wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

784

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

EPA’s role is to approve state choices,
provided that they meet the criteria of
the CAA. Accordingly, these proposed
actions merely approve state law as
meeting Federal requirements and does
not impose additional requirements
beyond those imposed by state law. For
that reason, these proposed actions:• are not a ‘‘significant regulatory
action’’ subject to review by the Officeof Management and Budget under
Executive Order 12866 (58 FR 51735,
October 4, 1993);• do not impose an informationcollection burden under the provisionsof the Paperwork Reduction Act (44
U.S.C. 3501 et seq.);• are certified as not having asignificant economic impact on asubstantial number of small entities
under the Regulatory Flexibility Act (5U.S.C. 601 et seq.);• do not contain any unfunded
mandate or significantly or uniquely
affect small governments, as describedin the Unfunded Mandates Reform Act
of 1995 (Pub. L. 104–4);• do not have Federalism
implications as specified in Executive
Order 13132 (64 FR 43255, August 10,1999);• are not an economically significant
regulatory action based on health orsafety risks subject to Executive Order
13045 (62 FR 19885, April 23, 1997);• are not a significant regulatory
action subject to Executive Order 13211(66 FR 28355, May 22, 2001);• are not subject to requirements ofSection 12(d) of the National
Technology Transfer and Advancement
Act of 1995 (15 U.S.C. 272 note) because
application of those requirements would
be inconsistent with the CAA; and• do not provide EPA with thediscretionary authority to address, as
appropriate, disproportionate humanhealth or environmental effects, using
practicable and legally permissible
methods, under Executive Order 12898(59 FR 7629, February 16, 1994).
In addition, this rule does not havetribal implications as specified by
Executive Order 13175 (65 FR 67249,
November 9, 2000), because the SIP is
not approved to apply in Indian country
located in the state, and EPA notes that
it will not impose substantial direct
costs on tribal governments or preempt
tribal law.
List of Subjects in 40 CFR Part 52
Environmental protection, Air
pollution control, Greenhouse Gas,
Intergovernmental relations, Reporting
and recordkeeping requirements.
Authority: 42 U.S.C. 7401 et seq.

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

Dated: December 23, 2013.
A. Stanley Meiburg,
Acting Regional Administrator, Region 4.
[FR Doc. 2014–00041 Filed 1–6–14; 8:45 am]
BILLING CODE 6560–50–P

DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
45 CFR Part 164
Health Insurance Portability andAccountability Act (HIPAA) Privacy
Rule and the National Instant Criminal
Background Check System (NICS)
AGENCY: Office for Civil Rights,

Department of Health and Human
Services.
ACTION: Notice of proposed rulemaking.
SUMMARY: The Department of Health andHuman Services (HHS or ‘‘theDepartment’’) is issuing this notice ofproposed rulemaking to modify the
Health Insurance Portability andAccountability Act of 1996 (HIPAA)
Privacy Rule to expressly permit certain
HIPAA covered entities to disclose to
the National Instant Criminal
Background Check System (NICS) the
identities of individuals who are subject
to a Federal ‘‘mental health prohibitor’’that disqualifies them from shipping,transporting, possessing, or receiving afirearm. The NICS is a national system
maintained by the Federal Bureau of
Investigation (FBI) to conduct
background checks on persons who may
be disqualified from receiving firearms
based on federally prohibited categories
or State law. Among the persons subject
to the Federal mental health prohibitor
are individuals who have been
involuntarily committed to a mental
institution; found incompetent to standtrial or not guilty by reason of insanity;or otherwise have been determined by acourt, board, commission, or otherlawful authority to be a danger tothemselves or others or to lack themental capacity to contract or manage
their own affairs, as a result of marked
subnormal intelligence or mental
illness, incompetency, condition, ordisease. Under this proposal, only
covered entities with lawful authority tomake adjudication or commitment
decisions that make individuals subject
to the Federal mental health prohibitor,or that serve as repositories of
information for NICS reporting
purposes, would be permitted todisclose the information needed forthese purposes. This disclosure would
be restricted to limited demographic

PO 00000

Frm 00022

Fmt 4702

Sfmt 4702

and certain other information andwould not include medical records, or
any mental health information beyond
the indication that the individual issubject to the Federal mental healthprohibitor. HHS notes that the
Department of Justice (DOJ) has
proposed clarifications to the regulatory
definitions relevant to the Federal
mental health prohibitor. The DOJ
proposal is published elsewhere in thisissue of the Federal Register. Whilecommenters should consider this
proposed regulation in light of theclarifications proposed in DOJ’s
proposal, we note that thoseclarifications would not change how
this proposed HIPAA permission would
operate.
DATES: Submit comments on or before
March 10, 2014.
ADDRESSES: Written comments may besubmitted through any of the methods
specified below. Please do not submit
duplicate comments.
• Federal eRulemaking Portal: You
may submit electronic comments at
http://www.regulations.gov. Follow the
instructions for submitting electroniccomments. Attachments should be in
Microsoft Word, WordPerfect, or Excel;
however, we prefer Microsoft Word.
• Regular, Express, or Overnight Mail:
You may mail written comments (oneoriginal and two copies) to the following
address only: U.S. Department of Healthand Human Services, Office for Civil
Rights, Attention: HIPAA Privacy Ruleand NICS, Hubert H. Humphrey
Building, Room 509F, 200
Independence Avenue SW.,
Washington, DC 20201.
• Hand Delivery or Courier: If you
prefer, you may deliver (by hand or
courier) your written comments (oneoriginal and two copies) to the following
address only: Office for Civil Rights,
Attention: HIPAA Privacy Rule and
NICS, Hubert H. Humphrey Building,Room 509F, 200 Independence Avenue
SW., Washington, DC 20201. (Because
access to the interior of the Hubert H.
Humphrey Building is not readily
available to persons without federal
government identification, commenters
are encouraged to leave their commentsin the mail drop slots located in themain lobby of the building.)
Inspection of Public Comments: Allcomments received before the close of
the comment period will be available forpublic inspection, including any
personally identifiable or confidential
business information that is included in
a comment. We will post comments
received before the close of thecomment period at http://
www.regulations.gov. Because

E:\FR\FM\07JAP1.SGM

07JAP1Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules
comments will be made public, theyshould not include any sensitive
personal information, such as a person’ssocial security number; date of birth;
driver’s license number, State
identification number or foreign countryequivalent; passport number; financial
account number; or credit or debit card
number. Comments also should notinclude any sensitive healthinformation, such as medical records orother individually identifiable healthinformation, or any non-public
corporate or trade association
information, such as trade secrets orother proprietary information.
FOR FURTHER INFORMATION CONTACT:
Andra Wicks, 202–205–2292.
SUPPLEMENTARY INFORMATION:
I. Background
On January 16, 2013, President Barack
Obama announced 23 executive actions
aimed at curbing gun violence acrossthe nation. Those actions include efforts
by the Federal government to strengthen
the national background check system,
and a specific commitment to ‘‘[a]ddress
unnecessary legal barriers, particularly
relating to the Health Insurance
Portability and Accountability Act, thatmay prevent States from making
information available to the backgroundcheck system.’’ The National InstantCriminal Background Check System(NICS) is the system used to determine
whether a potential firearms recipient isstatutorily prohibited from possessing or
receiving a firearm. The Department
developed this NPRM to propose amodification to the HIPAA Privacy Ruleto permit certain covered entities todisclose to the NICS the identities of
persons who are not allowed to possessor receive a firearm because they are
subject to the Federal mental healthprohibitor. The Department, throughthis NPRM, is soliciting public input onvarious issues, including whether itshould modify the HIPAA Privacy Ruleto permit covered entities to disclose to
the NICS the identities of persons
prohibited by State law from possessing
or receiving a firearm for reasons related
to mental health.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALSThe National Instant Criminal
Background Check System (NICS)
The Brady Handgun ViolencePrevention Act of 1993, Public Law
103–159, and its implementing
regulations, are designed to prevent thetransfer of firearms by licensed dealers
to individuals who are not allowed topossess or receive them as a result of
restrictions contained in either the Gun
Control Act of 1968, as amended (Title
18, United States Code, Chapter 44), or

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

State law. The Gun Control Act
identifies several categories (known as‘‘prohibitors’’) of individuals 1 who areprohibited from engaging in the
shipment, transport, receipt, or
possession of firearms, including
convicted felons and fugitives. Most
relevant for the purposes of this NPRM
is the Federal mental health prohibitor,
which, pursuant to Department ofJustice (DOJ) regulations, applies toindividuals who have been
involuntarily committed to a mental
institution, for reasons such as mental
illness or drug use; 2 found incompetentto stand trial or not guilty by reason of
insanity; or otherwise have been
adjudicated by a court, board,commission, or other lawful authority to
be a danger to themselves or others or
unable to manage their own affairs, asa result of marked subnormal
intelligence, or mental illness,
incompetency, condition, or disease.3
The Brady Act established the NICS tohelp enforce these prohibitions, as wellas State law prohibitions on thepossession or receipt of firearms.4 The
1 See 18 U.S.C. 922(g) and (n) and implementing
regulations at 27 CFR 478.11 and 27 CFR 478.32.
2 The regulation, at 27 CFR 478.11, defines‘‘Committed to a mental institution’’ as: A formal
commitment of a person to a mental institution bya court, board, commission, or other lawfulauthority. The term includes a commitment to amental institution involuntarily, commitment formental defectiveness or mental illness, as well as
commitments for other reasons, such as for druguse. The term does not include a person in a mental
institution for observation or a voluntary admission
to a mental institution. Note that DOJ has proposed
clarifications to this regulatory language, which are
published elsewhere in this issue of the Federal
Register.
3 The term used in the statute, ‘‘adjudicated as amental defective,’’ is defined by regulation to
include: ‘‘(a) A determination by a court, board,commission, or other lawful authority that a person,
as a result of marked subnormal intelligence, or
mental illness, incompetency, condition, or disease:(1) Is a danger to himself or to others; or (2) lacks
the mental capacity to contract or manage his own
affairs.’’ The term includes a finding of insanity ina criminal case, and a finding of incompetence tostand trial or a finding of not guilty by reason oflack of mental responsibility pursuant to the
Uniform Code of Military Justice. 27 CFR 478.11.
Note that DOJ has proposed clarifications to thisregulatory language, which are published elsewherein this issue of the Federal Register. We also notethat having ‘‘marked subnormal intelligence or
mental illness, incompetency, condition, ordisease,’’ is one necessary element of adetermination that an individual (other than an
individual who has been involuntarily committed)
is subject to the Federal mental health prohibitor.
To be subject to the Federal mental healthprohibitor, such an individual also must be
adjudicated to pose a danger to self or others or lackthe mental capacity to contract or manage their own
affairs.
4 See 28 CFR 25.1 through 25.11 (establishing
NICS information system specifications andprocesses) and 27 CFR part 478 (establishingrequirements and prohibitions for commerce infirearms and ammunition, including requirements
related to conducting NICS background checks).

