’s name;demographic information such as address, placeand date of birth, gender, citizenship, race andethnicity; and ‘‘yes’’ or ‘‘no’’ answers to questions
about the person’s criminal history and otherpotential prohibitors. The form is available at
http://www.atf.gov/forms/download/atf-f-44731.pdf.

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

proceed or is delayed. The transfer isdelayed if the prospective buyer’s
information matches a record containedin one of the databases reviewed. If
there is a match, a NICS examiner
reviews the record to determine whether
the information it contains is, in fact,prohibiting, and then either: (1) If therecord does not contain prohibiting
information, advises the FFL to proceedwith the transaction; (2) if the record
does contain prohibiting information,
denies the transaction (due toineligibility); or (3) if it is unclear based
solely on the existing information in therecord whether it is prohibiting, delays
the transaction pending further
research.10 The NICS examiner does notdisclose the reason for thedetermination to the FFL (e.g., the FFL
would not learn that the individual was
ineligible due to the Federal mental
health prohibitor). In case of a delay, if
the NICS examiner does not provide a
final instruction to the FFL within threebusiness days of the initial backgroundcheck request, the FFL may proceedwith the transaction.11
Although FFLs are required in mostcases to request a background checkthrough the NICS before transferring afirearm to a prospective buyer,12 Federal
law does not require State agencies toreport to the NICS the identities ofindividuals who are prohibited frompurchasing firearms under either
Federal or State prohibitors, and not allStates report complete information to
the NICS or the databases checked by it.
Following the shooting at Virginia Tech
University in 2007, and other tragedies
involving the illegal use of firearms,
Congress enacted the NICS
Improvement Amendments Act (NIAA)
of 2007, Public Law 110–180. Amongother provisions, the NIAA requires
Federal agencies to make accessible to
the NICS the identities of individuals
known by the agencies to be subject toone or more prohibitors, and it
authorizes incentive grants for States toprovide such information when it is in
their possession.13 In addition, some
10 For example, a ‘‘delay’’ response may meanthat further research is required because potentiallyprohibitive criteria exist, but the matched records
are incomplete, See Federal Bureau of Investigation(FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
11 Some States have waiting periods that also
must be complied with before a firearm may betransferred, regardless of whether a proceed
response from NICS is received by the FFL within
three business days.
12 See 27 CFR 478.102. Exceptions to thisrequirement are referenced in FN 8 above, andlisted in the regulation at 27 CFR 478.102(d).
13 Eligibility for these grants is limited to Statesthat have implemented a ‘‘relief from disabilities’’
program for individuals who are prohibited frompossessing or receiving firearms for mental health

PO 00000

Frm 00013

Fmt 4700

Sfmt 4700

383

States have enacted legislation requiring
the reporting of the identities ofineligible individuals to databases
accessible to the NICS or to a State levelrepository responsible for submitting
information to the relevant databases.
States generally report criminal
history information to the other relevant
databases that are checked by the NICS;
however, many States continue to reportlittle if any information concerning
individuals subject to the Federal
mental health prohibitor (or the other
Federal prohibitors) to the NICS
Index.14 As a result, the NICS does nothave access to complete information
about all individuals who are subject toone or more of the Federal prohibited
categories or who are prohibited frompossessing or receiving firearms under
State law.
The HIPAA Privacy Rule and NICS
Reporting
The Privacy Rule, promulgated underthe Health Insurance Portability andAccountability Act of 1996 (HIPAA),
Title II, Subtitle F—Administrative
Simplification, Public Law 104–191,
establishes federal protections to ensure
the privacy and security of protected
health information (PHI) and establishes
an array of individual rights withrespect to one’s own health information.
HIPAA applies to covered entities,
which include health plans, health careclearinghouses, and health careproviders that conduct certain standardtransactions (such as billing insurance)electronically. HIPAA covered entities
may only use and disclose PHI with theindividual’s written authorization, or asotherwise expressly permitted or
required by the HIPAA Privacy Rule.
The Privacy Rule seeks to balance
individuals’ privacy interests with
important public policy goals including
public health and safety. In doing so,
the Privacy Rule allows, subject tocertain conditions and limitations, usesand disclosures of PHI without
individuals’ authorization for certain
law enforcement purposes, to avert aserious threat to health or safety, andwhere required by State or other law,among other purposes.15
reasons. Such programs must provide that a State
court, board, commission, or other lawful authority
shall grant the relief if, based on the circumstances
regarding the disabilities and the person’s recordand reputation, the person is not likely to pose a
danger to public safety, and granting the relief
would not be contrary to the public interest. See
Public Law 110–180, Section 105.
14 Federal law does not require States to submit
reports to any of the three databases (the NICS
Index, the III, and NCIC) accessed during a NICS
Check.
15 See 45 CFR 164.512.

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

384

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

As stated above, individuals who aresubject to the Federal mental healthprohibitor are ineligible to purchase afirearm because they have been‘‘committed to a mental institution’’ or‘‘adjudicated as a mental defective.’’ 16
DOJ regulations define these categories
to include persons who have been
involuntarily committed to a mental
institution for reasons such as mental
illness or drug use; have been foundincompetent to stand trial or not guilty
by reason of insanity; or otherwise havebeen determined by a court, board,commission, or other lawful authority to
be a danger to themselves or others or
unable to manage their own affairs, asa result of marked subnormal
intelligence, or mental illness,
incompetency, condition, or disease. In
many cases, these records are notsubject to HIPAA. Records ofindividuals adjudicated as incompetentto stand trial, or not guilty by reason of
insanity, originate with entities in thecriminal justice system, and these
entities are not HIPAA covered entities.
Likewise, involuntary civil
commitments usually are made by court
order, and thus, records of such formal
commitments typically originate withentities in the justice system. In
addition, many adjudications
determining that individuals are adanger to themselves or others, or areincapable of managing their own affairs,
occur through a legal process in the
court system.
However, because of the variety ofState laws, there may be State agencies,
boards, commissions, or other lawfulauthorities outside the court system thatare involved in some involuntarycommitments or mental healthadjudications that make an individual
subject to the Federal mental healthprohibitor. Moreover, we understandthat some States have designatedrepositories to collect and report to the
NICS the identities of individuals
subject to the Federal mental healthprohibitor. We believe that certain of
these lawful authorities or repositories
also may be HIPAA covered entities(e.g., a State health agency may be acovered entity).
As we described in the NPRM, where
the record of an involuntarycommitment or mental healthadjudication originates with a HIPAA
covered entity, or the HIPAA covered
entity is the State repository for suchrecords, there are two ways in which
covered entities can currently report to
the NICS (without the individual’s
authorization). First, a covered entity
can disclose the relevant information to
16 See 18 U.S.C. 922(g)(4).

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

the NICS where a State has enacted alaw that requires (and does not merely
authorize) such reporting.17 Second,
where a State has not enacted such alaw, a HIPAA covered entity that
performs both health care and nonhealth care functions (e.g., NICS
reporting) could become a hybrid entity
under HIPAA so that the Privacy Rule
applies only to its health care functions.
A covered entity can achieve hybrid
entity status by designating its healthcare components as separate from othercomponents, documenting thedesignation, and implementing policies
and procedures to prevent unauthorizedaccess to PHI by the entity’s noncovered components.18 Under thesecircumstances, the covered entity canreport prohibitor information throughits non-HIPAA covered NICS reporting
unit without restriction under thePrivacy Rule. These provisions remainin effect and are not altered by theamendments to the Privacy Rule that we
issue today.
However, despite these avenues fordisclosure, many States still were notreporting to the NICS essential
information on persons prohibited frompossessing firearms for reasons related
to mental health; concerns were raisedthat the HIPAA Privacy Rule’s
restrictions on covered entities’
disclosures of PHI might be preventing
certain States from reporting therelevant information to the NICS.
In addition, in July 2012, the U.S.
Government Accountability Office(GAO) reported to Congress on the
results of a survey of six States that it
had assessed as part of a performance
audit of the progress made by DOJ andthe States in implementing the NIAA.19
In the report, the GAO wrote that‘‘officials from 3 of the 6 States wereviewed said that the absence of
explicit State-level statutory authority toshare mental health records was an
impediment to making such records
available to NICS.’’ 20 The report also
17 See 45 CFR 164.512(a). Note that disclosuresfor NICS purposes would not fall under the Privacy
Rule’s provisions permitting disclosures for law
enforcement purposes (which apply to specific law
enforcement inquiries) or to avert a serious threat
to health or safety (which require an imminent
threat of harm). See 45 CFR 164.512(f) and (j).
18 See 45 CFR 164.103, 164.105; 67 FR 53182 (8/14/2002).
19 See GAO–12–684, Gun Control: Sharing
Promising Practices and Assessing Incentives Could
Better Position Justice to Assist States in Providing
Records for Background Checks.
20 We note that the GAO Report uses the term‘‘mental health records’’ to refer to identifying
information on individuals who are subject to theFederal mental health prohibitor. To avoid
implying that mental health records are collected by
NICS, the Department uses the terms ‘‘identities,’’‘‘information,’’ or ‘‘data’’ in place of ‘‘mental healthrecords.’’ GAO–12–684, p. 12.