PO 00000

Frm 00023

Fmt 4702

Sfmt 4702

785

NICS Index, a database administered by
the Federal Bureau of Investigation(FBI), collects and maintains certain
identifying information about
individuals who are subject to one ormore Federal prohibitors and thus are
ineligible to purchase firearms.5 As of
2012, the NICS Index also contains
information on persons who are subject
to State law prohibitions on thepossession or receipt of firearms. The
minimum information required in a
NICS Index record consists of: The
name of the ineligible individual; thedate of birth; sex; and codes indicating
the applicable prohibitor, the submitting
entity, and the agency record supporting
the prohibition. For individuals subject
to the Federal mental health prohibitor,
only the fact that the individual issubject to that prohibitor is submitted to
the NICS; underlying diagnoses,
treatment records, and other identifiable
health information are not provided toor maintained by the NICS. A NICS
background check queries the NICS
Index and certain other national
databases 6 to determine whether aprospective buyer’s identifying
information matches any prohibiting
records contained in the databases. The
NICS Index can be accessed only for thelimited purposes authorized byregulation (see 28 CFR 25.6(j)) andcannot be used for other purposes,
including general law enforcement
activities.
The potential transfer of a firearmfrom a Federal Firearms Licensee (FFL)
to a prospective buyer proceeds asfollows: First, the prospective buyer isrequired to provide personal
information on a Firearms Transaction
Record (ATF Form 4473). Unless theprospective buyer has documentationthat he or she qualifies for an exception
to the NICS background check
5 Additionally, in 2012 the NICS Index began toinclude the identities of persons who are prohibitedfrom possessing or acquiring firearms by State law,which in some cases may be more restrictive thanFederal law. See Statement Before the Senate
Judiciary Committee, Subcommittee on Crime andTerrorism at a hearing entitled, ‘‘THE FIX GUNCHECKS ACT: BETTER STATE AND FEDERALCOMPLIANCE, SMARTER ENFORCEMENT’’(November 15, 2011), by David Cuthbertson,
Assistant Director, Criminal Justice Information
Services Division, Federal Bureau of Investigation.
Testimony available at: http://www.justice.gov/ola/testimony/112-1/11-15-11-fbi-cuthbertsontestimony-re-the-fix-gun-checks-act.pdf.
6 The other databases include the Interstate
Identification Index, which contains criminal
history record information; and the National Crime
Information Center, which includes, e.g.,
information on persons subject to civil protection
orders and arrest warrants. Additional information
is available at, http://www.fbi.gov/about-us/cjis/
nics/general-information/nics-overview.

E:\FR\FM\07JAP1.SGM

07JAP1

786

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

requirement under 18 U.S.C. 922(t)(3),7
the FFL contacts the NICS—
electronically, by telephone, or througha State level point of contact—andprovides certain identifying information
about the prospective buyer from ATF
Form 4473.8 Within about 30 seconds,
the FFL receives a response that theprospective firearm transfer may
proceed or is delayed. The transfer isdelayed if the prospective buyer’s
information matches a record containedin one of the databases reviewed. If
there is a match, a NICS examiner
reviews the record to determine whether
the information it contains is, in fact,prohibiting, and then either: (1) If therecord does not contain prohibiting
information, advises the FFL to proceedwith the transaction; (2) if the record
does contain prohibiting information,
denies the transaction (due toineligibility); or (3) if it is unclear based
solely on the existing information in therecord whether it is prohibiting, delays
the transaction pending further
research.9 The NICS examiner does notdisclose the reason for thedetermination to the FFL (e.g., the FFL
would not learn that the individual was
ineligible due to the Federal mental
health prohibitor). In case of a delay, if
the NICS examiner does not provide a
final instruction to the FFL within threebusiness days of the initial backgroundcheck request, the FFL may proceedwith the transaction if it chooses to do
so.10
Although FFLs are required in mostcases to request a background checkthrough the NICS before transferring afirearm to a prospective buyer,11 Federal
law does not require State agencies toreport to the NICS the identities ofindividuals who are prohibited frompurchasing firearms, and not all States
7 These exceptions are listed in the ATF
regulation at 27 CFR 478.102(d). For example, a
NICS check would not be required where thepotential recipient of a firearm has presented avalid State permit or license, provided conditions
at 27 CFR 478.102(d)(1) are met.
8 The form collects the prospective buyer’s name;demographic information such as address, placeand date of birth, gender, citizenship, race andethnicity; and ‘‘yes’’ or ‘‘no’’ answers to questions
about the person’s criminal history and otherpotential prohibitors. The form is available at http://www.atf.gov/forms/download/atf-f-4473-1.pdf.
9 For example, a ‘‘delay’’ response may mean thatfurther research is required because potentiallyprohibitive criteria exist, but the matched records
are incomplete, See Federal Bureau of Investigation(FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
10 Some States have waiting periods that also
must be complied with before a firearm may betransferred, regardless of whether a proceed
response from NICS is received by the FFL within
three business days.
11 See 27 CFR 478.102. Exceptions to thisrequirement are referenced in FN 7 above, andlisted in the regulation at 27 CFR 478.102(d).

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

report complete information to the NICS
or the databases checked by it.
Following the shooting at Virginia Tech
University in 2007, and other tragedies
involving the illegal use of firearms,
Congress enacted the NICS
Improvement Amendments Act (NIAA)
of 2008, Public Law 110–180. Amongother provisions, the NIAA requires
Federal agencies to make accessible to
the NICS the identities of individuals
known by the agencies to be subject toone or more prohibitors, and it
authorizes incentive grants for States toprovide such information when it is in
their possession.12 In addition, someStates enacted legislation requiring thereporting of the identities of ineligible
individuals to databases accessible to
the NICS or to a State level repository
responsible for submitting information
to the relevant databases. Although theStates generally report criminal history
and related information to theappropriate FBI-maintained databasesthat are checked by the NICS, many
States continue to report little if any
information to the NICS Index, so the
NICS does not have access to complete
information about all individuals whoare subject to one or more of the Federal
prohibited categories or prohibited frompossessing or receiving firearms under
State law.13
The HIPAA Privacy Rule and NICS
Reporting
The Privacy Rule, promulgated underthe Health Insurance Portability andAccountability Act of 1996 (HIPAA),
Title II, Subtitle F—Administrative
Simplification, Public Law 104–191,
establishes federal protections to ensure
the privacy and security of protected
health information and establishes anarray of individual rights with respect toone’s own health information. HIPAA
applies to covered entities, which
include health plans, health careclearinghouses, and health careproviders that conduct certain standardtransactions (such as billing insurance)electronically. HIPAA covered entities
may only use and disclose protected
health information with the individual’s
12 Eligibility for these grants is limited to Statesthat have implemented a relief from disabilities
program for individuals who are prohibited frompossessing or receiving firearms for mental healthreasons. Such programs must provide that a State
court, board, commission, or other lawful authority
shall grant the relief if, based on the circumstances
regarding the disabilities and the person’s recordand reputation, the person is not likely to pose a
danger to public safety, and granting the relief
would not be contrary to the public interest. See
Public Law 110–180, Section 105.
13 The same is true of the other two databases
accessed during a NICS Check, the III and NCIC.
State participation and reporting to those databases
is also not required.

PO 00000

Frm 00024

Fmt 4702

Sfmt 4702

written authorization, or as otherwise
expressly permitted or required by the
HIPAA Privacy Rule.
The Privacy Rule seeks to balance
individuals’ privacy interests with
important public policy goals including
public health and safety. In doing so,
the Privacy Rule allows, subject tocertain conditions and limitations, usesand disclosures of protected healthinformation without individuals’
authorization for certain law
enforcement purposes, to avert a serious
threat to health or safety, and whererequired by State or other law, among
other purposes. See 45 CFR 164.512.
As stated above, individuals who aresubject to the Federal mental healthprohibitor are ineligible to purchase afirearm because they have been‘‘committed to a mental institution’’ or‘‘adjudicated a mental defective’’, 18
U.S.C. 922(g)(4). DOJ regulations define
these categories to include persons who
have been involuntarily committed to amental institution for reasons such as
mental illness or drug use; have beenfound incompetent to stand trial or not
guilty by reason of insanity; orotherwise have been adjudicated by acourt, board, commission, or otherlawful authority to be a danger tothemselves or others or unable tomanage their own affairs, as a result ofmarked subnormal intelligence, or
mental illness, incompetency,
condition, or disease.14 Records ofindividuals adjudicated as incompetentto stand trial, or not guilty by reason of
insanity, originate with entities in thecriminal justice system, and these
entities are not HIPAA covered entities.
Likewise, involuntary civil
commitments usually are made by court
order, and thus, records of such formal
commitments typically originate withentities in the justice system. In
addition, many adjudications
determining that individuals pose a
danger to themselves or others, or areincapable of managing their own affairs,
occur through a legal process in the
court system.
However, because of the variety ofState laws, there may be State agencies,
boards, commissions, or other lawfulauthorities outside the court system thatare involved in some involuntarycommitments or mental healthadjudications that make an individual
subject to the Federal mental healthprohibitor. Moreover, we understandthat some States have designatedrepositories to collect and report to the
14 As noted above, DOJ has proposed
clarifications to the regulatory language relevant tothese two categories; the DOJ proposal is publishedelsewhere in this issue of the Federal Register.

E:\FR\FM\07JAP1.SGM

07JAP1

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules
NICS the identities of individuals
subject to the Federal mental healthprohibitor. We currently do not havesufficient data to determine to what
extent any of these lawful authorities orrepositories also may be a HIPAA
covered entity (e.g., a State healthagency).
Even in circumstances where records
are subject to HIPAA—for example,
where the record of an involuntarycommitment or mental healthadjudication originates with a HIPAA
covered entity, or the HIPAA covered
entity is the State repository for suchrecords—there are ways in which thePrivacy Rule permits the reporting to
the NICS. In particular, the Privacy Rulepermits the covered entity to disclose
the information to the NICS to theextent the State has enacted a law
requiring (not merely authorizing) suchreporting.15 Alternatively, where there
is no State law requiring reporting, thePrivacy Rule permits a HIPAA covered
entity that performs both health careand non-health care functions (e.g.,
NICS reporting) to become a hybrid
entity and thus, have the HIPAA Privacy
Rule apply only to its health carefunctions. The entity achieves hybrid
entity status by designating its healthcare components as separate from othercomponents, documenting thatdesignation, and implementing policies
and procedures to prevent unauthorizedaccess to protected health informationby the entity’s non-covered components.
Thus, an entity that has designated itself
a hybrid entity, in accordance with thePrivacy Rule,16 can report prohibitor
information through its non-HIPAA
covered NICS reporting unit without
restriction under the Privacy Rule.
However, many States still are notreporting to the NICS essential
information on persons prohibited frompossessing firearms for reasons related
to mental health. Thus, concerns havebeen raised that the HIPAA Privacy
Rule’s restrictions on covered entities’
disclosures of protected healthinformation may be preventing certain
States from reporting the relevant
information to the NICS. Further, in July
2012, the U.S. Government
Accountability Office (GAO) reported toCongress on the results of a survey of six
States that it had assessed as part of aperformance audit of the progress madeby DOJ and the States in implementing
15 See 45 CFR 164.512(a). Note that disclosuresfor NICS purposes would not fall under the Privacy
Rule’s provisions permitting disclosures for law
enforcement purposes (which apply to specific law
enforcement inquiries) or to avert a serious threat
to health or safety (which require an imminent
threat of harm). See 45 CFR 164.512(f) and (j).
16 See 45 CFR 164.103, 164.105.

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

the NIAA.17 In the report, the GAO
wrote that, ‘‘. . . officials from 3 of the
6 States we reviewed said that theabsence of explicit State-level statutory
authority to share mental health records
was an impediment to making suchrecords available to NICS.’’ 18 The report
also stated that, although the number ofrecords provided by the States to the
NICS had increased by 800 percent
between 2004 and 2011, this increase
was largely due to efforts by only 12States. The report raised the possibility
that States that do not report to the NICS
the identities of individuals who areprohibited from possessing firearms forreasons related to mental health may
experience challenges to reporting
related to the HIPAA Privacy Rule.
II. The ANPRM
BackgroundOn April 23, 2013, the Department
published an Advance Notice of
Proposed Rulemaking (ANPRM)
requesting public input on these issues(78 FR 23872). The ANPRM explainedthat the Department was considering
creating an express permission in the
HIPAA Privacy Rule for reporting
information relevant to the Federal
mental health prohibitor to the NICS by
those HIPAA covered entities
responsible for involuntarycommitments or the adjudications thatwould subject individuals to the Federal
mental health prohibitor, or that areotherwise designated by the States toreport to the NICS. In the ANPRM, theDepartment indicated that such an
amendment might produce clarity
regarding the Privacy Rule and help
make it as simple as possible for States
to report the identities of suchindividuals to the NICS.
The ANPRM stated that, in crafting
the elements of an express permission,
the Department would consider limiting
the information to be disclosed to theminimum information necessary for
NICS purposes, such as the names of theindividuals who are subject to theFederal mental health prohibitor,
demographic information such as datesof birth, and codes identifying thereporting entity and the relevant
prohibitor. We indicated that the NICS
17 See GAO–12–684, Gun Control: Sharing
Promising Practices and Assessing Incentives Could
Better Position Justice to Assist States in Providing
Records for Background Checks.
18 We note that the GAO Report uses the term‘‘mental health records’’ to refer to identifying
information on individuals who are subject to theFederal mental health prohibitor. To avoid
implying that mental health records are collected by
NICS, the Department uses the terms ‘‘identities,’’‘‘information,’’ or ‘‘data’’ in place of ‘‘mental healthrecords.’’ GAO–12–684, p. 12.

PO 00000

Frm 00025

Fmt 4702

Sfmt 4702

787

does not include, and we would notconsider permitting the disclosure of, anindividual’s treatment record or any
other clinical or diagnostic information
for this purpose. In addition, we would
consider permitting disclosures for
NICS purposes only by those covered
entities that order involuntarycommitments, perform relevant mental
health adjudications, or are otherwise
designated as State repositories for NICS
reporting purposes.
To inform our efforts to address any
issues in this area, we requested
comments on a series of questions
concerning the nature and scope of the
problem of underreporting. The
questions included:• The nature and extent of States’
participation in NICS reporting;• To what extent HIPAA is perceived
as a barrier to reporting, and specificexamples of situations in which
reporting to the NICS is hindered by
HIPAA requirements;• Steps States may have taken toaddress HIPAA challenges for reporting,including any statutory or regulatorychanges at the State level;• Whether States had designated any
HIPAA covered agencies as repositories
of information for NICS reporting
purposes and, if so, how the States haveaddressed HIPAA requirements while
reporting;• Whether certain HIPAA covered
entities in the States have authority toorder involuntary commitments or
perform other adjudications that makean individual subject to the Federal
mental health prohibitor;• Whether additional, non-HIPAA
related barriers to reporting exist;• Whether there are privacy
protections in place for data collected
for NICS reporting purposes, andwhether or how State public records
laws would apply to the information;• Whether creating an express
permission would have implications fortreatment, and whether there would beways to mitigate any unintended
consequences of creating such apermission; and• How HHS could disseminate
information or provide additional
guidance on the HIPAA Privacy Rule toaddress confusion about HIPAA that
may affect reporting to the NICS.
We requested comments from all
stakeholders on these issues, including
HIPAA covered entities; agencies ofState, territorial, and tribal governments;
law enforcement officials; individuals;
and consumer advocates and groups.

E:\FR\FM\07JAP1.SGM

07JAP1

788

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

III. Public Comments on the ANPRM
Introduction
The Department received over 2,050
comments in response to the ANPRM.
Commenters included individuals, Stateagencies, health care providers,
professional organizations, consumer
advocacy groups, and otherstakeholders.
Individuals generally expressed
concern that the NICS, the Federal
mental health prohibitor, and thecontemplated HIPAA permission,
would infringe on their Second
Amendment right to bear arms and theright to be afforded due process of law
under the U.S. Constitution
Many individual commenters, as wellas health care providers, organizations
representing providers, and consumer
advocacy groups, emphasized theimportance of protecting individuals’
health information privacy and raised
concerns regarding the possible adverse
consequences an express permission
could have on the patient-provider
treatment relationship and individuals’
willingness to seek needed mental
health care. Other commenters
supported the proposal as removing aperceived barrier to an important andnecessary public safety measure. Four
State agencies and several organizations
representing State officials and Statebased professional organizations
responded to the specific questions in
the ANPRM regarding how NICS
reporting occurs in those specific States
and their perceptions of HIPAA-related
barriers or other challenges related to
NICS reporting. We discuss thesecomments, along with others, in moredetail below.
Summary of Comments and Responses

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

A. Concerns Regarding the NICS and theFederal Mental Health Prohibitor
As noted above, a majority of
individual commenters voiced general
concern that NICS reporting would leadto infringements on individuals’ rights
to bear arms and to receive due processof law under the Constitution. Some
commenters voiced opposition to any
restriction on their right to bear arms.
Many commenters raised concernswith the Federal mental healthprohibitor category itself. Some, while
supportive of the general proposition
that individuals who pose a risk of harmto themselves or others should not haveaccess to firearms, expressed concernthat the Federal mental healthprohibitor was overly broad and would
result in individuals being reported to
the NICS Index who do not pose a threat
to society. A number of these

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

commenters expressed concern
regarding the standard used todetermine whether individuals should
be reported to the NICS, including thoseadjudicated as ‘‘lack[ing] the mental
capacity to contract or manage his own
affairs’’ under 27 CFR 478.11. Several
commenters were especially concernedthat the prohibitor might include
individuals who are adjudicated as
temporarily unable to independently
manage their Veterans or Supplemental
Security Income (SSI) benefits.
Further, many commenters asserted
that mental illness is not an effective
predictor of gun violence, and that there
is no direct correlation between
reporting individuals with mental
illnesses to the NICS Index and areduction in gun violence. Several
commenters added that studies haveshown that individuals with mental
disorders are more likely to be thevictims of violent crime by others thanthe perpetrators. In addition, somecommenters specifically objected toindividuals that fall within the Federal
mental health prohibitor being reported
to the NICS on the grounds that the
NICS is a ‘‘criminal’’ database.
Many commenters expressed
concerns about whether individuals
who are subject to the Federal mental
health prohibitor receive due process.
For example, many individuals wereconcerned that an individual would bereported to the NICS without a formal
adjudication through the judicial
system. A few commenters argued thatany determination that would subject anindividual to the Federal mental healthprohibitor should include a review by
one or more mental healthprofessionals. In general, commentersurged the Department to allow reportingof only those involuntary commitmentsthat involve due process of law.
State officials and many othercommenters emphasized the importanceof establishing mechanisms to remove
an individual’s name from the NICS
when the basis for their inclusion nolonger applies. Some of thesecommenters also expressed concern
about the difficulty, including the cost
and time involved, of getting anerroneous submission removed from the
NICS database. Several commentersnoted that individuals whose conditions
or circumstances change would nothave a process to seek removal from theNICS.
A few commenters suggested that, in
addition to the minimum information
currently needed to report an individual
to the NICS, covered entities should also
be permitted to disclose the date of thedisqualifying event. This, they asserted,
would make it easier for individuals to