PO 00000

Frm 00014

Fmt 4700

Sfmt 4700

stated that, although the number ofrecords provided by the States to the
NICS had increased by 800 percent
between 2004 and 2011, this increase
was largely due to efforts by only 12States. The report raised the possibility
that States that do not report to the NICS
the identities of individuals who areprohibited from possessing firearms forreasons related to mental health may
experience challenges to reporting
related to the HIPAA Privacy Rule.
II. The ANPRM
BackgroundOn April 23, 2013, the Department
published an Advance Notice of
Proposed Rulemaking (ANPRM)
requesting public input on these issues(78 FR 23872). The ANPRM explainedthat the Department was considering
creating an express permission in the
HIPAA Privacy Rule for reporting
information relevant to the Federal
mental health prohibitor to the NICS by
those HIPAA covered entities that (a)are responsible for the involuntarycommitments or other adjudications
that make individuals subject to theFederal mental health prohibitor, or (b)are designated by a State to report to the
NICS. In the ANPRM, the Department
indicated that such an amendment
might produce clarity regarding thePrivacy Rule and help make it simpler
for States to report the identities of suchindividuals to the NICS.
To inform our efforts to address any
issues in this area, we requested
comments on a series of questions
concerning the nature and scope of the
problem of underreporting and whether
a modification to the Privacy Rulewould help address these issues. We
also requested comments on any
implications of a modification to thePrivacy Rule for the mental healthcommunity or for the treatment of
individuals, and how the Department
might address any unintended
consequences of such a modification.
We received over 2,050 comments in
response from individuals, Stateagencies, health care providers,associations of health care professionals,
consumer advocacy groups, and otherstakeholders.
A number of commenters supported
creating an express permission as a way
to remove a potential barrier to an
important and necessary public safetymeasure, which could help keep
firearms out of the hands of individuals
who should not have them bystrengthening the background checksystem. Many others generally
expressed concern that the NICS, theFederal mental health prohibitor, and

E:\FR\FM\06JAR1.SGM

06JAR1Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
the contemplated HIPAA permission
would infringe on their Second
Amendment right to bear arms and theright to be afforded due process of law
under the U.S. Constitution. In addition,
many individual commenters, as well as
health care providers, organizations
representing providers, and consumer
advocacy groups, emphasized theimportance of protecting individuals’
health information privacy. These
commenters raised concerns regarding
the possible adverse consequences anexpress permission to report certain
information could have on the patientprovider treatment relationship andindividuals’ willingness to seek needed
mental health care.21

wgreen on DSK2VPTVN1PROD with RULES

III. Summary of the NPRM
After considering the publiccomments received on the ANPRM, wepublished a Notice of Proposed
Rulemaking (NPRM) on January 7,
2014,22 proposing to use theDepartment’s broad authority under
HIPAA to specify the permitted usesand disclosures of PHI by HIPAA
covered entities. The NPRM proposed torevise 45 CFR 164.512 of the Privacy
Rule by adding a new category of
permitted disclosures to 45 CFR
164.512(k), which addresses uses anddisclosures for specialized government
functions. The NPRM proposed newprovisions at (k)(7) that would permit
certain covered entities to disclose thelimited demographic and certain otherinformation needed for NICS reporting
purposes.
We indicated in the NPRM that there
is a strong public safety need for thisinformation to be accessible to the NICS
and that some States are currently
under-reporting or not reporting thisinformation at all. Further, althoughmost of the information relevant to theFederal mental health prohibitor is heldby entities that are not covered by
HIPAA, for those few HIPAA covered
entities that may be involved in therelevant commitments or adjudications,the Privacy Rule’s existing paths fordisclosure did not appear to be
sufficient. We explained that, to theextent that some covered entities
perform adjudicatory or repository
functions in States that have not enacted
laws requiring reporting to the NICS,
and that a subset of those may be unable
to achieve hybrid entity status due toadministrative challenges or otherreasons, an express permission would
21 Please see the ANPRM for a more thoroughdiscussion of public comments and responses. 78
FR 23872 (April 23, 2013).
22 See 79 FR 784 (January 7, 2014).

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

provide clarity and remove a barrier totheir reporting.
However, to address concerns
regarding an express permission’s
potential to harm the patient-provider
relationship or deterring individuals
from seeking needed mental health care,
we proposed to narrowly tailor thepermission to report information on
individuals subject to the Federal
mental health prohibitor in a number ofways. Specifically, we proposed tolimit: (1) Which covered entities could
use or disclose PHI for NICS reporting
purposes, (2) to whom the PHI could be
disclosed, and (3) the scope of theinformation that could be used ordisclosed.
First, the NPRM proposed a newparagraph at 164.512(k)(7)(i) to permit
certain NICS disclosures only by those
covered entities that function as
repositories of information relevant to
the Federal mental health prohibitor on
behalf of a State or that are responsible
for ordering the involuntarycommitments or other adjudications
that make an individual subject to theFederal mental health prohibitor. The
Federal prohibitor regulations define an
involuntary commitment as a formal
commitment of a person to a mental
institution by a court, board,commission, or other lawful authority.
The other applicable adjudications
include determinations by a court,
board, commission, or other lawfulauthority that persons are a danger tothemselves or others, or lack the mental
capacity to contract or manage theirown affairs, as a result of marked
subnormal intelligence, or mental
illness, incompetency, condition, ordisease.23 The prohibitor does not apply
to individuals in a psychiatric facility
for observation or who have been
admitted voluntarily; thus, the proposed
rule would not have permitted
disclosures with respect to thoseindividuals.
With respect to repositories of Federal
mental health prohibitor information,
we explained further that we did notintend to require States to formallydesignate the entities responsible for
NICS reporting, but that we would
expect States to be able to identify therelevant entities.
We noted in the NPRM that our
understanding was that lawful authority
for performing such adjudications andrepository functions rests, for the mostpart, with entities that operate outside
the scope of HIPAA. However, in theinterest of public safety, we wanted toensure that relevant adjudications could
be reported in the subset of States in
23 See 27 CFR 478.11 (Definitions).

PO 00000

Frm 00015

Fmt 4700

Sfmt 4700

385

which HIPAA covered entities may
make, or collect and report records of,these determinations.
We explained further that, inpermitting only entities involved inthese adjudicatory or repository/
reporting functions to use or disclose
Federal mental health prohibitor
information for NICS purposes, theproposal would not create a permission
for most treating providers to disclose
PHI about their own patients for these
purposes. We agreed with thecommenters on the ANPRM who argued
that encouraging voluntary treatment is
critical to ensuring positive outcomesfor individuals’ health as well as the
public’s safety, and explained that the
NPRM was designed to balance that goal
and the public safety interests served by
the NICS. We also agreed that nonhealth care entities bear primary
responsibility for collection andreporting of information relevant to theFederal mental health prohibitor inmost States. However, where a HIPAA
covered entity is a board, commission,or other lawful authority that makes
involuntary commitments or otheradjudications that result in individuals
being subject to the Federal mental
health prohibitor, we believed thoseentities too were likely to hold recordsof the relevant commitments andadjudications.
We requested public comment on theextent to which some States may havevested responsibility for Federal mental
health prohibitor reporting in HIPAA
covered entities, to what extent records
needed for NICS reporting are created or
maintained by covered entities, andwhether there are circumstances inwhich health care providers would needto report the identity of an individual
subject to the Federal mental healthprohibitor to a State designated records
repository or directly to the NICS. We
also requested comment on the types ofadditional guidance from OCR and/or
the NICS that would be helpful forunderstanding to which covered
entities, and under what circumstances,the proposed permission would apply.
Second, we proposed a newparagraph at (k)(7)(ii) providing that acovered entity identified in (k)(7)(i) may
use or disclose Federal mental healthprohibitor information for NICS
purposes only directly to the NICS or toan entity designated by the State as arepository of data for purposes ofreporting to the NICS. By clearly
delimiting the permitted recipients ofsuch disclosures, we explained that therule would ensure that covered entities
do not exceed the intended scope of thepermission by disclosing information
relevant to the Federal mental health

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

386

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

prohibitor to, for example, law
enforcement agencies that do not
operate as repositories of data for
purposes of reporting to the NICS.24 We
requested comment on whether there
are States in which a type of entity notdescribed in this proposed paragraph is
responsible for NICS reporting and thus,
should be able to receive NICS datafrom a HIPAA covered entity.
Third, we proposed a new paragraphat (k)(7)(iii) to limit the information
permitted to be used or disclosed towhat is needed for purposes of reportingto the NICS. This is consistent with thePrivacy Rule provision that generally
requires covered entities to makereasonable efforts to limit the PHI usedor disclosed to the minimum necessary
to accomplish the intended purpose.
Specifically, in the proposed regulation
text, we made clear that only the limited
demographic and certain otherinformation needed for purposes ofreporting to the NICS could be reported
under the permission. We indicatedthat, at the time, we believed that thenecessary information would be the data
elements needed to create a NICS Index
record: (1) Name of the individual; (2)date of birth; (3) sex; (4) a code ornotation indicating that the individualis subject to the Federal mental healthprohibitor; (5) a code or notation
representing the reporting entity; and (6)a code identifying the agency record
supporting the prohibition. The
proposed regulation text expressly
provided that the proposed modification
would not permit the use or disclosureof clinical or diagnostic information for
NICS reporting purposes. We requested
comment on whether, and in whatcircumstances, HIPAA covered entities
or other entities, such as courts,
currently report to a records repository
or directly to the NICS information thatwas not listed in the proposedparagraph.
In addition, we explained that wewere also considering permitting thedisclosure of some or all the following
additional data elements, which are
optional fields for a NICS Index entry,
for NICS reporting purposes: Social
Security number, place of birth, State ofresidence, height, weight, eye color, haircolor, and race. As we noted in the
NPRM, from what we understand, theseelements are not included in every NICS
record, but often are used to confirm
that a prospective firearm recipient
matches a record searched by the NICS
or to eliminate ‘‘false positive’’
24 We did not propose to change the Privacy
Rule’s existing permissions to use or disclose PHI
for specific law enforcement investigations, as
provided in 45 CFR 164.512(f).

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

background check results. We requested
public comment on this issue.
We also proposed to limit thepermission to uses and disclosuresabout individuals who are subject to theFederal mental health prohibitor andnot to apply it to disclosures about
individuals subject only to State mental
health prohibitors. However, werequested comment on this aspect of thescope of the permission, specificallywith regard to whether the permission
should be broadened to allow covered
entities to also disclose the identities ofindividuals who are prohibited by Statelaw from possessing or receiving
firearms for reasons related to mental
health.
Finally, we also explained that the
proposed permission would apply onlywith respect to the PHI of individuals
subject to the Federal mental healthprohibitor and not to the PHI of those
persons who may be subject to the other
Federal prohibitors listed at 18 U.S.C.
922(g). The lack of an express HIPAA
permission for reporting information
relevant to the Federal mental healthprohibitor was a limited problem andwe had not heard that there was asimilar issue with respect to the otherprohibitors. Thus, for example, acovered entity would not be able to use
the proposed permission to use or
disclose information about anindividual who is an unlawful user ofor addicted to any controlled substance(18 U.S.C. 922(g)(3)), except to theextent the individual was also subject to
the Federal mental health prohibitor.
We also noted that other laws could
impact disclosures related to the other
Federal prohibitors, including 18 U.S.C.
922(g)(3).25

interests to ensure that individuals are
not discouraged from seeking voluntarytreatment.
Under this final rule, covered entities
that order involuntary commitments or
make other adjudications that subject
individuals to the Federal mental healthprohibitor, or that serve as repositoriesof the relevant data, are permitted to use
or disclose the information needed for
NICS reporting of such individuals
either directly to the NICS or to a Staterepository of NICS data. Thus, if acovered health care entity also has a rolein the relevant mental healthadjudications or serves as a State datarepository, it now may disclose therelevant information for NICS reporting
purposes under this new permission
even if it is not designated as a HIPAA
hybrid entity or required by State law toreport. This final rule does not create an
express permission for covered entities
to disclose for NICS reporting purposes
the PHI of individuals who are subject
to State-only mental health prohibitors.
The Department’s rationale for
adopting the provisions in this final
rule, along with further clarifications
and interpretations of the provisions, isexplained below in the responses to the
public comments on the NPRM.