PO 00000

Frm 00026

Fmt 4702

Sfmt 4702

determine whether the report was madeerroneously.
We acknowledge the concerns ofthese commenters. However, this
proposed rule would not affect thescope of the NICS or the Federal mental
health prohibitor. Rather, the rule isintended to address perceptions thatHIPAA creates a barrier to entities
reporting information to the NICS. Morespecifically, it would create a way inwhich covered entities involved inreporting or collecting NICS data may
disclose, consistent with the Privacy
Rule, the information needed for NICS
reporting. It will not expand thecategories of prohibited persons ormodify other Federal or State laws
pertaining to firearms purchases, butwould be limited to those covered
entities that currently perform theadjudications that make individuals
subject to the Federal mental healthprohibitor, or that collect information
regarding such adjudications on behalfof a State.
Further, the Department clarifies thatthe proposed HIPAA permission for
NICS reporting would be limited toreporting of individuals who are subject
to the Federal mental health prohibitor,
as defined in Federal law andregulations. DOJ regulations state that
this would not include individuals in amental institution for observation or
admitted voluntarily. See 27 CFR 478.11(Definitions).19 Thus, individuals whoare subject to the Federal mental healthprohibitor are afforded the opportunity
for judicial review or other due process.
We acknowledge the commenters’
concerns with respect to opportunities
for remediation and note that
individuals who believe they are
wrongly denied the purchase of a
firearm can visit https://forms.fbi.gov/
nics-appeals-request-form to find out
more information and appeal theirdenial. Further, some States have
implemented programs providing forrelief from disabilities under the Federal
mental health prohibitor. Relief fromdisabilities is a process by which anindividual, who would otherwise beprohibited from purchasing a firearmunder the Federal mental healthprohibitor, may apply to the lawfulauthority in the State where thecommitment or adjudication occurred
for relief. The lawful authority must
grant relief if it can be established thatthe circumstances regarding thedisability and the applicant’s record andreputation are such that the applicant
19 DOJ has proposed clarifications to 27 CFR
478.11. The DOJ proposal is published elsewhere inthis issue of the Federal Register. The proposed
regulatory text would not alter this aspect of thedefinition of ‘‘committed to a mental institution.’’

E:\FR\FM\07JAP1.SGM

07JAP1Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules
will not be likely to act in a manner
dangerous to public safety, and the
granting of relief would not be contrary
to the public interest. States’ processes
for granting relief vary.
B. Comments Regarding NICS Reporting
Barriers and Creating an Express
Permission in the HIPAA Privacy Rule
1. State Processes for Reporting to the
NICS
Health agencies from three States
responded to the ANPRM’s specificquestions regarding NICS reporting in
those States. An official from the
Washington State Department of Socialand Health Services explained that a
HIPAA covered State agency had been
responsible for reporting to the NICS
until 2009, when a new State law
transferred reporting responsibility to
the State’s Administrative Office of the
Courts. Officials from the Colorado
Department of Health Care Policy and
Financing and the North Carolina
Department of Health and Human
Services stated that non-HIPAA covered
entities in those States are responsible
for reporting to the NICS (the State
Bureau of Investigation and the county
Clerks of Court, respectively). Three of
the State agency commenters added that
entities in their States also do notexperience any other, non-HIPAA
related, barriers to reporting to theNICS.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

2. Creating an Express Permission
Two of the State agency commenters
agreed with our statement in the
ANPRM that creating an express
permission in HIPAA for disclosures to
the NICS would resolve any perceived
ambiguity and be generally beneficial.
Several other commenters agreed, andasserted that an individual’s right to theprivacy of his or her medical records
should not be placed ahead of the safety
and welfare of the population as awhole. A few commenters noted thatHIPAA was intended to protect theprivacy of individuals’ healthinformation, not to protect individuals
from being identified as potential
threats to others.
In addition, the Law Center to Prevent
Gun Violence reported that, while amajority of States have enacted laws
relating to reporting information to the
NICS or a State repository, HIPAA
continues to be cited as a perceived
barrier to reporting to the NICS in a
number of States. This commentersuggested that the perception of abarrier may arise because HIPAA’s
permission for uses and disclosures thatare required by law would not permit
HIPAA covered entities to disclose

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

information for NICS purposes in Statesthat have enacted laws authorizing, but
not requiring, such reporting. Further
complicating disclosures to the NICS,
according to this commenter, is the factthat at least eleven States rely, at leastin part, on a mental health facility toreport information on individuals in aprohibited category. This commenter
reported that all of those States havestatutes requiring such reporting, but
noted that some of the State laws only
require reporting to State repositories,
and not to the NICS database. Finally,
the National Center for State Courts
asserted that reporting to the NICS byentities in a State’s judicial system canbe challenging due to varying
interpretations as to whether or when
HIPAA may affect such reporting. This
commenter felt an express permission
under HIPAA would help resolve thisperceived ambiguity.
Some commenters agreed that, if apermission were created, HIPAA’s
minimum necessary provisions should
apply to any disclosures for reporting to
the NICS database. These commentersappreciated the Department’s assurance
that an individual’s treatment record, or
any other clinical or diagnostic
information, is not needed for the NICS,
and we would not consider permitting
the disclosure of such information
under a proposed rule.
In addition, several commenters urgedthat any HIPAA exception be limited toreporting of ‘‘commitments’’ as definedby 27 CFR 478.11, as these commentersnoted, there exists a great varianceunder State law as to what constitutes
a commitment. Several commenters
requested clarification on what
constitutes a commitment under theFederal mental health prohibitor. One
commenter specifically urged theDepartment to not amend the HIPAA
Privacy Rule until the DOJ revises the
Gun Control Act regulations to clarify
the standards under which anindividual becomes subject to astatutory prohibitor.20
A number of commenters argued thatthe proposed permission was
unnecessary, some agreeing with the
ANPRM’s statement that HIPAA’s
existing permissions (e.g., for uses anddisclosures required by State law)largely permit NICS reporting to takeplace. However, it should be noted thatseveral commenters expressed, and thus
may have based their comments on, themisconception that the Privacy Rule’s
permission to disclose for public health
20 We note that DOJ has proposed clarifications to
the relevant regulations defining the categories of
persons who are prohibited from possessing
firearms. The DOJ proposal is published elsewherein this issue of the Federal Register.

PO 00000

Frm 00027

Fmt 4702

Sfmt 4702

789

purposes, law enforcement purposes, orto prevent a serious and imminent
threat, currently allow for disclosures to
the NICS. As we noted in the ANPRM,
NICS reporting would not be consistent
with the conditions the HIPAA Privacy
Rule places on such uses anddisclosures. See conditions listed at 45
CFR 164.512(b), (f), and (j).
Many commenters believed a change
to the Privacy Rule to be unnecessary
because the information generally isreported to the NICS by non-HIPAA
covered entities. One commenter
pointed out that, even in States thatallow mental health providers tocommit individuals without prioradjudication, in which case a HIPAA
covered provider might be the solepossessor of certain information related
to the Federal mental health prohibitor,
such information eventually must be
shared with the court system, usually
within a designated timeframe. This
commenter and others argued that it
would be more appropriate for a court
system, rather than providers, to report
information for NICS purposes. A few
commenters suggested that, whererecords relevant to the Federal mental
health prohibitor are not available to a
judicial agency, another State agency ora State’s Office of Attorney General
should be responsible for reporting.
Some commenters were opposed tothe creation of any express permission.
Many mental health advocates andindividual commenters voiced concernthat an express HIPAA permission forreporting to the NICS information
relevant to the Federal mental healthprohibitor would reinforce andexacerbate the stigma surrounding
mental illness. In addition, many
commenters expressed concern thatcreating an express permission todisclose information for NICS purposes
would harm the patient-provider
relationship and discourage someindividuals from seeking needed mental
health treatment, due to fear that theirdoctor might disclose otherwise
confidential communications about
particularly sensitive information, suchas mental health treatment information.
Some commenters expressed particularconcern that a change to the Privacy
Rule would adversely affect veterans bydeterring individuals with posttraumatic stress disorder (PTSD) andother mental health issues from seeking
mental health services for fear of losing
their firearms.
After considering the comments we
received, we agree that the creation ofan express permission in the HIPAA
Privacy Rule to disclose information
relevant to the Federal mental healthprohibitor for NICS purposes is

E:\FR\FM\07JAP1.SGM

07JAP1

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

790

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

necessary to address ambiguity andensure relevant information can bereported for this important public safety
purpose. Thus, as discussed more fully
below, we propose to permit certain
covered entities to disclose limited
information for NICS reporting
purposes.
It is important to note that a mental
health diagnosis does not, in itself,
make an individual subject to theFederal mental health prohibitor, which
requires an involuntary commitment or
adjudication that the individual poses a
danger to self or others or lacks themental capacity to contract or manage
their own affairs. For example, withrespect to the Federal mental healthprohibitor, concerns about veteransbeing reported to the NICS based solely
on a diagnosis of PTSD are misplaced.
Still, we acknowledge commenters’
concerns about possible detrimental
effects of an express NICS disclosure
provision on individuals’ relationships
with their health care providers, or on
individuals’ willingness to seek care in
the first place. We agree thatencouraging individuals to obtainappropriate treatment is critical to bothindividuals’ health and the public’s
safety. Therefore, we have narrowly
drawn this proposed permission suchthat it would not apply to the vast
majority of treating health careproviders, who do not perform theformal involuntary commitments orother adjudications that make anindividual subject to the Federal mental
health prohibitor, and do not serve asrepositories of information about suchcommitments and adjudications. Those
health care providers do not report to
the NICS currently and this would notchange under the proposed rule.
The Department has carefully tailoredthe proposed permission to generally
apply to entities that are not directly
involved in treatment to minimize any
potential adverse unintended
consequences, such as discouraging
individuals from seeking mental healthtreatment due to concerns that theirprovider might report them to the NICS.
Instead, as we explain more fully below
in the description of the rule, only those
HIPAA covered entities that conduct the
involuntary commitments or otheradjudications that make an individual
subject to the Federal mental healthprohibitor, or that serve as repositories
of information about such adjudications,would be permitted to rely on the
proposed express permission to disclose
information for NICS reporting
purposes.21
21 We note that other provisions of the HIPAA

Privacy Rule that permit covered entities to disclose

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

The Department is soliciting comment
on whether the permission should
instead be broad enough to also include
reporting of persons to the NICS who
are subject to State firearm prohibitions,in light of the many State laws that
restrict firearms possession for mental
health related reasons. It is possible that
extending the permission in this way
would expand the number of potential
reporting entities to include morecovered entities that provide treatment.
We describe the potential implicationsof expanding the scope of thepermission to include State law
prohibitors more fully below.
In addition, the proposed provision
would permit those entities to disclose
only the minimum necessary
information for NICS reporting
purposes. NICS does not access ormaintain diagnostic or clinicalinformation, so such information would
not be considered the minimum
necessary. The Department is soliciting
comment on whether to permit thedisclosure of certain additional
identifying information (but not toinclude diagnostic or clinicalinformation) that would help the NICS
make accurate matches or rule out
matches based on the additional
information. These additional
identifiers are discussed below in thedescription of the proposed rule.
We believe that the proposed change
would appropriately protect andpreserve individuals’ privacy interests,
the patient-provider relationship, andthe public’s health and safety. Weemphasize that most covered entities,
including treating providers who do notalso perform formal involuntarycommitments or other adjudications
that make an individual subject to theFederal mental health prohibitor, as
well as business associates, will not be
disclosing information about
individuals directly to the NICS under
this proposal. We expect most reporting
to continue to be done by the judicial
system. However, where the judicial
system lacks the information needed, or
where the judicial system is not theappropriate entity to report individuals
to the NICS, this proposal, if finalized,
will give States and covered entities
additional flexibility to ensure accurate
information is reported to the NICS.
information for public policy purposes remain in
effect. Thus, where a HIPAA covered entity,
including an entity not falling within the proposed
provision, is required by law to disclose to the
NICS, such disclosures would continue to bepermitted under the Privacy Rule.

PO 00000

Frm 00028

Fmt 4702

Sfmt 4702

C. Other Comments
1. Privacy, Security, and Uses of NICS
Information
A few commenters requested
information on whether information in
the NICS can be accessed bygovernment officials for purposes otherthan firearm purchase backgroundchecks. In addition, some commentersraised concerns regarding the privacy
and security protections afforded to
information reported to the NICS,
including protections for that
information when held by States andwhile in transit.
The relevant regulations permit NICS
background checks in conjunction withthe transfer of a firearm, issuance of
firearm or explosives permits orlicenses, as well as in conjunction with
ATF civil or criminal law enforcement
investigations relating to the Gun
Control Act or National Firearms Act.
See 28 CFR 25.6(j).22 The NICS cannot
be used for purposes beyond thosearticulated in the governing regulations,
including for general law enforcement
activities.
The DOJ regulations make clear that
FFLs can initiate NICS backgroundchecks only in connection with afirearm transaction requiring a NICS
background check. FFLs are prohibitedfrom initiating a query to the NICS for
any other purpose. Further, when an
individual prohibited from possessing afirearm attempts to obtain a firearmfrom an FFL, the FFL receives a
response indicating only that thetransfer has been denied or delayed
pending further review, but does nothave access to information about theapplicable prohibitor or any otheradditional information regarding thereason for the delay or denial.
With respect to the privacy andsecurity of information reported for
NICS purposes, the DOJ has establishedpolicies and procedures for ensuring theprivacy and security of NICS data in its
possession, including physical security
and safeguards, such as access
restrictions. Further, the DOJ requires
State and local law enforcement
agencies involved in conducting
background checks to observe certain
security policies and procedures whenprocessing NICS background checks.
Finally, in response to a question in
the ANPRM about the confidentiality of
information that has been collected bya repository for NICS reporting, several
commenters, including officials from
North Carolina, Washington, and
22 See Gun Control Act, 18 U.S.C. Chapter 44;
National Firearms Act, 26 U.S.C. Chapter 53; seealso 28 CFR 25.6(j), 63 FR 58303, 58308–58309.

E:\FR\FM\07JAP1.SGM

07JAP1Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules
Colorado, indicated that theindividually identifiable informationcollected for NICS reporting could not
be made publicly available under State
public records laws. Further, we notethat to the extent a HIPAA covered
entity is maintaining and reporting
information relevant to the Federal
mental health prohibitor that is
protected health information (including
demographic information), such entities
must continue to protect the
information in accordance with the
HIPAA Privacy and Security Rules,
which includes ensuring appropriate
safeguards to protect the information as
it is maintained and transmitted.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

2. Improving the Current Mental Health
System and Enforcement of Other Laws
Several commenters recommended
better tracking of firearms and better
enforcement of existing laws in place ofa HIPAA modification. Other
commenters urged the Department tofocus on improving the current mental
health care system in order to reduce
gun violence associated with mental
illness.
The Department continues to support
efforts by the Administration to dispel
stigmas relating to mental illness and toencourage individuals to seek voluntary
mental health treatment. With theimplementation of the Affordable Care
Act, millions of Americans who did notpreviously have coverage will receive
coverage for mental health services.
Additionally, the Administration has
improved access to mental healthservices for veterans and has supported
initiatives to train more mental healthprofessionals and help educators
recognize students showing signs ofmental illness and refer them toappropriate services.
3. Application of a HIPAA Permission to
Other Prohibitors
Several commenters requested
clarification on whether disclosures for
NICS reporting under the proposed rulewould be limited to the Federal mental
health prohibitor or if covered entities
could disclose protected healthinformation related to any of the Federal
prohibitors under the Gun Control Act.
Some other commenters recommended
that the Department amend the HIPAA
Privacy Rule to expressly permit suchreporting with respect to all of theFederal prohibitors. A few commenters
also urged the Department to extend any
express permission under the HIPAA
Privacy Rule for NICS reporting toinclude prohibitor categories that Statelaws have enacted, which may extend
beyond the Federal prohibitors. Some
commenters suggested creating a

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

provision permitting reporting related toother factors they perceive as associatedwith gun violence, such as domestic
violence and substance abuse.
The Department does not propose toexpand the proposed permission to
apply to information about individuals
who are subject to the other prohibitors
listed at 18 U.S.C. 922. HIPAA covered
entities are unlikely to have information
related to the other Federal prohibitors,
with the possible exception of the drug
use prohibitor, for which we understandcriminal records to be the primarysource of information for the NICS. We
note that, to the extent that individuals’
drug use results in their being
involuntarily committed, thoseindividuals would be subject to theFederal mental health prohibitor andthis proposed permission would apply.
Some States have enacted their own
laws prohibiting the possession orreceipt of firearms for reasons related tomental health and may prohibit thepurchase or possession of a firearm byadditional individuals who are nototherwise subject to the Federal mental
health prohibitor. For example, someStates may temporarily prohibit firearm
possession by individuals who havevoluntarily committed themselves toinpatient treatment, which currently
does not make an individual subject to
the Federal mental health prohibitor. As
noted above, some States currently
collect and report to the NICS theidentities of individuals who are subject
to State prohibitors, as well as theFederal prohibitors. To the extent that
States have enacted their own
prohibitions related to mental health,State law may also reduce barriers byrequiring reporting to the NICS by thosemaking the mental health assessmentsthat make individuals subject to a State
prohibition. However, the Department
requests comment on whether HIPAA isperceived as a barrier to reporting to the
NICS information about individuals
who are subject to State law firearm
prohibitions and whether the final ruleshould address this barrier.
Although the NICS has a role inhelping to enforce State firearms
prohibitions intended to keep firearms
out of the hands of certain individuals
for reasons related to mental health, the
NICS Index currently does not contain
information about all individuals whoare subject to such prohibitions. The
Department seeks comment on whether
the proposed permission should bebroadened to include information
relevant to those State law prohibitions,as well as information relevant to theFederal mental health prohibitor.
Expanding the permission would ensurethat relevant State law prohibitor

PO 00000

Frm 00029

Fmt 4702

Sfmt 4702

791

information could be reported to NICS
in States that do not otherwise require
the reporting. At the same time,
however, there are implications to
expanding the permission to encompass
State law prohibitors, which may bebroader than the Federal mental healthprohibitor. For example, if more entities
in States with their own prohibitors
have the authority to makedeterminations that subject individuals
to a firearms prohibition, there would be
an increased likelihood that moretreating providers would be permitted toreport information to the NICS. In
addition, there may be State laws thatprohibit the possession or receipt of a
firearm by individuals with particularmental health diagnoses or anassessment of ‘‘dangerousness’’ withcorrespondingly different procedural
protections for individuals. The
Department is seeking comment onwhether these concerns are borne out inany States and whether the proposed
permission should be broadened toinclude information relevant to thoseState law prohibitions.
4. Notice
A few commenters asked whether
individuals would be notified if theirprovider disclosed their protected
health information for NICS reporting
purposes. If such notification were notrequired, commenters recommended
that there be a way for individuals tofind out that their provider disclosed
their information for such purposes.
One commenter asked whether covered
entities would be required to revise
their Notice of Privacy Practices toinform individuals that the entities
might make disclosures for NICS
reporting purposes.
We are not proposing new notification
requirements.23 Further, the Department
would not require covered entities torevise their Notices of Privacy Practices
to specifically reference this newprovision. Existing notices that moregenerally refer to the types of
disclosures each covered entity ispermitted to make, including
disclosures for the public policy
purposes under 45 CFR 164.512, would
suffice.
5. HHS Authority
Several commenters argued that any
amendment to HIPAA to provide an
express permission for reporting to the
NICS database should be passed by
23 We note that individuals who have tried topurchase a firearm and been denied can appeal to
the FBI (and, in some States, to the NICS Point ofContact for the State), and learn the reason for thedenial, if they believe they have been erroneously
reported.