IV. Provisions of the Final Regulation
This final rule adopts themodifications to the HIPAA Privacy
Rule as proposed. After considering thecomments we received, we continue tobelieve that the creation of a limited
express permission in the HIPAA
Privacy Rule to use or disclose certain
information relevant to the Federal
mental health prohibitor for NICS
purposes is necessary to address barriers
related to HIPAA and to ensure that
relevant information can be reported forthis important public safety purpose.
Furthermore, this narrowly tailored rule
appropriately balances public safety
goals with important patient privacy

A. Comments Regarding Creating an
Express Permission for NICS Reportingin the HIPAA Privacy Rule
Comments: A number of commenters
expressed general support for including
an express permission in the HIPAA
Privacy Rule for reporting certain
information to the NICS, stating that therule change would help increase thereporting of information to the NICS,
reduce the ability of individuals withserious mental health problems to
obtain firearms, and ultimately lessen
the risk of harm to the individuals
themselves, law enforcement, and the
public.
Several advocacy organizations
involved in gun violence prevention
agreed with our statements in the NPRM
that the HIPAA Privacy Rule and, insome cases, perceptions of the Privacy
Rule, may create a barrier to certain
entities reporting to the NICS, and thatthe proposed modification would

25 The ability of certain entities to reportindividuals who are subject to the Federal
prohibitor at 18 U.S.C. 922(g)(3) may be affected by
the Confidentiality of Alcohol and Drug Abuse
Patient Records Regulations, 42 CFR part 2,
administered by the Substance Abuse and Mental
Health Services Administration (SAMHSA).

PO 00000

Frm 00016

Fmt 4700

Sfmt 4700

V. Analysis of and Responses to Public
Comments
We received more than 430 publiccomments in response to the NPRM,
including from advocacy organizations,associations of health care and mental
health professionals, a state mental
health agency, and individual membersof the public. A summary of thecomments we received on the proposed
rule and our responses follow.

E:\FR\FM\06JAR1.SGM

06JAR1Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

wgreen on DSK2VPTVN1PROD with RULES

address this problem. For example, thecomment submitted by Mayors Against
Illegal Guns (MAIG) indicated thatmental health treatment facilities inseven States currently are required by
State law to report Federal mental
health prohibitor information either
directly to the NICS or to State agencies
that report to the NICS, which indicatesthat mental health facilities do in somecases hold the relevant records. MAIG
inferred from this information that there
likely are other States in which HIPAA
covered entities have information thatshould be reported to the NICS, but thatthe entities may not be reporting due toconcerns about the HIPAA Privacy
Rule’s restrictions on disclosures. MAIG
also cited statements from interviews its
researchers conducted with State
officials about issues related to NICS
reporting and noted that officials fromnine States and the District of Columbia
had expressed concern that HIPAA, orother privacy requirements, generally
prohibited sending records to the NICS,
and thus that reporting would violate
such requirements. MAIG asserted thatwhether these cited concerns werebased on real or perceived barriers, its
research indicated that making clear theability to report without violating
privacy laws tended to greatly improvestate reporting rates, and that the
proposed modifications to the Privacy
Rule similarly would help states
improve their record submissions.26
A number of commenters asserted
that increasing reporting to the NICS
could, in turn, help to decrease rates ofgun violence. One of these commenters
cited research indicating that, in one
State, having a mental healthadjudication record in the NICS
database appeared to reduce the chanceof a person committing a first violent
crime.27
In addition, a number of commenters,
including the American Medical
Association (AMA), and the American
26 MAIG, Fatal Gaps, How Missing Records in theFederal Background Check System Put Guns in theHands of Killers (Nov. 2011).
27 The commenter cited Jeffrey Swanson,
Preventing Gun Violence Involving People with
Serious Mental Illness in REDUCING GUN
VIOLENCE IN AMERICA, INFORMING POLICYWITH EVIDENCE AND ANALYSIS (eds. Daniel W.
Webster and Jon S. Vernick, 2013). The study
authors note that, ‘‘[c]onsidering separately the
subgroup of people with serious mental illness who
do not have criminal records, our data seem tosuggest that the Brady Law background checks canhave some positive effect, if enforced. In those witha gun-disqualifying mental health record, risk ofviolent criminal offending declined significantly
after Connecticut began reporting gun-disqualifying
mental health records to the NICS.’’ The authors
also describe the limitations of the study and add,‘‘[t]hese findings do not prove a causal relationshipbetween the background check system and reduced
violent crime.’’

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

Psychiatric Association (APA),
expressed appreciation that the
proposed rule would appropriatelybalance protecting public safety andpreserving the patient-physician
relationship by narrowly defining thescope of the permission. The AMA
stated that its view on the issue ofreporting patient information to the
NICS is governed by the association’s
Code of Medical Ethics and policies
adopted by the AMA’s policy making
body. The AMA indicated that the Codeof Ethics supports strong protections forpatient privacy and, in most cases,
requires physicians to keep patient
medical records strictly confidential. If
there must be a breach inconfidentiality, such as for public healthor safety reasons, the disclosures must
be as narrow in scope as possible. In
light of these considerations, the AMA
expressed support for the Department’s
approach.
In contrast, many commenters did notsupport adding an express permission
in the HIPAA Privacy Rule for reporting
certain information about persons
subject to the Federal mental healthprohibitor for NICS purposes. Several
commenters asserted that there are only‘‘perceived barriers’’ related to HIPAA,
not real ones, so changing HIPAA would
be unlikely to increase the reporting of
mental health prohibitor information for
NICS purposes. One commentersuggested that, rather than facing
obstacles to reporting, States may bechoosing not to report on certain
categories of prohibited individuals forreasons unrelated to HIPAA—for
example, because the States do notbelieve the individuals pose a danger.
Other comments, some of whichhighlighted the importance of early andappropriate mental health intervention
as the most effective way to prevent
violence related to mental illness,
expressed concern that the proposed
permission would discourage
individuals from seeking needed
treatment. For example, the National
Association of Psychiatric Health
Systems (NAPHS) predicted that the
public perception of the proposed rulewould be that, if an individual disclosed
information to a therapist, the therapist
would be required to ‘‘report’’ thepatient. This commenter argued that, asa result, the proposed rule would createa chilling effect on individuals’
willingness to discuss issues intreatment that could lead to positive
resolution rather than violence directed
toward themselves or others. A numberof commenters also expressed concernthat the proposed rule would unfairly
target persons with mental illness andperpetuate unfounded and damaging

PO 00000

Frm 00017

Fmt 4700

Sfmt 4700

387

stereotypes about persons with mental
illness by sending a message to the
public that the Department perceives
mental illness as inextricably linked
with violence.
Some commenters expressed general
concern regarding the effects of the
proposed rule on individuals’ privacy
interests. A number of thesecommenters argued that
communications between patients andtheir health care providers should be
kept confidential under all
circumstances.
Response: After considering thecomments, we continue to believe thatthe creation of a limited express
permission in the HIPAA Privacy Ruleto disclose information relevant to theFederal mental prohibitor for NICS
purposes is necessary to address barriers
to reporting. In particular, to the extent
that some States do not require
reporting by law, and reporting entities
in those States may face administrativeor other challenges in creating a hybrid
entity, the HIPAA Privacy Rule may
create impediments to reporting thatcannot be cured through mere guidance.
Therefore, we believe such an express
permission will serve an important
public safety interest by removing abarrier to reporting that may exist incertain circumstances and thereby
potentially increase reporting by Statesthat historically have reported little or
no Federal mental health prohibitor data
to the NICS due to concerns about
violating the Privacy Rule.
Further, we believe that thelimitations contained in the narrowly
tailored express permission we adopt
appropriately respond to commenters’
important concerns about discouraging
individuals who need mental healthtreatment from seeking care. First, welimit the permission to only those
covered entities that order the
involuntary commitments or make theother adjudications that cause
individuals to be subject to the Federal
mental health prohibitor, or that serve
as repositories of such information for
NICS reporting purposes. Thus, the rule
does not affect most treating providers
or create a permission for them todisclose PHI about their own patientsfor these purposes. Second, we permit
such entities to disclose NICS data only
to designated repositories or the NICS.
Third, we limit the information that
may be disclosed to certain
demographic or other information thatis necessary for NICS reporting. Finally,
we do not expand the permission toencompass State law prohibitor
information. These aspects of theprovision are discussed more fully
below. By limiting the permission in

E:\FR\FM\06JAR1.SGM

06JAR1

388

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

these ways, we protect the patientprovider relationship. Further, we
believe these limitations carefullybalance an individual’s privacy interests
with the public safety interest inreporting certain information to the
NICS.
In response to concerns that the rule
unfairly singles out individuals withmental illness, we emphasize, as we didin the proposed rule, that a mental
health diagnosis does not, in itself,
make an individual subject to theFederal mental health prohibitor, which
requires an involuntary commitment or
adjudication that the individual poses a
danger to self or others or lacks themental capacity to contract or manage
his or her own affairs.
In addition, the Department continues
to support efforts by the Administration
to dispel negative attitudes andmisperceptions relating to mental
illness and to encourage individuals toseek voluntary mental health treatment.
With the implementation of the
Affordable Care Act, millions ofAmericans who did not previously havecoverage will receive coverage formental health services.

wgreen on DSK2VPTVN1PROD with RULES

B. Comments Regarding the Scope of thePermission
Expanding to State Law Prohibitors
Comments: We received several
comments in response to our question
about whether the permission should be
expanded to include State law
prohibitors. Of these, a minority ofcommenters supported expanding the
proposed rule to permit disclosures of
information about individuals who aresubject to State-only mental healthprohibitors (i.e., State prohibitors thathave different criteria than the Federal
mental health prohibitor). Several
commenters who advocated for thedisclosure of such information for NICS
reporting purposes asserted that Statelaw prohibitors would be effective only
if accurate and adequate information
were submitted to the NICS. One ofthese commenters argued that Stateefforts to report disqualifying records to
the NICS should be encouraged, notcurtailed by confusion over theapplicability of the HIPAA Privacy
Rules. The commenter also argued that
it would create greater confusion not toinclude the same express permission
with respect to State mental healthprohibitor information as was proposed
for the reporting of information related
to the Federal mental health prohibitor.
Another commenter who supported apermission to disclose information
about individuals who are subject toState-only mental health prohibitors

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

argued that increasing the disclosures to
the NICS about individuals who areprohibited by State law (but perhaps notFederal law) from purchasing firearms
could address the situation in which aperson who is subject to a prohibitor in
the person’s State of residence entersanother State temporarily for the sole
purpose of obtaining a firearm and thenreturns to the State where ownership is
prohibited with a firearm. This
commenter voiced the concern that, if
the State of residence does not provide
information about individuals who aresubject to State law prohibitors to theFederal background check system, a FFL
in another State would not know thatthe individual is subject to a prohibitor.
Several commenters asserted that an
express permission to disclose
information about individuals who aresubject to State mental healthprohibitors would help to avoid amisinterpretation that HIPAA prohibits
disclosures of PHI relevant to Statemental health prohibitors incircumstances when HIPAA otherwise
would not. Another commenter argued
that, as some State law prohibitors wereenacted before HIPAA, State legislators
would not have foreseen HIPAA-related
obstacles to disclosure or the resulting
need to require reporting to the NICS bylaw; as a result, those States may nothave laws in place to require thereporting of State law prohibitors.
One commenter who supported
extending the permission argued thatthe reporting of State mental healthprohibitors would be consistent withcongressional intent, as expressed
through statutes aimed at preventing
gun violence. The commenter asserted
that the NICS was established under the
Brady Gun Law to serve as a central
aggregated database of information
regarding the identities of individuals
who are prohibited from possessing
firearms under any Federal, State, or
local law.
In contrast, a number of commenters,
including several associations of mental
health professionals, expressed concernthat expanding the reporting permission
to apply to State law mental healthprohibitors would involve more treating
health care providers in NICS reporting,and that individuals would not seek
treatment for mental health problems ifthey felt that simply by seeking
treatment they could be reported to the
NICS.
Several commenters, including two
mental health professional associations,expressed concern that State mental
health prohibitors are being expanded
in an overly broad manner that willfurther negative attitudes andmisperceptions about mental illness.

PO 00000

Frm 00018

Fmt 4700

Sfmt 4700

The commenters pointed to an example
of a State statute that requires healthcare providers to report to the NICS theidentities of all individuals withintellectual disabilities, as well as
individuals who voluntarily commit
themselves to a mental institution.
The CCDRTF provided additional
examples of State law mental healthprohibitors that are significantly broader
than the Federal mental healthprohibitor and expressed concern thatmany of these State prohibitors apply toindividuals without the benefit of an
adjudication by a court, board,commission or other lawful authority, as
provided for under the Federal
prohibitor.28 This commenter asserted
that the Federal mental healthprohibitor forbids the reporting of
information to the NICS about
individuals who are subject to broader
State mental health prohibitors due to alack of equivalent procedural
protections for such individuals;
therefore, this commenter argued, topermit reporting related to State mental
health prohibitors would violate theSupremacy Clause and raise due processconcerns.
A number of commenters who
opposed the reporting of State mental
health prohibitors expressed concernthat the broadest State law prohibitors
would become the de facto national
standard if the NICS were to include
State law prohibitors. Others raised
concerns about the increased
complexity involved in accurately
maintaining the NICS database with theaddition of State law prohibitor records,
including challenges associated withavoiding or identifying duplicate
reports, resulting in less reliability,
increased inaccuracy, and improper
28 This commenter described laws enacted in four
States. According to the commenter, New York law
requires all mental health professionals to reportany person undergoing treatment that is ‘‘likely toengage in conduct that would result in serious harm
to self or others’’ (citing N.Y. Mental Hygiene. Law§ 9.46), while New York’s SAFE Act requires mental
health treatment providers to report covered
individuals to a state database without an
adjudicatory process (citing N.Y. Mental Hygiene
Law § 9.46). In California, the commenter stated,prohibitors apply to individuals undergoing
voluntary inpatient treatment (citing 30 Cal. Welf.
& Inst. Code § 8100(a)); and apply to individuals
involuntarily held as inpatients under 72-hourholds (citing Cal. Welf. & Inst. Code § 8103(f) andCal. Welf. & Inst. Code § 5150) without the types ofadjudications contemplated under the Federal
mental health prohibitor (citing 18 U.S.C. 922(g);U.S. v. Rehlander, 666 F.3d 45, 50 (1st Cir. 2012).
Finally, the commenter noted that Illinois andHawaii have prohibitors that apply to allindividuals who have received particular diagnoses(citing 31 430 Ill. Comp. Stat. 65/8(g) (intellectual
disability) and (s) (developmental disability); Haw.
Rev. Stat. Ann. § 134–7(c) (persons with significant
DSM diagnosed disorder).

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
denial of rights, as well as adding
complexity to appeals.
Response: We share the concerns ofcommenters that, due to the breadth ofsome State law prohibitors, theinclusion of State-only prohibitors in
the permission would increase theinvolvement of treating providers in
NICS reporting, which could negatively
affect patient-provider treatment
relationships and discourage someindividuals from seeking care. While wenote that the NICS currently receives
some information on State law
prohibitors, given these concerns andthe importance of protecting the patientprovider relationship, we do not think
it is appropriate to expand thepermission with respect to HIPAA
covered entities. We agree with thecommenters who stated that the healthand safety of individuals and the public
is best served if persons with mental
illness obtain appropriate treatment; bylimiting the permission to the narrower
Federal mental health prohibitor, andcarefully tailoring the permission in theways described throughout thispreamble, this final rule is designed toensure that such persons are notdiscouraged from seeking care.
With respect to some commenters’
concerns about State mental healthprohibitors being ineffective without a
HIPAA disclosure permission, we notethat the Privacy Rule does not affect thereporting of State law prohibitors by
non-HIPAA covered entities, which are
the entities that maintain most of therelevant information. Moreover, to theextent that covered entities maintainrelevant State law prohibitor
information and a State wants to ensurethat the reporting of this information
can occur, the Privacy Rule provides
certain other avenues for disclosure, as
we have described elsewhere. For
example, although our balancing ofinterests limits this express permission
under HIPAA to disclosures related to
the Federal mental health prohibitor,
this rule does not prevent Statelegislators from differently balancing theprivacy, health, and public safety issues
involved with respect to their State level
mental health prohibitors—nor does theFederal mental health prohibitor itself
prohibit reporting to the NICS of Statelaw prohibitor information, as acommenter asserted. If State legislators
determine that information related to a
State-only prohibitor should be
disclosed despite any potential chilling
effect on seeking treatment, they canenact a State law requiring the relevant
entities to report such information.
Alternatively, the relevant covered
entities can create a hybrid entity,
separating their HIPAA covered health

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

care functions from their NICS reportingor repository functions, such that the
information maintained by the covered
health care component is subject to thePrivacy Rule, while information held by
the non-covered component can bereported without regard to the Privacy
Rule.
We disagree with the commenters
who argued that excluding State-only
mental health prohibitor informationfrom the permission will create
confusion. We do not think this will
occur because this final rule clearly
indicates that it applies where firearm
possession is prohibited under aspecific provision in Federal law. We
also note that the rule delineates thetypes of covered entities that are
permitted to disclose, the information
they are permitted to share, thecategories of individuals covered by thepermission, and the entities to which
they can make such disclosures. In
addition, we intend to work with DOJ todevelop additional guidance on the
categories within the Federal mental
health prohibitor. Moreover, we do notbelieve this final rule will create a
misperception that HIPAA always
prohibits the reporting to the NICS ofindividuals who are subject to Stateonly mental health prohibitors. As
explained elsewhere in this preamble,
the Privacy Rule already permits usesand disclosures of PHI that are requiredby law, including State law reporting
requirements; also, HIPAA covered
entities that perform both health careand non-health care functions (e.g.,
NICS reporting) are permitted to create
hybrid entities under HIPAA so that thePrivacy Rule applies only to their healthcare functions. This final rule does notchange those provisions.
Finally, we do not agree that Congress
intended for State (or local) law
prohibitor information to be reported to
the NICS in all circumstances, such aswhere doing so would conflict withcountervailing privacy concerns due tothe treatment relationship between
patients and health care providers.
Therefore, this final rule balances avariety of important interests, including
protecting the privacy of individuals’
personal health information, ensuring
access to needed mental health careservices, and advancing the public
safety interests in ensuring that persons
who are prohibited by Federal law frompurchasing or possessing a firearm formental health reasons do not gain accessto firearms.
Entities Permitted To Report
Comment: Several commenters,
including the AMA and the National
Association of Psychiatric Health

PO 00000

Frm 00019

Fmt 4700

Sfmt 4700

389

Systems, expressed support for the
proposal to limit the permission to only
those entities in a State that are directly
involved in the relevant adjudications
or maintain records of them for NICS
reporting purposes. These commenters
expressed appreciation for the narrow
drafting of the NPRM based on the needto support provider-patient
relationships and encourage individuals
with mental illness to seek appropriate
care.
However, several advocacy
organizations and many individuals
argued that direct treatment providers
should not be permitted to report
information about their patients to the
NICS under any circumstances (i.e.,even if they are, or are part of, the entitythat orders involuntary commitments or
conducts other relevant adjudications,or serves as a repository of NICS data).
Some of these commenters argued thatreports to the NICS database shouldcome only from the judiciary.
Finally, we did not receive responses
to the question we posed in the NPRM
about whether additional types ofcovered entities within a State (otherthan those identified in the proposed
regulatory text) might be expected, andthus should be permitted under thePrivacy Rule, to report data to the NICS
or to a State repository.
Response: We agree with thecommenters who emphasized the needto protect the provider-patient
relationship, and this final rule
addresses such concerns by limiting thepermission to those covered entities that
also perform an adjudicatory or datarepository function. Furthermore, as
described more fully elsewhere in thispreamble, the permission does notextend to broader State law prohibitors,
which may not require a formal
adjudication or involuntarycommitment and whose inclusion likely
would involve more treatment providers
in NICS reporting.
In response to comments arguing that
only entities in the court system shouldbe permitted to report to NICS, it is ourunderstanding, based on publiccomments and our fact finding, thatcourts do not create or maintain recordsof all of the involuntary commitments orother adjudications that makeindividuals subject to the Federal
mental health prohibitor. Therefore, for
the NICS database to include reports ofall persons subject to the mental healthprohibitor, it is necessary for certain
other entities that create or maintainsuch information to be able to report.
We believe this permission will help
strengthen the background check system
to ensure that individuals who areprohibited from purchasing or

E:\FR\FM\06JAR1.SGM

06JAR1

390

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

possessing firearms are prevented fromobtaining them. We also acknowledge
the concerns of commenters who argued
that providers should not be permitted
to report information about theirpatients under any circumstances. As
explained in more detail elsewhere inthis preamble, to address these andother concerns, we have carefully
tailored this final rule to limit the
involvement health care providers, andto prevent disclosures of diagnostic or
clinical information for NICS reporting
purposes.