E:\FR\FM\07JAP1.SGM

07JAP1

792

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

Congress, not created by HHS. These
commenters argued that theAdministration would overstep its
authority if it adopted a regulatorychange that Congress chose not to enact
and that this would violate the principleof separation of powers. Additionally,
several commenters argued that under
the principle of federalism, regulation of
firearms should be left to the States.
We note that Congress, when it
enacted HIPAA, provided theDepartment with general authority todetermine the permissible uses anddisclosures of covered entities andmodify the HIPAA standards asappropriate. It is under this authoritythat the Department has proposed tomodify the Privacy Rule to permit
certain disclosures for the purpose of
NICS reporting.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

6. Additional Guidance
Several commenters asked for
additional guidance materials, training,and other outreach efforts from the
Department to help covered entities,
State agency officials, State legislatures,and State judiciaries better understand
HIPAA’s permitted and required
disclosures. Some commentersspecifically cited HIPAA as a perceived
barrier to State legislatures passing laws
requiring NICS reporting due tomisconceptions about HIPAA
preempting State law, and requested
that the Department conduct outreach to
explain HIPAA’s preemption
provisions. Other commenters urged theDepartment to increase its outreachefforts to encourage individuals to seek
voluntary mental health services.
The Department anticipates issuing
guidance to both address
misconceptions (e.g., such as theperception that HIPAA is a barrier toState legislatures passing laws requiring
reporting) and to help covered entities
comply with the rule. With respect tothe latter, we intend to work with DOJ
to issue additional guidance on the
categories within the Federal mental
health prohibitor,24 variations in State
law, and when and how the HIPAA
permission would apply. We willcontinue to evaluate additional areasthat may benefit from further guidance.
Finally, the Department will continue
its efforts to increase access to, andutilization of, needed mental health careservices.
24 We note that DOJ has proposed clarifications to
the regulatory definitions relevant to the Federal
mental health prohibitor. The DOJ proposal ispublished elsewhere in this issue of the Federal
Register.

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

IV. Overview of the Proposed Rule
We are proposing to revise 45 CFR
164.512 of the Privacy Rule by adding
a new category of permitted disclosures
to 45 CFR 164.512(k), which addresses
uses and disclosures for specialized
government functions. The newprovisions at (k)(7) would permit certain
covered entities to disclose theminimum necessary demographic andother information for NICS reporting
purposes, which would not include
clinical, diagnostic, or other mental
health information.
There is a strong public safety needfor this information to be accessible to
the NICS, and some States are currently
under-reporting or not reporting thisinformation at all. From what weunderstand, and what we have heard
from commenters, most of theinformation relevant to the Federal
mental health prohibitor is held byentities that are not covered by HIPAA.
For those few HIPAA covered entities
that may be involved in the relevant
commitments or adjudications, thePrivacy Rule contains paths fordisclosure, but these do not appear to be
sufficient. Therefore, we propose to add
another, narrowly tailored, permissionfor HIPAA covered entities that performthe commitments or adjudications thatmake individuals subject to the Federal
mental health prohibitor, or that act asrepositories of NICS records on behalf ofa State, to use and disclose certain
information for NICS reporting
purposes. To the extent that somecovered entities may perform
adjudicatory or repository functions inStates that have not enacted laws
requiring reporting to the NICS, and asubset of those may be unable to achieve
hybrid entity status for administrative orother reasons, this permission would
remove a barrier to their reporting andprovide clarity. Importantly, theproposed permission would focus on
those entities performing the relevant
commitment, adjudicatory or repository
functions, not on those performing
solely treatment functions.
We note that the proposed
modification to the Privacy Rule would
merely permit, and not require, covered
entities to report to the NICS. In
addition, it would not place additional
limitations on or otherwise affect thecurrently existing permitted uses anddisclosures of protected healthinformation under the Privacy Rule.
Thus, for example, the Rule’s current
permissions for uses and disclosuresrequired by other law, including State
law, would remain unchanged, as
would provisions permitting uses anddisclosures for law enforcement

PO 00000

Frm 00030

Fmt 4702

Sfmt 4702

purposes as part of a specificinvestigation, or to avert a serious andimminent threat. See 45 CFR 164.512(a),(f), and (j).
V. Description of the Proposed Rule
The following describes the specificprovisions of the proposed rule. Thoseinterested in commenting on the
proposed rule can assist the Departmentby preceding discussion of any
particular topic with a citation orreference to the aspect of the proposed
rule being discussed. While we request
comment on several specific questions,
we welcome comments on any aspect ofthe proposed rule.
General Rule
Paragraph (k)(7) would permit usesand disclosures of protected healthinformation for purposes of reporting to
the NICS or a State-designated entity theidentities of individuals who are subject
to the Federal mental health prohibitor
under 18 U.S.C. 922(g)(4), provided theconditions in the remaining paragraphs
under (k)(7) are met. We do not intend
with this paragraph to require formal
designations by the States, but wewould expect States to be able toidentify the responsible entity. We
request comment on whether the
proposed language encompasses allentities that are responsible forreporting to, or otherwise collecting
information for, the NICS on behalf of
the States.
The proposed permission would not
permit covered entities to use or
disclose the protected healthinformation of individuals who aresubject to one or more of the otherprohibitors listed at 18 U.S.C. 922(g), as
the lack of an express HIPAA
permission for reporting information
relevant to the Federal mental healthprohibitor is a limited problem and wehave not heard that there is a similar
issue with respect to the otherprohibitors. Thus, for example, acovered entity would not be able to use
this permission to use or disclose
information about an individual who isan unlawful user of or addicted to any
controlled substance (18 U.S.C.
922(g)(3)), except to the extent theindividual is also subject to the Federal
mental health prohibitor. We note that
other laws may impact disclosuresrelated to the other prohibitors,
including 18 U.S.C. 922(g)(3).
We propose to limit the permission touses and disclosures about individuals
who are subject to the Federal mental
health prohibitor. As discussed above,
we request comment on the scope of thepermission, specifically with regard towhether the permission should be

E:\FR\FM\07JAP1.SGM

07JAP1Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

broadened to allow covered entities todisclose the identities of individuals
who are prohibited by Federal or Statelaw from possessing or receiving
firearms for reasons related to mental
health.
Applicability
Paragraph (k)(7)(i) would apply theexpress permission only to covered
entities that function as repositories of
information relevant to the Federal
mental health prohibitor on behalf of aState, or that are responsible forordering the involuntary commitments
or other adjudications that make anindividual subject to the Federal mental
health prohibitor. The Federal
prohibitor regulations define an
involuntary commitment as a formal
commitment of a person to a mental
institution by a court, board,commission, or other lawful authority. It
does not apply to individuals in a
psychiatric facility for observation or
who have been admitted voluntarily.
The other applicable adjudications
include determinations by a court,
board, commission, or other lawfulauthority that persons are a danger tothemselves or others, or lack the mental
capacity to contract or manage theirown affairs, as a result of marked
subnormal intelligence, or mental
illness, incompetency, condition, ordisease. See 27 CFR 478.11(Definitions).25 This NPRM refers to theinvoluntary commitments and otherapplicable adjudications as, collectively,‘‘adjudications that make an individual
subject to the Federal mental healthprohibitor.’’Our understanding is that lawfulauthority for performing such
adjudications and repository functions
rests, for the most part, with entities that
operate outside the scope of HIPAA.
However, in the interest of public safety,
we want to ensure that relevant
adjudications can be reported in thesmall subset of States in which HIPAA
covered entities may make, or collectand report records of, these
determinations.
In permitting only entities involved inthese adjudicatory or repository/
reporting functions to use or disclose
Federal mental health prohibitor
information for NICS purposes, theproposal would not create a permission
for most treating providers to disclose
protected health information about theirown patients for these purposes. We
agree with the commenters who argued
that encouraging voluntary treatment is
25 Note that DOJ has proposed clarifications tothis regulation; the DOJ proposal is publishedelsewhere in this issue of the Federal Register.

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

critical to ensuring positive outcomesfor individuals’ health as well as the
public’s safety. We also agree with themany commenters who asserted that
non-health care entities should andcurrently do bear primary responsibility
for collection and reporting of
information relevant to the Federal
mental health prohibitor in most States.
However, where a HIPAA covered entity
is a board, commission, or other lawfulauthority that makes adjudications that
result in individuals being subject to theFederal mental health prohibitor, we
believe those entities are most likely tohold records of the relevant
adjudications.
We request public comment on theextent to which some States may havevested responsibility for Federal mental
health prohibitor reporting in HIPAA
covered entities, to what extent records
needed for NICS reporting are created or
maintained by covered entities, andwhether there are circumstances inwhich health care providers would needto report the identity of an individual
subject to the Federal mental healthprohibitor to a State designated records
repository or directly to the NICS. We
also request comment on the types ofadditional guidance from OCR and/or
the NICS that would be helpful forunderstanding to which covered
entities, and under what circumstances,the proposed permission would apply.
Recipients of Information Disclosures
Paragraph (k)(7)(ii) would providethat a covered entity identified in(k)(7)(i) may use or disclose Federal
mental health prohibitor information for
NICS purposes either directly to the
NICS or to an entity designated by theState as a repository of data for purposesof reporting to the NICS. By clearly
delimiting the permitted recipients ofsuch disclosures, the rule would ensurethat covered entities do not exceed theintended scope of the permission by
disclosing information relevant to theFederal mental health prohibitor to, forexample, law enforcement agencies that
do not operate as repositories of data for
purposes of reporting to the NICS.
Again, as stated above, the Privacy
Rule’s existing permissions to use or
disclose protected health information
for specific law enforcement
investigations, as provided in 45 CFR
164.512(f), would remain unchanged.
We request comment on whether there
are States in which a type of entity notdescribed in this proposed paragraph is
responsible for NICS reporting andneeds to be able to receive NICS datafrom a HIPAA covered entity.