wgreen on DSK2VPTVN1PROD with RULES

Demographic and Certain Other
Information Permitted To Be Reported
Comment: Many commentersspecifically voiced support for the
NPRM’s proposal not to permit thedisclosure of diagnostic or clinicalinformation for NICS reporting
purposes. (We also noted in the NPRM
that the NICS does not request or
contain such information.) For example,
the American Medical Association
stated that it strongly supported
restricting the information disclosed to
the limited demographic and otherinformation needed for reporting, as the
NPRM proposed. To support the pointthat NICS reporting is sufficiently
limited, another commenter pointed outthat the information that is reported to
the NICS generally is provided by theindividual to a FFL on the required
application for the firearm.
In contrast, one commenter asserted
that, as written, the proposed
permission would grant discretion tostate entities to determine the scope of‘‘demographic and certain otherinformation’’ to be reported and argued
further that DOJ (specifically ATF), not
HHS, has authority to define the‘‘minimum’’ information required by
NICS.
In response to our request forcomment on whether, and in whatcircumstances, entities currently report,
or should be permitted to report,
additional data elements needed toconfirm an individual’s identity, theConnecticut Department of Mental
Health and Addiction Services(DMHAS) asserted that certain
additional data elements are helpful in
confirming whether an individual isappropriately excluded from gun
purchase or possession in cases wheremultiple individuals share the same
name and date of birth. Several othercommenters agreed that permitting thedisclosure of additional data elements
for NICS reporting purposes would
allow more accurate verification of anindividual’s identity, resulting in fewer
erroneous denials, and would facilitate

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

the correction and updating of NICS
entries.
The Connecticut DMHAS and otherssuggested the inclusion of some or all of
the following specific data elements:
Social Security number, place of birth,state of residence, height, weight, eyecolor, hair color, and race. Social
Security number and race were cited as
the most reliable indicators of anindividual’s true identity.
Response: We agree with thecommenters who stated that limiting thepermission to exclude diagnostic andclinical information appropriatelybalances individuals’ privacy interestsand public safety priorities. We also
agree that there may be data elements
beyond those needed to create the NICS
record (i.e., the individual’s name, sex,
and date of birth; as well as codes
identifying (1) the Federal mental healthprohibitor, (2) the record documenting
the involuntary commitment or
adjudication, and (3) the entity fromwhich the record initiated) that may be
helpful in verifying identity andexcluding false matches. Given that, thefinal rule provides some flexibility forStates or reporting entities. We do not
specify in the regulatory text which data
elements may be disclosed, but clarify
in this preamble that what generally
would be considered the information‘‘needed for purposes of reporting to the[NICS]’’ in § 164.512(k)(7)(iii)(A) would
be the data elements required to create
a NICS record, as well as the following
elements to the extent necessary to
exclude false matches: Social Security
number, State of residence, height,
weight, place of birth, eye color, haircolor, and race (and we note that theFederal Bureau of Investigations (FBI)and not ATF has the authority to define
the information required by NICS). As
indicated above, these are the sameelements that were identified in the
NPRM.
C. Comments Regarding the NICS andthe Federal Mental Health Prohibitor
Comment: Many commenters raised
concerns about infringement of
individuals’ Second Amendment rightto bear arms without due process. A
number of these commentersspecifically expressed concern that anindividual could be reported to the
NICS without a formal adjudication
through the court system and argued
that due process under the Constitution
would require a hearing in a court oflaw before an individual could be madesubject to the Federal mental healthprohibitor.
Response: We acknowledge the viewsof the commenters. However, as we
explained in the NPRM, these concerns

PO 00000

Frm 00020

Fmt 4700

Sfmt 4700

relate to the Federal mental healthprohibitor rather than the HIPAA
Privacy Rule or this final rule, and thus
are outside the scope of this rule. This
final rule addresses HIPAA-related
barriers to entities reporting certain
information to the NICS about
individuals who are subject to theFederal mental health prohibitor. The
rule does not expand the categories offederally prohibited persons or modify
the criteria for determining that a person
is subject to the Federal mental healthprohibitor.
Comment: Several disability rights
advocates and others asserted that therule would not result in a decrease in
gun violence because mental illness
alone does not make a person more
likely to commit violence against others.
The Consortium for Citizens with
Disabilities Rights Task Force (CCDRTF)
cited studies indicating that mental
illness alone is not statistically related
to future violence and that even severe
mental illness without drug use or ahistory of violence is not linked with
future violence.29 Several commenters
also noted that persons with mental
illness are more likely to be the victimsof violence than its perpetrators.
Alternatively, several commentersargued that, even if there were a link
between mental illness and gun
violence, the proposed rule is notneeded because mechanisms already are
in place in place to prevent harm frompatients who are a threat to themselvesor the public.
Response: We acknowledge the viewsof the commenters. However, thesecommenters address the applicability of
the Federal mental health prohibitor
itself. This final rule does not expand
the existing categories of persons
prohibited from owning a firearm or
modify other Federal or State laws
pertaining to firearms purchases.
Therefore, these comments are beyond
the scope of this rule.
Comment: Several commenters raisedquestions about individuals’ ability tocorrect erroneous NICS reports or to
29 CCDRTF cited Eric B. Elbogen & Sally C.
Johnson, The Intricate Link Between Violence andMental Disorder: Results from the National
Epidemiologic Survey on Alcohol and Related
Conditions, 66 Arch. Gen. Psychiatry 152, 157 (Feb.
2009); David J. Vinkers, et al., Proportion of Crimes
Attributable to Mental Disorders in the Netherlands
Population, 11 World Psychiatry 134 (June 2012).
CCDRTF also indicated that other studies showeda modest relationship between serious mental
illness and violence, but that other factors (e.g.,
substance abuse, age, gender and lower economic
status) contribute more to increasing the likelihoodof committing violence than mental illness alone.
They cited R. Van Dorn, et al., Mental Disorder andViolence: Is There a Relationship Beyond SubstanceUse?, 47 Social Psychiatry and Psychiatric
Epidemiology 487, 499 (2012).

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
have their rights restored when they nolonger pose a danger to themselves orothers. A number of commenters
recommended assuring that the appeals
process is free of delay, inexpensive,and easy for individuals to initiate.
Other commenters asserted that theexpense to remove oneself from the
NICS database is prohibitive for someindividuals. As a result, the commenters
said, individuals effectively become
subject to a lifelong restriction on their
Second Amendment right to bear arms,
even after they recover from thecondition that led to their adjudication
and are eligible to apply for relief fromdisabilities under the Federal mental
health prohibitor. Similarly, onecommenter argued that, once anindividual is reported to the NICS, the‘‘relief from disabilities’’ process 30 isinadequate for remediation due to a lackof Federal funding to support State
programs, and wide variability in State
programs to provide relief as a result.
Another commenter recommended
allocating additional funding to support
State ‘‘relief from disabilities’’ programs.
Response: These comments areoutside the scope of the rule. However,we acknowledge the commenters’
concerns with respect to opportunities
for remediation and note that
individuals who believe they are
wrongly denied the purchase of a
firearm can visit https://forms.fbi.gov/
nice-appeals-request-form to find out
more information and appeal theirdenial. In addition, the NICS
Improvement Amendments Act of 2007
authorized grants for States that
implement programs for ‘‘relief fromdisabilities’’ in accordance with theAct.31 These programs are required toestablish processes by which anindividual who is subject to the Federal
mental health prohibitor may apply forrelief to the State where the relevant
commitment or adjudication occurred.
While States’ processes for granting
relief vary, the Act requires that relief be
granted if it can be established that thecircumstances regarding the disability
and the applicant’s record andreputation are such that the applicant
will not be likely to act in a manner
dangerous to public safety, and the
granting of relief would not be contrary
to the public interest.32
Comment: A number of commenters
expressed concern that a finding of
mental incompetence by the Veterans
Administration (VA), which could make
30 See footnote 13 above.
31 The DOJ Bureau of Justice Statistics provides

state data on NICS Act Record Improvement
Program (NARIP) Awards (available at http://
www.bjs.gov/index.cfm?ty=tp&tid=491#promising).
32 See Public Law 110–180, Section 105.

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

an individual subject to the Federal
mental health prohibitor and cause theindividual to be reported to the NICS,
may be based solely on a determinationthat the veteran is unable to handle
financial affairs, without regard todangerousness. The commenters argued
that these veterans do not receive due
process before being made subject to theFederal mental health prohibitor andbelieved that the proposed rule would
exacerbate this problem.
Response: We note that, as a federal
agency, the VA is required by law toreport prohibited persons to the
Attorney General, who oversees the
NICS.33 This final rule does not affectthat requirement or change theprocedures relating to adjudications thatmake individuals subject to the Federal
mental health prohibitor.34
D. Other Comments
Comment: A few commenters
expressed concern that covered entities
would misinterpret the proposed
permission as a requirement to report
information about their patients to the
NICS. Another commenter expressed
concern that the standards for reporting
NICS data will be adopted by courts as
a new standard of care for health careproviders, exposing covered entities that
do not report to increased liability. The
commenter requested that the
Department clarify that the HIPAA
permission is permissive, notmandatory.
Response: This final rule establishes
permission for certain HIPAA covered
entities—those with lawful authority tomake the adjudications or commitment
decisions that make individuals subject
to the Federal mental health prohibitor,or that serve as repositories of
information for NICS reporting
purposes—are permitted to disclose theinformation needed for these purposes.
The rule does not create a requirement
to disclose. In addition, as explained at
length in the NPRM and above, the rule
does not apply to most treating
providers, but only to those covered
entities that are responsible for the
involuntary commitments or otheradjudications that make individuals
subject to the Federal mental healthprohibitor, or that serve as repositories
of such data. However, we note thatcovered entities have a responsibility tocomply with all applicable laws, andthis final rule does not preempt State or
33 See NICS Improvement Amendments Act of2007 Sec. 101, 18 U.S.C. 922 note (2002).
34 We refer commenters to the VA regulations for
information about the due process afforded toveterans as part of VA competency determinations.
See 38 CFR 3.353 and 38 CFR 3.103.

PO 00000

Frm 00021

Fmt 4700

Sfmt 4700

391

other laws that may require reporting to
the NICS.
Comment: One commenter
recommended that the Department
evaluate whether the rule would havethe unintended consequence ofpermitting the reporting of individuals
based on mere medical findings.
Response: As we explain above, therule does not create a broad permission
for treating providers to report
information about their patients to the
NICS. Rather, the rule is narrowly
tailored to permit limited disclosures of
information about individuals who aresubject to the Federal mental healthprohibitor, which applies only where an
individual has been involuntarily
committed or otherwise has received a
relevant adjudication from a court,
board, commission, or other lawfulauthority.
Comment: One commenter
recommended training for the workforce
members of reporting entities to ensurethat they understand the applicable
reporting protocols sufficiently to avoid
making erroneous reports.
Response: We agree that training is
generally beneficial to assurecompliance with applicable standards.
Further, to the extent that reporting
entities also are HIPAA covered entities,
the Privacy Rule requires those entities
to train workforce members on thepolicies and procedures with respect tothe privacy and security of individuals’
health information. Where applicable,
such training would include ensuringthat workforce members have copies ofthe entity’s policies and procedures
implementing this final rule’s limited
permission for uses or disclosures of
PHI for NICS reporting purposes.
Comment: One commenter
recommended establishing a mechanism
to inform mental health patients andtheir caregivers about the patients’
status in the NICS.
Response: We decline to provide forsuch a mechanism in this final rulebecause it is outside the scope of therule. Nothing in this rule, however,precludes covered entities frominforming individuals that information
about them has been provided to the
NICS.
Comment: Several commenters
expressed concern that, by allowing
multiple entities within a State to reportto the NICS, the proposed rule would
create complexity, inaccuracy, anddelay in processing appeals, particularly
if the FBI refers the individual back to
the reporting entity for resolution.
Response: To the extent that the
involvement of multiple entities in
NICS reporting may affect the appeals
process in a state, this issue exists apart

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

392

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

from HIPAA. Each State determines theentity or entities responsible forreporting NICS data, depending on
where the records documenting aperson’s status as subject to one or moreof the Federal prohibitors are created or
maintained. As a result, a variety ofentities, including judicial, law
enforcement, public health, and otherentities in a State, already may be
involved in NICS reporting and appeals.
Comment: A few commenters
expressed concern that, as a result of the
proposed rule, some families may
choose not to seek involuntarycommitment proceedings for a family
member who needs treatment, butwhose livelihood depends on the ability
to possess a firearm (e.g., first
responders and members of themilitary), because the commitment
would result in a report to the NICS andthe loss of the patient’s livelihood.
Response: We note that the Federal
mental health prohibitor makes thepurchase or possession of firearms byprohibited individuals unlawful
regardless of whether an individual isreported to the NICS, and this final rule
does not change who is subject to theFederal mental health prohibitor. This
final rule also does not affect law
enforcement and military entities’authorities with respect to making theirworkforce decisions.
Comment: One commenter asked
whether covered entities are obligated to
update information they have submitted
to the NICS when an individual’s
circumstances change.
Response: Section 102(c)(1)(B) of the
NIAA requires States to update, correct,
modify, or remove a record from the
NICS if they determine that the person
is not prohibited or has received ‘‘relief
from disabilities’’ under the mental
health prohibitor.
Comment: A number of commentersargued that the proposed regulation
would contravene congressional intent,
arguing that Congress did not intend tochange HIPAA protections for NICS
purposes. The commenters stated thatlegislation on this topic had been
considered and rejected and specificallycited S. 649 (the ‘‘Fix Gun Checks Act’’),which was considered by the Senate on
April 18, 2013, but did not receive a
vote.
Similarly, some commenters asserted
that Congress could have included any
desired changes to HIPAA when it
passed the NICS Improvements
Amendments Act, but did not do so.
Therefore, the commenters argued,
Congress did not intend to modify
HIPAA for NICS reporting purposes.
Response: That Congress did notenact S. 649 does not provide relevant

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

evidence of congressional intent withrespect to the scope of the HIPAA
Privacy Rule. The absence of a provisionin the NIAA to modify HIPAA does not
imply that Congress intended to prevent
any revisions of the HIPAA Privacy Rulewith respect to the NICS. The HIPAA
statute confers broad authority on the
Department to specify the permitted
uses and disclosures of PHI by HIPAA
covered entities, and NIAA does notaffect this statutory authority.
Comment: Several disability rights
organizations asserted that the proposed
rule did not provide sufficient evidenceof HIPAA barriers to reporting in any
State to fulfill a requirement of the
Administrative Procedure Act (APA)
that there be a rational connection
between the facts found by a Federal
agency through the rulemaking process
and the regulatory choice made.35
Response: We disagree with thecommenters. As stated above, we
understand from other comments that atleast seven States currently rely on
HIPAA covered entities (such as mental
health facilities) to report Federal
mental health prohibitor data to the
NICS. These seven States have laws
regarding such reporting, but otherStates may not. To the extent that anyother State does not require NICSrelated disclosures by law and the State
has not enacted legislation addressing
the problem, the Privacy Rule, prior to
the effective date of this final rule,would have prevented such disclosures
by HIPAA covered entities that do nothave hybrid entity status.36 Therefore,
there are sufficient data demonstratingthat HIPAA’s disclosure restrictions canbe a barrier to NICS reporting, and thus
to the development of an accurate andcomprehensive NICS database. The data
support finalizing this modification to
the Privacy Rule, which removes
barriers while limiting thecircumstances under which covered
entities may disclose PHI to the NICS
and limiting the types of PHI that may
be disclosed.
We know of one State in particular inwhich the Privacy Rule’s disclosure
restrictions posed challenges for NICS
reporting. The State of New York had astatute requiring mental health facilities
in the State to report NICS data to theState mental health agency, the State’s

designated repository of NICS data.37 As
a result, the Privacy Rule permitted
such disclosures to the repository as
required-by-law disclosures. However,the statute did not expressly require themental health agency, which was acovered entity under HIPAA that did
not have hybrid entity status, to report
the data it collected to the NICS; thePrivacy Rule thus did not permit theagency to disclose this data. Ultimately,
the legislature needed to revise thestatute to expressly require the agency
to report the data to the NICS.38
In addition to removing barriers, anadditional benefit of the rule as
described more fully below is that itprovides clarity about the applicabilityof the Privacy Rule and its relationshipto State law in this area, as well as
provides an avenue for NICS reportingthat may obviate the need to enact
legislation at the State level.
Comment: One commenter requested
that the Department clarify how
HIPAA’s preemption provisions would
apply to State laws requiring or
prohibiting covered entities’ disclosuresof NICS data.
Response: We clarify that this final
rule does not change HIPAA’s existing
preemption provisions, which providethat the HIPAA rules preempt contrary
State laws (with certain exceptions,such as where the contrary provision ofState law is more stringent than the
HIPAA provision).39 Accordingly,
because the Privacy Rule, as modified
by this final rule, only permits (but does
not require) the disclosure for NICS
reporting purposes, State laws thatprohibit such disclosures are notcontrary to the Privacy Rule, andcovered entities in States with suchlaws remain subject to any applicableprohibitions against the disclosures
under State law. That is, the covered
entity could comply with both HIPAA
and such State law by not disclosing
PHI to the NICS.
Moreover, HIPAA contains an express
permission for disclosures that are
required by other law, such as State law.
Accordingly, State laws that require
disclosures, for any purposes, remain in
effect, as such laws are not contrary to
the Privacy Rule.
Comment: One commenter expressed
concern that the rule would create an
opportunity for the abuse of private
information, for example, by allowing
the government to disarm politicaldissidents who seek mental health care,

35 5 U.S.C. Subchapter II.
36 We note that at least three states have laws
permitting, but not requiring the disclosure ofmental health records to the NICS: Missouri, New
Jersey and West Virginia. See Mo. Rev. Stat. 630.140(2013); N.J. Stat. Ann. 30:4–24.3 (2013); W.Va. Code
61–7A–3 (2013).

PO 00000

Frm 00022

Fmt 4700

Sfmt 4700

37 2008 N.Y. Laws 491, codified at N.Y. Mental
Hyg. §§ 7.09(j); 13.09(g), 31.11(5), 33.13(b), (c)(2011); N.Y. Jud. Ct. Acts § 212(q) (2011).
38 NY Secure Ammunition and Firearms
Enforcement (SAFE) Act of 2013.
39 See 45 CFR 160.203.

E:\FR\FM\06JAR1.SGM

06JAR1

wgreen on DSK2VPTVN1PROD with RULES

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
or making it possible for medical
personnel to abuse their authority andremove an individual’s rights forillegitimate reasons.
Response: Concerns about
governmental or private actors taking
advantage of this permission to target
vulnerable persons are addressed by theprocedural framework built into thestatute that established the Federal
mental health prohibitor and its
implementing regulations, which thisfinal rule does not change. As wepreviously have noted, the Federal
mental health prohibitor, which makes
an individual reportable to the NICS,
applies only to the extent that theindividual is involuntarily committed ordetermined by a court, board,commission, or other lawful authority to
be a danger to self or others, or is unable
to manage his or her own affairs due toa mental illness or condition. 40 These
involuntary commitments and otheradjudications are not madeindependently by individual health careproviders without any form of official
legal review.
Comments: Some commenters
expressed concern that, by relaxing
HIPAA’s privacy requirements, theproposed rule could result in increased
disclosures of private healthinformation to the government. Several
commenters argued that the Federal
government has a poor record on
protecting individuals’ privacy andshould not be entrusted with healthinformation. In contrast, anothercommenter noted that Federal law,
including the Privacy Act, prohibits
access to the information in the NICS
database outside of the limited purposes
authorized by law, and information
about specific firearms transfers is
destroyed the day after the transaction.
Response: We agree that it isimportant to protect the privacy andsecurity of the information that isreported to the NICS and we note that
the NICS is subject to specific privacy
and security protections.41 In addition,
we again emphasize that only very
limited information may be disclosed
under this rule, and disclosures ofdiagnostic or clinical information are
expressly prohibited.
Comment: Finally, one commenter
requested clarification on whether, inStates where a covered entity is also alawful authority that orders involuntarycommitments or conducts otheradjudications that make individuals
subject to the Federal mental healthprohibitor, there is intended to be a
40 18 U.S.C. 922(g)(4); 27 CFR 478.11.
41 See 63 FR 58303 (October 30, 1998), codified
at 28 CFR part 25.