PO 00000

Frm 00031

Fmt 4702

Sfmt 4702

793

Limitations on the Information Used orDisclosed
Paragraph (k)(7)(iii) would strictly
limit the information used or disclosed
for NICS reporting purposes to theminimum necessary for such purposes.
The Privacy Rule requires uses anddisclosures of protected healthinformation to be limited to theminimum necessary for their intended
purpose, and in the proposed regulation
text, we make clear that only limited
demographic and other information
would constitute the minimum
necessary for NICS reporting. At thistime, we would consider the minimum
necessary information to include an
individual’s name; date of birth; sex; acode or notation indicating that theindividual is subject to the Federal
mental health prohibitor; a code ornotation representing the reporting
entity; and a code identifying the agency
record supporting the prohibition. The
proposed modification would not
permit the use or disclosure of clinicalor diagnostic information for NICS
reporting purposes. We request
comment on whether, and in whatcircumstances, HIPAA covered entities
or other entities such as courts currently
report to a records repository or directly
to the NICS information that is notlisted in the proposed paragraph.
We are also considering permitting
the disclosure of some or all thefollowing additional data elements,
which are optional fields for a NICS
Index entry, as part of the minimum
necessary for NICS reporting purposes:
Social Security number, place of birth,State of residence, height, weight, eyecolor, hair color, and race. From what
we understand, these elements are notincluded in every NICS record, but often
are used to confirm that a prospective
firearm recipient matches a record
searched by the NICS or to eliminate‘‘false positive’’ background check
results. We request public comment on
this issue.
VI. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact
statement in compliance with Executive
Order 12866 (September 1993,
Regulatory Planning and Review),
Executive Order 13563 (January 2011,
Improving Regulation and Regulatory
Review), the Regulatory Flexibility Act(RFA) (September 19, 1980, Pub. L. 96–354), the Unfunded Mandates ReformAct of 1995 (UMRA) (March 22, 1995,
Pub. L. 104–4), and Executive Order13132 on Federalism.

E:\FR\FM\07JAP1.SGM

07JAP1

794

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

1. Executive Order 12866 and Executive
Order 13563
Executive Orders 12866 and 135643
direct agencies to assess all costs andbenefits of available regulatory
alternatives and, if regulation isnecessary, to select regulatory
approaches that maximize net benefits(including potential economic,
environmental, public health and safety
effects, distributive impacts, andequity). Executive Order 135634
emphasizes the importance ofquantifying both costs and benefits, ofreducing costs, of harmonizing rules,
and of promoting flexibility. This rulehas been designated a ‘‘significant
regulatory action’’ although noteconomically significant, under section
3(f) of Executive Order 12866.
Accordingly, this rule has beenreviewed by the Office of Management
and Budget.
A regulatory impact analysis must be
prepared for all major rules that haveeconomically significant effects ($100
million or more in any one year) or
adversely affect in a material way the
economy, a sector of the economy,
productivity, competition, jobs, theenvironment, public health or safety, orState, local, or tribal government orcommunities (58 FR 51741). Because theproposed rule does not contain any new
requirements for covered entities, weestimate that the rule will be cost
neutral. We request comment on ourassumptions and information on thenature of any unanticipated costs thatcovered entities may incur as a result of
the rule.
Although we expect the economic
impact of the rule, including nonquantifiable costs and savings discussed
in the regulatory analysis below, to beless than $100 million annually, we
nevertheless conducted an analysis of
the costs of the proposed rule.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

2. Entities Subject to the Rule
This proposed rule would apply only
to covered entities that are responsible
for ordering involuntary commitments
or conducting other adjudications thatmake individuals subject to a Federal
prohibition against possessing firearms
under 18 U.S.C. 922(g)(4) (the Federal
mental health prohibitor), or that areotherwise designated by a State to report
the identities of such individuals to the
NICS. We do not have sufficient data to
determine the number of affected
entities, but, based on the information
available to us, we believe there would
be very few. Our understanding is that,for the most part, formal adjudications
and repository functions of this natureare conducted by entities, such as court

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

systems or law enforcement agencies,that are not covered by HIPAA. We
welcome public comment on thenumber of covered entities that might beaffected by this rule.
B. Why is this rule needed?
This proposed rule is needed toensure that, where HIPAA covered
entities make adjudications causing
individuals to become subject to theFederal mental health prohibitor, orserve as repositories of records of such
adjudications on behalf of States, those
covered entities can report the identitiesof those individuals to the NICS.
Specific permission under the Privacy
Rule for these disclosures is necessary
to the extent that some States have notenacted laws requiring reporting to the
NICS, but a covered entity in the Stateis nevertheless responsible for suchreporting. Importantly, the proposed
rule would permit only a small subsetof HIPAA covered entities (i.e., thosethat perform the relevant mental healthadjudications or repository functions) touse or disclose only limited, nonclinical information, for NICS purposes.
This narrowly tailored permission
would permit these important uses ordisclosures for public safety to occur
while maintaining a separation between
reporting functions and the mental
health treatment a patient might bereceiving.
C. Qualitative Analysis of Unquantified
Costs
The rule would be cost neutral withrespect to HIPAA covered entities. The
rule would not require entities that
already have a NICS reporting process
in place to change their current system
and would not create new reporting or
recordkeeping requirements for any
covered entity. The small number ofcovered entities that would be newly
permitted to report to the NICS or a
State repository under the rule could
begin reporting and may need todevelop policies and procedures to do
so. As the Privacy Rule only allows theuse or disclosure of information, anddoes not require it, any resulting burdenof reporting and associated proceduresis attributable to the Federal statutory
mental health prohibitor and the NICS
system itself. See 28 CFR Part 25,
Subpart A (http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/
Title28/28cfr25_main_02.tpl ). We
acknowledge that those entities thatchoose to begin reporting may wish toaddress this change in their HIPAA
policies and procedures, as well as
explain their procedures to office staff.
However, the rule would not require
any changes to existing HIPAA policies

PO 00000

Frm 00032

Fmt 4702

Sfmt 4702

and procedures. In addition, withrespect to training, the rule would not
require workforce training beyond what
is already required under the HIPAA
Privacy and Security Rules, and we do
not expect that such entities that choose
to report under the rule would do morethan ensure that their office staff havecopies of the new policies andprocedures. We request comment onthese assumptions and on the number ofentities that might begin to report to the
NICS for the first time, if any.
To the extent that the rule would
permit some covered entities to report to
the NICS for the first time, there may be
an increase in the number of individuals
whose identities are newly included in
the NICS and who are denied a firearmtransfer as a result. As a result, there
may be a concomitant increase inapplications for relief from disabilities
in states that provide such a relief
program. However, any burden to
individuals completing and submitting
the relief application form is attributed
to the procedures established by theState where the commitment or
adjudication occurred. The procedures
for applying for relief in States that haveestablished mental health relief fromdisabilities programs pursuant to the
NICS Improvement Amendments Act of2007 vary. We received a number ofcomments on the ANPRM asserting thatcreating an express permission in the
Privacy Rule for NICS reporting would
discourage individuals from seeking
needed mental health care. We
appreciate these concerns and agreewith commenters who asserted that
individuals’ health and the public’s
safety are best served by encouraging
appropriate treatment. We also
recognize that discouraging treatment
could increase the burden of untreatedmental conditions to individuals, in theform of increased suffering and loss of
productivity; to the health care system,
when individuals with untreated mental
illness need emergency hospitalization,for example; and to the public’s safety.
However, the majority of thesecommenters expressed the mistaken
belief that the proposed permission
would allow or require mental healthcare providers to report diagnostic or
clinical information to the NICS. Manyof these commenters also voiced
concern that an express permission
under HIPAA would potentially
increase burdens on providers.
Although one commenter suggested thatan express permission under HIPAA
would help lessen concerns aboutprovider liability for disclosures related
to NICS reporting, many morecommenters expressed concern that

E:\FR\FM\07JAP1.SGM

07JAP1

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules
creating an express permission mightlead providers to over report theirpatients due to a fear of liability for
failing to report a patient who later
commits an act of gun violence.
As explained above, we have carefully
and narrowly tailored the proposed rule
to apply only to a small number ofcovered entities that may be responsible
for the adjudications that make anindividual subject to the Federal mental
health prohibitor, or that serve asrepositories of data about such
adjudications. As such, the proposed
rule generally would maintain aseparation between treatment functions
and NICS reporting functions. In
addition, the rule would not permit theuse or disclosure of any diagnostic or
clinical information, or any otherinformation about an individual that is
not the minimum necessary for NICS
reporting purposes. Because of thesestrict limitations on the permitted usesand disclosures, we believe that
individuals would not be dissuaded
from seeking needed mental health careservices as a result of the proposed rule.
We welcome comment on thisassumption.
Finally, we recognize the intangible
burden to individuals of the stigma
associated with mental healthconditions. We again emphasize, as we
did in the ANPRM, that individuals
with treated mental health conditions as
a group have not been shown to pose anincreased risk of gun violence against
others compared with the general
population, and are in fact more likely
to be victims of violence than othermembers of the general population. We
note further that the Federal mental
health prohibitor does not apply to allindividuals with mental healthconditions, but instead a subset ofindividuals who have been
involuntarily committed or otherwise
adjudicated to be a danger to themselves
or others, or unable to manage their own
affairs, as a result of marked subnormal
intelligence, or mental illness,
incompetency, condition, or disease.
With this proposed rule, the Department
is not adopting or endorsing the ideathat individuals with mental healthconditions pose a danger to society.
Rather, the rule would permit a limited
number of HIPAA covered entities toreport to the NICS the identities ofindividuals in a particular subcategoryof persons who are currently prohibitedby Federal law from possessing
firearms. This permission would
facilitate the enforcement ofprohibitions that were established by
the Gun Control Act. Therefore, we do
not expect that this proposed rule