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

separation between the covered entity
and lawful authority functions of theentity.
Response: We note that, under thePrivacy Rule, both before and after themodification made in this final rule, acovered entity could provide for suchseparation by operating as a hybrid
entity, and disclose information throughits non-HIPAA covered NICS reporting
unit. However, it is our understandingthat some covered entities may beunable to achieve hybrid entity status
for administrative or other reasons. Thisis another reason for including theexpress permission described in the
final rule.
VI. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact
statement in compliance with Executive
Order 12866 (September 1993,
Regulatory Planning and Review),
Executive Order 13563 (January 2011,
Improving Regulation and Regulatory
Review), the Regulatory Flexibility Act(RFA) (September 19, 1980, Pub. L. 96–354), the Unfunded Mandates ReformAct of 1995 (UMRA) (March 22, 1995,
Pub. L. 104–4), and Executive Order13132 on Federalism.
1. Executive Order 12866 and Executive
Order 13563
Executive Orders 12866 and 13563
direct agencies to assess all costs andbenefits of available regulatory
alternatives and, if regulation isnecessary, to select regulatory
approaches that maximize net benefits(including potential economic,
environmental, public health and safety
effects, distributive impacts, andequity). Executive Order 13563
emphasizes the importance ofquantifying both costs and benefits, ofreducing costs, of harmonizing rules,
and of promoting flexibility. This rulehas been designated a ‘‘significant
regulatory action’’ although noteconomically significant, under section
3(f) of Executive Order 12866.
Accordingly, this rule has beenreviewed by the Office of Management
and Budget.
A regulatory impact analysis must be
prepared for all major rules that haveeconomically significant effects ($100
million or more in any one year) or
adversely affect in a material way the
economy, a sector of the economy,
productivity, competition, jobs, theenvironment, public health or safety, orState, local, or tribal government orcommunities (58 FR 51741). Because thefinal rule does not contain any new
requirements or prohibitions for covered

PO 00000

Frm 00023

Fmt 4700

Sfmt 4700

393

entities, we estimate that the rule will
be cost neutral. We did not receive
public comments on this assumption or
information indicating that covered
entities will incur any costs as a resultof the rule.
Although we expect the economic
impact of the rule, including nonquantifiable costs and savings discussed
in the regulatory analysis below, to beless than $100 million annually, we
nevertheless conducted an analysis of
the costs of the final rule.
2. Entities Subject to the Rule
This final rule applies only to covered
entities that function as repositories of
information relevant to the Federal
mental health prohibitor on behalf of aState or that are responsible for ordering
the involuntary commitments or otheradjudications that make an individual
subject to the Federal mental healthprohibitor. We do not have sufficient
data to determine the number of affected
entities, but, based on the information
available to us, we believe there would
be very few. Our understanding is that,for the most part, formal adjudications
and repository functions of this natureare conducted by entities, such as court
systems or law enforcement agencies,that are not covered by HIPAA. In
addition, even covered entities in somestates will not be affected because they
currently do not face HIPAA barriers toreporting either because state law
requires reporting or they have createdhybrid entities, as described above inthe preamble. We did not receive publiccomments on the number of covered
entities that will be affected by this rule.
B. Why is this rule needed?
This final rule is needed to ensure
that, where HIPAA covered entities
make adjudications causing individuals
to become subject to the Federal mental
health prohibitor, or serve asrepositories of records of such
adjudications on behalf of States, those
covered entities can report the identitiesof those individuals to the NICS. This
rule change can help further theimportant public safety goal ofstrengthening the background checksystem to ensure that individuals whoare prohibited from purchasing or
possessing firearms are not able toobtain them. Specific permission under
the Privacy Rule for these disclosures isnecessary to the extent that some States
have not enacted laws requiring
reporting to the NICS, but a covered
entity in the State is neverthelessresponsible for such reporting and does
not become a hybrid entity. Importantly,
the final rule permits only a small
subset of HIPAA covered entities (i.e.,

E:\FR\FM\06JAR1.SGM

06JAR1

394

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations

wgreen on DSK2VPTVN1PROD with RULES

those that perform the relevant mental
health adjudications or repository
functions) to use or disclose only
limited, non-clinical information, for
NICS purposes. This narrowly tailoredpermission permits these important uses
or disclosures for public safety to occur
while maintaining a separation between
reporting functions and the mental
health treatment a patient might bereceiving.
C. Qualitative Analysis of Unquantified
Costs
The rule is cost neutral with respect
to HIPAA covered entities. The rule
does not require entities that alreadyhave a NICS reporting process in place
to change their current system and does
not create new reporting or
recordkeeping requirements for any
covered entity. The small number ofcovered entities that are newly
permitted to report to the NICS or a
State repository under the rule canbegin to report and may need to develop
policies and procedures to do so. As thePrivacy Rule only allows the use or
disclosure of information, and does not
require it, any resulting burden ofreporting and associated procedures are
attributable to the choice made by anentity to report information, the Federal
statutory mental health prohibitor, andthe NICS system itself. See 28 CFR part25, subpart A. We acknowledge thatthose entities that choose to begin
reporting may wish to address thischange in their HIPAA policies andprocedures, as well as explain theirprocedures to office staff. However, therule does not require any changes toexisting HIPAA policies andprocedures. In addition, with respect totraining, the rule does not require
workforce training beyond what isalready required under the HIPAA
Privacy and Security Rules. We expectthat entities that choose to report under
the rule would also take steps to ensurethat their office staff have copies of the
new policies and procedures, which
would not involve any significant
additional costs. We did not receive
public comments contradicting theseassumptions or estimating the numberof entities that might begin to report to
the NICS for the first time, if any.
To the extent that the rule permits
some covered entities to report to the
NICS for the first time, there may be anincrease in the number of individuals
whose identities are newly included in
the NICS and who are denied a firearmtransfer as a result. Therefore, there may
be a concomitant increase inapplications for ‘‘relief fromdisabilities’’ in states that provide sucha relief program. However, any burden

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

to individuals completing andsubmitting the relief application form is
attributable to the Federal mental healthprohibitor and the procedures
established by the State where thecommitment or adjudication occurred.
The procedures for applying for relief inStates that have established mental
health prohibitor ‘‘relief fromdisabilities’’ programs pursuant to the
NICS Improvement Amendments Act of2007 vary.
We received a number of commentson the NPRM asserting that creating an
express permission in the Privacy Rulefor NICS reporting would discourage
individuals from seeking needed mental
health care. We appreciate theseconcerns and agree with commenters
who asserted that individuals’ healthand the public’s safety are best servedby encouraging appropriate treatment.
We also recognize that discouraging
treatment could increase the burden of
untreated mental conditions to
individuals, in the form of increased
suffering and loss of productivity; to thehealth care system, when individuals
with untreated mental illness needemergency hospitalization, for example;
and to the public’s safety. However,many of these commenters expressed
the mistaken belief that the permission
would allow or require most mental
health care providers to report theirpatients to the NICS.
As explained above, we have carefully
and narrowly tailored the final rule toapply only to a small number of covered
entities that may be responsible for the
adjudications that make an individual
subject to the Federal mental healthprohibitor, or that serve as repositoriesof data about such adjudications. The
rule generally maintains a separation
between treatment functions and NICS
reporting functions. In addition, the rule
does not permit the use or disclosure ofany diagnostic or clinical information,or any other information about anindividual that is not needed for NICS
reporting purposes. Because of thesestrict limitations on the permitted usesand disclosures, we believe that
individuals will not be dissuaded fromseeking needed mental health careservices as a result of the rule.
Finally, we recognize the intangible
burden to individuals of the negative
attitudes and misperceptions associatedwith mental health conditions. We notethat the Federal mental healthprohibitor does not apply to allindividuals with mental healthconditions, but instead to a subset ofindividuals who have been
involuntarily committed or determinedby a lawful authority to be a danger tothemselves or others, or unable to

PO 00000

Frm 00024

Fmt 4700

Sfmt 4700

manage their own affairs, as a result ofmarked subnormal intelligence, or
mental illness, incompetency,
condition, or disease. This rule permits
a limited number of HIPAA covered
entities to report to the NICS theidentities of individuals in a particular
subcategory of persons who are
currently prohibited by Federal law
from possessing firearms. Thispermission facilitates the enforcementof prohibitions that were established by
the Gun Control Act. Therefore, we do
not expect that this rule will exacerbate
negative attitudes or misperceptions
associated with mental healthconditions.
D. Qualitative Analysis of Unquantified
Benefits
While we believe that there may bebenefits to public safety as a result of
the rule, we are not able to monetize thevalue of such benefits.
For example, by removing a barrier toreporting, the rule may result inincreased reporting to the NICS ofindividuals who may pose a risk of gun
violence related to a serious mental
health condition. To the extent that thisrule permits covered entities to report
those individuals’ identities for NICS
purposes, the rule provides a public
safety benefit. One comment submitted
in response to the NPRM noted that
increased reporting could contribute tolowering the substantial financial costsof gun violence itself, which wasestimated at $174 billion in medical andlost productivity expenses in 2010.42
However, we do not have information
about whether, or how many, covered
entities would begin to report orincrease reporting to the NICS as aresult of the rule, nor do we have a basis
for estimating the impact, if any, on thefinancial costs associated with gun
violence.
An additional benefit of the rule isthat it provides clarity about theapplicability of the Privacy Rule and its
relationship to State law. Specifically,
the rule alleviates the concerns of Statelawmakers who, according to several
commenters on the ANPRM, may bereluctant to pursue State legislation
requiring entities to report Federal
mental health prohibitor information for
NICS purposes because of a
misconception that the HIPAA Privacy
Rule would preempt such requirements.
As explained more fully above, thePrivacy Rule permits uses anddisclosures that are required by law, and
42 This comment cited Miller TR. The Cost ofFirearm Violence. Children’s Safety Network
Economics and Data Analysis Resource Center, atPacific Institute for Research and Evaluation,
December 2012.

E:\FR\FM\06JAR1.SGM

06JAR1Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
thus would not preempt a State law
requiring disclosures to NICS. However,to the extent that State lawmakers
harbor this misconception, thispreamble clarifies HIPAA’s preemption
provisions and the final rule provides
an avenue for NICS reporting that may
obviate the need to enact legislation at
the State level.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The RFA requires agencies to analyze
and consider options for reducing
regulatory burden if a rule will impose
a significant burden on a substantial
number of small entities. The Act
requires the head of the agency either tocertify that the rule will not impose
such a burden or to perform a regulatory
flexibility analysis and consider
alternatives to lessen the burden. For
the reasons explained more fully abovein the summary of costs and benefits, it
is not expected that the rule will result
in compliance costs for covered entities
of any size because the rule does not
impose new requirements. Therefore,
the Secretary certifies that the rule will
not have a significant impact on asubstantial number of small entities.
2. Unfunded Mandates Reform Act

wgreen on DSK2VPTVN1PROD with RULES

Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipatedcosts and benefits before issuing any
rule whose mandates would require
spending in any one year $100 million
in 1995 dollars, updated annually for
inflation. In 2013, that threshold isapproximately $141 million dollars.
UMRA does not address the total cost ofa rule. Rather, it focuses on certain
categories of cost, mainly those ‘‘Federal
mandate’’ costs resulting from: (1)Imposing enforceable duties on State,
local, or Tribal governments, or on theprivate sector; or (2) increasing thestringency of conditions in, or
decreasing the funding of, State, local,
or Tribal governments underentitlement programs. As this rule does
not impose enforceable duties or affectentitlement programs, UMRA does not
require us to prepare an analysis of thecosts and benefits of the rule.
Nonetheless, we have done so inaccordance with Executive Orders
12866 and 13563, and present thisanalysis in sections C and D above.
3. Federalism
Executive Order 13132 establishes
certain requirements that an agency
must meet when it promulgates a rulethat imposes substantial direct
requirement costs on State and local