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

would exacerbate stigma associatedwith mental health conditions.
We request comment on thisassumption and on any other costs that
may be associated with the rule.
D. Qualitative Analysis of Unquantified
Benefits
While we believe that there may bebenefits to public safety as a result of
the rule, we are not able to monetize thevalue of such benefits.
For example, the rule may result inincreased reporting to the NICS ofindividuals who may pose a risk of gun
violence related to a serious mental
health condition. To the extent that thisrule would permit covered entities toreport those individuals’ identities for
NICS purposes, resulting in denial of
firearms to those who are prohibitedfrom possessing firearms under Federallaw, the rule would provide a public
safety benefit. However, we do not haveinformation about whether, or how
many, covered entities would begin toreport or increase reporting to the NICS
as a result of the rule.
An additional benefit of the rulewould be to alleviate the concerns ofState lawmakers who, according to ahandful of commenters, may bereluctant to pursue legislation requiring
entities to report Federal mental healthprohibitor information for NICS
purposes because of a misconceptionthat the HIPAA Privacy Rule would
preempt such requirements. As
explained more fully above, the Privacy
Rule permits uses and disclosures thatare required by law. To the extent that
State lawmakers harbor thismisconception, this rule would serveboth to clarify HIPAA’s preemption
provisions and provide an avenue for
NICS reporting that may obviate a needto enact legislation at the State level.
We welcome comment on any of theseissues.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The RFA requires agencies to analyze
and consider options for reducing
regulatory burden if a rule will impose
a significant burden on a substantial
number of small entities. The act
requires the head of the agency to either
certify that the rule would not impose
such a burden or perform a regulatory
flexibility analysis and consider
alternatives to lessen the burden. For
the reasons explained more fully abovein the summary of costs and benefits, it
is not expected that the rule would
result in compliance costs for covered
entities of any size because the rulewould not impose new requirements.

PO 00000

Frm 00033

Fmt 4702

Sfmt 4702

795

2. Unfunded Mandates Reform Act
Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipatedcosts and benefits before issuing any
rule whose mandates would require
spending in any one year $100 million
in 1995 dollars, updated annually for
inflation. In 2013, that threshold isapproximately $150 million dollars.
UMRA does not address the total cost ofa rule. Rather, it focuses on certain
categories of cost, mainly those ‘‘Federal
mandate’’ costs resulting from: (1)Imposing enforceable duties on State,
local, or Tribal governments, or on theprivate sector; or (2) increasing thestringency of conditions in, or
decreasing the funding of, State, local,
or Tribal governments underentitlement programs. As this proposed
rule would not impose enforceable
duties or affect entitlement programs,
UMRA does not require us to prepare an
analysis of the costs and benefits of therule. Nonetheless, we have done so inaccordance with Executive Orders
12866 and 13563, and present thisanalysis in sections C and D above.
3. Federalism
Executive Order 13132 establishes
certain requirements that an agency
must meet when it promulgates a rulethat imposes substantial direct
requirement costs on State and local
governments, preempts State law, orotherwise has Federalism implications.
The Federalism implications of the
HIPAA Privacy and Security Rules wereassessed as required by Executive Order13132 and published as part of thepreambles to the final rules on
December 28, 2000 (65 FR 82462,
82797) and February 20, 2003 (68 FR
8334, 8373), respectively. This proposed
rule would not impose requirements, or
any associated costs, on State and local
governments. Regarding preemption, thepreamble to the final Privacy Rule
explained that the HIPAA statutedictates the relationship between Statelaw and Privacy Rule requirements.
Therefore, the Privacy Rule’s existing
preemption provisions do not raise
Federalism issues, and these provisions
would not be affected by this proposed
rule. In addition, we again emphasizethat the proposed modification to therule would not require covered entities
to make disclosures that are prohibitedby State law, nor would it prevent
disclosures required by State law. For
these reasons, the rule would not have
Federalism implications.

E:\FR\FM\07JAP1.SGM

07JAP1

796

Federal Register / Vol. 79, No. 4 / Tuesday, January 7, 2014 / Proposed Rules

F. Accounting Statement
Whenever a rule is considered asignificant rule under Executive Order
12866, we are required to develop an
accounting statement indicating thecosts associated with the rule. As
explained above in the RIA, we expectthat the rule would be cost neutral.
However, we invite comment on
potential costs associated with the rule,
including costs to covered entities thatchoose to amend written HIPAA
policies and procedures or train staff.
VII. Collection of Information
Requirements
This proposed rule does not containnew requirements for informationcollections (i.e., reporting,recordkeeping, and third-party
disclosures) under the Paperwork
Reduction Act.
List of Subjects in 45 CFR Part 164
Administrative practice andprocedure, Computer technology,
Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Healthfacilities, Health insurance, Healthrecords, Hospitals, Medicaid, Medical
research, Medicare, Privacy, Reporting
and recordkeeping requirements, andSecurity.
For the reasons set forth in thepreamble, the Department of Health andHuman Services proposes to amend 45
CFR Subtitle A, Subchapter C, part 164,
as set forth below:

Dated: December 31, 2013.
Kathleen Sebelius,
Secretary.
[FR Doc. 2014–00055 Filed 1–3–14; 4:15 pm]
BILLING CODE 4153–01–P

DEPARTMENT OF THE INTERIORFish and Wildlife Service

PART 164—SECURITY AND PRIVACY

50 CFR Part 17■ 1. The authority citation for part 164[Docket No. FWS–R4–ES–2013–0015;
4500030113]

continues to read as follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C.
1320d–1320d–9; sec. 264, Pub. L. 104–191,
110 Stat. 2033–2034 (42 U.S.C. 1320d–2(note)); and secs. 13400–13424, Pub. L. 111–
5, 123 Stat. 258–279.
■ 2. Amend § 164.512 by adding

paragraph (k)(7) to read as follows:

*

*
*
*
*
(k) * * *(7) National Instant Criminal
Background Check System. A covered
entity may use or disclose protected
health information for purposes ofreporting to the National InstantCriminal Background Check System theidentity of an individual who isprohibited from possessing a firearmunder 18 U.S.C. 922(g)(4), provided thecovered entity:(i) Is a State agency or other entitythat is, or contains an entity that is:

VerDate Mar<15>201013:46 Jan 06, 2014

Jkt 232001

RIN 1018–AZ47

Endangered and Threatened Wildlife
and Plants; Designation of Critical
Habitat for Leavenworthia exigua var.
laciniata
AGENCY: Fish and Wildlife Service,§ 164.512 Uses and disclosures for which
an authorization or opportunity to agree orobject is not required.

wreier-aviles on DSK5TPTVN1PROD with PROPOSALS(A) An entity designated by the Stateto report, or which collects information
for purposes of reporting, on behalf of
the State, to the National InstantCriminal Background Check System; or(B) A court, board, commission, orother lawful authority that makes thecommitment or adjudication that causes
an individual to become subject to 18
U.S.C. 922(g)(4).
(ii) Discloses the information to:(A) The National Instant Criminal
Background Check System; or(B) An entity designated by the Stateto report, or which collects information
for purposes of reporting, on behalf of
the State, to the National InstantCriminal Background Check System;and(iii) (A) Discloses only the limited
demographic and certain otherinformation needed for purposes ofreporting to the National InstantCriminal Background Check System;
and(B) Does not disclose diagnostic or
clinical information for such purposes.
*
*
*
*
*

Interior.
ACTION: Proposed rule; reopening ofcomment period.
SUMMARY: We, the U.S. Fish andWildlife Service (Service), announce thereopening of the public comment periodon the May 24, 2013, proposed
designation of critical habitat for
Leavenworthia exigua var. laciniata(Kentucky glade cress) under theEndangered Species Act of 1973, as
amended (Act). We also announce theavailability of a draft economic analysis(DEA) of the proposed designation andan amended required determinations
section of the proposal. For this action,

PO 00000

Frm 00034

Fmt 4702

Sfmt 4702

our DEA consists of an incremental
effects memorandum considering theprobable incremental economic impacts
that may result from the proposed
designation of critical habitat and ascreening analysis of the probableeffects of the designation of critical
habitat for the Kentucky glade cress. We
are reopening the comment period toallow all interested parties anopportunity to comment simultaneouslyon the proposed rule, the associated
DEA, and the amended required
determinations section. Comments
previously submitted need not be
resubmitted, as they will be fully
considered in our determination on thisrulemaking action.
DATES: The comment period for the
proposed rule published May 24, 2013,at 78 FR 31479, is reopened. We willconsider comments received or
postmarked on or before February 6,
2014. Comments submitted
electronically using the Federal
eRulemaking Portal (see ADDRESSES
section, below) must be received by
11:59 p.m. Eastern Time on the closing
date.
ADDRESSES: Document availability: You
may obtain copies of the proposed ruleand the DEA on the Internet at http://
www.regulations.gov at Docket Number
FWS–R4–ES–2013–0015, or by mailfrom the Kentucky Ecological Services
Field Office (see FOR FURTHERINFORMATION CONTACT).
Written comments: You may submit
written comments by one of thefollowing methods:(1) Electronically: Go to the Federal
eRulemaking Portal: http://
www.regulations.gov. Submit commentson the critical habitat proposal andassociated DEA by searching for Docket
No. FWS–R4–ES–2013–0015, which isthe docket number for this rulemaking.
(2) By hard copy: Submit commentson the critical habitat proposal and DEA
by U.S. mail or hand-delivery to: Public
Comments Processing, Attn: FWS–R4–
ES–2013–0015; Division of Policy andDirectives Management; U.S. Fish andWildlife Service; 4401 N. Fairfax Drive,
MS 2042–PDM; Arlington, VA 22203.
We request that you send comments
only by the methods described above.
We will post all comments on http://
www.regulations.gov. This generallymeans that we will post any personal
information you provide us (see the
Public Comments section below for
more information).
FOR FURTHER INFORMATION CONTACT: Lee
Andrews, Field Supervisor, U.S. Fish
and Wildlife Service, Kentucky
Ecological Services Field Office, J.C.
Watts Federal Building, 330 W.

E:\FR\FM\07JAP1.SGM

07JAP1