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

governments, preempts State law, orotherwise has Federalism implications.
The Federalism implications of the
HIPAA Privacy and Security Rules wereassessed as required by Executive Order13132 and published as part of thepreambles to the final rules on
December 28, 2000 (65 FR 82462,
82797) and February 20, 2003 (68 FR
8334, 8373), respectively. This final rule
does not impose requirements, or any
associated costs, on State and local
governments. Regarding preemption, thepreamble to the final Privacy Rule
explained that the HIPAA statutedictates the relationship between Statelaw and Privacy Rule requirements.
Therefore, the Privacy Rule’s existing
preemption provisions do not raise
Federalism issues, and these provisions
are not affected by this rule.
One commenter argued that apermission for entities other than States
to report to the NICS would bypass thedecisions of the States regarding thesubmission of reports and, therefore,raises federalism implications. In
response, we again emphasize that thisrule does not require covered entities tomake disclosures that are prohibited by
State law, nor does it prevent
disclosures required by State law.
Further, States retain discretion todetermine which entities within theState are authorized to report
information to the NICS. For thesereasons, the rule does not have
Federalism implications.
F. Accounting Statement
Whenever a rule is considered asignificant rule under Executive Order
12866, we are required to develop an
accounting statement indicating thecosts associated with the rule. As
explained above, we expect that the rule
is cost neutral. We did not receive
public comments on any unanticipatedcosts associated with the rule, including
costs to covered entities that choose toamend written HIPAA policies andprocedures or to provide additional
training to staff.
VII. Collection of Information
Requirements
This final rule does not contain
requests or requirements to report
information to the government, nor does
it impose new requirements forrecordkeeping or disclosures to thirdparties or the public. Therefore, therequirements of the Paperwork
Reduction Act with respect toinformation collections do not apply.
List of Subjects in 45 CFR Part 164
Administrative practice andprocedure, Computer technology,

PO 00000

Frm 00025

Fmt 4700

Sfmt 4700

395

Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Healthfacilities, Health insurance, Healthrecords, Hospitals, Medicaid, Medical
research, Medicare, Privacy, Reporting
and recordkeeping requirements, andSecurity.
For the reasons set forth in thepreamble, the Department of Health andHuman Services amends 45 CFR
Subtitle A, Subchapter C, part 164, as
set forth below:
PART 164—SECURITY AND PRIVACY■ 1. The authority citation for part 164

continues to read as follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C.
1320d–1320d–9; sec. 264, Public Law 104–
191, 110 Stat. 2033–2034 (42 U.S.C. 1320d–2(note)); and secs. 13400–13424, Public Law
111–5, 123 Stat. 258–279.
■ 2. Amend § 164.512 by adding

paragraph (k)(7) to read as follows:§ 164.512 Uses and disclosures for which
an authorization or opportunity to agree orobject is not required.

*

*
*
*
*
(k) * * *(7) National Instant Criminal
Background Check System. A covered
entity may use or disclose protected
health information for purposes ofreporting to the National InstantCriminal Background Check System theidentity of an individual who isprohibited from possessing a firearmunder 18 U.S.C. 922(g)(4), provided thecovered entity:(i) Is a State agency or other entitythat is, or contains an entity that is:(A) An entity designated by the Stateto report, or which collects information
for purposes of reporting, on behalf of
the State, to the National InstantCriminal Background Check System; or(B) A court, board, commission, orother lawful authority that makes thecommitment or adjudication that causes
an individual to become subject to 18
U.S.C. 922(g)(4); and(ii) Discloses the information only to:(A) The National Instant Criminal
Background Check System; or(B) An entity designated by the Stateto report, or which collects information
for purposes of reporting, on behalf of
the State, to the National InstantCriminal Background Check System;and(iii)(A) Discloses only the limited
demographic and certain otherinformation needed for purposes ofreporting to the National InstantCriminal Background Check System;
and

E:\FR\FM\06JAR1.SGM

06JAR1

396

Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations(B) Does not disclose diagnostic or
clinical information for such purposes.
*
*
*
*
*
Dated: December 30, 2015.
Sylvia M. Burwell,
Secretary.
[FR Doc. 2015–33181 Filed 1–4–16; 4:15 pm]
BILLING CODE 4153–01–P

FEDERAL COMMUNICATIONSCOMMISSION
47 CFR Part 1[GN Docket No. 12–268; WT Docket Nos.
14–70, 05–211; RM–11395; FCC 15–80]

Updating Competitive Bidding Rules
AGENCY: Federal Communications

Commission.
ACTION: Final rule; announcement ofeffective date.
SUMMARY: In this document, theCommission announces that on
December 10, 2015, the Office ofManagement and Budget (OMB)
approved, on an emergency basis, for aperiod for six months, a revision to an
approved information collection to
implement a modified collection
requirement under 47 CFR 1.2105(c)(4)contained in the Part 1 Report andOrder, Updating Competitive Bidding
Rules, FCC 15–80. This document is
consistent with the Part 1 Report andOrder, which stated that theCommission would publish a documentin the Federal Register announcing
OMB approval and the effective date of
the rule and requirement.
DATES: 47 CFR 1.2105(c)(4), published at
80 FR 56764 on September 18, 2015, iseffective on January 6, 2016.
FOR FURTHER INFORMATION CONTACT:Contact Cathy Williams,
Cathy.Williams@fcc.gov, (202) 418–
2918.

wgreen on DSK2VPTVN1PROD with RULES

SUPPLEMENTARY INFORMATION: This

document announces that, on December
10, 2015, OMB approved, on an
emergency basis, a revision to an
approved information collection to
implement a modified informationcollection requirement under 47 CFR
1.2105(c)(4), published at 80 FR 56764
on September 18, 2015. The OMBControl Number is 3060–0995. The
Commission publishes this document as
an announcement of the effective date of
the rule and requirement. If you haveany comments on the burden estimates
listed below, or how the Commission
can improve the collections and reduceany burdens caused thereby, pleasecontact Cathy Williams, Federal

VerDate Sep<11>2014

13:07 Jan 05, 2016

Jkt 238001

Communications Commission, Room
1–C823, 445 12th Street SW.,
Washington, DC 20554. Please include
the OMB Control Number, 3060–0995,
in your correspondence. The
Commission will also accept yourcomments via the Internet if you send
them to PRA@fcc.gov.
To request materials in accessible
formats for people with disabilities(Braille, large print, electronic files,
audio format), send an email to fcc504@
fcc.gov or call the Consumer and
Governmental Affairs Bureau at (202)418–0530 (voice), (202) 418–0432(TTY).
Synopsis
As required by the Paperwork
Reduction Act of 1995 (44 U.S.C. 3507),
the Commission is notifying the publicthat it received emergency approval
from OMB on December 10, 2015 for therevised information collection
requirements contained in theinformation collection 3060–0995,
Section 1.2105(c), Bidding Application
and Certification Procedures; Sections
1.2105(c) and Section 1.2205,
Prohibition of Certain Communications.
Under 5 CFR 1320, an agency may notconduct or sponsor a collection of
information unless it displays a current,
valid OMB Control Number.
No person shall be subject to any
penalty for failing to comply with acollection of information subject to thePaperwork Reduction Act that does not
display a current, valid OMB Control
Number. The OMB Control Number is3060–0995. The foregoing document isrequired by the Paperwork Reduction
Act of 1995, Pub. L. 104–13, October 1,
1995, and 44 U.S.C. 3507.
The total annual reporting burdensand costs for the respondents are as
follows:
OMB Control Number: 3060–0995.
OMB Approval Date: December 10,
2015.
OMB Expiration Date: June 30, 2016.
Title: Section 1.2105(c), Bidding
Application and Certification
Procedures; Sections 1.2105(c) andSection 1.2205, Prohibition of Certain
Communications.
Form No.: N/A.
Respondents: Business or other forprofit entities; Not-for-profit
institutions; State, local or Tribal
government.
Number of Respondents andResponses: 10 respondents; 10
responses.
Estimated Time per Response: 1.5hours to 2 hours.
Frequency of Response: On occasion
reporting requirement.
Obligation to Respond: Required toobtain or retain benefits. The statutory

PO 00000

Frm 00026

Fmt 4700

Sfmt 4700

authority for this information collection
is contained in sections 154(i), 309(j),and 1452(a)(3) of the Communications
Act of 1934, as amended, 47 U.S.C. 4(i),309(j)(5), and 1452(a)(3), and section
1.2105(c)(4) of the Commission’s rules,
47 CFR 1.2105(c)(4).
Total Annual Burden: 50 hours.
Total Annual Cost: $9,000.
Privacy Act Impact Assessment: No
impact(s).
Nature and Extent of Confidentiality:
The Commission will take all reasonable
steps to protect the confidentiality of all
Commission-held data of a reverse
auction applicant consistent with theconfidentiality requirements of theSpectrum Act and the Commission’s
rules. See 47 U.S.C. 1452(a)(3); 47 CFR
1.2206. In addition, to the extent
necessary, a full power or Class A
television broadcast licensee may
request confidential treatment of any
report of a prohibited communication
submitted to the Commission that is notalready being treated as confidential
pursuant to section 0.459 of theCommission’s rules. See 47 CFR 0.459.
Forward auction applicants are entitled
to request confidentiality in accordancewith section 0.459 of the Commission’s
rules, 47 CFR 0.459.
Needs and Uses: In the Broadcast
Incentive Auction Report and Order,
Expanding the Economic andInnovation Opportunities of Spectrum
Through Incentive Auctions, FCC 14–
50, the Commission adopted a new rule
for forward auction applicantsprohibiting certain communications in
the context of the television broadcast
incentive auction (BIA), and amended
an existing rule to require forward
auction applicants that make or receive
a communication that is prohibited
under the new rule to file a report ofsuch a communication with theCommission. See 47 CFR 1.2105(c)(4),
1.2105(c)(6). Subsequently, as a result of
amendments to various other provisions
in section 1.2105(c) adopted in the Part
1 Report and Order, the new rule forforward auction applicants prohibiting
certain communications in the context
of the BIA and the amended reporting
requirement for forward auction
applicants were redesignated as1.2105(c)(4) and 1.2105(c)(6),
respectively, without any changes to thescope or substance of either rule. See 47
CFR 1.2105(c)(4), 1.2105(c)(6). The
Commission’s rules prohibiting certain
communications in Commission
auctions are designed to reinforce
existing antitrust laws, facilitate
detection of collusive conduct, anddeter anticompetitive behavior, without
being so strict as to discourageprocompetitive arrangements between

E:\FR\FM\06JAR1.SGM

06JAR1